{"389-ds-base":{"CVE-2012-0833":{"description":"The acllas__handle_group_entry function in servers/plugins/acl/acllas.c in 389 Directory Server before 1.2.10 does not properly handled access control instructions (ACIs) that use certificate groups, which allows remote authenticated LDAP users with a certificate group to cause a denial of service (infinite loop and CPU consumption) by binding to the server.","scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"2.3.1+dfsg1-1+deb12u1"},"fixed_version":"0","urgency":"unimportant"},"bullseye":{"status":"resolved","repositories":{"bullseye":"1.4.4.11-2","bullseye-security":"1.4.4.11-2+deb11u1"},"fixed_version":"0","urgency":"unimportant"},"sid":{"status":"resolved","repositories":{"sid":"3.1.2+dfsg1-1"},"fixed_version":"0","urgency":"unimportant"},"trixie":{"status":"resolved","repositories":{"trixie":"3.1.2+dfsg1-1"},"fixed_version":"0","urgency":"unimportant"}}},"CVE-2012-2678":{"description":"389 Directory Server before 1.2.11.6 (aka Red Hat Directory Server before 8.2.10-3), after the password for a LDAP user has been changed and before the server has been reset, allows remote attackers to read the plaintext password via the unhashed#user#password attribute.","scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"2.3.1+dfsg1-1+deb12u1"},"fixed_version":"0","urgency":"unimportant"},"bullseye":{"status":"resolved","repositories":{"bullseye":"1.4.4.11-2","bullseye-security":"1.4.4.11-2+deb11u1"},"fixed_version":"0","urgency":"unimportant"},"sid":{"status":"resolved","repositories":{"sid":"3.1.2+dfsg1-1"},"fixed_version":"0","urgency":"unimportant"},"trixie":{"status":"resolved","repositories":{"trixie":"3.1.2+dfsg1-1"},"fixed_version":"0","urgency":"unimportant"}}},"CVE-2012-2746":{"description":"389 Directory Server before 1.2.11.6 (aka Red Hat Directory Server before 8.2.10-3), when the password of a LDAP user has been changed and audit logging is enabled, saves the new password to the log in plain text, which allows remote authenticated users to read the password.","scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"2.3.1+dfsg1-1+deb12u1"},"fixed_version":"0","urgency":"unimportant"},"bullseye":{"status":"resolved","repositories":{"bullseye":"1.4.4.11-2","bullseye-security":"1.4.4.11-2+deb11u1"},"fixed_version":"0","urgency":"unimportant"},"sid":{"status":"resolved","repositories":{"sid":"3.1.2+dfsg1-1"},"fixed_version":"0","urgency":"unimportant"},"trixie":{"status":"resolved","repositories":{"trixie":"3.1.2+dfsg1-1"},"fixed_version":"0","urgency":"unimportant"}}},"CVE-2012-4450":{"description":"389 Directory Server 1.2.10 does not properly update the ACL when a DN entry is moved by a modrdn operation, which allows remote authenticated users with certain permissions to bypass ACL restrictions and access the DN entry.","debianbug":688942,"scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"2.3.1+dfsg1-1+deb12u1"},"fixed_version":"1.2.11.15-1","urgency":"not yet assigned"},"bullseye":{"status":"resolved","repositories":{"bullseye":"1.4.4.11-2","bullseye-security":"1.4.4.11-2+deb11u1"},"fixed_version":"1.2.11.15-1","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"3.1.2+dfsg1-1"},"fixed_version":"1.2.11.15-1","urgency":"not yet assigned"},"trixie":{"status":"resolved","repositories":{"trixie":"3.1.2+dfsg1-1"},"fixed_version":"1.2.11.15-1","urgency":"not yet assigned"}}},"CVE-2013-0312":{"description":"389 Directory Server before 1.3.0.4 allows remote attackers to cause a denial of service (crash) via a zero length LDAP control sequence.","scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"2.3.1+dfsg1-1+deb12u1"},"fixed_version":"1.3.0.3-1","urgency":"not yet assigned"},"bullseye":{"status":"resolved","repositories":{"bullseye":"1.4.4.11-2","bullseye-security":"1.4.4.11-2+deb11u1"},"fixed_version":"1.3.0.3-1","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"3.1.2+dfsg1-1"},"fixed_version":"1.3.0.3-1","urgency":"not yet assigned"},"trixie":{"status":"resolved","repositories":{"trixie":"3.1.2+dfsg1-1"},"fixed_version":"1.3.0.3-1","urgency":"not yet assigned"}}},"CVE-2013-0336":{"description":"The ipapwd_chpwop function in daemons/ipa-slapi-plugins/ipa-pwd-extop/ipa_pwd_extop.c in the directory server (dirsrv) in FreeIPA before 3.2.0 allows remote attackers to cause a denial of service (crash) via a connection request without a username/dn, related to the 389 directory server.","debianbug":704077,"scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"2.3.1+dfsg1-1+deb12u1"},"fixed_version":"1.3.2.9-1","urgency":"not yet assigned"},"bullseye":{"status":"resolved","repositories":{"bullseye":"1.4.4.11-2","bullseye-security":"1.4.4.11-2+deb11u1"},"fixed_version":"1.3.2.9-1","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"3.1.2+dfsg1-1"},"fixed_version":"1.3.2.9-1","urgency":"not yet assigned"},"trixie":{"status":"resolved","repositories":{"trixie":"3.1.2+dfsg1-1"},"fixed_version":"1.3.2.9-1","urgency":"not yet assigned"}}},"CVE-2013-1897":{"description":"The do_search function in ldap/servers/slapd/search.c in 389 Directory Server 1.2.x before 1.2.11.20 and 1.3.x before 1.3.0.5 does not properly restrict access to entries when the nsslapd-allow-anonymous-access configuration is set to rootdse and the BASE search scope is used, which allows remote attackers to obtain sensitive information outside of the rootDSE via a crafted LDAP search.","debianbug":704421,"scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"2.3.1+dfsg1-1+deb12u1"},"fixed_version":"1.3.2.9-1","urgency":"not yet assigned"},"bullseye":{"status":"resolved","repositories":{"bullseye":"1.4.4.11-2","bullseye-security":"1.4.4.11-2+deb11u1"},"fixed_version":"1.3.2.9-1","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"3.1.2+dfsg1-1"},"fixed_version":"1.3.2.9-1","urgency":"not yet assigned"},"trixie":{"status":"resolved","repositories":{"trixie":"3.1.2+dfsg1-1"},"fixed_version":"1.3.2.9-1","urgency":"not yet assigned"}}},"CVE-2013-2219":{"description":"The Red Hat Directory Server before 8.2.11-13 and 389 Directory Server do not properly restrict access to entity attributes, which allows remote authenticated users to obtain sensitive information via a search query for the attribute.","debianbug":718325,"scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"2.3.1+dfsg1-1+deb12u1"},"fixed_version":"1.3.2.9-1","urgency":"not yet assigned"},"bullseye":{"status":"resolved","repositories":{"bullseye":"1.4.4.11-2","bullseye-security":"1.4.4.11-2+deb11u1"},"fixed_version":"1.3.2.9-1","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"3.1.2+dfsg1-1"},"fixed_version":"1.3.2.9-1","urgency":"not yet assigned"},"trixie":{"status":"resolved","repositories":{"trixie":"3.1.2+dfsg1-1"},"fixed_version":"1.3.2.9-1","urgency":"not yet assigned"}}},"CVE-2013-4283":{"description":"ns-slapd in 389 Directory Server before 1.3.0.8 allows remote attackers to cause a denial of service (server crash) via a crafted Distinguished Name (DN) in a MOD operation request.","debianbug":721222,"scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"2.3.1+dfsg1-1+deb12u1"},"fixed_version":"1.3.2.9-1","urgency":"not yet assigned"},"bullseye":{"status":"resolved","repositories":{"bullseye":"1.4.4.11-2","bullseye-security":"1.4.4.11-2+deb11u1"},"fixed_version":"1.3.2.9-1","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"3.1.2+dfsg1-1"},"fixed_version":"1.3.2.9-1","urgency":"not yet assigned"},"trixie":{"status":"resolved","repositories":{"trixie":"3.1.2+dfsg1-1"},"fixed_version":"1.3.2.9-1","urgency":"not yet assigned"}}},"CVE-2013-4485":{"description":"389 Directory Server 1.2.11.15 (aka Red Hat Directory Server before 8.2.11-14) allows remote authenticated users to cause a denial of service (crash) via multiple @ characters in a GER attribute list in a search request.","debianbug":730115,"scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"2.3.1+dfsg1-1+deb12u1"},"fixed_version":"1.3.2.9-1","urgency":"not yet assigned"},"bullseye":{"status":"resolved","repositories":{"bullseye":"1.4.4.11-2","bullseye-security":"1.4.4.11-2+deb11u1"},"fixed_version":"1.3.2.9-1","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"3.1.2+dfsg1-1"},"fixed_version":"1.3.2.9-1","urgency":"not yet assigned"},"trixie":{"status":"resolved","repositories":{"trixie":"3.1.2+dfsg1-1"},"fixed_version":"1.3.2.9-1","urgency":"not yet assigned"}}},"CVE-2014-0132":{"description":"The SASL authentication functionality in 389 Directory Server before 1.2.11.26 allows remote authenticated users to connect as an arbitrary user and gain privileges via the authzid parameter in a SASL/GSSAPI bind.","debianbug":741600,"scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"2.3.1+dfsg1-1+deb12u1"},"fixed_version":"1.3.2.9-1.1","urgency":"not yet assigned"},"bullseye":{"status":"resolved","repositories":{"bullseye":"1.4.4.11-2","bullseye-security":"1.4.4.11-2+deb11u1"},"fixed_version":"1.3.2.9-1.1","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"3.1.2+dfsg1-1"},"fixed_version":"1.3.2.9-1.1","urgency":"not yet assigned"},"trixie":{"status":"resolved","repositories":{"trixie":"3.1.2+dfsg1-1"},"fixed_version":"1.3.2.9-1.1","urgency":"not yet assigned"}}},"CVE-2014-3562":{"description":"Red Hat Directory Server 8 and 389 Directory Server, when debugging is enabled, allows remote attackers to obtain sensitive replicated metadata by searching the directory.","debianbug":757437,"scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"2.3.1+dfsg1-1+deb12u1"},"fixed_version":"1.3.2.21-1","urgency":"not yet assigned"},"bullseye":{"status":"resolved","repositories":{"bullseye":"1.4.4.11-2","bullseye-security":"1.4.4.11-2+deb11u1"},"fixed_version":"1.3.2.21-1","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"3.1.2+dfsg1-1"},"fixed_version":"1.3.2.21-1","urgency":"not yet assigned"},"trixie":{"status":"resolved","repositories":{"trixie":"3.1.2+dfsg1-1"},"fixed_version":"1.3.2.21-1","urgency":"not yet assigned"}}},"CVE-2014-8105":{"description":"389 Directory Server before 1.3.2.27 and 1.3.3.x before 1.3.3.9 does not properly restrict access to the \"cn=changelog\" LDAP sub-tree, which allows remote attackers to obtain sensitive information from the changelog via unspecified vectors.","debianbug":779909,"scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"2.3.1+dfsg1-1+deb12u1"},"fixed_version":"1.3.3.5-4","urgency":"not yet assigned"},"bullseye":{"status":"resolved","repositories":{"bullseye":"1.4.4.11-2","bullseye-security":"1.4.4.11-2+deb11u1"},"fixed_version":"1.3.3.5-4","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"3.1.2+dfsg1-1"},"fixed_version":"1.3.3.5-4","urgency":"not yet assigned"},"trixie":{"status":"resolved","repositories":{"trixie":"3.1.2+dfsg1-1"},"fixed_version":"1.3.3.5-4","urgency":"not yet assigned"}}},"CVE-2014-8112":{"description":"389 Directory Server 1.3.1.x, 1.3.2.x before 1.3.2.27, and 1.3.3.x before 1.3.3.9 stores \"unhashed\" passwords even when the nsslapd-unhashed-pw-switch option is set to off, which allows remote authenticated users to obtain sensitive information by reading the Changelog.","debianbug":779909,"scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"2.3.1+dfsg1-1+deb12u1"},"fixed_version":"1.3.3.5-4","urgency":"not yet assigned"},"bullseye":{"status":"resolved","repositories":{"bullseye":"1.4.4.11-2","bullseye-security":"1.4.4.11-2+deb11u1"},"fixed_version":"1.3.3.5-4","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"3.1.2+dfsg1-1"},"fixed_version":"1.3.3.5-4","urgency":"not yet assigned"},"trixie":{"status":"resolved","repositories":{"trixie":"3.1.2+dfsg1-1"},"fixed_version":"1.3.3.5-4","urgency":"not yet assigned"}}},"CVE-2015-1854":{"description":"389 Directory Server before 1.3.3.10 allows attackers to bypass intended access restrictions and modify directory entries via a crafted ldapmodrdn call.","debianbug":783923,"scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"2.3.1+dfsg1-1+deb12u1"},"fixed_version":"1.3.3.10-1","urgency":"not yet assigned"},"bullseye":{"status":"resolved","repositories":{"bullseye":"1.4.4.11-2","bullseye-security":"1.4.4.11-2+deb11u1"},"fixed_version":"1.3.3.10-1","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"3.1.2+dfsg1-1"},"fixed_version":"1.3.3.10-1","urgency":"not yet assigned"},"trixie":{"status":"resolved","repositories":{"trixie":"3.1.2+dfsg1-1"},"fixed_version":"1.3.3.10-1","urgency":"not yet assigned"}}},"CVE-2015-3230":{"description":"389 Directory Server (formerly Fedora Directory Server) before 1.3.3.12 does not enforce the nsSSL3Ciphers preference when creating an sslSocket, which allows remote attackers to have unspecified impact by requesting to use a disabled cipher.","debianbug":789202,"scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"2.3.1+dfsg1-1+deb12u1"},"fixed_version":"1.3.3.12-1","urgency":"not yet assigned"},"bullseye":{"status":"resolved","repositories":{"bullseye":"1.4.4.11-2","bullseye-security":"1.4.4.11-2+deb11u1"},"fixed_version":"1.3.3.12-1","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"3.1.2+dfsg1-1"},"fixed_version":"1.3.3.12-1","urgency":"not yet assigned"},"trixie":{"status":"resolved","repositories":{"trixie":"3.1.2+dfsg1-1"},"fixed_version":"1.3.3.12-1","urgency":"not yet assigned"}}},"CVE-2016-0741":{"description":"slapd/connection.c in 389 Directory Server (formerly Fedora Directory Server) 1.3.4.x before 1.3.4.7 allows remote attackers to cause a denial of service (infinite loop and connection blocking) by leveraging an abnormally closed connection.","scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"2.3.1+dfsg1-1+deb12u1"},"fixed_version":"1.3.4.8-1","urgency":"not yet assigned"},"bullseye":{"status":"resolved","repositories":{"bullseye":"1.4.4.11-2","bullseye-security":"1.4.4.11-2+deb11u1"},"fixed_version":"1.3.4.8-1","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"3.1.2+dfsg1-1"},"fixed_version":"1.3.4.8-1","urgency":"not yet assigned"},"trixie":{"status":"resolved","repositories":{"trixie":"3.1.2+dfsg1-1"},"fixed_version":"1.3.4.8-1","urgency":"not yet assigned"}}},"CVE-2016-4992":{"description":"389 Directory Server in Red Hat Enterprise Linux Desktop 6 through 7, Red Hat Enterprise Linux HPC Node 6 through 7, Red Hat Enterprise Linux Server 6 through 7, and Red Hat Enterprise Linux Workstation 6 through 7 allows remote attackers to infer the existence of RDN component objects.","scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"2.3.1+dfsg1-1+deb12u1"},"fixed_version":"1.3.5.13-1","urgency":"not yet assigned"},"bullseye":{"status":"resolved","repositories":{"bullseye":"1.4.4.11-2","bullseye-security":"1.4.4.11-2+deb11u1"},"fixed_version":"1.3.5.13-1","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"3.1.2+dfsg1-1"},"fixed_version":"1.3.5.13-1","urgency":"not yet assigned"},"trixie":{"status":"resolved","repositories":{"trixie":"3.1.2+dfsg1-1"},"fixed_version":"1.3.5.13-1","urgency":"not yet assigned"}}},"CVE-2016-5405":{"description":"389 Directory Server in Red Hat Enterprise Linux Desktop 6 through 7, Red Hat Enterprise Linux HPC Node 6 through 7, Red Hat Enterprise Linux Server 6 through 7, and Red Hat Enterprise Linux Workstation 6 through 7 allows remote attackers to obtain user passwords.","debianbug":842121,"scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"2.3.1+dfsg1-1+deb12u1"},"fixed_version":"1.3.5.15-1","urgency":"not yet assigned"},"bullseye":{"status":"resolved","repositories":{"bullseye":"1.4.4.11-2","bullseye-security":"1.4.4.11-2+deb11u1"},"fixed_version":"1.3.5.15-1","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"3.1.2+dfsg1-1"},"fixed_version":"1.3.5.15-1","urgency":"not yet assigned"},"trixie":{"status":"resolved","repositories":{"trixie":"3.1.2+dfsg1-1"},"fixed_version":"1.3.5.15-1","urgency":"not yet assigned"}}},"CVE-2016-5416":{"description":"389 Directory Server in Red Hat Enterprise Linux Desktop 6 through 7, Red Hat Enterprise Linux HPC Node 6 through 7, Red Hat Enterprise Linux Server 6 through 7, and Red Hat Enterprise Linux Workstation 6 through 7 allows remote attackers to read the default Access Control Instructions.","debianbug":834233,"scope":"local","releases":{"bookworm":{"status":"open","repositories":{"bookworm":"2.3.1+dfsg1-1+deb12u1"},"urgency":"unimportant"},"bullseye":{"status":"open","repositories":{"bullseye":"1.4.4.11-2","bullseye-security":"1.4.4.11-2+deb11u1"},"urgency":"unimportant"},"sid":{"status":"open","repositories":{"sid":"3.1.2+dfsg1-1"},"urgency":"unimportant"},"trixie":{"status":"open","repositories":{"trixie":"3.1.2+dfsg1-1"},"urgency":"unimportant"}}},"CVE-2017-15134":{"description":"A stack buffer overflow flaw was found in the way 389-ds-base 1.3.6.x before 1.3.6.13, 1.3.7.x before 1.3.7.9, 1.4.x before 1.4.0.5 handled certain LDAP search filters. A remote, unauthenticated attacker could potentially use this flaw to make ns-slapd crash via a specially crafted LDAP request, thus resulting in denial of service.","debianbug":888452,"scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"2.3.1+dfsg1-1+deb12u1"},"fixed_version":"1.3.7.9-1","urgency":"not yet assigned"},"bullseye":{"status":"resolved","repositories":{"bullseye":"1.4.4.11-2","bullseye-security":"1.4.4.11-2+deb11u1"},"fixed_version":"1.3.7.9-1","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"3.1.2+dfsg1-1"},"fixed_version":"1.3.7.9-1","urgency":"not yet assigned"},"trixie":{"status":"resolved","repositories":{"trixie":"3.1.2+dfsg1-1"},"fixed_version":"1.3.7.9-1","urgency":"not yet assigned"}}},"CVE-2017-15135":{"description":"It was found that 389-ds-base since 1.3.6.1 up to and including 1.4.0.3 did not always handle internal hash comparison operations correctly during the authentication process. A remote, unauthenticated attacker could potentially use this flaw to bypass the authentication process under very rare and specific circumstances.","debianbug":888451,"scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"2.3.1+dfsg1-1+deb12u1"},"fixed_version":"1.3.7.9-1","urgency":"not yet assigned"},"bullseye":{"status":"resolved","repositories":{"bullseye":"1.4.4.11-2","bullseye-security":"1.4.4.11-2+deb11u1"},"fixed_version":"1.3.7.9-1","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"3.1.2+dfsg1-1"},"fixed_version":"1.3.7.9-1","urgency":"not yet assigned"},"trixie":{"status":"resolved","repositories":{"trixie":"3.1.2+dfsg1-1"},"fixed_version":"1.3.7.9-1","urgency":"not yet assigned"}}},"CVE-2017-2591":{"description":"389-ds-base before version 1.3.6 is vulnerable to an improperly NULL terminated array in the uniqueness_entry_to_config() function in the \"attribute uniqueness\" plugin of 389 Directory Server. An authenticated, or possibly unauthenticated, attacker could use this flaw to force an out-of-bound heap memory read, possibly triggering a crash of the LDAP service.","debianbug":851769,"scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"2.3.1+dfsg1-1+deb12u1"},"fixed_version":"1.3.5.15-2","urgency":"not yet assigned"},"bullseye":{"status":"resolved","repositories":{"bullseye":"1.4.4.11-2","bullseye-security":"1.4.4.11-2+deb11u1"},"fixed_version":"1.3.5.15-2","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"3.1.2+dfsg1-1"},"fixed_version":"1.3.5.15-2","urgency":"not yet assigned"},"trixie":{"status":"resolved","repositories":{"trixie":"3.1.2+dfsg1-1"},"fixed_version":"1.3.5.15-2","urgency":"not yet assigned"}}},"CVE-2017-2668":{"description":"389-ds-base before versions 1.3.5.17 and 1.3.6.10 is vulnerable to an invalid pointer dereference in the way LDAP bind requests are handled. A remote unauthenticated attacker could use this flaw to make ns-slapd crash via a specially crafted LDAP bind request, resulting in denial of service.","debianbug":860125,"scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"2.3.1+dfsg1-1+deb12u1"},"fixed_version":"1.3.5.17-1","urgency":"not yet assigned"},"bullseye":{"status":"resolved","repositories":{"bullseye":"1.4.4.11-2","bullseye-security":"1.4.4.11-2+deb11u1"},"fixed_version":"1.3.5.17-1","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"3.1.2+dfsg1-1"},"fixed_version":"1.3.5.17-1","urgency":"not yet assigned"},"trixie":{"status":"resolved","repositories":{"trixie":"3.1.2+dfsg1-1"},"fixed_version":"1.3.5.17-1","urgency":"not yet assigned"}}},"CVE-2017-7551":{"description":"389-ds-base version before 1.3.5.19 and 1.3.6.7 are vulnerable to password brute-force attacks during account lockout due to different return codes returned on password attempts.","debianbug":870752,"scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"2.3.1+dfsg1-1+deb12u1"},"fixed_version":"1.3.6.7-1","urgency":"not yet assigned"},"bullseye":{"status":"resolved","repositories":{"bullseye":"1.4.4.11-2","bullseye-security":"1.4.4.11-2+deb11u1"},"fixed_version":"1.3.6.7-1","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"3.1.2+dfsg1-1"},"fixed_version":"1.3.6.7-1","urgency":"not yet assigned"},"trixie":{"status":"resolved","repositories":{"trixie":"3.1.2+dfsg1-1"},"fixed_version":"1.3.6.7-1","urgency":"not yet assigned"}}},"CVE-2018-1054":{"description":"An out-of-bounds memory read flaw was found in the way 389-ds-base handled certain LDAP search filters, affecting all versions including 1.4.x. A remote, unauthenticated attacker could potentially use this flaw to make ns-slapd crash via a specially crafted LDAP request, thus resulting in denial of service.","debianbug":892124,"scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"2.3.1+dfsg1-1+deb12u1"},"fixed_version":"1.3.7.10-1","urgency":"not yet assigned"},"bullseye":{"status":"resolved","repositories":{"bullseye":"1.4.4.11-2","bullseye-security":"1.4.4.11-2+deb11u1"},"fixed_version":"1.3.7.10-1","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"3.1.2+dfsg1-1"},"fixed_version":"1.3.7.10-1","urgency":"not yet assigned"},"trixie":{"status":"resolved","repositories":{"trixie":"3.1.2+dfsg1-1"},"fixed_version":"1.3.7.10-1","urgency":"not yet assigned"}}},"CVE-2018-10850":{"description":"389-ds-base before versions 1.4.0.10, 1.3.8.3 is vulnerable to a race condition in the way 389-ds-base handles persistent search, resulting in a crash if the server is under load. An anonymous attacker could use this flaw to trigger a denial of service.","debianbug":903501,"scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"2.3.1+dfsg1-1+deb12u1"},"fixed_version":"1.4.0.15-1","urgency":"not yet assigned"},"bullseye":{"status":"resolved","repositories":{"bullseye":"1.4.4.11-2","bullseye-security":"1.4.4.11-2+deb11u1"},"fixed_version":"1.4.0.15-1","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"3.1.2+dfsg1-1"},"fixed_version":"1.4.0.15-1","urgency":"not yet assigned"},"trixie":{"status":"resolved","repositories":{"trixie":"3.1.2+dfsg1-1"},"fixed_version":"1.4.0.15-1","urgency":"not yet assigned"}}},"CVE-2018-10871":{"description":"389-ds-base before versions 1.3.8.5, 1.4.0.12 is vulnerable to a Cleartext Storage of Sensitive Information. By default, when the Replica and/or retroChangeLog plugins are enabled, 389-ds-base stores passwords in plaintext format in their respective changelog files. An attacker with sufficiently high privileges, such as root or Directory Manager, can query these files in order to retrieve plaintext passwords.","scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"2.3.1+dfsg1-1+deb12u1"},"fixed_version":"1.4.0.15-1","urgency":"not yet assigned"},"bullseye":{"status":"resolved","repositories":{"bullseye":"1.4.4.11-2","bullseye-security":"1.4.4.11-2+deb11u1"},"fixed_version":"1.4.0.15-1","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"3.1.2+dfsg1-1"},"fixed_version":"1.4.0.15-1","urgency":"not yet assigned"},"trixie":{"status":"resolved","repositories":{"trixie":"3.1.2+dfsg1-1"},"fixed_version":"1.4.0.15-1","urgency":"not yet assigned"}}},"CVE-2018-1089":{"description":"389-ds-base before versions 1.4.0.9, 1.3.8.1, 1.3.6.15 did not properly handle long search filters with characters needing escapes, possibly leading to buffer overflows. A remote, unauthenticated attacker could potentially use this flaw to make ns-slapd crash via a specially crafted LDAP request, thus resulting in denial of service.","debianbug":898138,"scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"2.3.1+dfsg1-1+deb12u1"},"fixed_version":"1.3.8.2-1","urgency":"not yet assigned"},"bullseye":{"status":"resolved","repositories":{"bullseye":"1.4.4.11-2","bullseye-security":"1.4.4.11-2+deb11u1"},"fixed_version":"1.3.8.2-1","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"3.1.2+dfsg1-1"},"fixed_version":"1.3.8.2-1","urgency":"not yet assigned"},"trixie":{"status":"resolved","repositories":{"trixie":"3.1.2+dfsg1-1"},"fixed_version":"1.3.8.2-1","urgency":"not yet assigned"}}},"CVE-2018-10935":{"description":"A flaw was found in the 389 Directory Server that allows users to cause a crash in the LDAP server using ldapsearch with server side sort.","debianbug":906985,"scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"2.3.1+dfsg1-1+deb12u1"},"fixed_version":"1.4.0.15-1","urgency":"not yet assigned"},"bullseye":{"status":"resolved","repositories":{"bullseye":"1.4.4.11-2","bullseye-security":"1.4.4.11-2+deb11u1"},"fixed_version":"1.4.0.15-1","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"3.1.2+dfsg1-1"},"fixed_version":"1.4.0.15-1","urgency":"not yet assigned"},"trixie":{"status":"resolved","repositories":{"trixie":"3.1.2+dfsg1-1"},"fixed_version":"1.4.0.15-1","urgency":"not yet assigned"}}},"CVE-2018-14624":{"description":"A vulnerability was discovered in 389-ds-base through versions 1.3.7.10, 1.3.8.8 and 1.4.0.16. The lock controlling the error log was not correctly used when re-opening the log file in log__error_emergency(). An attacker could send a flood of modifications to a very large DN, which would cause slapd to crash.","debianbug":907778,"scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"2.3.1+dfsg1-1+deb12u1"},"fixed_version":"1.4.0.18-1","urgency":"not yet assigned"},"bullseye":{"status":"resolved","repositories":{"bullseye":"1.4.4.11-2","bullseye-security":"1.4.4.11-2+deb11u1"},"fixed_version":"1.4.0.18-1","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"3.1.2+dfsg1-1"},"fixed_version":"1.4.0.18-1","urgency":"not yet assigned"},"trixie":{"status":"resolved","repositories":{"trixie":"3.1.2+dfsg1-1"},"fixed_version":"1.4.0.18-1","urgency":"not yet assigned"}}},"CVE-2018-14638":{"description":"A flaw was found in 389-ds-base before version 1.3.8.4-13. The process ns-slapd crashes in delete_passwdPolicy function when persistent search connections are terminated unexpectedly leading to remote denial of service.","debianbug":908859,"scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"2.3.1+dfsg1-1+deb12u1"},"fixed_version":"1.4.0.18-1","urgency":"not yet assigned"},"bullseye":{"status":"resolved","repositories":{"bullseye":"1.4.4.11-2","bullseye-security":"1.4.4.11-2+deb11u1"},"fixed_version":"1.4.0.18-1","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"3.1.2+dfsg1-1"},"fixed_version":"1.4.0.18-1","urgency":"not yet assigned"},"trixie":{"status":"resolved","repositories":{"trixie":"3.1.2+dfsg1-1"},"fixed_version":"1.4.0.18-1","urgency":"not yet assigned"}}},"CVE-2018-14648":{"description":"A flaw was found in 389 Directory Server. A specially crafted search query could lead to excessive CPU consumption in the do_search() function. An unauthenticated attacker could use this flaw to provoke a denial of service.","scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"2.3.1+dfsg1-1+deb12u1"},"fixed_version":"1.4.0.18-1","urgency":"not yet assigned"},"bullseye":{"status":"resolved","repositories":{"bullseye":"1.4.4.11-2","bullseye-security":"1.4.4.11-2+deb11u1"},"fixed_version":"1.4.0.18-1","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"3.1.2+dfsg1-1"},"fixed_version":"1.4.0.18-1","urgency":"not yet assigned"},"trixie":{"status":"resolved","repositories":{"trixie":"3.1.2+dfsg1-1"},"fixed_version":"1.4.0.18-1","urgency":"not yet assigned"}}},"CVE-2019-10171":{"description":"It was found that the fix for CVE-2018-14648 in 389-ds-base, versions 1.4.0.x before 1.4.0.17, was incorrectly applied in RHEL 7.5. An attacker would still be able to provoke excessive CPU consumption leading to a denial of service.","scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"2.3.1+dfsg1-1+deb12u1"},"fixed_version":"0","urgency":"unimportant"},"bullseye":{"status":"resolved","repositories":{"bullseye":"1.4.4.11-2","bullseye-security":"1.4.4.11-2+deb11u1"},"fixed_version":"0","urgency":"unimportant"},"sid":{"status":"resolved","repositories":{"sid":"3.1.2+dfsg1-1"},"fixed_version":"0","urgency":"unimportant"},"trixie":{"status":"resolved","repositories":{"trixie":"3.1.2+dfsg1-1"},"fixed_version":"0","urgency":"unimportant"}}},"CVE-2019-10224":{"description":"A flaw has been found in 389-ds-base versions 1.4.x.x before 1.4.1.3. When executed in verbose mode, the dscreate and dsconf commands may display sensitive information, such as the Directory Manager password. An attacker, able to see the screen or record the terminal standard error output, could use this flaw to gain sensitive information.","scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"2.3.1+dfsg1-1+deb12u1"},"fixed_version":"1.4.1.5-1","urgency":"not yet assigned"},"bullseye":{"status":"resolved","repositories":{"bullseye":"1.4.4.11-2","bullseye-security":"1.4.4.11-2+deb11u1"},"fixed_version":"1.4.1.5-1","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"3.1.2+dfsg1-1"},"fixed_version":"1.4.1.5-1","urgency":"not yet assigned"},"trixie":{"status":"resolved","repositories":{"trixie":"3.1.2+dfsg1-1"},"fixed_version":"1.4.1.5-1","urgency":"not yet assigned"}}},"CVE-2019-14824":{"description":"A flaw was found in the 'deref' plugin of 389-ds-base where it could use the 'search' permission to display attribute values. In some configurations, this could allow an authenticated attacker to view private attributes, such as password hashes.","debianbug":944150,"scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"2.3.1+dfsg1-1+deb12u1"},"fixed_version":"1.4.2.4-1","urgency":"not yet assigned"},"bullseye":{"status":"resolved","repositories":{"bullseye":"1.4.4.11-2","bullseye-security":"1.4.4.11-2+deb11u1"},"fixed_version":"1.4.2.4-1","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"3.1.2+dfsg1-1"},"fixed_version":"1.4.2.4-1","urgency":"not yet assigned"},"trixie":{"status":"resolved","repositories":{"trixie":"3.1.2+dfsg1-1"},"fixed_version":"1.4.2.4-1","urgency":"not yet assigned"}}},"CVE-2019-3883":{"description":"In 389-ds-base up to version 1.4.1.2, requests are handled by workers threads. Each sockets will be waited by the worker for at most 'ioblocktimeout' seconds. However this timeout applies only for un-encrypted requests. Connections using SSL/TLS are not taking this timeout into account during reads, and may hang longer.An unauthenticated attacker could repeatedly create hanging LDAP requests to hang all the workers, resulting in a Denial of Service.","debianbug":927939,"scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"2.3.1+dfsg1-1+deb12u1"},"fixed_version":"1.4.1.5-1","urgency":"not yet assigned"},"bullseye":{"status":"resolved","repositories":{"bullseye":"1.4.4.11-2","bullseye-security":"1.4.4.11-2+deb11u1"},"fixed_version":"1.4.1.5-1","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"3.1.2+dfsg1-1"},"fixed_version":"1.4.1.5-1","urgency":"not yet assigned"},"trixie":{"status":"resolved","repositories":{"trixie":"3.1.2+dfsg1-1"},"fixed_version":"1.4.1.5-1","urgency":"not yet assigned"}}},"CVE-2020-35518":{"description":"When binding against a DN during authentication, the reply from 389-ds-base will be different whether the DN exists or not. This can be used by an unauthenticated attacker to check the existence of an entry in the LDAP database.","scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"2.3.1+dfsg1-1+deb12u1"},"fixed_version":"1.4.4.10-1","urgency":"not yet assigned"},"bullseye":{"status":"resolved","repositories":{"bullseye":"1.4.4.11-2","bullseye-security":"1.4.4.11-2+deb11u1"},"fixed_version":"1.4.4.10-1","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"3.1.2+dfsg1-1"},"fixed_version":"1.4.4.10-1","urgency":"not yet assigned"},"trixie":{"status":"resolved","repositories":{"trixie":"3.1.2+dfsg1-1"},"fixed_version":"1.4.4.10-1","urgency":"not yet assigned"}}},"CVE-2021-3514":{"description":"When using a sync_repl client in 389-ds-base, an authenticated attacker can cause a NULL pointer dereference using a specially crafted query, causing a crash.","debianbug":988727,"scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"2.3.1+dfsg1-1+deb12u1"},"fixed_version":"1.4.4.11-2","urgency":"not yet assigned"},"bullseye":{"status":"resolved","repositories":{"bullseye":"1.4.4.11-2","bullseye-security":"1.4.4.11-2+deb11u1"},"fixed_version":"1.4.4.11-2","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"3.1.2+dfsg1-1"},"fixed_version":"1.4.4.11-2","urgency":"not yet assigned"},"trixie":{"status":"resolved","repositories":{"trixie":"3.1.2+dfsg1-1"},"fixed_version":"1.4.4.11-2","urgency":"not yet assigned"}}},"CVE-2021-3652":{"description":"A flaw was found in 389-ds-base. If an asterisk is imported as password hashes, either accidentally or maliciously, then instead of being inactive, any password will successfully match during authentication. This flaw allows an attacker to successfully authenticate as a user whose password was disabled.","debianbug":991405,"scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"2.3.1+dfsg1-1+deb12u1"},"fixed_version":"1.4.4.17-1","urgency":"not yet assigned"},"bullseye":{"status":"resolved","repositories":{"bullseye":"1.4.4.11-2","bullseye-security":"1.4.4.11-2+deb11u1"},"fixed_version":"1.4.4.11-2+deb11u1","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"3.1.2+dfsg1-1"},"fixed_version":"1.4.4.17-1","urgency":"not yet assigned"},"trixie":{"status":"resolved","repositories":{"trixie":"3.1.2+dfsg1-1"},"fixed_version":"1.4.4.17-1","urgency":"not yet assigned"}}},"CVE-2021-4091":{"description":"A double-free was found in the way 389-ds-base handles virtual attributes context in persistent searches. An attacker could send a series of search requests, forcing the server to behave unexpectedly, and crash.","scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"2.3.1+dfsg1-1+deb12u1"},"fixed_version":"2.0.15-1","urgency":"not yet assigned"},"bullseye":{"status":"resolved","repositories":{"bullseye":"1.4.4.11-2","bullseye-security":"1.4.4.11-2+deb11u1"},"fixed_version":"1.4.4.11-2+deb11u1","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"3.1.2+dfsg1-1"},"fixed_version":"2.0.15-1","urgency":"not yet assigned"},"trixie":{"status":"resolved","repositories":{"trixie":"3.1.2+dfsg1-1"},"fixed_version":"2.0.15-1","urgency":"not yet assigned"}}},"CVE-2022-0918":{"description":"A vulnerability was discovered in the 389 Directory Server that allows an unauthenticated attacker with network access to the LDAP port to cause a denial of service. The denial of service is triggered by a single message sent over a TCP connection, no bind or other authentication is required. The message triggers a segmentation fault that results in slapd crashing.","debianbug":1016445,"scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"2.3.1+dfsg1-1+deb12u1"},"fixed_version":"2.0.15-1.1","urgency":"not yet assigned"},"bullseye":{"status":"resolved","repositories":{"bullseye":"1.4.4.11-2","bullseye-security":"1.4.4.11-2+deb11u1"},"fixed_version":"1.4.4.11-2+deb11u1","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"3.1.2+dfsg1-1"},"fixed_version":"2.0.15-1.1","urgency":"not yet assigned"},"trixie":{"status":"resolved","repositories":{"trixie":"3.1.2+dfsg1-1"},"fixed_version":"2.0.15-1.1","urgency":"not yet assigned"}}},"CVE-2022-0996":{"description":"A vulnerability was found in the 389 Directory Server that allows expired passwords to access the database to cause improper authentication.","scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"2.3.1+dfsg1-1+deb12u1"},"fixed_version":"2.0.15-1","urgency":"not yet assigned"},"bullseye":{"status":"resolved","repositories":{"bullseye":"1.4.4.11-2","bullseye-security":"1.4.4.11-2+deb11u1"},"fixed_version":"1.4.4.11-2+deb11u1","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"3.1.2+dfsg1-1"},"fixed_version":"2.0.15-1","urgency":"not yet assigned"},"trixie":{"status":"resolved","repositories":{"trixie":"3.1.2+dfsg1-1"},"fixed_version":"2.0.15-1","urgency":"not yet assigned"}}},"CVE-2022-1949":{"description":"An access control bypass vulnerability found in 389-ds-base. That mishandling of the filter that would yield incorrect results, but as that has progressed, can be determined that it actually is an access control bypass. This may allow any remote unauthenticated user to issue a filter that allows searching for database items they do not have access to, including but not limited to potentially userPassword hashes and other sensitive data.","debianbug":1016446,"scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"2.3.1+dfsg1-1+deb12u1"},"fixed_version":"2.3.1-1","urgency":"not yet assigned"},"bullseye":{"status":"open","repositories":{"bullseye":"1.4.4.11-2","bullseye-security":"1.4.4.11-2+deb11u1"},"urgency":"not yet assigned","nodsa":"Minor issue, too intrusive to backport","nodsa_reason":"ignored"},"sid":{"status":"resolved","repositories":{"sid":"3.1.2+dfsg1-1"},"fixed_version":"2.3.1-1","urgency":"not yet assigned"},"trixie":{"status":"resolved","repositories":{"trixie":"3.1.2+dfsg1-1"},"fixed_version":"2.3.1-1","urgency":"not yet assigned"}}},"CVE-2022-2850":{"description":"A flaw was found In 389-ds-base. When the Content Synchronization plugin is enabled, an authenticated user can reach a NULL pointer dereference using a specially crafted query. This flaw allows an authenticated attacker to cause a denial of service. This CVE is assigned against an incomplete fix of CVE-2021-3514.","debianbug":1018054,"scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"2.3.1+dfsg1-1+deb12u1"},"fixed_version":"2.3.1-1","urgency":"not yet assigned"},"bullseye":{"status":"resolved","repositories":{"bullseye":"1.4.4.11-2","bullseye-security":"1.4.4.11-2+deb11u1"},"fixed_version":"1.4.4.11-2+deb11u1","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"3.1.2+dfsg1-1"},"fixed_version":"2.3.1-1","urgency":"not yet assigned"},"trixie":{"status":"resolved","repositories":{"trixie":"3.1.2+dfsg1-1"},"fixed_version":"2.3.1-1","urgency":"not yet assigned"}}},"CVE-2023-1055":{"description":"A flaw was found in RHDS 11 and RHDS 12. While browsing entries LDAP tries to decode the userPassword attribute instead of the userCertificate attribute which could lead into sensitive information leaked. An attacker with a local account where the cockpit-389-ds is running can list the processes and display the hashed passwords. The highest threat from this vulnerability is to data confidentiality.","debianbug":1034891,"scope":"local","releases":{"bookworm":{"status":"open","repositories":{"bookworm":"2.3.1+dfsg1-1+deb12u1"},"urgency":"not yet assigned","nodsa":"Minor issue","nodsa_reason":""},"bullseye":{"status":"open","repositories":{"bullseye":"1.4.4.11-2","bullseye-security":"1.4.4.11-2+deb11u1"},"urgency":"not yet assigned","nodsa":"Minor issue","nodsa_reason":""},"sid":{"status":"resolved","repositories":{"sid":"3.1.2+dfsg1-1"},"fixed_version":"2.3.4+dfsg1-1","urgency":"not yet assigned"},"trixie":{"status":"resolved","repositories":{"trixie":"3.1.2+dfsg1-1"},"fixed_version":"2.3.4+dfsg1-1","urgency":"not yet assigned"}}},"CVE-2024-1062":{"description":"A heap overflow flaw was found in 389-ds-base. This issue leads to a denial of service when writing a value larger than 256 chars in log_entry_attr.","debianbug":1066120,"scope":"local","releases":{"bookworm":{"status":"open","repositories":{"bookworm":"2.3.1+dfsg1-1+deb12u1"},"urgency":"not yet assigned","nodsa":"Minor issue","nodsa_reason":""},"bullseye":{"status":"open","repositories":{"bullseye":"1.4.4.11-2","bullseye-security":"1.4.4.11-2+deb11u1"},"urgency":"not yet assigned","nodsa":"Minor issue","nodsa_reason":""},"sid":{"status":"resolved","repositories":{"sid":"3.1.2+dfsg1-1"},"fixed_version":"2.3.4+dfsg1-1","urgency":"not yet assigned"},"trixie":{"status":"resolved","repositories":{"trixie":"3.1.2+dfsg1-1"},"fixed_version":"2.3.4+dfsg1-1","urgency":"not yet assigned"}}},"CVE-2024-2199":{"description":"A denial of service vulnerability was found in 389-ds-base ldap server. This issue may allow an authenticated user to cause a server crash while modifying `userPassword` using malformed input.","debianbug":1072531,"scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"2.3.1+dfsg1-1+deb12u1"},"fixed_version":"2.3.1+dfsg1-1+deb12u1","urgency":"not yet assigned"},"bullseye":{"status":"resolved","repositories":{"bullseye":"1.4.4.11-2","bullseye-security":"1.4.4.11-2+deb11u1"},"fixed_version":"1.4.4.11-2+deb11u1","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"3.1.2+dfsg1-1"},"fixed_version":"3.1.1+dfsg1-1","urgency":"not yet assigned"},"trixie":{"status":"resolved","repositories":{"trixie":"3.1.2+dfsg1-1"},"fixed_version":"3.1.1+dfsg1-1","urgency":"not yet assigned"}}},"CVE-2024-3657":{"description":"A flaw was found in 389-ds-base. A specially-crafted LDAP query can potentially cause a failure on the directory server, leading to a denial of service","scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"2.3.1+dfsg1-1+deb12u1"},"fixed_version":"2.3.1+dfsg1-1+deb12u1","urgency":"not yet assigned"},"bullseye":{"status":"resolved","repositories":{"bullseye":"1.4.4.11-2","bullseye-security":"1.4.4.11-2+deb11u1"},"fixed_version":"1.4.4.11-2+deb11u1","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"3.1.2+dfsg1-1"},"fixed_version":"3.1.1+dfsg1-1","urgency":"not yet assigned"},"trixie":{"status":"resolved","repositories":{"trixie":"3.1.2+dfsg1-1"},"fixed_version":"3.1.1+dfsg1-1","urgency":"not yet assigned"}}},"CVE-2024-5953":{"description":"A denial of service vulnerability was found in the 389-ds-base LDAP server. This issue may allow an authenticated user to cause a server denial of service while attempting to log in with a user with a malformed hash in their password.","scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"2.3.1+dfsg1-1+deb12u1"},"fixed_version":"2.3.1+dfsg1-1+deb12u1","urgency":"not yet assigned"},"bullseye":{"status":"resolved","repositories":{"bullseye":"1.4.4.11-2","bullseye-security":"1.4.4.11-2+deb11u1"},"fixed_version":"1.4.4.11-2+deb11u1","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"3.1.2+dfsg1-1"},"fixed_version":"3.1.1+dfsg1-1","urgency":"not yet assigned"},"trixie":{"status":"resolved","repositories":{"trixie":"3.1.2+dfsg1-1"},"fixed_version":"3.1.1+dfsg1-1","urgency":"not yet assigned"}}},"CVE-2024-6237":{"description":"A flaw was found in the 389 Directory Server. This flaw allows an unauthenticated user to cause a systematic server crash while sending a specific extended search request, leading to a denial of service.","scope":"local","releases":{"bookworm":{"status":"open","repositories":{"bookworm":"2.3.1+dfsg1-1+deb12u1"},"urgency":"not yet assigned","nodsa":"Minor issue","nodsa_reason":""},"bullseye":{"status":"open","repositories":{"bullseye":"1.4.4.11-2","bullseye-security":"1.4.4.11-2+deb11u1"},"urgency":"not yet assigned","nodsa":"Minor issue, DoS","nodsa_reason":"postponed"},"sid":{"status":"resolved","repositories":{"sid":"3.1.2+dfsg1-1"},"fixed_version":"2.4.5+dfsg1-1","urgency":"not yet assigned"},"trixie":{"status":"resolved","repositories":{"trixie":"3.1.2+dfsg1-1"},"fixed_version":"2.4.5+dfsg1-1","urgency":"not yet assigned"}}},"CVE-2024-8445":{"description":"The fix for CVE-2024-2199 in 389-ds-base was insufficient to cover all scenarios. In certain product versions, an authenticated user may cause a server crash while modifying `userPassword` using malformed input.","debianbug":1082852,"scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"2.3.1+dfsg1-1+deb12u1"},"fixed_version":"2.0.11-1","urgency":"not yet assigned"},"bullseye":{"status":"resolved","repositories":{"bullseye":"1.4.4.11-2","bullseye-security":"1.4.4.11-2+deb11u1"},"fixed_version":"1.4.4.11-2+deb11u1","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"3.1.2+dfsg1-1"},"fixed_version":"2.0.11-1","urgency":"not yet assigned"},"trixie":{"status":"resolved","repositories":{"trixie":"3.1.2+dfsg1-1"},"fixed_version":"2.0.11-1","urgency":"not yet assigned"}}},"CVE-2025-14905":{"description":"A flaw was found in the 389-ds-base server. A heap buffer overflow vulnerability exists in the `schema_attr_enum_callback` function within the `schema.c` file. This occurs because the code incorrectly calculates the buffer size by summing alias string lengths without accounting for additional formatting characters. When a large number of aliases are processed, this oversight can lead to a heap overflow, potentially allowing a remote attacker to cause a Denial of Service (DoS) or achieve Remote Code Execution (RCE).","scope":"local","releases":{"bookworm":{"status":"open","repositories":{"bookworm":"2.3.1+dfsg1-1+deb12u1"},"urgency":"not yet assigned"},"bullseye":{"status":"open","repositories":{"bullseye":"1.4.4.11-2","bullseye-security":"1.4.4.11-2+deb11u1"},"urgency":"not yet assigned"},"sid":{"status":"open","repositories":{"sid":"3.1.2+dfsg1-1"},"urgency":"not yet assigned"},"trixie":{"status":"open","repositories":{"trixie":"3.1.2+dfsg1-1"},"urgency":"not yet assigned"}}},"CVE-2025-2487":{"description":"A flaw was found in the 389-ds-base LDAP Server. This issue occurs when issuing a Modify DN LDAP operation through the ldap protocol, when the function return value is not tested and a NULL pointer is dereferenced. If a privileged user performs a ldap MODDN operation after a failed operation, it could lead to a Denial of Service (DoS) or system crash.","debianbug":1100994,"scope":"local","releases":{"bookworm":{"status":"open","repositories":{"bookworm":"2.3.1+dfsg1-1+deb12u1"},"urgency":"not yet assigned","nodsa":"Minor issue","nodsa_reason":""},"bullseye":{"status":"open","repositories":{"bullseye":"1.4.4.11-2","bullseye-security":"1.4.4.11-2+deb11u1"},"urgency":"not yet assigned","nodsa":"need priviligied user; DoS","nodsa_reason":"postponed"},"sid":{"status":"resolved","repositories":{"sid":"3.1.2+dfsg1-1"},"fixed_version":"3.1.2+dfsg1-1","urgency":"not yet assigned"},"trixie":{"status":"resolved","repositories":{"trixie":"3.1.2+dfsg1-1"},"fixed_version":"3.1.2+dfsg1-1","urgency":"not yet assigned"}}}},"7zip":{"CVE-2022-47111":{"description":"7-Zip 22.01 does not report an error for certain invalid xz files, involving block flags and reserved bits. Some later versions are unaffected.","scope":"local","releases":{"bookworm":{"status":"open","repositories":{"bookworm":"22.01+dfsg-8+deb12u1"},"urgency":"unimportant"},"forky":{"status":"open","repositories":{"forky":"26.00+dfsg-2"},"urgency":"unimportant"},"sid":{"status":"open","repositories":{"sid":"26.00+dfsg-2"},"urgency":"unimportant"},"trixie":{"status":"open","repositories":{"trixie":"25.01+dfsg-1~deb13u1"},"urgency":"unimportant"}}},"CVE-2022-47112":{"description":"7-Zip 22.01 does not report an error for certain invalid xz files, involving stream flags and reserved bits. Some later versions are unaffected.","scope":"local","releases":{"bookworm":{"status":"open","repositories":{"bookworm":"22.01+dfsg-8+deb12u1"},"urgency":"unimportant"},"forky":{"status":"open","repositories":{"forky":"26.00+dfsg-2"},"urgency":"unimportant"},"sid":{"status":"open","repositories":{"sid":"26.00+dfsg-2"},"urgency":"unimportant"},"trixie":{"status":"open","repositories":{"trixie":"25.01+dfsg-1~deb13u1"},"urgency":"unimportant"}}},"CVE-2023-31102":{"description":"Ppmd7.c in 7-Zip before 23.00 allows an integer underflow and invalid read operation via a crafted 7Z archive.","scope":"local","releases":{"bookworm":{"status":"open","repositories":{"bookworm":"22.01+dfsg-8+deb12u1"},"urgency":"not yet assigned","nodsa":"Minor issue; will be fixed via point release","nodsa_reason":"","next_point_update":true},"forky":{"status":"resolved","repositories":{"forky":"26.00+dfsg-2"},"fixed_version":"23.01+dfsg-1","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"26.00+dfsg-2"},"fixed_version":"23.01+dfsg-1","urgency":"not yet assigned"},"trixie":{"status":"resolved","repositories":{"trixie":"25.01+dfsg-1~deb13u1"},"fixed_version":"23.01+dfsg-1","urgency":"not yet assigned"}}},"CVE-2023-40481":{"description":"7-Zip SquashFS File Parsing Out-Of-Bounds Write Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of 7-Zip. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file.  The specific flaw exists within the parsing of SQFS files. The issue results from the lack of proper validation of user-supplied data, which can result in a write past the end of an allocated buffer. An attacker can leverage this vulnerability to execute code in the context of the current process. Was ZDI-CAN-18589.","scope":"local","releases":{"bookworm":{"status":"open","repositories":{"bookworm":"22.01+dfsg-8+deb12u1"},"urgency":"not yet assigned","nodsa":"Minor issue; will be fixed via point release","nodsa_reason":"","next_point_update":true},"forky":{"status":"resolved","repositories":{"forky":"26.00+dfsg-2"},"fixed_version":"23.01+dfsg-1","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"26.00+dfsg-2"},"fixed_version":"23.01+dfsg-1","urgency":"not yet assigned"},"trixie":{"status":"resolved","repositories":{"trixie":"25.01+dfsg-1~deb13u1"},"fixed_version":"23.01+dfsg-1","urgency":"not yet assigned"}}},"CVE-2023-52168":{"description":"The NtfsHandler.cpp NTFS handler in 7-Zip before 24.01 (for 7zz) contains a heap-based buffer overflow that allows an attacker to overwrite two bytes at multiple offsets beyond the allocated buffer size: buffer+512*i-2, for i=9, i=10, i=11, etc.","scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"22.01+dfsg-8+deb12u1"},"fixed_version":"22.01+dfsg-8+deb12u1","urgency":"not yet assigned"},"forky":{"status":"resolved","repositories":{"forky":"26.00+dfsg-2"},"fixed_version":"24.05+dfsg-1","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"26.00+dfsg-2"},"fixed_version":"24.05+dfsg-1","urgency":"not yet assigned"},"trixie":{"status":"resolved","repositories":{"trixie":"25.01+dfsg-1~deb13u1"},"fixed_version":"24.05+dfsg-1","urgency":"not yet assigned"}}},"CVE-2023-52169":{"description":"The NtfsHandler.cpp NTFS handler in 7-Zip before 24.01 (for 7zz) contains an out-of-bounds read that allows an attacker to read beyond the intended buffer. The bytes read beyond the intended buffer are presented as a part of a filename listed in the file system image. This has security relevance in some known web-service use cases where untrusted users can upload files and have them extracted by a server-side 7-Zip process.","scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"22.01+dfsg-8+deb12u1"},"fixed_version":"22.01+dfsg-8+deb12u1","urgency":"not yet assigned"},"forky":{"status":"resolved","repositories":{"forky":"26.00+dfsg-2"},"fixed_version":"24.05+dfsg-1","urgency":"unimportant"},"sid":{"status":"resolved","repositories":{"sid":"26.00+dfsg-2"},"fixed_version":"24.05+dfsg-1","urgency":"unimportant"},"trixie":{"status":"resolved","repositories":{"trixie":"25.01+dfsg-1~deb13u1"},"fixed_version":"24.05+dfsg-1","urgency":"unimportant"}}},"CVE-2024-11477":{"description":"7-Zip Zstandard Decompression Integer Underflow Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of 7-Zip. Interaction with this library is required to exploit this vulnerability but attack vectors may vary depending on the implementation.  The specific flaw exists within the implementation of Zstandard decompression. The issue results from the lack of proper validation of user-supplied data, which can result in an integer underflow before writing to memory. An attacker can leverage this vulnerability to execute code in the context of the current process. Was ZDI-CAN-24346.","scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"22.01+dfsg-8+deb12u1"},"fixed_version":"0","urgency":"unimportant"},"forky":{"status":"resolved","repositories":{"forky":"26.00+dfsg-2"},"fixed_version":"24.07+dfsg-1","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"26.00+dfsg-2"},"fixed_version":"24.07+dfsg-1","urgency":"not yet assigned"},"trixie":{"status":"resolved","repositories":{"trixie":"25.01+dfsg-1~deb13u1"},"fixed_version":"24.07+dfsg-1","urgency":"not yet assigned"}}},"CVE-2024-11612":{"description":"7-Zip CopyCoder Infinite Loop Denial-of-Service Vulnerability. This vulnerability allows remote attackers to create a denial-of-service condition on affected installations of 7-Zip. Interaction with this library is required to exploit this vulnerability but attack vectors may vary depending on the implementation.  The specific flaw exists within the processing of streams. The issue results from a logic error that can lead to an infinite loop. An attacker can leverage this vulnerability to create a denial-of-service condition on the system. Was ZDI-CAN-24307.","scope":"local","releases":{"bookworm":{"status":"open","repositories":{"bookworm":"22.01+dfsg-8+deb12u1"},"urgency":"unimportant","next_point_update":true},"forky":{"status":"resolved","repositories":{"forky":"26.00+dfsg-2"},"fixed_version":"24.08+dfsg-1","urgency":"unimportant"},"sid":{"status":"resolved","repositories":{"sid":"26.00+dfsg-2"},"fixed_version":"24.08+dfsg-1","urgency":"unimportant"},"trixie":{"status":"resolved","repositories":{"trixie":"25.01+dfsg-1~deb13u1"},"fixed_version":"24.08+dfsg-1","urgency":"unimportant"}}},"CVE-2025-0411":{"description":"7-Zip Mark-of-the-Web Bypass Vulnerability. This vulnerability allows remote attackers to bypass the Mark-of-the-Web protection mechanism on affected installations of 7-Zip. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file.  The specific flaw exists within the handling of archived files. When extracting files from a crafted archive that bears the Mark-of-the-Web, 7-Zip does not propagate the Mark-of-the-Web to the extracted files. An attacker can leverage this vulnerability to execute arbitrary code in the context of the current user. Was ZDI-CAN-25456.","scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"22.01+dfsg-8+deb12u1"},"fixed_version":"0","urgency":"unimportant"},"forky":{"status":"resolved","repositories":{"forky":"26.00+dfsg-2"},"fixed_version":"0","urgency":"unimportant"},"sid":{"status":"resolved","repositories":{"sid":"26.00+dfsg-2"},"fixed_version":"0","urgency":"unimportant"},"trixie":{"status":"resolved","repositories":{"trixie":"25.01+dfsg-1~deb13u1"},"fixed_version":"0","urgency":"unimportant"}}},"CVE-2025-11001":{"description":"7-Zip ZIP File Parsing Directory Traversal Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of 7-Zip. Interaction with this product is required to exploit this vulnerability but attack vectors may vary depending on the implementation.  The specific flaw exists within the handling of symbolic links in ZIP files. Crafted data in a ZIP file can cause the process to traverse to unintended directories. An attacker can leverage this vulnerability to execute code in the context of a service account. Was ZDI-CAN-26753.","scope":"local","releases":{"bookworm":{"status":"open","repositories":{"bookworm":"22.01+dfsg-8+deb12u1"},"urgency":"not yet assigned","nodsa":"Minor issue","nodsa_reason":"","next_point_update":true},"forky":{"status":"resolved","repositories":{"forky":"26.00+dfsg-2"},"fixed_version":"25.00+dfsg-1","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"26.00+dfsg-2"},"fixed_version":"25.00+dfsg-1","urgency":"not yet assigned"},"trixie":{"status":"resolved","repositories":{"trixie":"25.01+dfsg-1~deb13u1"},"fixed_version":"25.01+dfsg-1~deb13u1","urgency":"not yet assigned"}}},"CVE-2025-11002":{"description":"7-Zip ZIP File Parsing Directory Traversal Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of 7-Zip. Interaction with this product is required to exploit this vulnerability but attack vectors may vary depending on the implementation.  The specific flaw exists within the handling of symbolic links in ZIP files. Crafted data in a ZIP file can cause the process to traverse to unintended directories. An attacker can leverage this vulnerability to execute code in the context of a service account. Was ZDI-CAN-26743.","scope":"local","releases":{"bookworm":{"status":"open","repositories":{"bookworm":"22.01+dfsg-8+deb12u1"},"urgency":"not yet assigned","nodsa":"Minor issue","nodsa_reason":"","next_point_update":true},"forky":{"status":"resolved","repositories":{"forky":"26.00+dfsg-2"},"fixed_version":"25.00+dfsg-1","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"26.00+dfsg-2"},"fixed_version":"25.00+dfsg-1","urgency":"not yet assigned"},"trixie":{"status":"resolved","repositories":{"trixie":"25.01+dfsg-1~deb13u1"},"fixed_version":"25.01+dfsg-1~deb13u1","urgency":"not yet assigned"}}},"CVE-2025-53817":{"description":"7-Zip is a file archiver with a high compression ratio. 7-Zip supports extracting from Compound Documents. Prior to version 25.0.0, a null pointer dereference in the Compound handler may lead to denial of service. Version 25.0.0 contains a fix cor the issue.","scope":"local","releases":{"bookworm":{"status":"open","repositories":{"bookworm":"22.01+dfsg-8+deb12u1"},"urgency":"unimportant","next_point_update":true},"forky":{"status":"resolved","repositories":{"forky":"26.00+dfsg-2"},"fixed_version":"25.00+dfsg-1","urgency":"unimportant"},"sid":{"status":"resolved","repositories":{"sid":"26.00+dfsg-2"},"fixed_version":"25.00+dfsg-1","urgency":"unimportant"},"trixie":{"status":"resolved","repositories":{"trixie":"25.01+dfsg-1~deb13u1"},"fixed_version":"25.00+dfsg-1","urgency":"unimportant"}}},"CVE-2025-55188":{"description":"7-Zip before 25.01 does not always properly handle symbolic links during extraction.","debianbug":1111068,"scope":"local","releases":{"bookworm":{"status":"open","repositories":{"bookworm":"22.01+dfsg-8+deb12u1"},"urgency":"not yet assigned","nodsa":"Minor issue","nodsa_reason":"","next_point_update":true},"forky":{"status":"resolved","repositories":{"forky":"26.00+dfsg-2"},"fixed_version":"25.01+dfsg-1","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"26.00+dfsg-2"},"fixed_version":"25.01+dfsg-1","urgency":"not yet assigned"},"trixie":{"status":"resolved","repositories":{"trixie":"25.01+dfsg-1~deb13u1"},"fixed_version":"25.01+dfsg-1~deb13u1","urgency":"not yet assigned"}}}},"7zip-rar":{"CVE-2025-53816":{"description":"7-Zip is a file archiver with a high compression ratio. Zeroes written outside heap buffer in RAR5 handler may lead to memory corruption and denial of service in versions of 7-Zip prior to 25.0.0. Version 25.0.0 contains a fix for the issue.","debianbug":1109494,"scope":"local","releases":{"forky":{"status":"resolved","repositories":{"forky":"26.00+ds-1"},"fixed_version":"25.00+ds-1","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"26.00+ds-1"},"fixed_version":"25.00+ds-1","urgency":"not yet assigned"},"trixie":{"status":"resolved","repositories":{"trixie":"25.00+ds-1+deb13u1"},"fixed_version":"25.00+ds-1","urgency":"not yet assigned"}}}},"9base":{"CVE-2014-1935":{"description":"9base 1:6-6 and 1:6-7 insecurely creates temporary files which results in predictable filenames.","debianbug":737206,"scope":"local","releases":{"bookworm":{"status":"open","repositories":{"bookworm":"1:6-13"},"urgency":"unimportant"},"bullseye":{"status":"open","repositories":{"bullseye":"1:6-11"},"urgency":"unimportant"},"forky":{"status":"open","repositories":{"forky":"1:6-15"},"urgency":"unimportant"},"sid":{"status":"open","repositories":{"sid":"1:6-15"},"urgency":"unimportant"},"trixie":{"status":"open","repositories":{"trixie":"1:6-14"},"urgency":"unimportant"}}}},"a2ps":{"CVE-2001-1593":{"description":"The tempname_ensure function in lib/routines.h in a2ps 4.14 and earlier, as used by the spy_user function and possibly other functions, allows local users to modify arbitrary files via a symlink attack on a temporary file.","debianbug":737385,"scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"1:4.14-8"},"fixed_version":"1:4.14-1.2","urgency":"low"},"bullseye":{"status":"resolved","repositories":{"bullseye":"1:4.14-7"},"fixed_version":"1:4.14-1.2","urgency":"low"},"forky":{"status":"resolved","repositories":{"forky":"1:4.15.7-5"},"fixed_version":"1:4.14-1.2","urgency":"low"},"sid":{"status":"resolved","repositories":{"sid":"1:4.15.7-5"},"fixed_version":"1:4.14-1.2","urgency":"low"},"trixie":{"status":"resolved","repositories":{"trixie":"1:4.15.6-1"},"fixed_version":"1:4.14-1.2","urgency":"low"}}},"CVE-2004-1170":{"description":"a2ps 4.13 allows remote attackers to execute arbitrary commands via shell metacharacters in the filename.","debianbug":283134,"scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"1:4.14-8"},"fixed_version":"1:4.13b-4.2","urgency":"not yet assigned"},"bullseye":{"status":"resolved","repositories":{"bullseye":"1:4.14-7"},"fixed_version":"1:4.13b-4.2","urgency":"not yet assigned"},"forky":{"status":"resolved","repositories":{"forky":"1:4.15.7-5"},"fixed_version":"1:4.13b-4.2","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"1:4.15.7-5"},"fixed_version":"1:4.13b-4.2","urgency":"not yet assigned"},"trixie":{"status":"resolved","repositories":{"trixie":"1:4.15.6-1"},"fixed_version":"1:4.13b-4.2","urgency":"not yet assigned"}}},"CVE-2004-1377":{"description":"The (1) fixps (aka fixps.in) and (2) psmandup (aka psmandup.in) scripts in a2ps before 4.13 allow local users to overwrite arbitrary files via a symlink attack on temporary files.","debianbug":286385,"scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"1:4.14-8"},"fixed_version":"1:4.13b-4.3","urgency":"not yet assigned"},"bullseye":{"status":"resolved","repositories":{"bullseye":"1:4.14-7"},"fixed_version":"1:4.13b-4.3","urgency":"not yet assigned"},"forky":{"status":"resolved","repositories":{"forky":"1:4.15.7-5"},"fixed_version":"1:4.13b-4.3","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"1:4.15.7-5"},"fixed_version":"1:4.13b-4.3","urgency":"not yet assigned"},"trixie":{"status":"resolved","repositories":{"trixie":"1:4.15.6-1"},"fixed_version":"1:4.13b-4.3","urgency":"not yet assigned"}}},"CVE-2014-0466":{"description":"The fixps script in a2ps 4.14 does not use the -dSAFER option when executing gs, which allows context-dependent attackers to delete arbitrary files or execute arbitrary commands via a crafted PostScript file.","debianbug":742902,"scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"1:4.14-8"},"fixed_version":"1:4.14-1.3","urgency":"not yet assigned"},"bullseye":{"status":"resolved","repositories":{"bullseye":"1:4.14-7"},"fixed_version":"1:4.14-1.3","urgency":"not yet assigned"},"forky":{"status":"resolved","repositories":{"forky":"1:4.15.7-5"},"fixed_version":"1:4.14-1.3","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"1:4.15.7-5"},"fixed_version":"1:4.14-1.3","urgency":"not yet assigned"},"trixie":{"status":"resolved","repositories":{"trixie":"1:4.15.6-1"},"fixed_version":"1:4.14-1.3","urgency":"not yet assigned"}}},"CVE-2015-8107":{"description":"Format string vulnerability in GNU a2ps 4.14 allows remote attackers to execute arbitrary code.","scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"1:4.14-8"},"fixed_version":"1:4.14-1.2","urgency":"not yet assigned"},"bullseye":{"status":"resolved","repositories":{"bullseye":"1:4.14-7"},"fixed_version":"1:4.14-1.2","urgency":"not yet assigned"},"forky":{"status":"resolved","repositories":{"forky":"1:4.15.7-5"},"fixed_version":"1:4.14-1.2","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"1:4.15.7-5"},"fixed_version":"1:4.14-1.2","urgency":"not yet assigned"},"trixie":{"status":"resolved","repositories":{"trixie":"1:4.15.6-1"},"fixed_version":"1:4.14-1.2","urgency":"not yet assigned"}}}},"aardvark-dns":{"CVE-2024-8418":{"description":"A flaw was found in Aardvark-dns, which is vulnerable to a Denial of Service attack due to the serial processing of TCP DNS queries. An attacker can exploit this flaw by keeping a TCP connection open indefinitely, causing the server to become unresponsive and resulting in other DNS queries timing out. This issue prevents legitimate users from accessing DNS services, thereby disrupting normal operations and causing service downtime.","debianbug":1080964,"scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"1.4.0-3"},"fixed_version":"0","urgency":"unimportant"},"forky":{"status":"resolved","repositories":{"forky":"1.16.0-2"},"fixed_version":"1.12.2-1","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"1.16.0-2"},"fixed_version":"1.12.2-1","urgency":"not yet assigned"},"trixie":{"status":"resolved","repositories":{"trixie":"1.14.0-3"},"fixed_version":"1.12.2-1","urgency":"not yet assigned"}}}},"abcm2ps":{"CVE-2004-1258":{"description":"Buffer overflow in the put_words function in subs.c for abcm2ps 3.7.20 allows remote attackers to execute arbitrary code via crafted ABC files.","scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"8.14.14-1"},"fixed_version":"4.8.5-1","urgency":"not yet assigned"},"bullseye":{"status":"resolved","repositories":{"bullseye":"8.14.11-0.1"},"fixed_version":"4.8.5-1","urgency":"not yet assigned"},"forky":{"status":"resolved","repositories":{"forky":"8.14.18-1"},"fixed_version":"4.8.5-1","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"8.14.18-1"},"fixed_version":"4.8.5-1","urgency":"not yet assigned"},"trixie":{"status":"resolved","repositories":{"trixie":"8.14.17-2"},"fixed_version":"4.8.5-1","urgency":"not yet assigned"}}},"CVE-2010-3441":{"description":"Multiple buffer overflows in abcm2ps before 5.9.12 might allow remote attackers to execute arbitrary code via (1) a crafted input file, related to the PUT0 and PUT1 output macros; (2) a crafted input file, related to the trim_title function; and possibly (3) a long -O option on a command line.","debianbug":577014,"scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"8.14.14-1"},"fixed_version":"5.9.13-0.1","urgency":"low"},"bullseye":{"status":"resolved","repositories":{"bullseye":"8.14.11-0.1"},"fixed_version":"5.9.13-0.1","urgency":"low"},"forky":{"status":"resolved","repositories":{"forky":"8.14.18-1"},"fixed_version":"5.9.13-0.1","urgency":"low"},"sid":{"status":"resolved","repositories":{"sid":"8.14.18-1"},"fixed_version":"5.9.13-0.1","urgency":"low"},"trixie":{"status":"resolved","repositories":{"trixie":"8.14.17-2"},"fixed_version":"5.9.13-0.1","urgency":"low"}}},"CVE-2010-4743":{"description":"Heap-based buffer overflow in the getarena function in abc2ps.c in abcm2ps before 5.9.13 might allow remote attackers to execute arbitrary code via a crafted ABC file, a different vulnerability than CVE-2010-3441.  NOTE: some of these details are obtained from third party information.","scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"8.14.14-1"},"fixed_version":"5.9.22-1","urgency":"low"},"bullseye":{"status":"resolved","repositories":{"bullseye":"8.14.11-0.1"},"fixed_version":"5.9.22-1","urgency":"low"},"forky":{"status":"resolved","repositories":{"forky":"8.14.18-1"},"fixed_version":"5.9.22-1","urgency":"low"},"sid":{"status":"resolved","repositories":{"sid":"8.14.18-1"},"fixed_version":"5.9.22-1","urgency":"low"},"trixie":{"status":"resolved","repositories":{"trixie":"8.14.17-2"},"fixed_version":"5.9.22-1","urgency":"low"}}},"CVE-2010-4744":{"description":"Multiple unspecified vulnerabilities in abcm2ps before 5.9.13 have unknown impact and attack vectors, a different issue than CVE-2010-3441.","scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"8.14.14-1"},"fixed_version":"5.9.22-1","urgency":"low"},"bullseye":{"status":"resolved","repositories":{"bullseye":"8.14.11-0.1"},"fixed_version":"5.9.22-1","urgency":"low"},"forky":{"status":"resolved","repositories":{"forky":"8.14.18-1"},"fixed_version":"5.9.22-1","urgency":"low"},"sid":{"status":"resolved","repositories":{"sid":"8.14.18-1"},"fixed_version":"5.9.22-1","urgency":"low"},"trixie":{"status":"resolved","repositories":{"trixie":"8.14.17-2"},"fixed_version":"5.9.22-1","urgency":"low"}}},"CVE-2018-10753":{"description":"Stack-based buffer overflow in the delayed_output function in music.c in abcm2ps through 8.13.20 allows remote attackers to cause a denial of service (application crash) or possibly have unspecified other impact.","debianbug":897966,"scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"8.14.14-1"},"fixed_version":"8.14.2-0.1","urgency":"unimportant"},"bullseye":{"status":"resolved","repositories":{"bullseye":"8.14.11-0.1"},"fixed_version":"8.14.2-0.1","urgency":"unimportant"},"forky":{"status":"resolved","repositories":{"forky":"8.14.18-1"},"fixed_version":"8.14.2-0.1","urgency":"unimportant"},"sid":{"status":"resolved","repositories":{"sid":"8.14.18-1"},"fixed_version":"8.14.2-0.1","urgency":"unimportant"},"trixie":{"status":"resolved","repositories":{"trixie":"8.14.17-2"},"fixed_version":"8.14.2-0.1","urgency":"unimportant"}}},"CVE-2018-10771":{"description":"Stack-based buffer overflow in the get_key function in parse.c in abcm2ps through 8.13.20 allows remote attackers to cause a denial of service (application crash) or possibly have unspecified other impact.","debianbug":898130,"scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"8.14.14-1"},"fixed_version":"8.14.2-0.1","urgency":"unimportant"},"bullseye":{"status":"resolved","repositories":{"bullseye":"8.14.11-0.1"},"fixed_version":"8.14.2-0.1","urgency":"unimportant"},"forky":{"status":"resolved","repositories":{"forky":"8.14.18-1"},"fixed_version":"8.14.2-0.1","urgency":"unimportant"},"sid":{"status":"resolved","repositories":{"sid":"8.14.18-1"},"fixed_version":"8.14.2-0.1","urgency":"unimportant"},"trixie":{"status":"resolved","repositories":{"trixie":"8.14.17-2"},"fixed_version":"8.14.2-0.1","urgency":"unimportant"}}},"CVE-2019-1010069":{"description":"moinejf abcm2ps 8.13.20 is affected by: Incorrect Access Control. The impact is: Allows attackers to cause a denial of service attack via a crafted file. The component is: front.c, function txt_add. The fixed version is: after commit commit 08aef597656d065e86075f3d53fda89765845eae.","scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"8.14.14-1"},"fixed_version":"8.14.2-0.1","urgency":"unimportant"},"bullseye":{"status":"resolved","repositories":{"bullseye":"8.14.11-0.1"},"fixed_version":"8.14.2-0.1","urgency":"unimportant"},"forky":{"status":"resolved","repositories":{"forky":"8.14.18-1"},"fixed_version":"8.14.2-0.1","urgency":"unimportant"},"sid":{"status":"resolved","repositories":{"sid":"8.14.18-1"},"fixed_version":"8.14.2-0.1","urgency":"unimportant"},"trixie":{"status":"resolved","repositories":{"trixie":"8.14.17-2"},"fixed_version":"8.14.2-0.1","urgency":"unimportant"}}},"CVE-2021-32434":{"description":"abcm2ps v8.14.11 was discovered to contain an out-of-bounds read in the function calculate_beam at draw.c.","scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"8.14.14-1"},"fixed_version":"8.14.13-1","urgency":"unimportant"},"bullseye":{"status":"open","repositories":{"bullseye":"8.14.11-0.1"},"urgency":"unimportant"},"forky":{"status":"resolved","repositories":{"forky":"8.14.18-1"},"fixed_version":"8.14.13-1","urgency":"unimportant"},"sid":{"status":"resolved","repositories":{"sid":"8.14.18-1"},"fixed_version":"8.14.13-1","urgency":"unimportant"},"trixie":{"status":"resolved","repositories":{"trixie":"8.14.17-2"},"fixed_version":"8.14.13-1","urgency":"unimportant"}}},"CVE-2021-32435":{"description":"Stack-based buffer overflow in the function get_key in parse.c of abcm2ps v8.14.11 allows remote attackers to cause a Denial of Service (DoS) via unspecified vectors.","scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"8.14.14-1"},"fixed_version":"8.14.13-1","urgency":"not yet assigned"},"bullseye":{"status":"open","repositories":{"bullseye":"8.14.11-0.1"},"urgency":"not yet assigned","nodsa":"Minor issue","nodsa_reason":""},"forky":{"status":"resolved","repositories":{"forky":"8.14.18-1"},"fixed_version":"8.14.13-1","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"8.14.18-1"},"fixed_version":"8.14.13-1","urgency":"not yet assigned"},"trixie":{"status":"resolved","repositories":{"trixie":"8.14.17-2"},"fixed_version":"8.14.13-1","urgency":"not yet assigned"}}},"CVE-2021-32436":{"description":"An out-of-bounds read in the function write_title() in subs.c of abcm2ps v8.14.11 allows remote attackers to cause a Denial of Service (DoS) via unspecified vectors.","scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"8.14.14-1"},"fixed_version":"8.14.13-1","urgency":"unimportant"},"bullseye":{"status":"open","repositories":{"bullseye":"8.14.11-0.1"},"urgency":"unimportant"},"forky":{"status":"resolved","repositories":{"forky":"8.14.18-1"},"fixed_version":"8.14.13-1","urgency":"unimportant"},"sid":{"status":"resolved","repositories":{"sid":"8.14.18-1"},"fixed_version":"8.14.13-1","urgency":"unimportant"},"trixie":{"status":"resolved","repositories":{"trixie":"8.14.17-2"},"fixed_version":"8.14.13-1","urgency":"unimportant"}}}},"abcmidi":{"CVE-2004-1256":{"description":"Multiple buffer overflows in the (1) event_text and (2) event_specific functions in abc2midi 2004.12.04 allow remote attackers to execute arbitrary code via crafted ABC files.","scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"20230208+ds1-1"},"fixed_version":"20050101-1","urgency":"not yet assigned"},"bullseye":{"status":"resolved","repositories":{"bullseye":"20210221-1"},"fixed_version":"20050101-1","urgency":"not yet assigned"},"forky":{"status":"resolved","repositories":{"forky":"20250627+ds-1.1"},"fixed_version":"20050101-1","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"20250627+ds-1.1"},"fixed_version":"20050101-1","urgency":"not yet assigned"},"trixie":{"status":"resolved","repositories":{"trixie":"20250216+ds-1"},"fixed_version":"20050101-1","urgency":"not yet assigned"}}},"CVE-2006-1514":{"description":"Multiple buffer overflows in the abcmidi-yaps translator in abcmidi 20050101, and other versions, allow remote attackers to execute arbitrary code via crafted ABC music files that trigger the overflows during translation into PostScript.","scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"20230208+ds1-1"},"fixed_version":"20060422-1","urgency":"not yet assigned"},"bullseye":{"status":"resolved","repositories":{"bullseye":"20210221-1"},"fixed_version":"20060422-1","urgency":"not yet assigned"},"forky":{"status":"resolved","repositories":{"forky":"20250627+ds-1.1"},"fixed_version":"20060422-1","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"20250627+ds-1.1"},"fixed_version":"20060422-1","urgency":"not yet assigned"},"trixie":{"status":"resolved","repositories":{"trixie":"20250216+ds-1"},"fixed_version":"20060422-1","urgency":"not yet assigned"}}}},"abiword":{"CVE-2004-0645":{"description":"Buffer overflow in the wvHandleDateTimePicture function in wv library (wvWare) 0.7.4 through 0.7.6 and 1.0.0 allows remote attackers to execute arbitrary code via a document with a long DateTime field.","scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"3.0.5~dfsg-3.2"},"fixed_version":"2.0.8","urgency":"not yet assigned"},"bullseye":{"status":"resolved","repositories":{"bullseye":"3.0.4~dfsg-3"},"fixed_version":"2.0.8","urgency":"not yet assigned"},"forky":{"status":"resolved","repositories":{"forky":"3.0.8+ds-2"},"fixed_version":"2.0.8","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"3.0.8+ds-2"},"fixed_version":"2.0.8","urgency":"not yet assigned"},"trixie":{"status":"resolved","repositories":{"trixie":"3.0.6~dfsg-1"},"fixed_version":"2.0.8","urgency":"not yet assigned"}}},"CVE-2005-2964":{"description":"Stack-based buffer overflow in AbiWord before 2.2.10 allows attackers to execute arbitrary code via the RTF import mechanism.","debianbug":329839,"scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"3.0.5~dfsg-3.2"},"fixed_version":"2.2.10-1","urgency":"medium"},"bullseye":{"status":"resolved","repositories":{"bullseye":"3.0.4~dfsg-3"},"fixed_version":"2.2.10-1","urgency":"medium"},"forky":{"status":"resolved","repositories":{"forky":"3.0.8+ds-2"},"fixed_version":"2.2.10-1","urgency":"medium"},"sid":{"status":"resolved","repositories":{"sid":"3.0.8+ds-2"},"fixed_version":"2.2.10-1","urgency":"medium"},"trixie":{"status":"resolved","repositories":{"trixie":"3.0.6~dfsg-1"},"fixed_version":"2.2.10-1","urgency":"medium"}}},"CVE-2005-2972":{"description":"Multiple stack-based buffer overflows in the RTF import feature in AbiWord before 2.2.11 allow user-assisted attackers to execute arbitrary code via an RTF file with long identifiers, which are not properly handled in the (1) ParseLevelText, (2) getCharsInsideBrace, (3) HandleLists, (4) or (5) HandleAbiLists functions in ie_imp_RTF.cpp, a different vulnerability than CVE-2005-2964.","debianbug":333740,"scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"3.0.5~dfsg-3.2"},"fixed_version":"2.4.1-1","urgency":"medium"},"bullseye":{"status":"resolved","repositories":{"bullseye":"3.0.4~dfsg-3"},"fixed_version":"2.4.1-1","urgency":"medium"},"forky":{"status":"resolved","repositories":{"forky":"3.0.8+ds-2"},"fixed_version":"2.4.1-1","urgency":"medium"},"sid":{"status":"resolved","repositories":{"sid":"3.0.8+ds-2"},"fixed_version":"2.4.1-1","urgency":"medium"},"trixie":{"status":"resolved","repositories":{"trixie":"3.0.6~dfsg-1"},"fixed_version":"2.4.1-1","urgency":"medium"}}},"CVE-2006-4513":{"description":"Multiple integer overflows in the WV library in wvWare (formerly mswordview) before 1.2.3, as used by AbiWord, KWord, and possibly other products, allow user-assisted remote attackers to execute arbitrary code via a crafted Microsoft Word (DOC) file that produces (1) large LFO clfolvl values in the wvGetLFO_records function or (2) a large LFO nolfo value in the wvGetFLO_PLF function.","debianbug":396360,"scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"3.0.5~dfsg-3.2"},"fixed_version":"2.4.6-1","urgency":"not yet assigned"},"bullseye":{"status":"resolved","repositories":{"bullseye":"3.0.4~dfsg-3"},"fixed_version":"2.4.6-1","urgency":"not yet assigned"},"forky":{"status":"resolved","repositories":{"forky":"3.0.8+ds-2"},"fixed_version":"2.4.6-1","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"3.0.8+ds-2"},"fixed_version":"2.4.6-1","urgency":"not yet assigned"},"trixie":{"status":"resolved","repositories":{"trixie":"3.0.6~dfsg-1"},"fixed_version":"2.4.6-1","urgency":"not yet assigned"}}},"CVE-2017-17529":{"description":"af/util/xp/ut_go_file.cpp in AbiWord 3.0.2-2 does not validate strings before launching the program specified by the BROWSER environment variable, which might allow remote attackers to conduct argument-injection attacks via a crafted URL.","debianbug":884923,"scope":"local","releases":{"bookworm":{"status":"open","repositories":{"bookworm":"3.0.5~dfsg-3.2"},"urgency":"unimportant"},"bullseye":{"status":"open","repositories":{"bullseye":"3.0.4~dfsg-3"},"urgency":"unimportant"},"forky":{"status":"open","repositories":{"forky":"3.0.8+ds-2"},"urgency":"unimportant"},"sid":{"status":"open","repositories":{"sid":"3.0.8+ds-2"},"urgency":"unimportant"},"trixie":{"status":"open","repositories":{"trixie":"3.0.6~dfsg-1"},"urgency":"unimportant"}}}},"abseil":{"CVE-2025-0838":{"description":"There exists a heap buffer overflow vulnerable in Abseil-cpp. The sized constructors, reserve(), and rehash() methods of absl::{flat,node}hash{set,map} did not impose an upper bound on their size argument. As a result, it was possible for a caller to pass a very large size that would cause an integer overflow when computing the size of the container's backing store, and a subsequent out-of-bounds memory write. Subsequent accesses to the container might also access out-of-bounds memory. We recommend upgrading past commit 5a0e2cb5e3958dd90bb8569a2766622cb74d90c1","debianbug":1098903,"scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"20220623.1-1+deb12u2"},"fixed_version":"20220623.1-1+deb12u1","urgency":"not yet assigned"},"bullseye":{"status":"resolved","repositories":{"bullseye":"0~20200923.3-2","bullseye-security":"0~20200923.3-2+deb11u1"},"fixed_version":"0~20200923.3-2+deb11u1","urgency":"not yet assigned"},"forky":{"status":"resolved","repositories":{"forky":"20240722.0-4"},"fixed_version":"20240722.0-3","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"20240722.0-4"},"fixed_version":"20240722.0-3","urgency":"not yet assigned"},"trixie":{"status":"resolved","repositories":{"trixie":"20240722.0-4"},"fixed_version":"20240722.0-3","urgency":"not yet assigned"}}}},"accountsservice":{"CVE-2011-4406":{"description":"The Ubuntu AccountsService package before 0.6.14-1git1ubuntu1.1 does not properly drop privileges when changing language settings, which allows local users to modify arbitrary files via unspecified vectors.","scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"22.08.8-6"},"fixed_version":"0.6.15-3","urgency":"not yet assigned"},"bullseye":{"status":"resolved","repositories":{"bullseye":"0.6.55-3"},"fixed_version":"0.6.15-3","urgency":"not yet assigned"},"forky":{"status":"resolved","repositories":{"forky":"23.13.9-8"},"fixed_version":"0.6.15-3","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"23.13.9-8"},"fixed_version":"0.6.15-3","urgency":"not yet assigned"},"trixie":{"status":"resolved","repositories":{"trixie":"23.13.9-7"},"fixed_version":"0.6.15-3","urgency":"not yet assigned"}}},"CVE-2012-2737":{"description":"The user_change_icon_file_authorized_cb function in /usr/libexec/accounts-daemon in AccountsService before 0.6.22 does not properly check the UID when copying an icon file to the system cache directory, which allows local users to read arbitrary files via a race condition.","debianbug":679429,"scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"22.08.8-6"},"fixed_version":"0.6.21-6","urgency":"not yet assigned"},"bullseye":{"status":"resolved","repositories":{"bullseye":"0.6.55-3"},"fixed_version":"0.6.21-6","urgency":"not yet assigned"},"forky":{"status":"resolved","repositories":{"forky":"23.13.9-8"},"fixed_version":"0.6.21-6","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"23.13.9-8"},"fixed_version":"0.6.21-6","urgency":"not yet assigned"},"trixie":{"status":"resolved","repositories":{"trixie":"23.13.9-7"},"fixed_version":"0.6.21-6","urgency":"not yet assigned"}}},"CVE-2012-6655":{"description":"An issue exists AccountService 0.6.37 in the user_change_password_authorized_cb() function in user.c which could let a local users obtain encrypted passwords.","debianbug":757912,"scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"22.08.8-6"},"fixed_version":"22.08.8-4","urgency":"low"},"bullseye":{"status":"open","repositories":{"bullseye":"0.6.55-3"},"urgency":"low","nodsa":"Minor issue","nodsa_reason":"ignored"},"forky":{"status":"resolved","repositories":{"forky":"23.13.9-8"},"fixed_version":"22.08.8-4","urgency":"low"},"sid":{"status":"resolved","repositories":{"sid":"23.13.9-8"},"fixed_version":"22.08.8-4","urgency":"low"},"trixie":{"status":"resolved","repositories":{"trixie":"23.13.9-7"},"fixed_version":"22.08.8-4","urgency":"low"}}},"CVE-2018-14036":{"description":"Directory Traversal with ../ sequences occurs in AccountsService before 0.6.50 because of an insufficient path check in user_change_icon_file_authorized_cb() in user.c.","debianbug":903828,"scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"22.08.8-6"},"fixed_version":"0.6.45-2","urgency":"low"},"bullseye":{"status":"resolved","repositories":{"bullseye":"0.6.55-3"},"fixed_version":"0.6.45-2","urgency":"low"},"forky":{"status":"resolved","repositories":{"forky":"23.13.9-8"},"fixed_version":"0.6.45-2","urgency":"low"},"sid":{"status":"resolved","repositories":{"sid":"23.13.9-8"},"fixed_version":"0.6.45-2","urgency":"low"},"trixie":{"status":"resolved","repositories":{"trixie":"23.13.9-7"},"fixed_version":"0.6.45-2","urgency":"low"}}},"CVE-2020-16126":{"description":"An Ubuntu-specific modification to AccountsService in versions before 0.6.55-0ubuntu13.2, among other earlier versions, improperly dropped the ruid, allowing untrusted users to send signals to AccountService, thus stopping it from handling D-Bus messages in a timely fashion.","scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"22.08.8-6"},"fixed_version":"0","urgency":"unimportant"},"bullseye":{"status":"resolved","repositories":{"bullseye":"0.6.55-3"},"fixed_version":"0","urgency":"unimportant"},"forky":{"status":"resolved","repositories":{"forky":"23.13.9-8"},"fixed_version":"0","urgency":"unimportant"},"sid":{"status":"resolved","repositories":{"sid":"23.13.9-8"},"fixed_version":"0","urgency":"unimportant"},"trixie":{"status":"resolved","repositories":{"trixie":"23.13.9-7"},"fixed_version":"0","urgency":"unimportant"}}},"CVE-2020-16127":{"description":"An Ubuntu-specific modification to AccountsService in versions before 0.6.55-0ubuntu13.2, among other earlier versions, would perform unbounded read operations on user-controlled ~/.pam_environment files, allowing an infinite loop if /dev/zero is symlinked to this location.","scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"22.08.8-6"},"fixed_version":"0","urgency":"unimportant"},"bullseye":{"status":"resolved","repositories":{"bullseye":"0.6.55-3"},"fixed_version":"0","urgency":"unimportant"},"forky":{"status":"resolved","repositories":{"forky":"23.13.9-8"},"fixed_version":"0","urgency":"unimportant"},"sid":{"status":"resolved","repositories":{"sid":"23.13.9-8"},"fixed_version":"0","urgency":"unimportant"},"trixie":{"status":"resolved","repositories":{"trixie":"23.13.9-7"},"fixed_version":"0","urgency":"unimportant"}}},"CVE-2021-3939":{"description":"Ubuntu-specific modifications to accountsservice (in patch file debian/patches/0010-set-language.patch) caused the fallback_locale variable, pointing to static storage, to be freed, in the user_change_language_authorized_cb function. This is reachable via the SetLanguage dbus function. This is fixed in versions 0.6.55-0ubuntu12~20.04.5, 0.6.55-0ubuntu13.3, 0.6.55-0ubuntu14.1.","scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"22.08.8-6"},"fixed_version":"0","urgency":"unimportant"},"bullseye":{"status":"resolved","repositories":{"bullseye":"0.6.55-3"},"fixed_version":"0","urgency":"unimportant"},"forky":{"status":"resolved","repositories":{"forky":"23.13.9-8"},"fixed_version":"0","urgency":"unimportant"},"sid":{"status":"resolved","repositories":{"sid":"23.13.9-8"},"fixed_version":"0","urgency":"unimportant"},"trixie":{"status":"resolved","repositories":{"trixie":"23.13.9-7"},"fixed_version":"0","urgency":"unimportant"}}},"CVE-2022-1804":{"description":"accountsservice no longer drops permissions when writting .pam_environment","scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"22.08.8-6"},"fixed_version":"0","urgency":"unimportant"},"bullseye":{"status":"resolved","repositories":{"bullseye":"0.6.55-3"},"fixed_version":"0","urgency":"unimportant"},"forky":{"status":"resolved","repositories":{"forky":"23.13.9-8"},"fixed_version":"0","urgency":"unimportant"},"sid":{"status":"resolved","repositories":{"sid":"23.13.9-8"},"fixed_version":"0","urgency":"unimportant"},"trixie":{"status":"resolved","repositories":{"trixie":"23.13.9-7"},"fixed_version":"0","urgency":"unimportant"}}},"CVE-2023-3297":{"description":"In Ubuntu's accountsservice an unprivileged local attacker can trigger a use-after-free vulnerability in accountsservice by sending a D-Bus message to the accounts-daemon process.","scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"22.08.8-6"},"fixed_version":"0","urgency":"unimportant"},"bullseye":{"status":"resolved","repositories":{"bullseye":"0.6.55-3"},"fixed_version":"0","urgency":"unimportant"},"forky":{"status":"resolved","repositories":{"forky":"23.13.9-8"},"fixed_version":"0","urgency":"unimportant"},"sid":{"status":"resolved","repositories":{"sid":"23.13.9-8"},"fixed_version":"0","urgency":"unimportant"},"trixie":{"status":"resolved","repositories":{"trixie":"23.13.9-7"},"fixed_version":"0","urgency":"unimportant"}}}},"ace":{"CVE-2014-6311":{"description":"generate_doygen.pl in ace before 6.2.7+dfsg-2 creates predictable file names in the /tmp directory which allows attackers to gain elevated privileges.","debianbug":760709,"scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"7.0.8+dfsg-2"},"fixed_version":"6.2.7+dfsg-2","urgency":"unimportant"},"bullseye":{"status":"resolved","repositories":{"bullseye":"6.5.12+dfsg-3"},"fixed_version":"6.2.7+dfsg-2","urgency":"unimportant"},"forky":{"status":"resolved","repositories":{"forky":"8.0.5+dfsg-2"},"fixed_version":"6.2.7+dfsg-2","urgency":"unimportant"},"sid":{"status":"resolved","repositories":{"sid":"8.0.5+dfsg-2"},"fixed_version":"6.2.7+dfsg-2","urgency":"unimportant"},"trixie":{"status":"resolved","repositories":{"trixie":"8.0.2+dfsg-2"},"fixed_version":"6.2.7+dfsg-2","urgency":"unimportant"}}}},"acl":{"CVE-2009-4411":{"description":"The (1) setfacl and (2) getfacl commands in XFS acl 2.2.47, when running in recursive (-R) mode, follow symbolic links even when the --physical (aka -P) or -L option is specified, which might allow local users to modify the ACL for arbitrary files or directories via a symlink attack.","debianbug":499076,"scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"2.3.1-3"},"fixed_version":"2.2.49-2","urgency":"low"},"bullseye":{"status":"resolved","repositories":{"bullseye":"2.2.53-10"},"fixed_version":"2.2.49-2","urgency":"low"},"forky":{"status":"resolved","repositories":{"forky":"2.3.2-3"},"fixed_version":"2.2.49-2","urgency":"low"},"sid":{"status":"resolved","repositories":{"sid":"2.3.2-3"},"fixed_version":"2.2.49-2","urgency":"low"},"trixie":{"status":"resolved","repositories":{"trixie":"2.3.2-2"},"fixed_version":"2.2.49-2","urgency":"low"}}}},"acm":{"CVE-2002-0391":{"description":"Integer overflow in xdr_array function in RPC servers for operating systems that use libc, glibc, or other code based on SunRPC including dietlibc, allows remote attackers to execute arbitrary code by passing a large number of arguments to xdr_array through RPC services such as rpc.cmsd and dmispd.","scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"6.0+20200416-1.1"},"fixed_version":"5.0-10","urgency":"not yet assigned"},"bullseye":{"status":"resolved","repositories":{"bullseye":"6.0+20200416-1"},"fixed_version":"5.0-10","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"6.0+20200416-1.2"},"fixed_version":"5.0-10","urgency":"not yet assigned"},"trixie":{"status":"resolved","repositories":{"trixie":"6.0+20200416-1.2"},"fixed_version":"5.0-10","urgency":"not yet assigned"}}}},"acme.sh":{"CVE-2023-38198":{"description":"acme.sh before 3.0.6 runs arbitrary commands from a remote server via eval, as exploited in the wild in June 2023.","scope":"local","releases":{"forky":{"status":"resolved","repositories":{"forky":"3.1.2+~cs0.0.20251126-2"},"fixed_version":"0","urgency":"unimportant"},"sid":{"status":"resolved","repositories":{"sid":"3.1.2+~cs0.0.20251126-2"},"fixed_version":"0","urgency":"unimportant"},"trixie":{"status":"resolved","repositories":{"trixie":"3.1.1-1"},"fixed_version":"0","urgency":"unimportant"}}}},"acpi-support":{"CVE-2014-0484":{"description":"The Debian acpi-support package before 0.140-5+deb7u3 allows local users to gain privileges via vectors related to the \"user's environment.\"","scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"0.143-5.1"},"fixed_version":"0.142-4","urgency":"not yet assigned"},"bullseye":{"status":"resolved","repositories":{"bullseye":"0.143-5"},"fixed_version":"0.142-4","urgency":"not yet assigned"},"forky":{"status":"resolved","repositories":{"forky":"0.143-5.2"},"fixed_version":"0.142-4","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"0.143-5.2"},"fixed_version":"0.142-4","urgency":"not yet assigned"},"trixie":{"status":"resolved","repositories":{"trixie":"0.143-5.2"},"fixed_version":"0.142-4","urgency":"not yet assigned"}}},"CVE-2014-1419":{"description":"Race condition in the power policy functions in policy-funcs in acpi-support before 0.142 allows local users to gain privileges via unspecified vectors.","scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"0.143-5.1"},"fixed_version":"0.142-2","urgency":"not yet assigned"},"bullseye":{"status":"resolved","repositories":{"bullseye":"0.143-5"},"fixed_version":"0.142-2","urgency":"not yet assigned"},"forky":{"status":"resolved","repositories":{"forky":"0.143-5.2"},"fixed_version":"0.142-2","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"0.143-5.2"},"fixed_version":"0.142-2","urgency":"not yet assigned"},"trixie":{"status":"resolved","repositories":{"trixie":"0.143-5.2"},"fixed_version":"0.142-2","urgency":"not yet assigned"}}}},"acpica-unix":{"CVE-2017-13693":{"description":"The acpi_ds_create_operands() function in drivers/acpi/acpica/dsutils.c in the Linux kernel through 4.12.9 does not flush the operand cache and causes a kernel stack dump, which allows local users to obtain sensitive information from kernel memory and bypass the KASLR protection mechanism (in the kernel through 4.9) via a crafted ACPI table.","scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"20200925-8"},"fixed_version":"20180209-1","urgency":"unimportant"},"bullseye":{"status":"resolved","repositories":{"bullseye":"20200925-1.2"},"fixed_version":"20180209-1","urgency":"unimportant"},"forky":{"status":"resolved","repositories":{"forky":"20251212-1"},"fixed_version":"20180209-1","urgency":"unimportant"},"sid":{"status":"resolved","repositories":{"sid":"20251212-1"},"fixed_version":"20180209-1","urgency":"unimportant"},"trixie":{"status":"resolved","repositories":{"trixie":"20250404-1"},"fixed_version":"20180209-1","urgency":"unimportant"}}},"CVE-2017-13694":{"description":"The acpi_ps_complete_final_op() function in drivers/acpi/acpica/psobject.c in the Linux kernel through 4.12.9 does not flush the node and node_ext caches and causes a kernel stack dump, which allows local users to obtain sensitive information from kernel memory and bypass the KASLR protection mechanism (in the kernel through 4.9) via a crafted ACPI table.","scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"20200925-8"},"fixed_version":"20180209-1","urgency":"unimportant"},"bullseye":{"status":"resolved","repositories":{"bullseye":"20200925-1.2"},"fixed_version":"20180209-1","urgency":"unimportant"},"forky":{"status":"resolved","repositories":{"forky":"20251212-1"},"fixed_version":"20180209-1","urgency":"unimportant"},"sid":{"status":"resolved","repositories":{"sid":"20251212-1"},"fixed_version":"20180209-1","urgency":"unimportant"},"trixie":{"status":"resolved","repositories":{"trixie":"20250404-1"},"fixed_version":"20180209-1","urgency":"unimportant"}}},"CVE-2017-13695":{"description":"The acpi_ns_evaluate() function in drivers/acpi/acpica/nseval.c in the Linux kernel through 4.12.9 does not flush the operand cache and causes a kernel stack dump, which allows local users to obtain sensitive information from kernel memory and bypass the KASLR protection mechanism (in the kernel through 4.9) via a crafted ACPI table.","scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"20200925-8"},"fixed_version":"20180209-1","urgency":"unimportant"},"bullseye":{"status":"resolved","repositories":{"bullseye":"20200925-1.2"},"fixed_version":"20180209-1","urgency":"unimportant"},"forky":{"status":"resolved","repositories":{"forky":"20251212-1"},"fixed_version":"20180209-1","urgency":"unimportant"},"sid":{"status":"resolved","repositories":{"sid":"20251212-1"},"fixed_version":"20180209-1","urgency":"unimportant"},"trixie":{"status":"resolved","repositories":{"trixie":"20250404-1"},"fixed_version":"20180209-1","urgency":"unimportant"}}},"CVE-2024-24856":{"description":"The memory allocation function ACPI_ALLOCATE_ZEROED does not guarantee a successful allocation, but the subsequent code directly dereferences the pointer that receives it, which may lead to null pointer dereference.  To fix this issue, a null pointer check should be added. If it is null,  return exception code AE_NO_MEMORY.","scope":"local","releases":{"bookworm":{"status":"open","repositories":{"bookworm":"20200925-8"},"urgency":"unimportant"},"bullseye":{"status":"open","repositories":{"bullseye":"20200925-1.2"},"urgency":"unimportant"},"forky":{"status":"resolved","repositories":{"forky":"20251212-1"},"fixed_version":"20240827-2","urgency":"unimportant"},"sid":{"status":"resolved","repositories":{"sid":"20251212-1"},"fixed_version":"20240827-2","urgency":"unimportant"},"trixie":{"status":"resolved","repositories":{"trixie":"20250404-1"},"fixed_version":"20240827-2","urgency":"unimportant"}}}},"acpid":{"CVE-2009-0798":{"description":"ACPI Event Daemon (acpid) before 1.0.10 allows remote attackers to cause a denial of service (CPU consumption and connectivity loss) by opening a large number of UNIX sockets without closing them, which triggers an infinite loop.","scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"1:2.0.33-2"},"fixed_version":"1.0.10-1","urgency":"medium"},"bullseye":{"status":"resolved","repositories":{"bullseye":"1:2.0.32-1"},"fixed_version":"1.0.10-1","urgency":"medium"},"forky":{"status":"resolved","repositories":{"forky":"1:2.0.34-1"},"fixed_version":"1.0.10-1","urgency":"medium"},"sid":{"status":"resolved","repositories":{"sid":"1:2.0.34-1"},"fixed_version":"1.0.10-1","urgency":"medium"},"trixie":{"status":"resolved","repositories":{"trixie":"1:2.0.34-1"},"fixed_version":"1.0.10-1","urgency":"medium"}}},"CVE-2009-4033":{"description":"A certain Red Hat patch for acpid 1.0.4 effectively triggers a call to the open function with insufficient arguments, which might allow local users to leverage weak permissions on /var/log/acpid, and obtain sensitive information by reading this file, cause a denial of service by overwriting this file, or gain privileges by executing this file.","scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"1:2.0.33-2"},"fixed_version":"0","urgency":"unimportant"},"bullseye":{"status":"resolved","repositories":{"bullseye":"1:2.0.32-1"},"fixed_version":"0","urgency":"unimportant"},"forky":{"status":"resolved","repositories":{"forky":"1:2.0.34-1"},"fixed_version":"0","urgency":"unimportant"},"sid":{"status":"resolved","repositories":{"sid":"1:2.0.34-1"},"fixed_version":"0","urgency":"unimportant"},"trixie":{"status":"resolved","repositories":{"trixie":"1:2.0.34-1"},"fixed_version":"0","urgency":"unimportant"}}},"CVE-2009-4235":{"description":"acpid 1.0.4 sets an unrestrictive umask, which might allow local users to leverage weak permissions on /var/log/acpid, and obtain sensitive information by reading this file or cause a denial of service by overwriting this file, a different vulnerability than CVE-2009-4033.","debianbug":560771,"scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"1:2.0.33-2"},"fixed_version":"1.0.6","urgency":"low"},"bullseye":{"status":"resolved","repositories":{"bullseye":"1:2.0.32-1"},"fixed_version":"1.0.6","urgency":"low"},"forky":{"status":"resolved","repositories":{"forky":"1:2.0.34-1"},"fixed_version":"1.0.6","urgency":"low"},"sid":{"status":"resolved","repositories":{"sid":"1:2.0.34-1"},"fixed_version":"1.0.6","urgency":"low"},"trixie":{"status":"resolved","repositories":{"trixie":"1:2.0.34-1"},"fixed_version":"1.0.6","urgency":"low"}}},"CVE-2011-1159":{"description":"acpid.c in acpid before 2.0.9 does not properly handle a situation in which a process has connected to acpid.socket but is not reading any data, which allows local users to cause a denial of service (daemon hang) via a crafted application that performs a connect system call but no read system calls.","scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"1:2.0.33-2"},"fixed_version":"1:2.0.9-1","urgency":"not yet assigned"},"bullseye":{"status":"resolved","repositories":{"bullseye":"1:2.0.32-1"},"fixed_version":"1:2.0.9-1","urgency":"not yet assigned"},"forky":{"status":"resolved","repositories":{"forky":"1:2.0.34-1"},"fixed_version":"1:2.0.9-1","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"1:2.0.34-1"},"fixed_version":"1:2.0.9-1","urgency":"not yet assigned"},"trixie":{"status":"resolved","repositories":{"trixie":"1:2.0.34-1"},"fixed_version":"1:2.0.9-1","urgency":"not yet assigned"}}},"CVE-2011-2777":{"description":"samples/powerbtn/powerbtn.sh in acpid (aka acpid2) 2.0.16 and earlier uses the pidof program incorrectly, which allows local users to gain privileges by running a program with the name kded4 and a DBUS_SESSION_BUS_ADDRESS environment variable containing commands.","scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"1:2.0.33-2"},"fixed_version":"1:2.0.14-1","urgency":"not yet assigned"},"bullseye":{"status":"resolved","repositories":{"bullseye":"1:2.0.32-1"},"fixed_version":"1:2.0.14-1","urgency":"not yet assigned"},"forky":{"status":"resolved","repositories":{"forky":"1:2.0.34-1"},"fixed_version":"1:2.0.14-1","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"1:2.0.34-1"},"fixed_version":"1:2.0.14-1","urgency":"not yet assigned"},"trixie":{"status":"resolved","repositories":{"trixie":"1:2.0.34-1"},"fixed_version":"1:2.0.14-1","urgency":"not yet assigned"}}},"CVE-2011-4578":{"description":"event.c in acpid (aka acpid2) before 2.0.11 does not have an appropriate umask setting during execution of event-handler scripts, which might allow local users to (1) perform write operations within directories created by a script, or (2) read files created by a script, via standard filesystem system calls.","scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"1:2.0.33-2"},"fixed_version":"1:2.0.11-1","urgency":"not yet assigned"},"bullseye":{"status":"resolved","repositories":{"bullseye":"1:2.0.32-1"},"fixed_version":"1:2.0.11-1","urgency":"not yet assigned"},"forky":{"status":"resolved","repositories":{"forky":"1:2.0.34-1"},"fixed_version":"1:2.0.11-1","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"1:2.0.34-1"},"fixed_version":"1:2.0.11-1","urgency":"not yet assigned"},"trixie":{"status":"resolved","repositories":{"trixie":"1:2.0.34-1"},"fixed_version":"1:2.0.11-1","urgency":"not yet assigned"}}}},"activemq":{"CVE-2011-4905":{"description":"Apache ActiveMQ before 5.6.0 allows remote attackers to cause a denial of service (file-descriptor exhaustion and broker crash or hang) by sending many openwire failover:tcp:// connection requests.","debianbug":655495,"scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"5.17.2+dfsg-2+deb12u1","bookworm-security":"5.17.2+dfsg-2+deb12u1"},"fixed_version":"5.5.0+dfsg-5","urgency":"not yet assigned"},"bullseye":{"status":"resolved","repositories":{"bullseye":"5.16.1-1","bullseye-security":"5.16.1-1+deb11u2"},"fixed_version":"5.5.0+dfsg-5","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"5.17.6+dfsg-2"},"fixed_version":"5.5.0+dfsg-5","urgency":"not yet assigned"},"trixie":{"status":"resolved","repositories":{"trixie":"5.17.6+dfsg-2"},"fixed_version":"5.5.0+dfsg-5","urgency":"not yet assigned"}}},"CVE-2012-6092":{"description":"Multiple cross-site scripting (XSS) vulnerabilities in the web demos in Apache ActiveMQ before 5.8.0 allow remote attackers to inject arbitrary web script or HTML via (1) the refresh parameter to PortfolioPublishServlet.java (aka demo/portfolioPublish or Market Data Publisher), or vectors involving (2) debug logs or (3) subscribe messages in webapp/websocket/chat.js.  NOTE: AMQ-4124 is covered by CVE-2012-6551.","scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"5.17.2+dfsg-2+deb12u1","bookworm-security":"5.17.2+dfsg-2+deb12u1"},"fixed_version":"0","urgency":"unimportant"},"bullseye":{"status":"resolved","repositories":{"bullseye":"5.16.1-1","bullseye-security":"5.16.1-1+deb11u2"},"fixed_version":"0","urgency":"unimportant"},"sid":{"status":"resolved","repositories":{"sid":"5.17.6+dfsg-2"},"fixed_version":"0","urgency":"unimportant"},"trixie":{"status":"resolved","repositories":{"trixie":"5.17.6+dfsg-2"},"fixed_version":"0","urgency":"unimportant"}}},"CVE-2012-6551":{"description":"The default configuration of Apache ActiveMQ before 5.8.0 enables a sample web application, which allows remote attackers to cause a denial of service (broker resource consumption) via HTTP requests.","scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"5.17.2+dfsg-2+deb12u1","bookworm-security":"5.17.2+dfsg-2+deb12u1"},"fixed_version":"0","urgency":"unimportant"},"bullseye":{"status":"resolved","repositories":{"bullseye":"5.16.1-1","bullseye-security":"5.16.1-1+deb11u2"},"fixed_version":"0","urgency":"unimportant"},"sid":{"status":"resolved","repositories":{"sid":"5.17.6+dfsg-2"},"fixed_version":"0","urgency":"unimportant"},"trixie":{"status":"resolved","repositories":{"trixie":"5.17.6+dfsg-2"},"fixed_version":"0","urgency":"unimportant"}}},"CVE-2013-1879":{"description":"Cross-site scripting (XSS) vulnerability in scheduled.jsp in Apache ActiveMQ 5.8.0 and earlier allows remote attackers to inject arbitrary web script or HTML via vectors involving the \"cron of a message.\"","scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"5.17.2+dfsg-2+deb12u1","bookworm-security":"5.17.2+dfsg-2+deb12u1"},"fixed_version":"0","urgency":"unimportant"},"bullseye":{"status":"resolved","repositories":{"bullseye":"5.16.1-1","bullseye-security":"5.16.1-1+deb11u2"},"fixed_version":"0","urgency":"unimportant"},"sid":{"status":"resolved","repositories":{"sid":"5.17.6+dfsg-2"},"fixed_version":"0","urgency":"unimportant"},"trixie":{"status":"resolved","repositories":{"trixie":"5.17.6+dfsg-2"},"fixed_version":"0","urgency":"unimportant"}}},"CVE-2013-1880":{"description":"Cross-site scripting (XSS) vulnerability in the Portfolio publisher servlet in the demo web application in Apache ActiveMQ before 5.9.0 allows remote attackers to inject arbitrary web script or HTML via the refresh parameter to demo/portfolioPublish, a different vulnerability than CVE-2012-6092.","scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"5.17.2+dfsg-2+deb12u1","bookworm-security":"5.17.2+dfsg-2+deb12u1"},"fixed_version":"0","urgency":"unimportant"},"bullseye":{"status":"resolved","repositories":{"bullseye":"5.16.1-1","bullseye-security":"5.16.1-1+deb11u2"},"fixed_version":"0","urgency":"unimportant"},"sid":{"status":"resolved","repositories":{"sid":"5.17.6+dfsg-2"},"fixed_version":"0","urgency":"unimportant"},"trixie":{"status":"resolved","repositories":{"trixie":"5.17.6+dfsg-2"},"fixed_version":"0","urgency":"unimportant"}}},"CVE-2013-3060":{"description":"The web console in Apache ActiveMQ before 5.8.0 does not require authentication, which allows remote attackers to obtain sensitive information or cause a denial of service via HTTP requests.","scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"5.17.2+dfsg-2+deb12u1","bookworm-security":"5.17.2+dfsg-2+deb12u1"},"fixed_version":"0","urgency":"unimportant"},"bullseye":{"status":"resolved","repositories":{"bullseye":"5.16.1-1","bullseye-security":"5.16.1-1+deb11u2"},"fixed_version":"0","urgency":"unimportant"},"sid":{"status":"resolved","repositories":{"sid":"5.17.6+dfsg-2"},"fixed_version":"0","urgency":"unimportant"},"trixie":{"status":"resolved","repositories":{"trixie":"5.17.6+dfsg-2"},"fixed_version":"0","urgency":"unimportant"}}},"CVE-2014-3576":{"description":"The processControlCommand function in broker/TransportConnection.java in Apache ActiveMQ before 5.11.0 allows remote attackers to cause a denial of service (shutdown) via a shutdown command.","debianbug":792857,"scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"5.17.2+dfsg-2+deb12u1","bookworm-security":"5.17.2+dfsg-2+deb12u1"},"fixed_version":"5.6.0+dfsg1-4+deb8u1","urgency":"not yet assigned"},"bullseye":{"status":"resolved","repositories":{"bullseye":"5.16.1-1","bullseye-security":"5.16.1-1+deb11u2"},"fixed_version":"5.6.0+dfsg1-4+deb8u1","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"5.17.6+dfsg-2"},"fixed_version":"5.6.0+dfsg1-4+deb8u1","urgency":"not yet assigned"},"trixie":{"status":"resolved","repositories":{"trixie":"5.17.6+dfsg-2"},"fixed_version":"5.6.0+dfsg1-4+deb8u1","urgency":"not yet assigned"}}},"CVE-2014-3600":{"description":"XML external entity (XXE) vulnerability in Apache ActiveMQ 5.x before 5.10.1 allows remote consumers to have unspecified impact via vectors involving an XPath based selector when dequeuing XML messages.","debianbug":777196,"scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"5.17.2+dfsg-2+deb12u1","bookworm-security":"5.17.2+dfsg-2+deb12u1"},"fixed_version":"5.6.0+dfsg1-4","urgency":"low"},"bullseye":{"status":"resolved","repositories":{"bullseye":"5.16.1-1","bullseye-security":"5.16.1-1+deb11u2"},"fixed_version":"5.6.0+dfsg1-4","urgency":"low"},"sid":{"status":"resolved","repositories":{"sid":"5.17.6+dfsg-2"},"fixed_version":"5.6.0+dfsg1-4","urgency":"low"},"trixie":{"status":"resolved","repositories":{"trixie":"5.17.6+dfsg-2"},"fixed_version":"5.6.0+dfsg1-4","urgency":"low"}}},"CVE-2014-3612":{"description":"The LDAPLoginModule implementation in the Java Authentication and Authorization Service (JAAS) in Apache ActiveMQ 5.x before 5.10.1 allows remote attackers to bypass authentication by logging in with an empty password and valid username, which triggers an unauthenticated bind. NOTE: this identifier has been SPLIT per ADT2 due to different vulnerability types. See CVE-2015-6524 for the use of wildcard operators in usernames.","debianbug":777196,"scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"5.17.2+dfsg-2+deb12u1","bookworm-security":"5.17.2+dfsg-2+deb12u1"},"fixed_version":"5.6.0+dfsg1-4","urgency":"low"},"bullseye":{"status":"resolved","repositories":{"bullseye":"5.16.1-1","bullseye-security":"5.16.1-1+deb11u2"},"fixed_version":"5.6.0+dfsg1-4","urgency":"low"},"sid":{"status":"resolved","repositories":{"sid":"5.17.6+dfsg-2"},"fixed_version":"5.6.0+dfsg1-4","urgency":"low"},"trixie":{"status":"resolved","repositories":{"trixie":"5.17.6+dfsg-2"},"fixed_version":"5.6.0+dfsg1-4","urgency":"low"}}},"CVE-2014-8110":{"description":"Multiple cross-site scripting (XSS) vulnerabilities in the web based administration console in Apache ActiveMQ 5.x before 5.10.1 allow remote attackers to inject arbitrary web script or HTML via unspecified vectors.","scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"5.17.2+dfsg-2+deb12u1","bookworm-security":"5.17.2+dfsg-2+deb12u1"},"fixed_version":"0","urgency":"unimportant"},"bullseye":{"status":"resolved","repositories":{"bullseye":"5.16.1-1","bullseye-security":"5.16.1-1+deb11u2"},"fixed_version":"0","urgency":"unimportant"},"sid":{"status":"resolved","repositories":{"sid":"5.17.6+dfsg-2"},"fixed_version":"0","urgency":"unimportant"},"trixie":{"status":"resolved","repositories":{"trixie":"5.17.6+dfsg-2"},"fixed_version":"0","urgency":"unimportant"}}},"CVE-2015-1830":{"description":"Directory traversal vulnerability in the fileserver upload/download functionality for blob messages in Apache ActiveMQ 5.x before 5.11.2 for Windows allows remote attackers to create JSP files in arbitrary directories via unspecified vectors.","scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"5.17.2+dfsg-2+deb12u1","bookworm-security":"5.17.2+dfsg-2+deb12u1"},"fixed_version":"0","urgency":"unimportant"},"bullseye":{"status":"resolved","repositories":{"bullseye":"5.16.1-1","bullseye-security":"5.16.1-1+deb11u2"},"fixed_version":"0","urgency":"unimportant"},"sid":{"status":"resolved","repositories":{"sid":"5.17.6+dfsg-2"},"fixed_version":"0","urgency":"unimportant"},"trixie":{"status":"resolved","repositories":{"trixie":"5.17.6+dfsg-2"},"fixed_version":"0","urgency":"unimportant"}}},"CVE-2015-5254":{"description":"Apache ActiveMQ 5.x before 5.13.0 does not restrict the classes that can be serialized in the broker, which allows remote attackers to execute arbitrary code via a crafted serialized Java Message Service (JMS) ObjectMessage object.","debianbug":809733,"scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"5.17.2+dfsg-2+deb12u1","bookworm-security":"5.17.2+dfsg-2+deb12u1"},"fixed_version":"5.13.2+dfsg-1","urgency":"not yet assigned"},"bullseye":{"status":"resolved","repositories":{"bullseye":"5.16.1-1","bullseye-security":"5.16.1-1+deb11u2"},"fixed_version":"5.13.2+dfsg-1","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"5.17.6+dfsg-2"},"fixed_version":"5.13.2+dfsg-1","urgency":"not yet assigned"},"trixie":{"status":"resolved","repositories":{"trixie":"5.17.6+dfsg-2"},"fixed_version":"5.13.2+dfsg-1","urgency":"not yet assigned"}}},"CVE-2015-6524":{"description":"The LDAPLoginModule implementation in the Java Authentication and Authorization Service (JAAS) in Apache ActiveMQ 5.x before 5.10.1 allows wildcard operators in usernames, which allows remote attackers to obtain credentials via a brute force attack. NOTE: this identifier was SPLIT from CVE-2014-3612 per ADT2 due to different vulnerability types.","scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"5.17.2+dfsg-2+deb12u1","bookworm-security":"5.17.2+dfsg-2+deb12u1"},"fixed_version":"5.6.0+dfsg1-4","urgency":"low"},"bullseye":{"status":"resolved","repositories":{"bullseye":"5.16.1-1","bullseye-security":"5.16.1-1+deb11u2"},"fixed_version":"5.6.0+dfsg1-4","urgency":"low"},"sid":{"status":"resolved","repositories":{"sid":"5.17.6+dfsg-2"},"fixed_version":"5.6.0+dfsg1-4","urgency":"low"},"trixie":{"status":"resolved","repositories":{"trixie":"5.17.6+dfsg-2"},"fixed_version":"5.6.0+dfsg1-4","urgency":"low"}}},"CVE-2015-7559":{"description":"It was found that the Apache ActiveMQ client before 5.14.5 exposed a remote shutdown command in the ActiveMQConnection class. An attacker logged into a compromised broker could use this flaw to achieve denial of service on a connected client.","debianbug":860866,"scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"5.17.2+dfsg-2+deb12u1","bookworm-security":"5.17.2+dfsg-2+deb12u1"},"fixed_version":"5.14.3-3","urgency":"not yet assigned"},"bullseye":{"status":"resolved","repositories":{"bullseye":"5.16.1-1","bullseye-security":"5.16.1-1+deb11u2"},"fixed_version":"5.14.3-3","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"5.17.6+dfsg-2"},"fixed_version":"5.14.3-3","urgency":"not yet assigned"},"trixie":{"status":"resolved","repositories":{"trixie":"5.17.6+dfsg-2"},"fixed_version":"5.14.3-3","urgency":"not yet assigned"}}},"CVE-2016-0734":{"description":"The web-based administration console in Apache ActiveMQ 5.x before 5.13.2 does not send an X-Frame-Options HTTP header, which makes it easier for remote attackers to conduct clickjacking attacks via a crafted web page that contains a (1) FRAME or (2) IFRAME element.","scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"5.17.2+dfsg-2+deb12u1","bookworm-security":"5.17.2+dfsg-2+deb12u1"},"fixed_version":"0","urgency":"unimportant"},"bullseye":{"status":"resolved","repositories":{"bullseye":"5.16.1-1","bullseye-security":"5.16.1-1+deb11u2"},"fixed_version":"0","urgency":"unimportant"},"sid":{"status":"resolved","repositories":{"sid":"5.17.6+dfsg-2"},"fixed_version":"0","urgency":"unimportant"},"trixie":{"status":"resolved","repositories":{"trixie":"5.17.6+dfsg-2"},"fixed_version":"0","urgency":"unimportant"}}},"CVE-2016-0782":{"description":"The administration web console in Apache ActiveMQ 5.x before 5.11.4, 5.12.x before 5.12.3, and 5.13.x before 5.13.2 allows remote authenticated users to conduct cross-site scripting (XSS) attacks and consequently obtain sensitive information from a Java memory dump via vectors related to creating a queue.","scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"5.17.2+dfsg-2+deb12u1","bookworm-security":"5.17.2+dfsg-2+deb12u1"},"fixed_version":"5.13.2+dfsg-1","urgency":"unimportant"},"bullseye":{"status":"resolved","repositories":{"bullseye":"5.16.1-1","bullseye-security":"5.16.1-1+deb11u2"},"fixed_version":"5.13.2+dfsg-1","urgency":"unimportant"},"sid":{"status":"resolved","repositories":{"sid":"5.17.6+dfsg-2"},"fixed_version":"5.13.2+dfsg-1","urgency":"unimportant"},"trixie":{"status":"resolved","repositories":{"trixie":"5.17.6+dfsg-2"},"fixed_version":"5.13.2+dfsg-1","urgency":"unimportant"}}},"CVE-2016-3088":{"description":"The Fileserver web application in Apache ActiveMQ 5.x before 5.14.0 allows remote attackers to upload and execute arbitrary files via an HTTP PUT followed by an HTTP MOVE request.","scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"5.17.2+dfsg-2+deb12u1","bookworm-security":"5.17.2+dfsg-2+deb12u1"},"fixed_version":"5.14.0+dfsg-1","urgency":"not yet assigned"},"bullseye":{"status":"resolved","repositories":{"bullseye":"5.16.1-1","bullseye-security":"5.16.1-1+deb11u2"},"fixed_version":"5.14.0+dfsg-1","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"5.17.6+dfsg-2"},"fixed_version":"5.14.0+dfsg-1","urgency":"not yet assigned"},"trixie":{"status":"resolved","repositories":{"trixie":"5.17.6+dfsg-2"},"fixed_version":"5.14.0+dfsg-1","urgency":"not yet assigned"}}},"CVE-2016-6810":{"description":"In Apache ActiveMQ 5.x before 5.14.2, an instance of a cross-site scripting vulnerability was identified to be present in the web based administration console. The root cause of this issue is improper user data output validation.","scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"5.17.2+dfsg-2+deb12u1","bookworm-security":"5.17.2+dfsg-2+deb12u1"},"fixed_version":"5.14.2+dfsg-1","urgency":"unimportant"},"bullseye":{"status":"resolved","repositories":{"bullseye":"5.16.1-1","bullseye-security":"5.16.1-1+deb11u2"},"fixed_version":"5.14.2+dfsg-1","urgency":"unimportant"},"sid":{"status":"resolved","repositories":{"sid":"5.17.6+dfsg-2"},"fixed_version":"5.14.2+dfsg-1","urgency":"unimportant"},"trixie":{"status":"resolved","repositories":{"trixie":"5.17.6+dfsg-2"},"fixed_version":"5.14.2+dfsg-1","urgency":"unimportant"}}},"CVE-2017-15709":{"description":"When using the OpenWire protocol in ActiveMQ versions 5.14.0 to 5.15.2 it was found that certain system details (such as the OS and kernel version) are exposed as plain text.","debianbug":890352,"scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"5.17.2+dfsg-2+deb12u1","bookworm-security":"5.17.2+dfsg-2+deb12u1"},"fixed_version":"5.15.3-1","urgency":"not yet assigned"},"bullseye":{"status":"resolved","repositories":{"bullseye":"5.16.1-1","bullseye-security":"5.16.1-1+deb11u2"},"fixed_version":"5.15.3-1","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"5.17.6+dfsg-2"},"fixed_version":"5.15.3-1","urgency":"not yet assigned"},"trixie":{"status":"resolved","repositories":{"trixie":"5.17.6+dfsg-2"},"fixed_version":"5.15.3-1","urgency":"not yet assigned"}}},"CVE-2018-11775":{"description":"TLS hostname verification when using the Apache ActiveMQ Client before 5.15.6 was missing which could make the client vulnerable to a MITM attack between a Java application using the ActiveMQ client and the ActiveMQ server. This is now enabled by default.","debianbug":908950,"scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"5.17.2+dfsg-2+deb12u1","bookworm-security":"5.17.2+dfsg-2+deb12u1"},"fixed_version":"5.15.6-1","urgency":"low"},"bullseye":{"status":"resolved","repositories":{"bullseye":"5.16.1-1","bullseye-security":"5.16.1-1+deb11u2"},"fixed_version":"5.15.6-1","urgency":"low"},"sid":{"status":"resolved","repositories":{"sid":"5.17.6+dfsg-2"},"fixed_version":"5.15.6-1","urgency":"low"},"trixie":{"status":"resolved","repositories":{"trixie":"5.17.6+dfsg-2"},"fixed_version":"5.15.6-1","urgency":"low"}}},"CVE-2018-8006":{"description":"An instance of a cross-site scripting vulnerability was identified to be present in the web based administration console on the queue.jsp page of Apache ActiveMQ versions 5.0.0 to 5.15.5. The root cause of this issue is improper data filtering of the QueueFilter parameter.","scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"5.17.2+dfsg-2+deb12u1","bookworm-security":"5.17.2+dfsg-2+deb12u1"},"fixed_version":"5.15.6-1","urgency":"unimportant"},"bullseye":{"status":"resolved","repositories":{"bullseye":"5.16.1-1","bullseye-security":"5.16.1-1+deb11u2"},"fixed_version":"5.15.6-1","urgency":"unimportant"},"sid":{"status":"resolved","repositories":{"sid":"5.17.6+dfsg-2"},"fixed_version":"5.15.6-1","urgency":"unimportant"},"trixie":{"status":"resolved","repositories":{"trixie":"5.17.6+dfsg-2"},"fixed_version":"5.15.6-1","urgency":"unimportant"}}},"CVE-2019-0222":{"description":"In Apache ActiveMQ 5.0.0 - 5.15.8, unmarshalling corrupt MQTT frame can lead to broker Out of Memory exception making it unresponsive.","debianbug":925964,"scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"5.17.2+dfsg-2+deb12u1","bookworm-security":"5.17.2+dfsg-2+deb12u1"},"fixed_version":"5.15.9-1","urgency":"unimportant"},"bullseye":{"status":"resolved","repositories":{"bullseye":"5.16.1-1","bullseye-security":"5.16.1-1+deb11u2"},"fixed_version":"5.15.9-1","urgency":"unimportant"},"sid":{"status":"resolved","repositories":{"sid":"5.17.6+dfsg-2"},"fixed_version":"5.15.9-1","urgency":"unimportant"},"trixie":{"status":"resolved","repositories":{"trixie":"5.17.6+dfsg-2"},"fixed_version":"5.15.9-1","urgency":"unimportant"}}},"CVE-2020-11998":{"description":"A regression has been introduced in the commit preventing JMX re-bind. By passing an empty environment map to RMIConnectorServer, instead of the map that contains the authentication credentials, it leaves ActiveMQ open to the following attack: https://docs.oracle.com/javase/8/docs/technotes/guides/management/agent.html \"A remote client could create a javax.management.loading.MLet MBean and use it to create new MBeans from arbitrary URLs, at least if there is no security manager. In other words, a rogue remote client could make your Java application execute arbitrary code.\" Mitigation: Upgrade to Apache ActiveMQ 5.15.13","scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"5.17.2+dfsg-2+deb12u1","bookworm-security":"5.17.2+dfsg-2+deb12u1"},"fixed_version":"0","urgency":"unimportant"},"bullseye":{"status":"resolved","repositories":{"bullseye":"5.16.1-1","bullseye-security":"5.16.1-1+deb11u2"},"fixed_version":"0","urgency":"unimportant"},"sid":{"status":"resolved","repositories":{"sid":"5.17.6+dfsg-2"},"fixed_version":"0","urgency":"unimportant"},"trixie":{"status":"resolved","repositories":{"trixie":"5.17.6+dfsg-2"},"fixed_version":"0","urgency":"unimportant"}}},"CVE-2020-13920":{"description":"Apache ActiveMQ uses LocateRegistry.createRegistry() to create the JMX RMI registry and binds the server to the \"jmxrmi\" entry. It is possible to connect to the registry without authentication and call the rebind method to rebind jmxrmi to something else. If an attacker creates another server to proxy the original, and bound that, he effectively becomes a man in the middle and is able to intercept the credentials when an user connects. Upgrade to Apache ActiveMQ 5.15.12.","scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"5.17.2+dfsg-2+deb12u1","bookworm-security":"5.17.2+dfsg-2+deb12u1"},"fixed_version":"5.16.0-1","urgency":"not yet assigned"},"bullseye":{"status":"resolved","repositories":{"bullseye":"5.16.1-1","bullseye-security":"5.16.1-1+deb11u2"},"fixed_version":"5.16.0-1","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"5.17.6+dfsg-2"},"fixed_version":"5.16.0-1","urgency":"not yet assigned"},"trixie":{"status":"resolved","repositories":{"trixie":"5.17.6+dfsg-2"},"fixed_version":"5.16.0-1","urgency":"not yet assigned"}}},"CVE-2020-13947":{"description":"An instance of a cross-site scripting vulnerability was identified to be present in the web based administration console on the message.jsp page of Apache ActiveMQ versions 5.15.12 through 5.16.0.","scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"5.17.2+dfsg-2+deb12u1","bookworm-security":"5.17.2+dfsg-2+deb12u1"},"fixed_version":"5.16.1-1","urgency":"unimportant"},"bullseye":{"status":"resolved","repositories":{"bullseye":"5.16.1-1","bullseye-security":"5.16.1-1+deb11u2"},"fixed_version":"5.16.1-1","urgency":"unimportant"},"sid":{"status":"resolved","repositories":{"sid":"5.17.6+dfsg-2"},"fixed_version":"5.16.1-1","urgency":"unimportant"},"trixie":{"status":"resolved","repositories":{"trixie":"5.17.6+dfsg-2"},"fixed_version":"5.16.1-1","urgency":"unimportant"}}},"CVE-2020-1941":{"description":"In Apache ActiveMQ 5.0.0 to 5.15.11, the webconsole admin GUI is open to XSS, in the view that lists the contents of a queue.","scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"5.17.2+dfsg-2+deb12u1","bookworm-security":"5.17.2+dfsg-2+deb12u1"},"fixed_version":"5.16.0-1","urgency":"unimportant"},"bullseye":{"status":"resolved","repositories":{"bullseye":"5.16.1-1","bullseye-security":"5.16.1-1+deb11u2"},"fixed_version":"5.16.0-1","urgency":"unimportant"},"sid":{"status":"resolved","repositories":{"sid":"5.17.6+dfsg-2"},"fixed_version":"5.16.0-1","urgency":"unimportant"},"trixie":{"status":"resolved","repositories":{"trixie":"5.17.6+dfsg-2"},"fixed_version":"5.16.0-1","urgency":"unimportant"}}},"CVE-2021-26117":{"description":"The optional ActiveMQ LDAP login module can be configured to use anonymous access to the LDAP server. In this case, for Apache ActiveMQ Artemis prior to version 2.16.0 and Apache ActiveMQ prior to versions 5.16.1 and 5.15.14, the anonymous context is used to verify a valid users password in error, resulting in no check on the password.","debianbug":982590,"scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"5.17.2+dfsg-2+deb12u1","bookworm-security":"5.17.2+dfsg-2+deb12u1"},"fixed_version":"5.16.1-1","urgency":"not yet assigned"},"bullseye":{"status":"resolved","repositories":{"bullseye":"5.16.1-1","bullseye-security":"5.16.1-1+deb11u2"},"fixed_version":"5.16.1-1","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"5.17.6+dfsg-2"},"fixed_version":"5.16.1-1","urgency":"not yet assigned"},"trixie":{"status":"resolved","repositories":{"trixie":"5.17.6+dfsg-2"},"fixed_version":"5.16.1-1","urgency":"not yet assigned"}}},"CVE-2022-41678":{"description":"Once an user is authenticated on Jolokia, he can potentially trigger arbitrary code execution.\u00a0  In details, in ActiveMQ configurations, jetty allows org.jolokia.http.AgentServlet to handler request to /api/jolokia  org.jolokia.http.HttpRequestHandler#handlePostRequest is able to create JmxRequest through JSONObject. And calls to org.jolokia.http.HttpRequestHandler#executeRequest.  Into deeper calling stacks, org.jolokia.handler.ExecHandler#doHandleRequest can be invoked through refection. This could lead to RCE through via various mbeans. One example is unrestricted deserialization in jdk.management.jfr.FlightRecorderMXBeanImpl which exists on Java version above 11.  1 Call newRecording.  2 Call setConfiguration. And a webshell data hides in it.  3 Call startRecording.  4 Call copyTo method. The webshell will be written to a .jsp file.  The mitigation is to restrict (by default) the actions authorized on Jolokia, or disable Jolokia. A more restrictive Jolokia configuration has been defined in default ActiveMQ distribution. We encourage users to upgrade to ActiveMQ distributions version including updated Jolokia configuration: 5.16.6, 5.17.4, 5.18.0, 6.0.0.","scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"5.17.2+dfsg-2+deb12u1","bookworm-security":"5.17.2+dfsg-2+deb12u1"},"fixed_version":"5.17.2+dfsg-2+deb12u1","urgency":"not yet assigned"},"bullseye":{"status":"resolved","repositories":{"bullseye":"5.16.1-1","bullseye-security":"5.16.1-1+deb11u2"},"fixed_version":"5.16.1-1+deb11u1","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"5.17.6+dfsg-2"},"fixed_version":"5.17.6+dfsg-1","urgency":"unimportant"},"trixie":{"status":"resolved","repositories":{"trixie":"5.17.6+dfsg-2"},"fixed_version":"5.17.6+dfsg-1","urgency":"unimportant"}}},"CVE-2023-46604":{"description":"The Java OpenWire protocol marshaller is vulnerable to Remote Code  Execution. This vulnerability may allow a remote attacker with network  access to either a Java-based OpenWire broker or client to run arbitrary  shell commands by manipulating serialized class types in the OpenWire  protocol to cause either the client or the broker (respectively) to  instantiate any class on the classpath.  Users are recommended to upgrade  both brokers and clients to version 5.15.16, 5.16.7, 5.17.6, or 5.18.3  which fixes this issue.","debianbug":1054909,"scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"5.17.2+dfsg-2+deb12u1","bookworm-security":"5.17.2+dfsg-2+deb12u1"},"fixed_version":"5.17.2+dfsg-2+deb12u1","urgency":"not yet assigned"},"bullseye":{"status":"resolved","repositories":{"bullseye":"5.16.1-1","bullseye-security":"5.16.1-1+deb11u2"},"fixed_version":"5.16.1-1+deb11u1","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"5.17.6+dfsg-2"},"fixed_version":"5.17.6+dfsg-1","urgency":"not yet assigned"},"trixie":{"status":"resolved","repositories":{"trixie":"5.17.6+dfsg-2"},"fixed_version":"5.17.6+dfsg-1","urgency":"not yet assigned"}}},"CVE-2024-32114":{"description":"In Apache ActiveMQ 6.x, the default configuration doesn't secure the API web context (where the Jolokia JMX REST API and the Message REST API are located). It means that anyone can use these layers without any required authentication. Potentially, anyone can interact with the broker (using Jolokia JMX REST API) and/or produce/consume messages or purge/delete destinations (using the Message REST API).  To mitigate, users can update the default conf/jetty.xml configuration file to add authentication requirement: <bean id=\"securityConstraintMapping\" class=\"org.eclipse.jetty.security.ConstraintMapping\"> \u00a0 <property name=\"constraint\" ref=\"securityConstraint\" /> \u00a0 <property name=\"pathSpec\" value=\"/\" /> </bean>  Or we encourage users to upgrade to Apache ActiveMQ 6.1.2 where the default configuration has been updated with authentication by default.","scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"5.17.2+dfsg-2+deb12u1","bookworm-security":"5.17.2+dfsg-2+deb12u1"},"fixed_version":"0","urgency":"unimportant"},"bullseye":{"status":"resolved","repositories":{"bullseye":"5.16.1-1","bullseye-security":"5.16.1-1+deb11u2"},"fixed_version":"0","urgency":"unimportant"},"sid":{"status":"resolved","repositories":{"sid":"5.17.6+dfsg-2"},"fixed_version":"0","urgency":"unimportant"},"trixie":{"status":"resolved","repositories":{"trixie":"5.17.6+dfsg-2"},"fixed_version":"0","urgency":"unimportant"}}},"CVE-2025-27533":{"description":"Memory Allocation with Excessive Size Value vulnerability in Apache ActiveMQ.  During unmarshalling of OpenWire commands the size value of buffers was not properly validated which could lead to excessive memory allocation and be exploited to cause a denial of service (DoS) by depleting process memory, thereby affecting applications and services that rely on the availability of the ActiveMQ broker when not using mutual TLS connections. This issue affects Apache ActiveMQ: from 6.0.0 before 6.1.6, from 5.18.0 before 5.18.7, from 5.17.0 before 5.17.7, before 5.16.8. ActiveMQ 5.19.0 is not affected.  Users are recommended to upgrade to version 6.1.6+, 5.19.0+,  5.18.7+, 5.17.7, or 5.16.8 or which fixes the issue.  Existing users may implement mutual TLS to mitigate the risk on affected brokers.","debianbug":1104933,"scope":"local","releases":{"bookworm":{"status":"open","repositories":{"bookworm":"5.17.2+dfsg-2+deb12u1","bookworm-security":"5.17.2+dfsg-2+deb12u1"},"urgency":"not yet assigned"},"bullseye":{"status":"resolved","repositories":{"bullseye":"5.16.1-1","bullseye-security":"5.16.1-1+deb11u2"},"fixed_version":"5.16.1-1+deb11u2","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"5.17.6+dfsg-2"},"fixed_version":"5.17.6+dfsg-2","urgency":"not yet assigned"},"trixie":{"status":"resolved","repositories":{"trixie":"5.17.6+dfsg-2"},"fixed_version":"5.17.6+dfsg-2","urgency":"not yet assigned"}}},"CVE-2025-66168":{"description":"Apache ActiveMQ does not properly validate the remaining length field which may lead to an overflow during the decoding of malformed packets.\u00a0When this integer overflow occurs, ActiveMQ may incorrectly compute the total Remaining Length and subsequently misinterpret the payload as multiple MQTT control packets which makes\u00a0the broker susceptible to unexpected behavior when interacting with non-compliant clients.\u00a0This behavior violates the MQTT v3.1.1 specification, which restricts Remaining Length to a maximum of 4 bytes.\u00a0The scenario occurs on established connections after the authentication process. Brokers that are not enabling mqtt transport connectors are not impacted.  This issue affects Apache ActiveMQ: before 5.19.2, 6.0.0 to 6.1.8, and 6.2.0  Users are recommended to upgrade to version 5.19.2, 6.1.9, or 6.2.1, which fixes the issue.","scope":"local","releases":{"bookworm":{"status":"open","repositories":{"bookworm":"5.17.2+dfsg-2+deb12u1","bookworm-security":"5.17.2+dfsg-2+deb12u1"},"urgency":"not yet assigned"},"bullseye":{"status":"open","repositories":{"bullseye":"5.16.1-1","bullseye-security":"5.16.1-1+deb11u2"},"urgency":"not yet assigned"},"sid":{"status":"open","repositories":{"sid":"5.17.6+dfsg-2"},"urgency":"not yet assigned"},"trixie":{"status":"open","repositories":{"trixie":"5.17.6+dfsg-2"},"urgency":"not yet assigned"}}}},"adduser":{"TEMP-0331720-9168FE":{"debianbug":331720,"releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"3.134"},"fixed_version":"3.77","urgency":"low"},"bullseye":{"status":"resolved","repositories":{"bullseye":"3.118+deb11u1"},"fixed_version":"3.77","urgency":"low"},"forky":{"status":"resolved","repositories":{"forky":"3.154"},"fixed_version":"3.77","urgency":"low"},"sid":{"status":"resolved","repositories":{"sid":"3.154"},"fixed_version":"3.77","urgency":"low"},"trixie":{"status":"resolved","repositories":{"trixie":"3.152"},"fixed_version":"3.77","urgency":"low"}}}},"adequate":{"CVE-2013-6409":{"description":"Debian adequate before 0.8.1, when run by root with the --user option, allows local users to hijack the tty and possibly gain privileges via the TIOCSTI ioctl.","debianbug":730691,"scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"0.15.9~deb12u1"},"fixed_version":"0.8.1","urgency":"not yet assigned"},"bullseye":{"status":"resolved","repositories":{"bullseye":"0.15.6"},"fixed_version":"0.8.1","urgency":"not yet assigned"},"forky":{"status":"resolved","repositories":{"forky":"0.17.6"},"fixed_version":"0.8.1","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"0.17.6"},"fixed_version":"0.8.1","urgency":"not yet assigned"},"trixie":{"status":"resolved","repositories":{"trixie":"0.17.5"},"fixed_version":"0.8.1","urgency":"not yet assigned"}}}},"admesh":{"CVE-2018-25033":{"description":"ADMesh through 0.98.4 has a heap-based buffer over-read in stl_update_connects_remove_1 (called from stl_remove_degenerate) in connect.c in libadmesh.a.","debianbug":1010770,"scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"0.98.4-2"},"fixed_version":"0.98.4-2","urgency":"not yet assigned"},"bullseye":{"status":"open","repositories":{"bullseye":"0.98.4-1"},"urgency":"not yet assigned","nodsa":"Minor issue; can be fixed via point release","nodsa_reason":""},"forky":{"status":"resolved","repositories":{"forky":"0.98.5-1"},"fixed_version":"0.98.4-2","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"0.98.5-1"},"fixed_version":"0.98.4-2","urgency":"not yet assigned"},"trixie":{"status":"resolved","repositories":{"trixie":"0.98.5-1"},"fixed_version":"0.98.4-2","urgency":"not yet assigned"}}},"CVE-2022-38072":{"description":"An improper array index validation vulnerability exists in the stl_fix_normal_directions functionality of ADMesh Master Commit 767a105 and v0.98.4. A specially-crafted stl file can lead to a heap buffer overflow. An attacker can provide a malicious file to trigger this vulnerability.","scope":"local","releases":{"bookworm":{"status":"open","repositories":{"bookworm":"0.98.4-2"},"urgency":"not yet assigned","nodsa":"Minor issue","nodsa_reason":""},"bullseye":{"status":"open","repositories":{"bullseye":"0.98.4-1"},"urgency":"not yet assigned","nodsa":"Minor issue","nodsa_reason":"postponed"},"forky":{"status":"resolved","repositories":{"forky":"0.98.5-1"},"fixed_version":"0.98.5-1","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"0.98.5-1"},"fixed_version":"0.98.5-1","urgency":"not yet assigned"},"trixie":{"status":"resolved","repositories":{"trixie":"0.98.5-1"},"fixed_version":"0.98.5-1","urgency":"not yet assigned"}}},"CVE-2026-2653":{"description":"A security flaw has been discovered in admesh up to 0.98.5. This issue affects the function stl_check_normal_vector of the file src/normals.c. Performing a manipulation results in heap-based buffer overflow. The attack must be initiated from a local position. The exploit has been released to the public and may be used for attacks. It looks like this product is not really maintained anymore.","debianbug":1128613,"scope":"local","releases":{"bookworm":{"status":"open","repositories":{"bookworm":"0.98.4-2"},"urgency":"not yet assigned","nodsa":"Minor issue","nodsa_reason":""},"bullseye":{"status":"open","repositories":{"bullseye":"0.98.4-1"},"urgency":"not yet assigned","nodsa":"Minor issue","nodsa_reason":"postponed"},"forky":{"status":"open","repositories":{"forky":"0.98.5-1"},"urgency":"not yet assigned"},"sid":{"status":"open","repositories":{"sid":"0.98.5-1"},"urgency":"not yet assigned"},"trixie":{"status":"open","repositories":{"trixie":"0.98.5-1"},"urgency":"not yet assigned","nodsa":"Minor issue","nodsa_reason":""}}}},"adminer":{"CVE-2018-7667":{"description":"Adminer through 4.3.1 has SSRF via the server parameter.","debianbug":893668,"scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"4.8.1-1"},"fixed_version":"4.5.0-1","urgency":"not yet assigned"},"bullseye":{"status":"resolved","repositories":{"bullseye":"4.7.9-2"},"fixed_version":"4.5.0-1","urgency":"not yet assigned"},"forky":{"status":"resolved","repositories":{"forky":"5.4.2+dfsg-1"},"fixed_version":"4.5.0-1","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"5.4.2+dfsg-1"},"fixed_version":"4.5.0-1","urgency":"not yet assigned"},"trixie":{"status":"resolved","repositories":{"trixie":"5.2.1+dfsg-1"},"fixed_version":"4.5.0-1","urgency":"not yet assigned"}}},"CVE-2020-35572":{"description":"Adminer through 4.7.8 allows XSS via the history parameter to the default URI.","scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"4.8.1-1"},"fixed_version":"4.7.9-1","urgency":"not yet assigned"},"bullseye":{"status":"resolved","repositories":{"bullseye":"4.7.9-2"},"fixed_version":"4.7.9-1","urgency":"not yet assigned"},"forky":{"status":"resolved","repositories":{"forky":"5.4.2+dfsg-1"},"fixed_version":"4.7.9-1","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"5.4.2+dfsg-1"},"fixed_version":"4.7.9-1","urgency":"not yet assigned"},"trixie":{"status":"resolved","repositories":{"trixie":"5.2.1+dfsg-1"},"fixed_version":"4.7.9-1","urgency":"not yet assigned"}}},"CVE-2021-21311":{"description":"Adminer is an open-source database management in a single PHP file. In adminer from version 4.0.0 and before 4.7.9 there is a server-side request forgery vulnerability. Users of Adminer versions bundling all drivers (e.g. `adminer.php`) are affected. This is fixed in version 4.7.9.","scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"4.8.1-1"},"fixed_version":"4.7.9-1","urgency":"not yet assigned"},"bullseye":{"status":"resolved","repositories":{"bullseye":"4.7.9-2"},"fixed_version":"4.7.9-1","urgency":"not yet assigned"},"forky":{"status":"resolved","repositories":{"forky":"5.4.2+dfsg-1"},"fixed_version":"4.7.9-1","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"5.4.2+dfsg-1"},"fixed_version":"4.7.9-1","urgency":"not yet assigned"},"trixie":{"status":"resolved","repositories":{"trixie":"5.2.1+dfsg-1"},"fixed_version":"4.7.9-1","urgency":"not yet assigned"}}},"CVE-2021-29625":{"description":"Adminer is open-source database management software. A cross-site scripting vulnerability in Adminer versions 4.6.1 to 4.8.0 affects users of MySQL, MariaDB, PgSQL and SQLite. XSS is in most cases prevented by strict CSP in all modern browsers. The only exception is when Adminer is using a `pdo_` extension to communicate with the database (it is used if the native extensions are not enabled). In browsers without CSP, Adminer versions 4.6.1 to 4.8.0 are affected. The vulnerability is patched in version 4.8.1. As workarounds, one can use a browser supporting strict CSP or enable the native PHP extensions (e.g. `mysqli`) or disable displaying PHP errors (`display_errors`).","debianbug":988886,"scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"4.8.1-1"},"fixed_version":"4.7.9-2","urgency":"not yet assigned"},"bullseye":{"status":"resolved","repositories":{"bullseye":"4.7.9-2"},"fixed_version":"4.7.9-2","urgency":"not yet assigned"},"forky":{"status":"resolved","repositories":{"forky":"5.4.2+dfsg-1"},"fixed_version":"4.7.9-2","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"5.4.2+dfsg-1"},"fixed_version":"4.7.9-2","urgency":"not yet assigned"},"trixie":{"status":"resolved","repositories":{"trixie":"5.2.1+dfsg-1"},"fixed_version":"4.7.9-2","urgency":"not yet assigned"}}},"CVE-2021-43008":{"description":"Improper Access Control in Adminer versions 1.12.0 to 4.6.2 (fixed in version 4.6.3) allows an attacker to achieve Arbitrary File Read on the remote server by requesting the Adminer to connect to a remote MySQL database.","scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"4.8.1-1"},"fixed_version":"4.6.3-1","urgency":"not yet assigned"},"bullseye":{"status":"resolved","repositories":{"bullseye":"4.7.9-2"},"fixed_version":"4.6.3-1","urgency":"not yet assigned"},"forky":{"status":"resolved","repositories":{"forky":"5.4.2+dfsg-1"},"fixed_version":"4.6.3-1","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"5.4.2+dfsg-1"},"fixed_version":"4.6.3-1","urgency":"not yet assigned"},"trixie":{"status":"resolved","repositories":{"trixie":"5.2.1+dfsg-1"},"fixed_version":"4.6.3-1","urgency":"not yet assigned"}}},"CVE-2023-45195":{"description":"Adminer and AdminerEvo are vulnerable to SSRF via database connection fields. This could allow an unauthenticated remote attacker to enumerate or access systems the attacker would not otherwise have access to.\u00a0Adminer is no longer supported, but this issue was fixed in AdminerEvo version 4.8.4.","debianbug":1074430,"scope":"local","releases":{"bookworm":{"status":"open","repositories":{"bookworm":"4.8.1-1"},"urgency":"not yet assigned","nodsa":"Minor issue","nodsa_reason":""},"bullseye":{"status":"open","repositories":{"bullseye":"4.7.9-2"},"urgency":"not yet assigned","nodsa":"Minor issue","nodsa_reason":""},"forky":{"status":"resolved","repositories":{"forky":"5.4.2+dfsg-1"},"fixed_version":"4.8.1-4","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"5.4.2+dfsg-1"},"fixed_version":"4.8.1-4","urgency":"not yet assigned"},"trixie":{"status":"resolved","repositories":{"trixie":"5.2.1+dfsg-1"},"fixed_version":"4.8.1-4","urgency":"not yet assigned"}}},"CVE-2023-45196":{"description":"Adminer and AdminerEvo allow an unauthenticated remote attacker to cause a denial of service by connecting to an attacker-controlled service that responds with HTTP redirects. The denial of service is subject to PHP configuration limits.\u00a0Adminer is no longer supported, but this issue was fixed in AdminerEvo version 4.8.4.","debianbug":1074430,"scope":"local","releases":{"bookworm":{"status":"open","repositories":{"bookworm":"4.8.1-1"},"urgency":"not yet assigned","nodsa":"Minor issue","nodsa_reason":""},"bullseye":{"status":"open","repositories":{"bullseye":"4.7.9-2"},"urgency":"not yet assigned","nodsa":"Minor issue","nodsa_reason":""},"forky":{"status":"resolved","repositories":{"forky":"5.4.2+dfsg-1"},"fixed_version":"4.8.1-4","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"5.4.2+dfsg-1"},"fixed_version":"4.8.1-4","urgency":"not yet assigned"},"trixie":{"status":"resolved","repositories":{"trixie":"5.2.1+dfsg-1"},"fixed_version":"4.8.1-4","urgency":"not yet assigned"}}},"CVE-2025-43960":{"description":"Adminer 4.8.1, when using Monolog for logging, allows a Denial of Service (memory consumption) via a crafted serialized payload (e.g., using s:1000000000), leading to a PHP Object Injection issue. Remote, unauthenticated attackers can trigger this by sending a malicious serialized object, which forces excessive memory usage, rendering Adminer\u2019s interface unresponsive and causing a server-level DoS. While the server may recover after several minutes, multiple simultaneous requests can cause a complete crash requiring manual intervention.","scope":"local","releases":{"bookworm":{"status":"open","repositories":{"bookworm":"4.8.1-1"},"urgency":"unimportant"},"bullseye":{"status":"open","repositories":{"bullseye":"4.7.9-2"},"urgency":"unimportant"},"forky":{"status":"open","repositories":{"forky":"5.4.2+dfsg-1"},"urgency":"unimportant"},"sid":{"status":"open","repositories":{"sid":"5.4.2+dfsg-1"},"urgency":"unimportant"},"trixie":{"status":"open","repositories":{"trixie":"5.2.1+dfsg-1"},"urgency":"unimportant"}}},"CVE-2026-25892":{"description":"Adminer is open-source database management software. Adminer v5.4.1 and earlier has a version check mechanism where adminer.org sends signed version info via JavaScript postMessage, which the browser then POSTs to ?script=version. This endpoint lacks origin validation and accepts POST data from any source. An attacker can POST version[] parameter which PHP converts to an array. On next page load, openssl_verify() receives this array instead of string and throws TypeError, returning HTTP 500 to all users. Upgrade to Adminer 5.4.2.","scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"4.8.1-1"},"fixed_version":"0","urgency":"unimportant"},"bullseye":{"status":"resolved","repositories":{"bullseye":"4.7.9-2"},"fixed_version":"0","urgency":"unimportant"},"forky":{"status":"resolved","repositories":{"forky":"5.4.2+dfsg-1"},"fixed_version":"0","urgency":"unimportant"},"sid":{"status":"resolved","repositories":{"sid":"5.4.2+dfsg-1"},"fixed_version":"0","urgency":"unimportant"},"trixie":{"status":"resolved","repositories":{"trixie":"5.2.1+dfsg-1"},"fixed_version":"0","urgency":"unimportant"}}}},"adns":{"CVE-2008-1447":{"description":"The DNS protocol, as implemented in (1) BIND 8 and 9 before 9.5.0-P1, 9.4.2-P1, and 9.3.5-P1; (2) Microsoft DNS in Windows 2000 SP4, XP SP2 and SP3, and Server 2003 SP1 and SP2; and other implementations allow remote attackers to spoof DNS traffic via a birthday attack that uses in-bailiwick referrals to conduct cache poisoning against recursive resolvers, related to insufficient randomness of DNS transaction IDs and source ports, aka \"DNS Insufficient Socket Entropy Vulnerability\" or \"the Kaminsky bug.\"","debianbug":492698,"scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"1.6.0-2"},"fixed_version":"1.4-2","urgency":"unimportant"},"bullseye":{"status":"resolved","repositories":{"bullseye":"1.6.0-2"},"fixed_version":"1.4-2","urgency":"unimportant"},"forky":{"status":"resolved","repositories":{"forky":"1.6.1-1"},"fixed_version":"1.4-2","urgency":"unimportant"},"sid":{"status":"resolved","repositories":{"sid":"1.6.1-1"},"fixed_version":"1.4-2","urgency":"unimportant"},"trixie":{"status":"resolved","repositories":{"trixie":"1.6.1-1"},"fixed_version":"1.4-2","urgency":"unimportant"}}},"CVE-2008-4100":{"description":"GNU adns 1.4 and earlier uses a fixed source port and sequential transaction IDs for DNS requests, which makes it easier for remote attackers to spoof DNS responses, a different vulnerability than CVE-2008-1447.  NOTE: the vendor reports that this is intended behavior and is compatible with the product's intended role in a trusted environment.","debianbug":492698,"scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"1.6.0-2"},"fixed_version":"1.4-2","urgency":"unimportant"},"bullseye":{"status":"resolved","repositories":{"bullseye":"1.6.0-2"},"fixed_version":"1.4-2","urgency":"unimportant"},"forky":{"status":"resolved","repositories":{"forky":"1.6.1-1"},"fixed_version":"1.4-2","urgency":"unimportant"},"sid":{"status":"resolved","repositories":{"sid":"1.6.1-1"},"fixed_version":"1.4-2","urgency":"unimportant"},"trixie":{"status":"resolved","repositories":{"trixie":"1.6.1-1"},"fixed_version":"1.4-2","urgency":"unimportant"}}},"CVE-2017-9103":{"description":"An issue was discovered in adns before 1.5.2. pap_mailbox822 does not properly check st from adns__findlabel_next. Without this, an uninitialised stack value can be used as the first label length. Depending on the circumstances, an attacker might be able to trick adns into crashing the calling program, leaking aspects of the contents of some of its memory, causing it to allocate lots of memory, or perhaps overrunning a buffer. This is only possible with applications which make non-raw queries for SOA or RP records.","scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"1.6.0-2"},"fixed_version":"1.6.0-2","urgency":"unimportant"},"bullseye":{"status":"resolved","repositories":{"bullseye":"1.6.0-2"},"fixed_version":"1.6.0-2","urgency":"unimportant"},"forky":{"status":"resolved","repositories":{"forky":"1.6.1-1"},"fixed_version":"1.6.0-2","urgency":"unimportant"},"sid":{"status":"resolved","repositories":{"sid":"1.6.1-1"},"fixed_version":"1.6.0-2","urgency":"unimportant"},"trixie":{"status":"resolved","repositories":{"trixie":"1.6.1-1"},"fixed_version":"1.6.0-2","urgency":"unimportant"}}},"CVE-2017-9104":{"description":"An issue was discovered in adns before 1.5.2. It hangs, eating CPU, if a compression pointer loop is encountered.","scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"1.6.0-2"},"fixed_version":"1.6.0-2","urgency":"unimportant"},"bullseye":{"status":"resolved","repositories":{"bullseye":"1.6.0-2"},"fixed_version":"1.6.0-2","urgency":"unimportant"},"forky":{"status":"resolved","repositories":{"forky":"1.6.1-1"},"fixed_version":"1.6.0-2","urgency":"unimportant"},"sid":{"status":"resolved","repositories":{"sid":"1.6.1-1"},"fixed_version":"1.6.0-2","urgency":"unimportant"},"trixie":{"status":"resolved","repositories":{"trixie":"1.6.1-1"},"fixed_version":"1.6.0-2","urgency":"unimportant"}}},"CVE-2017-9105":{"description":"An issue was discovered in adns before 1.5.2. It corrupts a pointer when a nameserver speaks first because of a wrong number of pointer dereferences. This bug may well be exploitable as a remote code execution.","scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"1.6.0-2"},"fixed_version":"1.6.0-2","urgency":"unimportant"},"bullseye":{"status":"resolved","repositories":{"bullseye":"1.6.0-2"},"fixed_version":"1.6.0-2","urgency":"unimportant"},"forky":{"status":"resolved","repositories":{"forky":"1.6.1-1"},"fixed_version":"1.6.0-2","urgency":"unimportant"},"sid":{"status":"resolved","repositories":{"sid":"1.6.1-1"},"fixed_version":"1.6.0-2","urgency":"unimportant"},"trixie":{"status":"resolved","repositories":{"trixie":"1.6.1-1"},"fixed_version":"1.6.0-2","urgency":"unimportant"}}},"CVE-2017-9106":{"description":"An issue was discovered in adns before 1.5.2. adns_rr_info mishandles a bogus *datap. The general pattern for formatting integers is to sprintf into a fixed-size buffer. This is correct if the input is in the right range; if it isn't, the buffer may be overrun (depending on the sizes of the types on the current platform). Of course the inputs ought to be right. And there are pointers in there too, so perhaps one could say that the caller ought to check these things. It may be better to require the caller to make the pointer structure right, but to have the code here be defensive about (and tolerate with an error but without crashing) out-of-range integer values. So: it should defend each of these integer conversion sites with a check for the actual permitted range, and return adns_s_invaliddata if not. The lack of this check causes the SOA sign extension bug to be a serious security problem: the sign extended SOA value is out of range, and overruns the buffer when reconverted. This is related to sign extending SOA 32-bit integer fields, and use of a signed data type.","scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"1.6.0-2"},"fixed_version":"1.6.0-2","urgency":"unimportant"},"bullseye":{"status":"resolved","repositories":{"bullseye":"1.6.0-2"},"fixed_version":"1.6.0-2","urgency":"unimportant"},"forky":{"status":"resolved","repositories":{"forky":"1.6.1-1"},"fixed_version":"1.6.0-2","urgency":"unimportant"},"sid":{"status":"resolved","repositories":{"sid":"1.6.1-1"},"fixed_version":"1.6.0-2","urgency":"unimportant"},"trixie":{"status":"resolved","repositories":{"trixie":"1.6.1-1"},"fixed_version":"1.6.0-2","urgency":"unimportant"}}},"CVE-2017-9107":{"description":"An issue was discovered in adns before 1.5.2. It overruns reading a buffer if a domain ends with backslash. If the query domain ended with \\, and adns_qf_quoteok_query was specified, qdparselabel would read additional bytes from the buffer and try to treat them as the escape sequence. It would depart the input buffer and start processing many bytes of arbitrary heap data as if it were the query domain. Eventually it would run out of input or find some other kind of error, and declare the query domain invalid. But before then it might outrun available memory and crash. In principle this could be a denial of service attack.","scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"1.6.0-2"},"fixed_version":"1.6.0-2","urgency":"unimportant"},"bullseye":{"status":"resolved","repositories":{"bullseye":"1.6.0-2"},"fixed_version":"1.6.0-2","urgency":"unimportant"},"forky":{"status":"resolved","repositories":{"forky":"1.6.1-1"},"fixed_version":"1.6.0-2","urgency":"unimportant"},"sid":{"status":"resolved","repositories":{"sid":"1.6.1-1"},"fixed_version":"1.6.0-2","urgency":"unimportant"},"trixie":{"status":"resolved","repositories":{"trixie":"1.6.1-1"},"fixed_version":"1.6.0-2","urgency":"unimportant"}}},"CVE-2017-9108":{"description":"An issue was discovered in adns before 1.5.2. adnshost mishandles a missing final newline on a stdin read. It is wrong to increment used as well as setting r, since used is incremented according to r, later. Rather one should be doing what read() would have done. Without this fix, adnshost may read and process one byte beyond the buffer, perhaps crashing or perhaps somehow leaking the value of that byte.","scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"1.6.0-2"},"fixed_version":"1.6.0-2","urgency":"unimportant"},"bullseye":{"status":"resolved","repositories":{"bullseye":"1.6.0-2"},"fixed_version":"1.6.0-2","urgency":"unimportant"},"forky":{"status":"resolved","repositories":{"forky":"1.6.1-1"},"fixed_version":"1.6.0-2","urgency":"unimportant"},"sid":{"status":"resolved","repositories":{"sid":"1.6.1-1"},"fixed_version":"1.6.0-2","urgency":"unimportant"},"trixie":{"status":"resolved","repositories":{"trixie":"1.6.1-1"},"fixed_version":"1.6.0-2","urgency":"unimportant"}}},"CVE-2017-9109":{"description":"An issue was discovered in adns before 1.5.2. It fails to ignore apparent answers before the first RR that was found the first time. when this is fixed, the second answer scan finds the same RRs at the first. Otherwise, adns can be confused by interleaving answers for the CNAME target, with the CNAME itself. In that case the answer data structure (on the heap) can be overrun. With this fixed, it prefers to look only at the answer RRs which come after the CNAME, which is at least arguably correct.","scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"1.6.0-2"},"fixed_version":"1.6.0-2","urgency":"unimportant"},"bullseye":{"status":"resolved","repositories":{"bullseye":"1.6.0-2"},"fixed_version":"1.6.0-2","urgency":"unimportant"},"forky":{"status":"resolved","repositories":{"forky":"1.6.1-1"},"fixed_version":"1.6.0-2","urgency":"unimportant"},"sid":{"status":"resolved","repositories":{"sid":"1.6.1-1"},"fixed_version":"1.6.0-2","urgency":"unimportant"},"trixie":{"status":"resolved","repositories":{"trixie":"1.6.1-1"},"fixed_version":"1.6.0-2","urgency":"unimportant"}}}},"adplug":{"CVE-2006-3581":{"description":"Multiple stack-based buffer overflows in Audacious AdPlug 2.0 and earlier allow remote user-assisted attackers to execute arbitrary code via large (1) DTM and (2) S3M files.","debianbug":378279,"scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"2.3.3+dfsg-2"},"fixed_version":"2.0.1-1","urgency":"medium"},"bullseye":{"status":"resolved","repositories":{"bullseye":"2.3.3+dfsg-2"},"fixed_version":"2.0.1-1","urgency":"medium"},"forky":{"status":"resolved","repositories":{"forky":"2.4+dfsg-2"},"fixed_version":"2.0.1-1","urgency":"medium"},"sid":{"status":"resolved","repositories":{"sid":"2.4+dfsg-2"},"fixed_version":"2.0.1-1","urgency":"medium"},"trixie":{"status":"resolved","repositories":{"trixie":"2.3.3+dfsg-2"},"fixed_version":"2.0.1-1","urgency":"medium"}}},"CVE-2006-3582":{"description":"Multiple heap-based buffer overflows in Audacious AdPlug 2.0 and earlier allow remote user-assisted attackers to execute arbitrary code via the size specified in the package header of (1) CFF, (2) MTK, (3) DMO, and (4) U6M files.","debianbug":378279,"scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"2.3.3+dfsg-2"},"fixed_version":"2.0.1-1","urgency":"medium"},"bullseye":{"status":"resolved","repositories":{"bullseye":"2.3.3+dfsg-2"},"fixed_version":"2.0.1-1","urgency":"medium"},"forky":{"status":"resolved","repositories":{"forky":"2.4+dfsg-2"},"fixed_version":"2.0.1-1","urgency":"medium"},"sid":{"status":"resolved","repositories":{"sid":"2.4+dfsg-2"},"fixed_version":"2.0.1-1","urgency":"medium"},"trixie":{"status":"resolved","repositories":{"trixie":"2.3.3+dfsg-2"},"fixed_version":"2.0.1-1","urgency":"medium"}}},"CVE-2018-17825":{"description":"An issue was discovered in AdPlug 2.3.1. There are several double-free vulnerabilities in the CEmuopl class in emuopl.cpp because of a destructor's two OPLDestroy calls, each of which frees TL_TABLE, SIN_TABLE, AMS_TABLE, and VIB_TABLE.","debianbug":910534,"scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"2.3.3+dfsg-2"},"fixed_version":"2.2.1+dfsg3-1","urgency":"low"},"bullseye":{"status":"resolved","repositories":{"bullseye":"2.3.3+dfsg-2"},"fixed_version":"2.2.1+dfsg3-1","urgency":"low"},"forky":{"status":"resolved","repositories":{"forky":"2.4+dfsg-2"},"fixed_version":"2.2.1+dfsg3-1","urgency":"low"},"sid":{"status":"resolved","repositories":{"sid":"2.4+dfsg-2"},"fixed_version":"2.2.1+dfsg3-1","urgency":"low"},"trixie":{"status":"resolved","repositories":{"trixie":"2.3.3+dfsg-2"},"fixed_version":"2.2.1+dfsg3-1","urgency":"low"}}},"CVE-2019-14690":{"description":"AdPlug 2.3.1 has a heap-based buffer overflow in CxadbmfPlayer::__bmf_convert_stream() in bmf.cpp.","debianbug":943929,"scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"2.3.3+dfsg-2"},"fixed_version":"2.3.3+dfsg-2","urgency":"not yet assigned"},"bullseye":{"status":"resolved","repositories":{"bullseye":"2.3.3+dfsg-2"},"fixed_version":"2.3.3+dfsg-2","urgency":"not yet assigned"},"forky":{"status":"resolved","repositories":{"forky":"2.4+dfsg-2"},"fixed_version":"2.3.3+dfsg-2","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"2.4+dfsg-2"},"fixed_version":"2.3.3+dfsg-2","urgency":"not yet assigned"},"trixie":{"status":"resolved","repositories":{"trixie":"2.3.3+dfsg-2"},"fixed_version":"2.3.3+dfsg-2","urgency":"not yet assigned"}}},"CVE-2019-14691":{"description":"AdPlug 2.3.1 has a heap-based buffer overflow in CdtmLoader::load() in dtm.cpp.","debianbug":943928,"scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"2.3.3+dfsg-2"},"fixed_version":"2.3.3+dfsg-2","urgency":"not yet assigned"},"bullseye":{"status":"resolved","repositories":{"bullseye":"2.3.3+dfsg-2"},"fixed_version":"2.3.3+dfsg-2","urgency":"not yet assigned"},"forky":{"status":"resolved","repositories":{"forky":"2.4+dfsg-2"},"fixed_version":"2.3.3+dfsg-2","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"2.4+dfsg-2"},"fixed_version":"2.3.3+dfsg-2","urgency":"not yet assigned"},"trixie":{"status":"resolved","repositories":{"trixie":"2.3.3+dfsg-2"},"fixed_version":"2.3.3+dfsg-2","urgency":"not yet assigned"}}},"CVE-2019-14692":{"description":"AdPlug 2.3.1 has a heap-based buffer overflow in CmkjPlayer::load() in mkj.cpp.","debianbug":943927,"scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"2.3.3+dfsg-2"},"fixed_version":"2.3.3+dfsg-2","urgency":"not yet assigned"},"bullseye":{"status":"resolved","repositories":{"bullseye":"2.3.3+dfsg-2"},"fixed_version":"2.3.3+dfsg-2","urgency":"not yet assigned"},"forky":{"status":"resolved","repositories":{"forky":"2.4+dfsg-2"},"fixed_version":"2.3.3+dfsg-2","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"2.4+dfsg-2"},"fixed_version":"2.3.3+dfsg-2","urgency":"not yet assigned"},"trixie":{"status":"resolved","repositories":{"trixie":"2.3.3+dfsg-2"},"fixed_version":"2.3.3+dfsg-2","urgency":"not yet assigned"}}},"CVE-2019-14732":{"description":"AdPlug 2.3.1 has multiple heap-based buffer overflows in Ca2mLoader::load() in a2m.cpp.","scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"2.3.3+dfsg-2"},"fixed_version":"2.3.3+dfsg-2","urgency":"not yet assigned"},"bullseye":{"status":"resolved","repositories":{"bullseye":"2.3.3+dfsg-2"},"fixed_version":"2.3.3+dfsg-2","urgency":"not yet assigned"},"forky":{"status":"resolved","repositories":{"forky":"2.4+dfsg-2"},"fixed_version":"2.3.3+dfsg-2","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"2.4+dfsg-2"},"fixed_version":"2.3.3+dfsg-2","urgency":"not yet assigned"},"trixie":{"status":"resolved","repositories":{"trixie":"2.3.3+dfsg-2"},"fixed_version":"2.3.3+dfsg-2","urgency":"not yet assigned"}}},"CVE-2019-14733":{"description":"AdPlug 2.3.1 has multiple heap-based buffer overflows in CradLoader::load() in rad.cpp.","scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"2.3.3+dfsg-2"},"fixed_version":"2.3.3+dfsg-2","urgency":"not yet assigned"},"bullseye":{"status":"resolved","repositories":{"bullseye":"2.3.3+dfsg-2"},"fixed_version":"2.3.3+dfsg-2","urgency":"not yet assigned"},"forky":{"status":"resolved","repositories":{"forky":"2.4+dfsg-2"},"fixed_version":"2.3.3+dfsg-2","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"2.4+dfsg-2"},"fixed_version":"2.3.3+dfsg-2","urgency":"not yet assigned"},"trixie":{"status":"resolved","repositories":{"trixie":"2.3.3+dfsg-2"},"fixed_version":"2.3.3+dfsg-2","urgency":"not yet assigned"}}},"CVE-2019-14734":{"description":"AdPlug 2.3.1 has multiple heap-based buffer overflows in CmtkLoader::load() in mtk.cpp.","scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"2.3.3+dfsg-2"},"fixed_version":"2.3.3+dfsg-2","urgency":"not yet assigned"},"bullseye":{"status":"resolved","repositories":{"bullseye":"2.3.3+dfsg-2"},"fixed_version":"2.3.3+dfsg-2","urgency":"not yet assigned"},"forky":{"status":"resolved","repositories":{"forky":"2.4+dfsg-2"},"fixed_version":"2.3.3+dfsg-2","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"2.4+dfsg-2"},"fixed_version":"2.3.3+dfsg-2","urgency":"not yet assigned"},"trixie":{"status":"resolved","repositories":{"trixie":"2.3.3+dfsg-2"},"fixed_version":"2.3.3+dfsg-2","urgency":"not yet assigned"}}},"CVE-2019-15151":{"description":"AdPlug 2.3.1 has a double free in the Cu6mPlayer class in u6m.h.","debianbug":946340,"scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"2.3.3+dfsg-2"},"fixed_version":"2.3.3+dfsg-2","urgency":"not yet assigned"},"bullseye":{"status":"resolved","repositories":{"bullseye":"2.3.3+dfsg-2"},"fixed_version":"2.3.3+dfsg-2","urgency":"not yet assigned"},"forky":{"status":"resolved","repositories":{"forky":"2.4+dfsg-2"},"fixed_version":"2.3.3+dfsg-2","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"2.4+dfsg-2"},"fixed_version":"2.3.3+dfsg-2","urgency":"not yet assigned"},"trixie":{"status":"resolved","repositories":{"trixie":"2.3.3+dfsg-2"},"fixed_version":"2.3.3+dfsg-2","urgency":"not yet assigned"}}}},"advancecomp":{"CVE-2018-1056":{"description":"An out-of-bounds heap buffer read flaw was found in the way advancecomp before 2.1-2018/02 handled processing of ZIP files. An attacker could potentially use this flaw to crash the advzip utility by tricking it into processing crafted ZIP files.","debianbug":889270,"scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"2.5-1"},"fixed_version":"2.1-1","urgency":"not yet assigned"},"bullseye":{"status":"resolved","repositories":{"bullseye":"2.1-2.1"},"fixed_version":"2.1-1","urgency":"not yet assigned"},"forky":{"status":"resolved","repositories":{"forky":"2.5-1"},"fixed_version":"2.1-1","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"2.5-1"},"fixed_version":"2.1-1","urgency":"not yet assigned"},"trixie":{"status":"resolved","repositories":{"trixie":"2.5-1"},"fixed_version":"2.1-1","urgency":"not yet assigned"}}},"CVE-2019-8379":{"description":"An issue was discovered in AdvanceCOMP through 2.1. A NULL pointer dereference exists in the function be_uint32_read() located in endianrw.h. It can be triggered by sending a crafted file to a binary. It allows an attacker to cause a Denial of Service (Segmentation fault) or possibly have unspecified other impact when a victim opens a specially crafted file.","debianbug":928729,"scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"2.5-1"},"fixed_version":"2.1-2.1","urgency":"not yet assigned"},"bullseye":{"status":"resolved","repositories":{"bullseye":"2.1-2.1"},"fixed_version":"2.1-2.1","urgency":"not yet assigned"},"forky":{"status":"resolved","repositories":{"forky":"2.5-1"},"fixed_version":"2.1-2.1","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"2.5-1"},"fixed_version":"2.1-2.1","urgency":"not yet assigned"},"trixie":{"status":"resolved","repositories":{"trixie":"2.5-1"},"fixed_version":"2.1-2.1","urgency":"not yet assigned"}}},"CVE-2019-8383":{"description":"An issue was discovered in AdvanceCOMP through 2.1. An invalid memory address occurs in the function adv_png_unfilter_8 in lib/png.c. It can be triggered by sending a crafted file to a binary. It allows an attacker to cause a Denial of Service (Segmentation fault) or possibly have unspecified other impact when a victim opens a specially crafted file.","debianbug":928730,"scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"2.5-1"},"fixed_version":"2.1-2.1","urgency":"not yet assigned"},"bullseye":{"status":"resolved","repositories":{"bullseye":"2.1-2.1"},"fixed_version":"2.1-2.1","urgency":"not yet assigned"},"forky":{"status":"resolved","repositories":{"forky":"2.5-1"},"fixed_version":"2.1-2.1","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"2.5-1"},"fixed_version":"2.1-2.1","urgency":"not yet assigned"},"trixie":{"status":"resolved","repositories":{"trixie":"2.5-1"},"fixed_version":"2.1-2.1","urgency":"not yet assigned"}}},"CVE-2019-9210":{"description":"In AdvanceCOMP 2.1, png_compress in pngex.cc in advpng has an integer overflow upon encountering an invalid PNG size, which results in an attempted memcpy to write into a buffer that is too small. (There is also a heap-based buffer over-read.)","debianbug":923416,"scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"2.5-1"},"fixed_version":"2.1-2","urgency":"low"},"bullseye":{"status":"resolved","repositories":{"bullseye":"2.1-2.1"},"fixed_version":"2.1-2","urgency":"low"},"forky":{"status":"resolved","repositories":{"forky":"2.5-1"},"fixed_version":"2.1-2","urgency":"low"},"sid":{"status":"resolved","repositories":{"sid":"2.5-1"},"fixed_version":"2.1-2","urgency":"low"},"trixie":{"status":"resolved","repositories":{"trixie":"2.5-1"},"fixed_version":"2.1-2","urgency":"low"}}},"CVE-2022-35014":{"description":"Advancecomp v2.3 contains a segmentation fault.","debianbug":1019592,"scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"2.5-1"},"fixed_version":"2.4-1","urgency":"unimportant"},"bullseye":{"status":"open","repositories":{"bullseye":"2.1-2.1"},"urgency":"unimportant"},"forky":{"status":"resolved","repositories":{"forky":"2.5-1"},"fixed_version":"2.4-1","urgency":"unimportant"},"sid":{"status":"resolved","repositories":{"sid":"2.5-1"},"fixed_version":"2.4-1","urgency":"unimportant"},"trixie":{"status":"resolved","repositories":{"trixie":"2.5-1"},"fixed_version":"2.4-1","urgency":"unimportant"}}},"CVE-2022-35015":{"description":"Advancecomp v2.3 was discovered to contain a heap buffer overflow via le_uint32_read at /lib/endianrw.h.","debianbug":1019592,"scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"2.5-1"},"fixed_version":"2.4-1","urgency":"unimportant"},"bullseye":{"status":"open","repositories":{"bullseye":"2.1-2.1"},"urgency":"unimportant"},"forky":{"status":"resolved","repositories":{"forky":"2.5-1"},"fixed_version":"2.4-1","urgency":"unimportant"},"sid":{"status":"resolved","repositories":{"sid":"2.5-1"},"fixed_version":"2.4-1","urgency":"unimportant"},"trixie":{"status":"resolved","repositories":{"trixie":"2.5-1"},"fixed_version":"2.4-1","urgency":"unimportant"}}},"CVE-2022-35016":{"description":"Advancecomp v2.3 was discovered to contain a heap buffer overflow.","debianbug":1019592,"scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"2.5-1"},"fixed_version":"2.4-1","urgency":"unimportant"},"bullseye":{"status":"open","repositories":{"bullseye":"2.1-2.1"},"urgency":"unimportant"},"forky":{"status":"resolved","repositories":{"forky":"2.5-1"},"fixed_version":"2.4-1","urgency":"unimportant"},"sid":{"status":"resolved","repositories":{"sid":"2.5-1"},"fixed_version":"2.4-1","urgency":"unimportant"},"trixie":{"status":"resolved","repositories":{"trixie":"2.5-1"},"fixed_version":"2.4-1","urgency":"unimportant"}}},"CVE-2022-35017":{"description":"Advancecomp v2.3 was discovered to contain a heap buffer overflow.","debianbug":1019592,"scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"2.5-1"},"fixed_version":"2.4-1","urgency":"unimportant"},"bullseye":{"status":"open","repositories":{"bullseye":"2.1-2.1"},"urgency":"unimportant"},"forky":{"status":"resolved","repositories":{"forky":"2.5-1"},"fixed_version":"2.4-1","urgency":"unimportant"},"sid":{"status":"resolved","repositories":{"sid":"2.5-1"},"fixed_version":"2.4-1","urgency":"unimportant"},"trixie":{"status":"resolved","repositories":{"trixie":"2.5-1"},"fixed_version":"2.4-1","urgency":"unimportant"}}},"CVE-2022-35018":{"description":"Advancecomp v2.3 was discovered to contain a segmentation fault.","debianbug":1019592,"scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"2.5-1"},"fixed_version":"2.4-1","urgency":"unimportant"},"bullseye":{"status":"open","repositories":{"bullseye":"2.1-2.1"},"urgency":"unimportant"},"forky":{"status":"resolved","repositories":{"forky":"2.5-1"},"fixed_version":"2.4-1","urgency":"unimportant"},"sid":{"status":"resolved","repositories":{"sid":"2.5-1"},"fixed_version":"2.4-1","urgency":"unimportant"},"trixie":{"status":"resolved","repositories":{"trixie":"2.5-1"},"fixed_version":"2.4-1","urgency":"unimportant"}}},"CVE-2022-35019":{"description":"Advancecomp v2.3 was discovered to contain a segmentation fault.","debianbug":1019592,"scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"2.5-1"},"fixed_version":"2.4-1","urgency":"not yet assigned"},"bullseye":{"status":"open","repositories":{"bullseye":"2.1-2.1"},"urgency":"not yet assigned","nodsa":"Minor issue","nodsa_reason":""},"forky":{"status":"resolved","repositories":{"forky":"2.5-1"},"fixed_version":"2.4-1","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"2.5-1"},"fixed_version":"2.4-1","urgency":"not yet assigned"},"trixie":{"status":"resolved","repositories":{"trixie":"2.5-1"},"fixed_version":"2.4-1","urgency":"not yet assigned"}}},"CVE-2022-35020":{"description":"Advancecomp v2.3 was discovered to contain a heap buffer overflow via the component __interceptor_memcpy at /sanitizer_common/sanitizer_common_interceptors.inc.","debianbug":1019592,"scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"2.5-1"},"fixed_version":"2.4-1","urgency":"unimportant"},"bullseye":{"status":"open","repositories":{"bullseye":"2.1-2.1"},"urgency":"unimportant"},"forky":{"status":"resolved","repositories":{"forky":"2.5-1"},"fixed_version":"2.4-1","urgency":"unimportant"},"sid":{"status":"resolved","repositories":{"sid":"2.5-1"},"fixed_version":"2.4-1","urgency":"unimportant"},"trixie":{"status":"resolved","repositories":{"trixie":"2.5-1"},"fixed_version":"2.4-1","urgency":"unimportant"}}},"CVE-2023-2961":{"description":"A segmentation fault flaw was found in the Advancecomp package. This may lead to decreased availability.","scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"2.5-1"},"fixed_version":"2.5-1","urgency":"unimportant"},"bullseye":{"status":"open","repositories":{"bullseye":"2.1-2.1"},"urgency":"unimportant"},"forky":{"status":"resolved","repositories":{"forky":"2.5-1"},"fixed_version":"2.5-1","urgency":"unimportant"},"sid":{"status":"resolved","repositories":{"sid":"2.5-1"},"fixed_version":"2.5-1","urgency":"unimportant"},"trixie":{"status":"resolved","repositories":{"trixie":"2.5-1"},"fixed_version":"2.5-1","urgency":"unimportant"}}}},"advi":{"CVE-2009-2295":{"description":"Multiple integer overflows in CamlImages 2.2 and earlier might allow context-dependent attackers to execute arbitrary code via a crafted PNG image with large width and height values that trigger a heap-based buffer overflow in the (1) read_png_file or (2) read_png_file_as_rgb24 function.","debianbug":550440,"scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"1.10.2-9"},"fixed_version":"1.6.0-15","urgency":"low"},"bullseye":{"status":"resolved","repositories":{"bullseye":"1.10.2-9"},"fixed_version":"1.6.0-15","urgency":"low"},"forky":{"status":"resolved","repositories":{"forky":"2.0.0-5"},"fixed_version":"1.6.0-15","urgency":"low"},"sid":{"status":"resolved","repositories":{"sid":"2.0.0-5"},"fixed_version":"1.6.0-15","urgency":"low"},"trixie":{"status":"resolved","repositories":{"trixie":"2.0.0-4"},"fixed_version":"1.6.0-15","urgency":"low"}}},"CVE-2009-2660":{"description":"Multiple integer overflows in CamlImages 2.2 might allow context-dependent attackers to execute arbitrary code via images containing large width and height values that trigger a heap-based buffer overflow, related to (1) crafted GIF files (gifread.c) and (2) crafted JPEG files (jpegread.c), a different vulnerability than CVE-2009-2295.","debianbug":551282,"scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"1.10.2-9"},"fixed_version":"1.6.0-15","urgency":"low"},"bullseye":{"status":"resolved","repositories":{"bullseye":"1.10.2-9"},"fixed_version":"1.6.0-15","urgency":"low"},"forky":{"status":"resolved","repositories":{"forky":"2.0.0-5"},"fixed_version":"1.6.0-15","urgency":"low"},"sid":{"status":"resolved","repositories":{"sid":"2.0.0-5"},"fixed_version":"1.6.0-15","urgency":"low"},"trixie":{"status":"resolved","repositories":{"trixie":"2.0.0-4"},"fixed_version":"1.6.0-15","urgency":"low"}}},"CVE-2009-3296":{"description":"Multiple integer overflows in tiffread.c in CamlImages 2.2 might allow remote attackers to execute arbitrary code via TIFF images containing large width and height values that trigger heap-based buffer overflows.","debianbug":551282,"scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"1.10.2-9"},"fixed_version":"1.6.0-15","urgency":"low"},"bullseye":{"status":"resolved","repositories":{"bullseye":"1.10.2-9"},"fixed_version":"1.6.0-15","urgency":"low"},"forky":{"status":"resolved","repositories":{"forky":"2.0.0-5"},"fixed_version":"1.6.0-15","urgency":"low"},"sid":{"status":"resolved","repositories":{"sid":"2.0.0-5"},"fixed_version":"1.6.0-15","urgency":"low"},"trixie":{"status":"resolved","repositories":{"trixie":"2.0.0-4"},"fixed_version":"1.6.0-15","urgency":"low"}}}},"aerc":{"CVE-2025-49466":{"description":"aerc before 93bec0d allows directory traversal in commands/msgview/open.go because of direct path concatenation of the name of an attachment part,","scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"0.14.0-1"},"fixed_version":"0","urgency":"unimportant"},"forky":{"status":"resolved","repositories":{"forky":"0.21.0-2"},"fixed_version":"0.20.0-2","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"0.21.0-2"},"fixed_version":"0.20.0-2","urgency":"not yet assigned"},"trixie":{"status":"resolved","repositories":{"trixie":"0.20.0-2"},"fixed_version":"0.20.0-2","urgency":"not yet assigned"}}}},"afflib":{"CVE-2018-8050":{"description":"The af_get_page() function in lib/afflib_pages.cpp in AFFLIB (aka AFFLIBv3) through 3.7.16 allows remote attackers to cause a denial of service (segmentation fault) via a corrupt AFF image that triggers an unexpected pagesize value.","debianbug":892599,"scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"3.7.20-1"},"fixed_version":"3.7.16-3","urgency":"unimportant"},"bullseye":{"status":"resolved","repositories":{"bullseye":"3.7.19-1"},"fixed_version":"3.7.16-3","urgency":"unimportant"},"forky":{"status":"resolved","repositories":{"forky":"3.7.22-1"},"fixed_version":"3.7.16-3","urgency":"unimportant"},"sid":{"status":"resolved","repositories":{"sid":"3.7.22-1"},"fixed_version":"3.7.16-3","urgency":"unimportant"},"trixie":{"status":"resolved","repositories":{"trixie":"3.7.21-1"},"fixed_version":"3.7.16-3","urgency":"unimportant"}}}},"aflplusplus":{"CVE-2023-26266":{"description":"In AFL++ 4.05c, the CmpLog component uses the current working directory to resolve and execute unprefixed fuzzing targets, allowing code execution.","debianbug":1033255,"scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"4.04c-4"},"fixed_version":"4.04c-4","urgency":"not yet assigned"},"bullseye":{"status":"open","repositories":{"bullseye":"2.68c-1"},"urgency":"not yet assigned","nodsa":"Minor issue","nodsa_reason":""},"forky":{"status":"resolved","repositories":{"forky":"4.33c-1.1"},"fixed_version":"4.04c-4","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"4.33c-1.1"},"fixed_version":"4.04c-4","urgency":"not yet assigned"},"trixie":{"status":"resolved","repositories":{"trixie":"4.21c-5"},"fixed_version":"4.04c-4","urgency":"not yet assigned"}}}},"afuse":{"CVE-2008-2232":{"description":"The expand_template function in afuse.c in afuse 0.2 allows local users to gain privileges via shell metacharacters in a pathname.","debianbug":490921,"scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"0.4.1-1.1"},"fixed_version":"0.2-3","urgency":"medium"},"bullseye":{"status":"resolved","repositories":{"bullseye":"0.4.1-1"},"fixed_version":"0.2-3","urgency":"medium"},"sid":{"status":"resolved","repositories":{"sid":"0.5.0-0.1"},"fixed_version":"0.2-3","urgency":"medium"},"trixie":{"status":"resolved","repositories":{"trixie":"0.5.0-0.1"},"fixed_version":"0.2-3","urgency":"medium"}}}},"agg":{"CVE-2019-6245":{"description":"An issue was discovered in Anti-Grain Geometry (AGG) 2.4 as used in SVG++ (aka svgpp) 1.2.3. In the function agg::cell_aa::not_equal, dx is assigned to (x2 - x1). If dx >= dx_limit, which is (16384 << poly_subpixel_shift), this function will call itself recursively. There can be a situation where (x2 - x1) is always bigger than dx_limit during the recursion, leading to continual stack consumption.","debianbug":919322,"scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"1:2.6.1-r134+dfsg1-2"},"fixed_version":"1:2.4-r127+dfsg1-1","urgency":"low"},"bullseye":{"status":"resolved","repositories":{"bullseye":"1:2.6.1-r134+dfsg1-2"},"fixed_version":"1:2.4-r127+dfsg1-1","urgency":"low"},"forky":{"status":"resolved","repositories":{"forky":"1:2.7.0.r145+dfsg-2.1"},"fixed_version":"1:2.4-r127+dfsg1-1","urgency":"low"},"sid":{"status":"resolved","repositories":{"sid":"1:2.7.0.r145+dfsg-2.1"},"fixed_version":"1:2.4-r127+dfsg1-1","urgency":"low"},"trixie":{"status":"resolved","repositories":{"trixie":"1:2.7.0.r145+dfsg-2"},"fixed_version":"1:2.4-r127+dfsg1-1","urgency":"low"}}}},"aide":{"CVE-2005-2096":{"description":"zlib 1.2 and later versions allows remote attackers to cause a denial of service (crash) via a crafted compressed stream with an incomplete code description of a length greater than 1, which leads to a buffer overflow, as demonstrated using a crafted PNG file.","debianbug":317523,"scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"0.18.3-1+deb12u4","bookworm-security":"0.18.3-1+deb12u4"},"fixed_version":"0.10-6.1.1","urgency":"unimportant"},"bullseye":{"status":"resolved","repositories":{"bullseye":"0.17.3-4+deb11u2","bullseye-security":"0.17.3-4+deb11u3"},"fixed_version":"0.10-6.1.1","urgency":"unimportant"},"forky":{"status":"resolved","repositories":{"forky":"0.19.2-3"},"fixed_version":"0.10-6.1.1","urgency":"unimportant"},"sid":{"status":"resolved","repositories":{"sid":"0.19.2-3"},"fixed_version":"0.10-6.1.1","urgency":"unimportant"},"trixie":{"status":"resolved","repositories":{"trixie":"0.19.1-2+deb13u2","trixie-security":"0.19.1-2+deb13u1"},"fixed_version":"0.10-6.1.1","urgency":"unimportant"}}},"CVE-2021-45417":{"description":"AIDE before 0.17.4 allows local users to obtain root privileges via crafted file metadata (such as XFS extended attributes or tmpfs ACLs), because of a heap-based buffer overflow.","scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"0.18.3-1+deb12u4","bookworm-security":"0.18.3-1+deb12u4"},"fixed_version":"0.17.4-1","urgency":"not yet assigned"},"bullseye":{"status":"resolved","repositories":{"bullseye":"0.17.3-4+deb11u2","bullseye-security":"0.17.3-4+deb11u3"},"fixed_version":"0.17.3-4+deb11u1","urgency":"not yet assigned"},"forky":{"status":"resolved","repositories":{"forky":"0.19.2-3"},"fixed_version":"0.17.4-1","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"0.19.2-3"},"fixed_version":"0.17.4-1","urgency":"not yet assigned"},"trixie":{"status":"resolved","repositories":{"trixie":"0.19.1-2+deb13u2","trixie-security":"0.19.1-2+deb13u1"},"fixed_version":"0.17.4-1","urgency":"not yet assigned"}}},"CVE-2025-54389":{"description":"AIDE is an advanced intrusion detection environment. Prior to version 0.19.2, there is an improper output neutralization vulnerability in AIDE.  An attacker can craft a malicious filename by including terminal escape sequences to hide the addition or removal of the file from the report and/or tamper with the log output. A local user might exploit this to bypass the AIDE detection of malicious files. Additionally the output of extended attribute key names and symbolic links targets are also not properly neutralized. This issue has been patched in version 0.19.2. A workaround involves configuring AIDE to write the report output to a regular file, redirecting stdout to a regular file, or redirecting the log output written to stderr to a regular file.","scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"0.18.3-1+deb12u4","bookworm-security":"0.18.3-1+deb12u4"},"fixed_version":"0.18.3-1+deb12u4","urgency":"not yet assigned"},"bullseye":{"status":"resolved","repositories":{"bullseye":"0.17.3-4+deb11u2","bullseye-security":"0.17.3-4+deb11u3"},"fixed_version":"0.17.3-4+deb11u3","urgency":"not yet assigned"},"forky":{"status":"resolved","repositories":{"forky":"0.19.2-3"},"fixed_version":"0.19.2-1","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"0.19.2-3"},"fixed_version":"0.19.2-1","urgency":"not yet assigned"},"trixie":{"status":"resolved","repositories":{"trixie":"0.19.1-2+deb13u2","trixie-security":"0.19.1-2+deb13u1"},"fixed_version":"0.19.1-2+deb13u1","urgency":"not yet assigned"}}},"CVE-2025-54409":{"description":"AIDE is an advanced intrusion detection environment. From versions 0.13 to 0.19.1, there is a null pointer dereference vulnerability in AIDE. An attacker can crash the program during report printing or database listing after setting extended file attributes with an empty attribute value or with a key containing a comma. A local user might exploit this to cause a local denial of service. This issue has been patched in version 0.19.2. A workaround involves removing xattrs group from rules matching files on affected file systems.","scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"0.18.3-1+deb12u4","bookworm-security":"0.18.3-1+deb12u4"},"fixed_version":"0.18.3-1+deb12u4","urgency":"not yet assigned"},"bullseye":{"status":"resolved","repositories":{"bullseye":"0.17.3-4+deb11u2","bullseye-security":"0.17.3-4+deb11u3"},"fixed_version":"0.17.3-4+deb11u3","urgency":"not yet assigned"},"forky":{"status":"resolved","repositories":{"forky":"0.19.2-3"},"fixed_version":"0.19.2-1","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"0.19.2-3"},"fixed_version":"0.19.2-1","urgency":"not yet assigned"},"trixie":{"status":"resolved","repositories":{"trixie":"0.19.1-2+deb13u2","trixie-security":"0.19.1-2+deb13u1"},"fixed_version":"0.19.1-2+deb13u1","urgency":"not yet assigned"}}}},"aiomysql":{"CVE-2025-62611":{"description":"aiomysql is a library for accessing a MySQL database from the asyncio. Prior to version 0.3.0, the client-side settings are not checked before sending local files to MySQL server, which allows obtaining arbitrary files from the client using a rogue server. It is possible to create a rogue MySQL server that emulates authorization, ignores client flags and requests arbitrary files from the client by sending a LOAD_LOCAL instruction packet. This issue has been patched in version 0.3.0.","debianbug":1118754,"scope":"local","releases":{"bookworm":{"status":"open","repositories":{"bookworm":"0.1.1-2"},"urgency":"not yet assigned","nodsa":"Minor issue","nodsa_reason":""},"bullseye":{"status":"open","repositories":{"bullseye":"0.0.20-2"},"urgency":"not yet assigned","nodsa":"Minor issue","nodsa_reason":"postponed"},"forky":{"status":"resolved","repositories":{"forky":"0.3.2-2"},"fixed_version":"0.3.2-1","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"0.3.2-2"},"fixed_version":"0.3.2-1","urgency":"not yet assigned"},"trixie":{"status":"open","repositories":{"trixie":"0.1.1-2"},"urgency":"not yet assigned","nodsa":"Minor issue","nodsa_reason":""}}}},"aircrack-ng":{"CVE-2007-2057":{"description":"Stack-based buffer overflow in aircrack-ng airodump-ng 0.7 allows remote attackers to execute arbitrary code via crafted 802.11 authentication packets.","scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"1:1.7-5"},"fixed_version":"1:0.7-3","urgency":"medium"},"bullseye":{"status":"resolved","repositories":{"bullseye":"1:1.6+git20210130.91820bc-1"},"fixed_version":"1:0.7-3","urgency":"medium"},"forky":{"status":"resolved","repositories":{"forky":"1:1.7+git20230807.4bf83f1a-2"},"fixed_version":"1:0.7-3","urgency":"medium"},"sid":{"status":"resolved","repositories":{"sid":"1:1.7+git20230807.4bf83f1a-2"},"fixed_version":"1:0.7-3","urgency":"medium"},"trixie":{"status":"resolved","repositories":{"trixie":"1:1.7+git20230807.4bf83f1a-2"},"fixed_version":"1:0.7-3","urgency":"medium"}}},"CVE-2010-1159":{"description":"Multiple heap-based buffer overflows in Aircrack-ng before 1.1 allow remote attackers to cause a denial of service (crash) and execute arbitrary code via a (1) large length value in an EAPOL packet or (2) long EAPOL packet.","debianbug":577758,"scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"1:1.7-5"},"fixed_version":"1:1.1-1","urgency":"low"},"bullseye":{"status":"resolved","repositories":{"bullseye":"1:1.6+git20210130.91820bc-1"},"fixed_version":"1:1.1-1","urgency":"low"},"forky":{"status":"resolved","repositories":{"forky":"1:1.7+git20230807.4bf83f1a-2"},"fixed_version":"1:1.1-1","urgency":"low"},"sid":{"status":"resolved","repositories":{"sid":"1:1.7+git20230807.4bf83f1a-2"},"fixed_version":"1:1.1-1","urgency":"low"},"trixie":{"status":"resolved","repositories":{"trixie":"1:1.7+git20230807.4bf83f1a-2"},"fixed_version":"1:1.1-1","urgency":"low"}}},"CVE-2014-8321":{"description":"Stack-based buffer overflow in the gps_tracker function in airodump-ng.c in Aircrack-ng before 1.2 RC 1 allows local users to execute arbitrary code or gain privileges via unspecified vectors.","debianbug":767979,"scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"1:1.7-5"},"fixed_version":"1:1.2-0~beta3-2","urgency":"not yet assigned"},"bullseye":{"status":"resolved","repositories":{"bullseye":"1:1.6+git20210130.91820bc-1"},"fixed_version":"1:1.2-0~beta3-2","urgency":"not yet assigned"},"forky":{"status":"resolved","repositories":{"forky":"1:1.7+git20230807.4bf83f1a-2"},"fixed_version":"1:1.2-0~beta3-2","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"1:1.7+git20230807.4bf83f1a-2"},"fixed_version":"1:1.2-0~beta3-2","urgency":"not yet assigned"},"trixie":{"status":"resolved","repositories":{"trixie":"1:1.7+git20230807.4bf83f1a-2"},"fixed_version":"1:1.2-0~beta3-2","urgency":"not yet assigned"}}},"CVE-2014-8322":{"description":"Stack-based buffer overflow in the tcp_test function in aireplay-ng.c in Aircrack-ng before 1.2 RC 1 allows remote attackers to execute arbitrary code via a crafted length parameter value.","debianbug":767979,"scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"1:1.7-5"},"fixed_version":"1:1.2-0~beta3-2","urgency":"not yet assigned"},"bullseye":{"status":"resolved","repositories":{"bullseye":"1:1.6+git20210130.91820bc-1"},"fixed_version":"1:1.2-0~beta3-2","urgency":"not yet assigned"},"forky":{"status":"resolved","repositories":{"forky":"1:1.7+git20230807.4bf83f1a-2"},"fixed_version":"1:1.2-0~beta3-2","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"1:1.7+git20230807.4bf83f1a-2"},"fixed_version":"1:1.2-0~beta3-2","urgency":"not yet assigned"},"trixie":{"status":"resolved","repositories":{"trixie":"1:1.7+git20230807.4bf83f1a-2"},"fixed_version":"1:1.2-0~beta3-2","urgency":"not yet assigned"}}},"CVE-2014-8323":{"description":"buddy-ng.c in Aircrack-ng before 1.2 Beta 3 allows remote attackers to cause a denial of service (segmentation fault) via a response with a crafted length parameter.","debianbug":767979,"scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"1:1.7-5"},"fixed_version":"1:1.2-0~beta3-2","urgency":"not yet assigned"},"bullseye":{"status":"resolved","repositories":{"bullseye":"1:1.6+git20210130.91820bc-1"},"fixed_version":"1:1.2-0~beta3-2","urgency":"not yet assigned"},"forky":{"status":"resolved","repositories":{"forky":"1:1.7+git20230807.4bf83f1a-2"},"fixed_version":"1:1.2-0~beta3-2","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"1:1.7+git20230807.4bf83f1a-2"},"fixed_version":"1:1.2-0~beta3-2","urgency":"not yet assigned"},"trixie":{"status":"resolved","repositories":{"trixie":"1:1.7+git20230807.4bf83f1a-2"},"fixed_version":"1:1.2-0~beta3-2","urgency":"not yet assigned"}}},"CVE-2014-8324":{"description":"network.c in Aircrack-ng before 1.2 Beta 3 allows remote attackers to cause a denial of service (segmentation fault) via a response with a crafted length parameter.","debianbug":767979,"scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"1:1.7-5"},"fixed_version":"1:1.2-0~beta3-2","urgency":"not yet assigned"},"bullseye":{"status":"resolved","repositories":{"bullseye":"1:1.6+git20210130.91820bc-1"},"fixed_version":"1:1.2-0~beta3-2","urgency":"not yet assigned"},"forky":{"status":"resolved","repositories":{"forky":"1:1.7+git20230807.4bf83f1a-2"},"fixed_version":"1:1.2-0~beta3-2","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"1:1.7+git20230807.4bf83f1a-2"},"fixed_version":"1:1.2-0~beta3-2","urgency":"not yet assigned"},"trixie":{"status":"resolved","repositories":{"trixie":"1:1.7+git20230807.4bf83f1a-2"},"fixed_version":"1:1.2-0~beta3-2","urgency":"not yet assigned"}}}},"alien-arena":{"CVE-2007-4754":{"description":"Format string vulnerability in the safe_bprintf function in acesrc/acebot_cmds.c in Alien Arena 2007 6.10 and earlier allows remote attackers to cause a denial of service (daemon crash) via format string specifiers in a nickname.","debianbug":442075,"scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"7.71.3+dfsg-3"},"fixed_version":"6.05-4.1","urgency":"medium"},"bullseye":{"status":"resolved","repositories":{"bullseye":"7.66+dfsg-6"},"fixed_version":"6.05-4.1","urgency":"medium"},"forky":{"status":"resolved","repositories":{"forky":"7.71.7+dfsg-1"},"fixed_version":"6.05-4.1","urgency":"medium"},"sid":{"status":"resolved","repositories":{"sid":"7.71.7+dfsg-1"},"fixed_version":"6.05-4.1","urgency":"medium"},"trixie":{"status":"resolved","repositories":{"trixie":"7.71.7+dfsg-1"},"fixed_version":"6.05-4.1","urgency":"medium"}}},"CVE-2007-4755":{"description":"Alien Arena 2007 6.10 and earlier allows remote attackers to cause a denial of service (client disconnect) by sending a client_connect command in a forged packet from the server to a client.  NOTE: client IP addresses are available via product-specific queries.","debianbug":442075,"scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"7.71.3+dfsg-3"},"fixed_version":"6.05-4.1","urgency":"low"},"bullseye":{"status":"resolved","repositories":{"bullseye":"7.66+dfsg-6"},"fixed_version":"6.05-4.1","urgency":"low"},"forky":{"status":"resolved","repositories":{"forky":"7.71.7+dfsg-1"},"fixed_version":"6.05-4.1","urgency":"low"},"sid":{"status":"resolved","repositories":{"sid":"7.71.7+dfsg-1"},"fixed_version":"6.05-4.1","urgency":"low"},"trixie":{"status":"resolved","repositories":{"trixie":"7.71.7+dfsg-1"},"fixed_version":"6.05-4.1","urgency":"low"}}},"CVE-2009-3637":{"description":"Stack-based buffer overflow in the M_AddToServerList function in client/menu.c in Red Planet Arena Alien Arena 7.30 allows remote attackers to execute arbitrary code via a packet with a crafted server description to UDP port 27901 followed by a packet with a long print command.","debianbug":552038,"scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"7.71.3+dfsg-3"},"fixed_version":"7.33-1","urgency":"medium"},"bullseye":{"status":"resolved","repositories":{"bullseye":"7.66+dfsg-6"},"fixed_version":"7.33-1","urgency":"medium"},"forky":{"status":"resolved","repositories":{"forky":"7.71.7+dfsg-1"},"fixed_version":"7.33-1","urgency":"medium"},"sid":{"status":"resolved","repositories":{"sid":"7.71.7+dfsg-1"},"fixed_version":"7.33-1","urgency":"medium"},"trixie":{"status":"resolved","repositories":{"trixie":"7.71.7+dfsg-1"},"fixed_version":"7.33-1","urgency":"medium"}}},"CVE-2010-3439":{"description":"It is possible to cause a DoS condition by causing the server to crash in alien-arena 7.33 by supplying various invalid parameters to the download command.","debianbug":575621,"scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"7.71.3+dfsg-3"},"fixed_version":"7.33-5","urgency":"low"},"bullseye":{"status":"resolved","repositories":{"bullseye":"7.66+dfsg-6"},"fixed_version":"7.33-5","urgency":"low"},"forky":{"status":"resolved","repositories":{"forky":"7.71.7+dfsg-1"},"fixed_version":"7.33-5","urgency":"low"},"sid":{"status":"resolved","repositories":{"sid":"7.71.7+dfsg-1"},"fixed_version":"7.33-5","urgency":"low"},"trixie":{"status":"resolved","repositories":{"trixie":"7.71.7+dfsg-1"},"fixed_version":"7.33-5","urgency":"low"}}}},"allegro4.4":{"CVE-2021-36489":{"description":"Buffer Overflow vulnerability in Allegro through 5.2.6 allows attackers to cause a denial of service via crafted PCX/TGA/BMP files to allegro_image addon.","debianbug":1032670,"scope":"local","releases":{"bookworm":{"status":"open","repositories":{"bookworm":"2:4.4.3.1-3"},"urgency":"not yet assigned","nodsa":"Minor issue","nodsa_reason":"ignored"},"bullseye":{"status":"open","repositories":{"bullseye":"2:4.4.3.1-2"},"urgency":"not yet assigned","nodsa":"Minor issue","nodsa_reason":""},"forky":{"status":"open","repositories":{"forky":"2:4.4.3.1-7"},"urgency":"not yet assigned"},"sid":{"status":"open","repositories":{"sid":"2:4.4.3.1-7"},"urgency":"not yet assigned"},"trixie":{"status":"open","repositories":{"trixie":"2:4.4.3.1-5"},"urgency":"not yet assigned","nodsa":"Minor issue","nodsa_reason":"ignored"}}}},"allegro5":{"CVE-2021-36489":{"description":"Buffer Overflow vulnerability in Allegro through 5.2.6 allows attackers to cause a denial of service via crafted PCX/TGA/BMP files to allegro_image addon.","scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"2:5.2.8.0+dfsg-1"},"fixed_version":"2:5.2.8.0-1","urgency":"not yet assigned"},"bullseye":{"status":"resolved","repositories":{"bullseye":"2:5.2.6.0-3+deb11u1"},"fixed_version":"2:5.2.6.0-3+deb11u1","urgency":"not yet assigned"},"forky":{"status":"resolved","repositories":{"forky":"2:5.2.11.3+dfsg-1"},"fixed_version":"2:5.2.8.0-1","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"2:5.2.11.3+dfsg-1"},"fixed_version":"2:5.2.8.0-1","urgency":"not yet assigned"},"trixie":{"status":"resolved","repositories":{"trixie":"2:5.2.10.1+dfsg-1"},"fixed_version":"2:5.2.8.0-1","urgency":"not yet assigned"}}}},"almanah":{"CVE-2013-1853":{"description":"Almanah Diary 0.9.0 and 0.10.0 does not encrypt the database when closed, which allows local users to obtain sensitive information by reading the database.","debianbug":702905,"scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"0.12.3-2"},"fixed_version":"0.9.1-1","urgency":"not yet assigned"},"bullseye":{"status":"resolved","repositories":{"bullseye":"0.12.3-1"},"fixed_version":"0.9.1-1","urgency":"not yet assigned"},"trixie":{"status":"resolved","repositories":{"trixie":"0.12.4-1"},"fixed_version":"0.9.1-1","urgency":"not yet assigned"}}}},"alpine":{"CVE-2002-1903":{"description":"Pine 4.2.1 through 4.4.4 puts Unix usernames and/or uid into Sender: and X-Sender: headers, which could allow remote attackers to obtain sensitive information.","scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"2.26+dfsg-1"},"fixed_version":"0","urgency":"unimportant"},"bullseye":{"status":"resolved","repositories":{"bullseye":"2.24+dfsg1-1"},"fixed_version":"0","urgency":"unimportant"},"forky":{"status":"resolved","repositories":{"forky":"2.26+dfsg-5"},"fixed_version":"0","urgency":"unimportant"},"sid":{"status":"resolved","repositories":{"sid":"2.26+dfsg-5"},"fixed_version":"0","urgency":"unimportant"},"trixie":{"status":"resolved","repositories":{"trixie":"2.26+dfsg-3"},"fixed_version":"0","urgency":"unimportant"}}},"CVE-2003-0297":{"description":"c-client IMAP Client, as used in imap-2002b and Pine 4.53, allows remote malicious IMAP servers to cause a denial of service (crash) and possibly execute arbitrary code via certain large (1) literal and (2) mailbox size values that cause either integer signedness errors or integer overflow errors.","scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"2.26+dfsg-1"},"fixed_version":"0","urgency":"unimportant"},"bullseye":{"status":"resolved","repositories":{"bullseye":"2.24+dfsg1-1"},"fixed_version":"0","urgency":"unimportant"},"forky":{"status":"resolved","repositories":{"forky":"2.26+dfsg-5"},"fixed_version":"0","urgency":"unimportant"},"sid":{"status":"resolved","repositories":{"sid":"2.26+dfsg-5"},"fixed_version":"0","urgency":"unimportant"},"trixie":{"status":"resolved","repositories":{"trixie":"2.26+dfsg-3"},"fixed_version":"0","urgency":"unimportant"}}},"CVE-2003-0720":{"description":"Buffer overflow in PINE before 4.58 allows remote attackers to execute arbitrary code via a malformed message/external-body MIME type.","scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"2.26+dfsg-1"},"fixed_version":"0","urgency":"unimportant"},"bullseye":{"status":"resolved","repositories":{"bullseye":"2.24+dfsg1-1"},"fixed_version":"0","urgency":"unimportant"},"forky":{"status":"resolved","repositories":{"forky":"2.26+dfsg-5"},"fixed_version":"0","urgency":"unimportant"},"sid":{"status":"resolved","repositories":{"sid":"2.26+dfsg-5"},"fixed_version":"0","urgency":"unimportant"},"trixie":{"status":"resolved","repositories":{"trixie":"2.26+dfsg-3"},"fixed_version":"0","urgency":"unimportant"}}},"CVE-2003-0721":{"description":"Integer signedness error in rfc2231_get_param from strings.c in PINE before 4.58 allows remote attackers to execute arbitrary code via an email that causes an out-of-bounds array access using a negative number.","scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"2.26+dfsg-1"},"fixed_version":"0","urgency":"unimportant"},"bullseye":{"status":"resolved","repositories":{"bullseye":"2.24+dfsg1-1"},"fixed_version":"0","urgency":"unimportant"},"forky":{"status":"resolved","repositories":{"forky":"2.26+dfsg-5"},"fixed_version":"0","urgency":"unimportant"},"sid":{"status":"resolved","repositories":{"sid":"2.26+dfsg-5"},"fixed_version":"0","urgency":"unimportant"},"trixie":{"status":"resolved","repositories":{"trixie":"2.26+dfsg-3"},"fixed_version":"0","urgency":"unimportant"}}},"CVE-2005-1066":{"description":"Race condition in rpdump in Pine 4.62 and earlier allows local users to overwrite arbitrary files via a symlink attack.","scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"2.26+dfsg-1"},"fixed_version":"0","urgency":"unimportant"},"bullseye":{"status":"resolved","repositories":{"bullseye":"2.24+dfsg1-1"},"fixed_version":"0","urgency":"unimportant"},"forky":{"status":"resolved","repositories":{"forky":"2.26+dfsg-5"},"fixed_version":"0","urgency":"unimportant"},"sid":{"status":"resolved","repositories":{"sid":"2.26+dfsg-5"},"fixed_version":"0","urgency":"unimportant"},"trixie":{"status":"resolved","repositories":{"trixie":"2.26+dfsg-3"},"fixed_version":"0","urgency":"unimportant"}}},"CVE-2005-2933":{"description":"Buffer overflow in the mail_valid_net_parse_work function in mail.c for Washington's IMAP Server (UW-IMAP) before imap-2004g allows remote attackers to execute arbitrary code via a mailbox name containing a single double-quote (\") character without a closing quote, which causes bytes after the double-quote to be copied into a buffer indefinitely.","scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"2.26+dfsg-1"},"fixed_version":"0","urgency":"unimportant"},"bullseye":{"status":"resolved","repositories":{"bullseye":"2.24+dfsg1-1"},"fixed_version":"0","urgency":"unimportant"},"forky":{"status":"resolved","repositories":{"forky":"2.26+dfsg-5"},"fixed_version":"0","urgency":"unimportant"},"sid":{"status":"resolved","repositories":{"sid":"2.26+dfsg-5"},"fixed_version":"0","urgency":"unimportant"},"trixie":{"status":"resolved","repositories":{"trixie":"2.26+dfsg-3"},"fixed_version":"0","urgency":"unimportant"}}},"CVE-2008-5005":{"description":"Multiple stack-based buffer overflows in (1) University of Washington IMAP Toolkit 2002 through 2007c, (2) University of Washington Alpine 2.00 and earlier, and (3) Panda IMAP allow (a) local users to gain privileges by specifying a long folder extension argument on the command line to the tmail or dmail program; and (b) remote attackers to execute arbitrary code by sending e-mail to a destination mailbox name composed of a username and '+' character followed by a long string, processed by the tmail or possibly dmail program.","scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"2.26+dfsg-1"},"fixed_version":"0","urgency":"unimportant"},"bullseye":{"status":"resolved","repositories":{"bullseye":"2.24+dfsg1-1"},"fixed_version":"0","urgency":"unimportant"},"forky":{"status":"resolved","repositories":{"forky":"2.26+dfsg-5"},"fixed_version":"0","urgency":"unimportant"},"sid":{"status":"resolved","repositories":{"sid":"2.26+dfsg-5"},"fixed_version":"0","urgency":"unimportant"},"trixie":{"status":"resolved","repositories":{"trixie":"2.26+dfsg-3"},"fixed_version":"0","urgency":"unimportant"}}},"CVE-2008-5514":{"description":"Off-by-one error in the rfc822_output_char function in the RFC822BUFFER routines in the University of Washington (UW) c-client library, as used by the UW IMAP toolkit before imap-2007e and other applications, allows context-dependent attackers to cause a denial of service (crash) via an e-mail message that triggers a buffer overflow.","scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"2.26+dfsg-1"},"fixed_version":"2.02-3.1","urgency":"low"},"bullseye":{"status":"resolved","repositories":{"bullseye":"2.24+dfsg1-1"},"fixed_version":"2.02-3.1","urgency":"low"},"forky":{"status":"resolved","repositories":{"forky":"2.26+dfsg-5"},"fixed_version":"2.02-3.1","urgency":"low"},"sid":{"status":"resolved","repositories":{"sid":"2.26+dfsg-5"},"fixed_version":"2.02-3.1","urgency":"low"},"trixie":{"status":"resolved","repositories":{"trixie":"2.26+dfsg-3"},"fixed_version":"2.02-3.1","urgency":"low"}}},"CVE-2015-2305":{"description":"Integer overflow in the regcomp implementation in the Henry Spencer BSD regex library (aka rxspencer) alpha3.8.g5 on 32-bit platforms, as used in NetBSD through 6.1.5 and other products, might allow context-dependent attackers to execute arbitrary code via a large regular expression that leads to a heap-based buffer overflow.","scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"2.26+dfsg-1"},"fixed_version":"0","urgency":"unimportant"},"bullseye":{"status":"resolved","repositories":{"bullseye":"2.24+dfsg1-1"},"fixed_version":"0","urgency":"unimportant"},"forky":{"status":"resolved","repositories":{"forky":"2.26+dfsg-5"},"fixed_version":"0","urgency":"unimportant"},"sid":{"status":"resolved","repositories":{"sid":"2.26+dfsg-5"},"fixed_version":"0","urgency":"unimportant"},"trixie":{"status":"resolved","repositories":{"trixie":"2.26+dfsg-3"},"fixed_version":"0","urgency":"unimportant"}}},"CVE-2020-14929":{"description":"Alpine before 2.23 silently proceeds to use an insecure connection after a /tls is sent in certain circumstances involving PREAUTH, which is a less secure behavior than the alternative of closing the connection and letting the user decide what they would like to do.","debianbug":963179,"scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"2.26+dfsg-1"},"fixed_version":"2.23+dfsg1-1","urgency":"not yet assigned"},"bullseye":{"status":"resolved","repositories":{"bullseye":"2.24+dfsg1-1"},"fixed_version":"2.23+dfsg1-1","urgency":"not yet assigned"},"forky":{"status":"resolved","repositories":{"forky":"2.26+dfsg-5"},"fixed_version":"2.23+dfsg1-1","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"2.26+dfsg-5"},"fixed_version":"2.23+dfsg1-1","urgency":"not yet assigned"},"trixie":{"status":"resolved","repositories":{"trixie":"2.26+dfsg-3"},"fixed_version":"2.23+dfsg1-1","urgency":"not yet assigned"}}},"CVE-2021-38370":{"description":"In Alpine before 2.25, untagged responses from an IMAP server are accepted before STARTTLS.","debianbug":992171,"scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"2.26+dfsg-1"},"fixed_version":"2.25+dfsg1-1","urgency":"not yet assigned"},"bullseye":{"status":"open","repositories":{"bullseye":"2.24+dfsg1-1"},"urgency":"not yet assigned","nodsa":"Minor issue","nodsa_reason":""},"forky":{"status":"resolved","repositories":{"forky":"2.26+dfsg-5"},"fixed_version":"2.25+dfsg1-1","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"2.26+dfsg-5"},"fixed_version":"2.25+dfsg1-1","urgency":"not yet assigned"},"trixie":{"status":"resolved","repositories":{"trixie":"2.26+dfsg-3"},"fixed_version":"2.25+dfsg1-1","urgency":"not yet assigned"}}},"CVE-2021-46853":{"description":"Alpine before 2.25 allows remote attackers to cause a denial of service (application crash) when LIST or LSUB is sent before STARTTLS.","scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"2.26+dfsg-1"},"fixed_version":"2.25+dfsg1-1","urgency":"not yet assigned"},"bullseye":{"status":"open","repositories":{"bullseye":"2.24+dfsg1-1"},"urgency":"not yet assigned","nodsa":"Minor issue","nodsa_reason":""},"forky":{"status":"resolved","repositories":{"forky":"2.26+dfsg-5"},"fixed_version":"2.25+dfsg1-1","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"2.26+dfsg-5"},"fixed_version":"2.25+dfsg1-1","urgency":"not yet assigned"},"trixie":{"status":"resolved","repositories":{"trixie":"2.26+dfsg-3"},"fixed_version":"2.25+dfsg1-1","urgency":"not yet assigned"}}}},"alsa-lib":{"CVE-2005-0087":{"description":"The alsa-lib package in Red Hat Linux 4 disables stack protection for the libasound.so library, which makes it easier for attackers to execute arbitrary code if there are other vulnerabilities in the library.","scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"1.2.8-1"},"fixed_version":"1.0.9-1","urgency":"unimportant"},"bullseye":{"status":"resolved","repositories":{"bullseye":"1.2.4-1.1","bullseye-security":"1.2.4-1.1+deb11u1"},"fixed_version":"1.0.9-1","urgency":"unimportant"},"forky":{"status":"resolved","repositories":{"forky":"1.2.15.3-1"},"fixed_version":"1.0.9-1","urgency":"unimportant"},"sid":{"status":"resolved","repositories":{"sid":"1.2.15.3-1"},"fixed_version":"1.0.9-1","urgency":"unimportant"},"trixie":{"status":"resolved","repositories":{"trixie":"1.2.14-1"},"fixed_version":"1.0.9-1","urgency":"unimportant"}}},"CVE-2026-25068":{"description":"alsa-lib versions 1.2.2 up to and including 1.2.15.2, prior to commit 5f7fe33, contain a heap-based buffer overflow in the topology mixer control decoder. The tplg_decode_control_mixer1() function reads the num_channels field from untrusted .tplg data and uses it as a loop bound without validating it against the fixed-size channel array (SND_TPLG_MAX_CHAN). A crafted topology file with an excessive num_channels value can cause out-of-bounds heap writes, leading to a crash.","debianbug":1126629,"scope":"local","releases":{"bookworm":{"status":"open","repositories":{"bookworm":"1.2.8-1"},"urgency":"not yet assigned","nodsa":"Minor issue","nodsa_reason":""},"bullseye":{"status":"resolved","repositories":{"bullseye":"1.2.4-1.1","bullseye-security":"1.2.4-1.1+deb11u1"},"fixed_version":"1.2.4-1.1+deb11u1","urgency":"not yet assigned"},"forky":{"status":"open","repositories":{"forky":"1.2.15.3-1"},"urgency":"not yet assigned"},"sid":{"status":"open","repositories":{"sid":"1.2.15.3-1"},"urgency":"not yet assigned"},"trixie":{"status":"open","repositories":{"trixie":"1.2.14-1"},"urgency":"not yet assigned","nodsa":"Minor issue","nodsa_reason":""}}}},"alsaplayer":{"CVE-2002-1896":{"description":"Buffer overflow in Alsaplayer 0.99.71, when installed setuid root, allows local users to execute arbitrary code via a long (1) -f or (2) -o command line argument.","scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"0.99.81-2"},"fixed_version":"0.99.72-1","urgency":"not yet assigned"},"bullseye":{"status":"resolved","repositories":{"bullseye":"0.99.81-2"},"fixed_version":"0.99.72-1","urgency":"not yet assigned"},"forky":{"status":"resolved","repositories":{"forky":"0.99.82-4"},"fixed_version":"0.99.72-1","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"0.99.82-4"},"fixed_version":"0.99.72-1","urgency":"not yet assigned"},"trixie":{"status":"resolved","repositories":{"trixie":"0.99.82-2"},"fixed_version":"0.99.72-1","urgency":"not yet assigned"}}},"CVE-2006-4089":{"description":"Multiple buffer overflows in Andy Lo-A-Foe AlsaPlayer 0.99.76 and earlier allow remote attackers to cause a denial of service (application crash), or have other unknown impact, via (1) a long Location field sent by a web server, which triggers an overflow in the reconnect function in reader/http/http.c; (2) a long URL sent by a web server when AlsaPlayer is seeking a media file for the playlist, which triggers overflows in new_list_item and CbUpdated in interface/gtk/PlaylistWindow.cpp; and (3) a long response sent by a CDDB server, which triggers an overflow in cddb_lookup in input/ccda/cdda_engine.c.","debianbug":382842,"scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"0.99.81-2"},"fixed_version":"0.99.76-9","urgency":"medium"},"bullseye":{"status":"resolved","repositories":{"bullseye":"0.99.81-2"},"fixed_version":"0.99.76-9","urgency":"medium"},"forky":{"status":"resolved","repositories":{"forky":"0.99.82-4"},"fixed_version":"0.99.76-9","urgency":"medium"},"sid":{"status":"resolved","repositories":{"sid":"0.99.82-4"},"fixed_version":"0.99.76-9","urgency":"medium"},"trixie":{"status":"resolved","repositories":{"trixie":"0.99.82-2"},"fixed_version":"0.99.76-9","urgency":"medium"}}},"CVE-2007-5301":{"description":"Buffer overflow in the vorbis_stream_info function in input/vorbis/vorbis_engine.c (aka the vorbis input plugin) in AlsaPlayer before 0.99.80-rc3 allows remote attackers to execute arbitrary code via a .OGG file with long comments.","debianbug":446034,"scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"0.99.81-2"},"fixed_version":"0.99.80~rc4-1","urgency":"low"},"bullseye":{"status":"resolved","repositories":{"bullseye":"0.99.81-2"},"fixed_version":"0.99.80~rc4-1","urgency":"low"},"forky":{"status":"resolved","repositories":{"forky":"0.99.82-4"},"fixed_version":"0.99.80~rc4-1","urgency":"low"},"sid":{"status":"resolved","repositories":{"sid":"0.99.82-4"},"fixed_version":"0.99.80~rc4-1","urgency":"low"},"trixie":{"status":"resolved","repositories":{"trixie":"0.99.82-2"},"fixed_version":"0.99.80~rc4-1","urgency":"low"}}}},"altermime":{"CVE-2002-1721":{"description":"Off-by-one error in alterMIME 0.1.10 and 0.1.11 allows remote attackers to cause a denial of service (crash) via an x-header that causes snprintf overwrite the FFGET_FILE variable with a (null) byte.","scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"0.3.10-12"},"fixed_version":"0","urgency":"unimportant"},"bullseye":{"status":"resolved","repositories":{"bullseye":"0.3.10-12"},"fixed_version":"0","urgency":"unimportant"},"forky":{"status":"resolved","repositories":{"forky":"0.3.10-13"},"fixed_version":"0","urgency":"unimportant"},"sid":{"status":"resolved","repositories":{"sid":"0.3.10-13"},"fixed_version":"0","urgency":"unimportant"},"trixie":{"status":"resolved","repositories":{"trixie":"0.3.10-13"},"fixed_version":"0","urgency":"unimportant"}}}},"amanda":{"CVE-2002-0901":{"description":"Multiple buffer overflows in Advanced Maryland Automatic Network Disk Archiver (AMANDA) 2.3.0.4 allow (1) remote attackers to execute arbitrary code via long commands to the amindexd daemon, or certain local users to execute arbitrary code via long command line arguments to the programs (2) amcheck, (3) amgetidx, (4) amtrmidx, (5) createindex-dump, or (6) createindex-gnutar.","scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"1:3.5.1-11+deb12u2"},"fixed_version":"2.4.0b6-1","urgency":"not yet assigned"},"bullseye":{"status":"resolved","repositories":{"bullseye":"1:3.5.1-7","bullseye-security":"1:3.5.1-7+deb11u1"},"fixed_version":"2.4.0b6-1","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"1:3.5.4-2.1"},"fixed_version":"2.4.0b6-1","urgency":"not yet assigned"},"trixie":{"status":"resolved","repositories":{"trixie":"1:3.5.4-2"},"fixed_version":"2.4.0b6-1","urgency":"not yet assigned"}}},"CVE-2016-10729":{"description":"An issue was discovered in Amanda 3.3.1. A user with backup privileges can trivially compromise a client installation. The \"runtar\" setuid root binary does not check for additional arguments supplied after --create, allowing users to manipulate commands and perform command injection as root.","scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"1:3.5.1-11+deb12u2"},"fixed_version":"1:3.3.9-1","urgency":"unimportant"},"bullseye":{"status":"resolved","repositories":{"bullseye":"1:3.5.1-7","bullseye-security":"1:3.5.1-7+deb11u1"},"fixed_version":"1:3.3.9-1","urgency":"unimportant"},"sid":{"status":"resolved","repositories":{"sid":"1:3.5.4-2.1"},"fixed_version":"1:3.3.9-1","urgency":"unimportant"},"trixie":{"status":"resolved","repositories":{"trixie":"1:3.5.4-2"},"fixed_version":"1:3.3.9-1","urgency":"unimportant"}}},"CVE-2016-10730":{"description":"An issue was discovered in Amanda 3.3.1. A user with backup privileges can trivially compromise a client installation. Amstar is an Amanda Application API script. It should not be run by users directly. It uses star to backup and restore data. It runs binaries with root permissions when parsing the command line argument --star-path.","scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"1:3.5.1-11+deb12u2"},"fixed_version":"1:3.3.9-1","urgency":"unimportant"},"bullseye":{"status":"resolved","repositories":{"bullseye":"1:3.5.1-7","bullseye-security":"1:3.5.1-7+deb11u1"},"fixed_version":"1:3.3.9-1","urgency":"unimportant"},"sid":{"status":"resolved","repositories":{"sid":"1:3.5.4-2.1"},"fixed_version":"1:3.3.9-1","urgency":"unimportant"},"trixie":{"status":"resolved","repositories":{"trixie":"1:3.5.4-2"},"fixed_version":"1:3.3.9-1","urgency":"unimportant"}}},"CVE-2022-37703":{"description":"In Amanda 3.5.1, an information leak vulnerability was found in the calcsize SUID binary. An attacker can abuse this vulnerability to know if a directory exists or not anywhere in the fs. The binary will use `opendir()` as root directly without checking the path, letting the attacker provide an arbitrary path.","debianbug":1021017,"scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"1:3.5.1-11+deb12u2"},"fixed_version":"1:3.5.1-10","urgency":"not yet assigned"},"bullseye":{"status":"resolved","repositories":{"bullseye":"1:3.5.1-7","bullseye-security":"1:3.5.1-7+deb11u1"},"fixed_version":"1:3.5.1-7+deb11u1","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"1:3.5.4-2.1"},"fixed_version":"1:3.5.1-10","urgency":"not yet assigned"},"trixie":{"status":"resolved","repositories":{"trixie":"1:3.5.4-2"},"fixed_version":"1:3.5.1-10","urgency":"not yet assigned"}}},"CVE-2022-37704":{"description":"Amanda 3.5.1 allows privilege escalation from the regular user backup to root. The SUID binary located at /lib/amanda/rundump will execute /usr/sbin/dump as root with controlled arguments from the attacker which may lead to escalation of privileges, denial of service, and information disclosure.","debianbug":1029829,"scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"1:3.5.1-11+deb12u2"},"fixed_version":"1:3.5.1-10","urgency":"not yet assigned"},"bullseye":{"status":"resolved","repositories":{"bullseye":"1:3.5.1-7","bullseye-security":"1:3.5.1-7+deb11u1"},"fixed_version":"1:3.5.1-7+deb11u1","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"1:3.5.4-2.1"},"fixed_version":"1:3.5.1-10","urgency":"not yet assigned"},"trixie":{"status":"resolved","repositories":{"trixie":"1:3.5.4-2"},"fixed_version":"1:3.5.1-10","urgency":"not yet assigned"}}},"CVE-2022-37705":{"description":"A privilege escalation flaw was found in Amanda 3.5.1 in which the backup user can acquire root privileges. The vulnerable component is the runtar SUID program, which is a wrapper to run /usr/bin/tar with specific arguments that are controllable by the attacker. This program mishandles the arguments passed to tar binary (it expects that the argument name and value are separated with a space; however, separating them with an equals sign is also supported),","debianbug":1029829,"scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"1:3.5.1-11+deb12u2"},"fixed_version":"1:3.5.1-10","urgency":"not yet assigned"},"bullseye":{"status":"resolved","repositories":{"bullseye":"1:3.5.1-7","bullseye-security":"1:3.5.1-7+deb11u1"},"fixed_version":"1:3.5.1-7+deb11u1","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"1:3.5.4-2.1"},"fixed_version":"1:3.5.1-10","urgency":"not yet assigned"},"trixie":{"status":"resolved","repositories":{"trixie":"1:3.5.4-2"},"fixed_version":"1:3.5.1-10","urgency":"not yet assigned"}}},"CVE-2023-30577":{"description":"AMANDA (Advanced Maryland Automatic Network Disk Archiver) before tag-community-3.5.4 mishandles argument checking for runtar.c, a different vulnerability than CVE-2022-37705.","debianbug":1055253,"scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"1:3.5.1-11+deb12u2"},"fixed_version":"1:3.5.1-11+deb12u1","urgency":"not yet assigned"},"bullseye":{"status":"resolved","repositories":{"bullseye":"1:3.5.1-7","bullseye-security":"1:3.5.1-7+deb11u1"},"fixed_version":"1:3.5.1-7+deb11u1","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"1:3.5.4-2.1"},"fixed_version":"1:3.5.1-11.1","urgency":"not yet assigned"},"trixie":{"status":"resolved","repositories":{"trixie":"1:3.5.4-2"},"fixed_version":"1:3.5.1-11.1","urgency":"not yet assigned"}}}},"amarok":{"CVE-2006-6979":{"description":"The ruby handlers in the Magnatune component in Amarok do not properly quote text in certain contexts, probably including construction of an unzip command line, which allows attackers to execute arbitrary commands via shell metacharacters.","debianbug":410850,"scope":"local","releases":{"forky":{"status":"resolved","repositories":{"forky":"3.3.2-1"},"fixed_version":"1.4.4-1","urgency":"low"},"sid":{"status":"resolved","repositories":{"sid":"3.3.2-1"},"fixed_version":"1.4.4-1","urgency":"low"},"trixie":{"status":"resolved","repositories":{"trixie":"3.2.2-1"},"fixed_version":"1.4.4-1","urgency":"low"}}},"CVE-2006-6980":{"description":"The magnatune.com album browser in Amarok allows attackers to cause a denial of service (application crash) via unspecified vectors.","debianbug":410850,"scope":"local","releases":{"forky":{"status":"resolved","repositories":{"forky":"3.3.2-1"},"fixed_version":"1.4.4-4","urgency":"unimportant"},"sid":{"status":"resolved","repositories":{"sid":"3.3.2-1"},"fixed_version":"1.4.4-4","urgency":"unimportant"},"trixie":{"status":"resolved","repositories":{"trixie":"3.2.2-1"},"fixed_version":"1.4.4-4","urgency":"unimportant"}}},"CVE-2008-3699":{"description":"The MagnatuneBrowser::listDownloadComplete function in magnatunebrowser/magnatunebrowser.cpp in Amarok before 1.4.10 allows local users to overwrite arbitrary files via a symlink attack on the album_info.xml temporary file.","debianbug":494765,"scope":"local","releases":{"forky":{"status":"resolved","repositories":{"forky":"3.3.2-1"},"fixed_version":"1.4.10-1","urgency":"unimportant"},"sid":{"status":"resolved","repositories":{"sid":"3.3.2-1"},"fixed_version":"1.4.10-1","urgency":"unimportant"},"trixie":{"status":"resolved","repositories":{"trixie":"3.2.2-1"},"fixed_version":"1.4.10-1","urgency":"unimportant"}}},"CVE-2009-0135":{"description":"Multiple integer overflows in the Audible::Tag::readTag function in metadata/audible/audibletag.cpp in Amarok 1.4.10 through 2.0.1 allow remote attackers to execute arbitrary code via an Audible Audio (.aa) file with a large (1) nlen or (2) vlen Tag value, each of which triggers a heap-based buffer overflow.","scope":"local","releases":{"forky":{"status":"resolved","repositories":{"forky":"3.3.2-1"},"fixed_version":"1.4.10-2","urgency":"medium"},"sid":{"status":"resolved","repositories":{"sid":"3.3.2-1"},"fixed_version":"1.4.10-2","urgency":"medium"},"trixie":{"status":"resolved","repositories":{"trixie":"3.2.2-1"},"fixed_version":"1.4.10-2","urgency":"medium"}}},"CVE-2009-0136":{"description":"Multiple array index errors in the Audible::Tag::readTag function in metadata/audible/audibletag.cpp in Amarok 1.4.10 through 2.0.1 allow remote attackers to cause a denial of service (application crash) or execute arbitrary code via an Audible Audio (.aa) file with a crafted (1) nlen or (2) vlen Tag value, each of which can lead to an invalid pointer dereference, or the writing of a 0x00 byte to an arbitrary memory location, after an allocation failure.","scope":"local","releases":{"forky":{"status":"resolved","repositories":{"forky":"3.3.2-1"},"fixed_version":"1.4.10-2","urgency":"medium"},"sid":{"status":"resolved","repositories":{"sid":"3.3.2-1"},"fixed_version":"1.4.10-2","urgency":"medium"},"trixie":{"status":"resolved","repositories":{"trixie":"3.2.2-1"},"fixed_version":"1.4.10-2","urgency":"medium"}}},"CVE-2020-13152":{"description":"A remote user can create a specially crafted M3U file, media playlist file that when loaded by the target user, will trigger a memory leak, whereby Amarok 2.8.0 continue to waste resources over time, eventually allows attackers to cause a denial of service.","scope":"local","releases":{"forky":{"status":"open","repositories":{"forky":"3.3.2-1"},"urgency":"unimportant"},"sid":{"status":"open","repositories":{"sid":"3.3.2-1"},"urgency":"unimportant"},"trixie":{"status":"open","repositories":{"trixie":"3.2.2-1"},"urgency":"unimportant"}}}},"amavisd-new":{"CVE-2024-28054":{"description":"Amavis before 2.12.3 and 2.13.x before 2.13.1, in part because of its use of MIME-tools, has an Interpretation Conflict (relative to some mail user agents) when there are multiple boundary parameters in a MIME email message. Consequently, there can be an incorrect check for banned files or malware.","scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"1:2.13.0-3+deb12u1"},"fixed_version":"1:2.13.0-3+deb12u1","urgency":"not yet assigned"},"bullseye":{"status":"resolved","repositories":{"bullseye":"1:2.11.1-5+deb11u1"},"fixed_version":"1:2.11.1-5+deb11u1","urgency":"not yet assigned"},"forky":{"status":"resolved","repositories":{"forky":"1:2.13.0-7"},"fixed_version":"1:2.13.0-5","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"1:2.13.0-7"},"fixed_version":"1:2.13.0-5","urgency":"not yet assigned"},"trixie":{"status":"resolved","repositories":{"trixie":"1:2.13.0-7"},"fixed_version":"1:2.13.0-5","urgency":"not yet assigned"}}},"TEMP-0410588-2CACBB":{"debianbug":410588,"releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"1:2.13.0-3+deb12u1"},"fixed_version":"1:2.5.2-1","urgency":"unimportant"},"bullseye":{"status":"resolved","repositories":{"bullseye":"1:2.11.1-5+deb11u1"},"fixed_version":"1:2.5.2-1","urgency":"unimportant"},"forky":{"status":"resolved","repositories":{"forky":"1:2.13.0-7"},"fixed_version":"1:2.5.2-1","urgency":"unimportant"},"sid":{"status":"resolved","repositories":{"sid":"1:2.13.0-7"},"fixed_version":"1:2.5.2-1","urgency":"unimportant"},"trixie":{"status":"resolved","repositories":{"trixie":"1:2.13.0-7"},"fixed_version":"1:2.5.2-1","urgency":"unimportant"}}}},"amd64-microcode":{"CVE-2017-5715":{"description":"Systems with microprocessors utilizing speculative execution and indirect branch prediction may allow unauthorized disclosure of information to an attacker with local user access via a side-channel analysis.","scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"3.20250311.1~deb12u1","bookworm-security":"3.20230719.1~deb12u1"},"fixed_version":"3.20180515.1","urgency":"not yet assigned"},"bullseye":{"status":"resolved","repositories":{"bullseye":"3.20240820.1~deb11u1","bullseye-security":"3.20250311.1~deb11u1"},"fixed_version":"3.20180515.1","urgency":"not yet assigned"},"forky":{"status":"resolved","repositories":{"forky":"3.20251202.1"},"fixed_version":"3.20180515.1","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"3.20251202.1"},"fixed_version":"3.20180515.1","urgency":"not yet assigned"},"trixie":{"status":"resolved","repositories":{"trixie":"3.20250311.1"},"fixed_version":"3.20180515.1","urgency":"not yet assigned"}}},"CVE-2019-9836":{"description":"Secure Encrypted Virtualization (SEV) on Advanced Micro Devices (AMD) Platform Security Processor (PSP; aka AMD Secure Processor or AMD-SP) 0.17 build 11 and earlier has an insecure cryptographic implementation.","debianbug":970395,"scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"3.20250311.1~deb12u1","bookworm-security":"3.20230719.1~deb12u1"},"fixed_version":"3.20220411.1","urgency":"not yet assigned"},"bullseye":{"status":"resolved","repositories":{"bullseye":"3.20240820.1~deb11u1","bullseye-security":"3.20250311.1~deb11u1"},"fixed_version":"3.20230719.1~deb11u1","urgency":"not yet assigned"},"forky":{"status":"resolved","repositories":{"forky":"3.20251202.1"},"fixed_version":"3.20220411.1","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"3.20251202.1"},"fixed_version":"3.20220411.1","urgency":"not yet assigned"},"trixie":{"status":"resolved","repositories":{"trixie":"3.20250311.1"},"fixed_version":"3.20220411.1","urgency":"not yet assigned"}}},"CVE-2023-20569":{"description":"A side channel vulnerability on some of the AMD CPUs may allow an attacker to influence the return address prediction. This may result in speculative execution at an attacker-controlled\u202faddress, potentially leading to information disclosure.","scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"3.20250311.1~deb12u1","bookworm-security":"3.20230719.1~deb12u1"},"fixed_version":"3.20230719.1~deb12u1","urgency":"not yet assigned"},"bullseye":{"status":"resolved","repositories":{"bullseye":"3.20240820.1~deb11u1","bullseye-security":"3.20250311.1~deb11u1"},"fixed_version":"3.20230719.1~deb11u1","urgency":"not yet assigned"},"forky":{"status":"resolved","repositories":{"forky":"3.20251202.1"},"fixed_version":"3.20230719.1","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"3.20251202.1"},"fixed_version":"3.20230719.1","urgency":"not yet assigned"},"trixie":{"status":"resolved","repositories":{"trixie":"3.20250311.1"},"fixed_version":"3.20230719.1","urgency":"not yet assigned"}}},"CVE-2023-20584":{"description":"IOMMU improperly handles certain special address ranges with invalid device table entries (DTEs), which may allow an attacker with privileges and a compromised Hypervisor to induce DTE faults to bypass RMP checks in SEV-SNP, potentially leading to a loss of guest integrity.","scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"3.20250311.1~deb12u1","bookworm-security":"3.20230719.1~deb12u1"},"fixed_version":"3.20240820.1~deb12u1","urgency":"not yet assigned"},"bullseye":{"status":"resolved","repositories":{"bullseye":"3.20240820.1~deb11u1","bullseye-security":"3.20250311.1~deb11u1"},"fixed_version":"3.20240820.1~deb11u1","urgency":"not yet assigned"},"forky":{"status":"resolved","repositories":{"forky":"3.20251202.1"},"fixed_version":"3.20240820.1","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"3.20251202.1"},"fixed_version":"3.20240820.1","urgency":"not yet assigned"},"trixie":{"status":"resolved","repositories":{"trixie":"3.20250311.1"},"fixed_version":"3.20240820.1","urgency":"not yet assigned"}}},"CVE-2023-20592":{"description":"Improper or unexpected behavior of the INVD instruction in some AMD CPUs may allow an attacker with a malicious hypervisor to affect cache line write-back behavior of the CPU leading to a potential loss of guest virtual machine (VM) memory integrity.","scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"3.20250311.1~deb12u1","bookworm-security":"3.20230719.1~deb12u1"},"fixed_version":"3.20230719.1~deb12u1","urgency":"not yet assigned"},"bullseye":{"status":"resolved","repositories":{"bullseye":"3.20240820.1~deb11u1","bullseye-security":"3.20250311.1~deb11u1"},"fixed_version":"3.20230719.1~deb11u1","urgency":"not yet assigned"},"forky":{"status":"resolved","repositories":{"forky":"3.20251202.1"},"fixed_version":"3.20230719.1","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"3.20251202.1"},"fixed_version":"3.20230719.1","urgency":"not yet assigned"},"trixie":{"status":"resolved","repositories":{"trixie":"3.20250311.1"},"fixed_version":"3.20230719.1","urgency":"not yet assigned"}}},"CVE-2023-20593":{"description":"An issue in \u201cZen 2\u201d CPUs, under specific microarchitectural circumstances, may allow an attacker to potentially access sensitive information.","debianbug":1041863,"scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"3.20250311.1~deb12u1","bookworm-security":"3.20230719.1~deb12u1"},"fixed_version":"3.20230719.1~deb12u1","urgency":"not yet assigned"},"bullseye":{"status":"resolved","repositories":{"bullseye":"3.20240820.1~deb11u1","bullseye-security":"3.20250311.1~deb11u1"},"fixed_version":"3.20230719.1~deb11u1","urgency":"not yet assigned"},"forky":{"status":"resolved","repositories":{"forky":"3.20251202.1"},"fixed_version":"3.20230719.1","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"3.20251202.1"},"fixed_version":"3.20230719.1","urgency":"not yet assigned"},"trixie":{"status":"resolved","repositories":{"trixie":"3.20250311.1"},"fixed_version":"3.20230719.1","urgency":"not yet assigned"}}},"CVE-2023-31315":{"description":"Improper validation in a model specific register (MSR) could allow a malicious program with ring0 access to modify SMM configuration while SMI lock is enabled, potentially leading to arbitrary code execution.","scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"3.20250311.1~deb12u1","bookworm-security":"3.20230719.1~deb12u1"},"fixed_version":"3.20240710.2~deb12u1","urgency":"not yet assigned"},"bullseye":{"status":"resolved","repositories":{"bullseye":"3.20240820.1~deb11u1","bullseye-security":"3.20250311.1~deb11u1"},"fixed_version":"3.20240710.2~deb11u1","urgency":"not yet assigned"},"forky":{"status":"resolved","repositories":{"forky":"3.20251202.1"},"fixed_version":"3.20240710.1","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"3.20251202.1"},"fixed_version":"3.20240710.1","urgency":"not yet assigned"},"trixie":{"status":"resolved","repositories":{"trixie":"3.20250311.1"},"fixed_version":"3.20240710.1","urgency":"not yet assigned"}}},"CVE-2023-31356":{"description":"Incomplete system memory cleanup in SEV firmware could allow a privileged attacker to corrupt guest private memory, potentially resulting in a loss of data integrity.","scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"3.20250311.1~deb12u1","bookworm-security":"3.20230719.1~deb12u1"},"fixed_version":"3.20240820.1~deb12u1","urgency":"not yet assigned"},"bullseye":{"status":"resolved","repositories":{"bullseye":"3.20240820.1~deb11u1","bullseye-security":"3.20250311.1~deb11u1"},"fixed_version":"3.20240820.1~deb11u1","urgency":"not yet assigned"},"forky":{"status":"resolved","repositories":{"forky":"3.20251202.1"},"fixed_version":"3.20240820.1","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"3.20251202.1"},"fixed_version":"3.20240820.1","urgency":"not yet assigned"},"trixie":{"status":"resolved","repositories":{"trixie":"3.20250311.1"},"fixed_version":"3.20240820.1","urgency":"not yet assigned"}}},"CVE-2024-36348":{"description":"A transient execution vulnerability in some AMD processors may allow a user process to infer the control registers speculatively even if UMIP feature is enabled, potentially resulting in information leakage.","scope":"local","releases":{"bookworm":{"status":"open","repositories":{"bookworm":"3.20250311.1~deb12u1","bookworm-security":"3.20230719.1~deb12u1"},"urgency":"unimportant"},"bullseye":{"status":"open","repositories":{"bullseye":"3.20240820.1~deb11u1","bullseye-security":"3.20250311.1~deb11u1"},"urgency":"unimportant"},"forky":{"status":"open","repositories":{"forky":"3.20251202.1"},"urgency":"unimportant"},"sid":{"status":"open","repositories":{"sid":"3.20251202.1"},"urgency":"unimportant"},"trixie":{"status":"open","repositories":{"trixie":"3.20250311.1"},"urgency":"unimportant"}}},"CVE-2024-36349":{"description":"A transient execution vulnerability in some AMD processors may allow a user process to infer TSC_AUX even when such a read is disabled, potentially resulting in information leakage.","scope":"local","releases":{"bookworm":{"status":"open","repositories":{"bookworm":"3.20250311.1~deb12u1","bookworm-security":"3.20230719.1~deb12u1"},"urgency":"unimportant"},"bullseye":{"status":"open","repositories":{"bullseye":"3.20240820.1~deb11u1","bullseye-security":"3.20250311.1~deb11u1"},"urgency":"unimportant"},"forky":{"status":"open","repositories":{"forky":"3.20251202.1"},"urgency":"unimportant"},"sid":{"status":"open","repositories":{"sid":"3.20251202.1"},"urgency":"unimportant"},"trixie":{"status":"open","repositories":{"trixie":"3.20250311.1"},"urgency":"unimportant"}}},"CVE-2024-36350":{"description":"A transient execution vulnerability in some AMD processors may allow an attacker to infer data from previous stores, potentially resulting in the leakage of privileged information.","debianbug":1109035,"scope":"local","releases":{"bookworm":{"status":"open","repositories":{"bookworm":"3.20250311.1~deb12u1","bookworm-security":"3.20230719.1~deb12u1"},"urgency":"not yet assigned"},"bullseye":{"status":"open","repositories":{"bullseye":"3.20240820.1~deb11u1","bullseye-security":"3.20250311.1~deb11u1"},"urgency":"not yet assigned"},"forky":{"status":"resolved","repositories":{"forky":"3.20251202.1"},"fixed_version":"3.20251202.1","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"3.20251202.1"},"fixed_version":"3.20251202.1","urgency":"not yet assigned"},"trixie":{"status":"open","repositories":{"trixie":"3.20250311.1"},"urgency":"not yet assigned"}}},"CVE-2024-36357":{"description":"A transient execution vulnerability in some AMD processors may allow an attacker to infer data in the L1D cache, potentially resulting in the leakage of sensitive information across privileged boundaries.","debianbug":1109035,"scope":"local","releases":{"bookworm":{"status":"open","repositories":{"bookworm":"3.20250311.1~deb12u1","bookworm-security":"3.20230719.1~deb12u1"},"urgency":"not yet assigned"},"bullseye":{"status":"open","repositories":{"bullseye":"3.20240820.1~deb11u1","bullseye-security":"3.20250311.1~deb11u1"},"urgency":"not yet assigned"},"forky":{"status":"resolved","repositories":{"forky":"3.20251202.1"},"fixed_version":"3.20251202.1","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"3.20251202.1"},"fixed_version":"3.20251202.1","urgency":"not yet assigned"},"trixie":{"status":"open","repositories":{"trixie":"3.20250311.1"},"urgency":"not yet assigned"}}},"CVE-2024-56161":{"description":"Improper signature verification in AMD CPU ROM microcode patch loader may allow an attacker with local administrator privilege to load malicious CPU microcode resulting in loss of confidentiality and integrity of a confidential guest running under AMD SEV-SNP.","debianbug":1095470,"scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"3.20250311.1~deb12u1","bookworm-security":"3.20230719.1~deb12u1"},"fixed_version":"3.20250311.1~deb12u1","urgency":"not yet assigned"},"bullseye":{"status":"resolved","repositories":{"bullseye":"3.20240820.1~deb11u1","bullseye-security":"3.20250311.1~deb11u1"},"fixed_version":"3.20250311.1~deb11u1","urgency":"not yet assigned"},"forky":{"status":"resolved","repositories":{"forky":"3.20251202.1"},"fixed_version":"3.20250311.1","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"3.20251202.1"},"fixed_version":"3.20250311.1","urgency":"not yet assigned"},"trixie":{"status":"resolved","repositories":{"trixie":"3.20250311.1"},"fixed_version":"3.20250311.1","urgency":"not yet assigned"}}},"CVE-2025-0033":{"description":"Improper access control within AMD SEV-SNP could allow an admin privileged attacker to write to the RMP during SNP initialization, potentially resulting in a loss of SEV-SNP guest memory integrity.","scope":"local","releases":{"bookworm":{"status":"open","repositories":{"bookworm":"3.20250311.1~deb12u1","bookworm-security":"3.20230719.1~deb12u1"},"urgency":"not yet assigned"},"bullseye":{"status":"open","repositories":{"bullseye":"3.20240820.1~deb11u1","bullseye-security":"3.20250311.1~deb11u1"},"urgency":"not yet assigned"},"forky":{"status":"open","repositories":{"forky":"3.20251202.1"},"urgency":"not yet assigned"},"sid":{"status":"open","repositories":{"sid":"3.20251202.1"},"urgency":"not yet assigned"},"trixie":{"status":"open","repositories":{"trixie":"3.20250311.1"},"urgency":"not yet assigned"}}},"CVE-2025-29934":{"description":"A bug within some AMD CPUs could allow a local admin-privileged attacker to run a SEV-SNP guest using stale TLB entries, potentially resulting in loss of data integrity.","scope":"local","releases":{"bookworm":{"status":"open","repositories":{"bookworm":"3.20250311.1~deb12u1","bookworm-security":"3.20230719.1~deb12u1"},"urgency":"not yet assigned"},"bullseye":{"status":"open","repositories":{"bullseye":"3.20240820.1~deb11u1","bullseye-security":"3.20250311.1~deb11u1"},"urgency":"not yet assigned"},"forky":{"status":"open","repositories":{"forky":"3.20251202.1"},"urgency":"not yet assigned"},"sid":{"status":"open","repositories":{"sid":"3.20251202.1"},"urgency":"not yet assigned"},"trixie":{"status":"open","repositories":{"trixie":"3.20250311.1"},"urgency":"not yet assigned"}}},"CVE-2025-29943":{"description":"Write what were condition within AMD CPUs may allow an admin-privileged attacker to modify the configuration of the CPU pipeline potentially resulting in the corruption of the stack pointer inside an SEV-SNP guest.","scope":"local","releases":{"bookworm":{"status":"open","repositories":{"bookworm":"3.20250311.1~deb12u1","bookworm-security":"3.20230719.1~deb12u1"},"urgency":"not yet assigned"},"bullseye":{"status":"open","repositories":{"bullseye":"3.20240820.1~deb11u1","bullseye-security":"3.20250311.1~deb11u1"},"urgency":"not yet assigned"},"forky":{"status":"resolved","repositories":{"forky":"3.20251202.1"},"fixed_version":"3.20251202.1","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"3.20251202.1"},"fixed_version":"3.20251202.1","urgency":"not yet assigned"},"trixie":{"status":"open","repositories":{"trixie":"3.20250311.1"},"urgency":"not yet assigned"}}},"CVE-2025-48514":{"description":"Insufficient Granularity of Access Control in SEV firmware can allow a privileged attacker to create a SEV-ES Guest to attack SNP guest, potentially resulting in a loss of confidentiality.","scope":"local","releases":{"bookworm":{"status":"open","repositories":{"bookworm":"3.20250311.1~deb12u1","bookworm-security":"3.20230719.1~deb12u1"},"urgency":"not yet assigned"},"bullseye":{"status":"open","repositories":{"bullseye":"3.20240820.1~deb11u1","bullseye-security":"3.20250311.1~deb11u1"},"urgency":"not yet assigned"},"forky":{"status":"open","repositories":{"forky":"3.20251202.1"},"urgency":"not yet assigned"},"sid":{"status":"open","repositories":{"sid":"3.20251202.1"},"urgency":"not yet assigned"},"trixie":{"status":"open","repositories":{"trixie":"3.20250311.1"},"urgency":"not yet assigned"}}},"CVE-2025-48517":{"description":"Insufficient Granularity of Access Control in SEV firmware could allow a privileged user with a malicious hypervisor to create a SEV-ES guest with an ASID in the range meant for SEV-SNP guests potentially resulting in a partial loss of confidentiality.","scope":"local","releases":{"bookworm":{"status":"open","repositories":{"bookworm":"3.20250311.1~deb12u1","bookworm-security":"3.20230719.1~deb12u1"},"urgency":"not yet assigned"},"bullseye":{"status":"open","repositories":{"bullseye":"3.20240820.1~deb11u1","bullseye-security":"3.20250311.1~deb11u1"},"urgency":"not yet assigned"},"forky":{"status":"open","repositories":{"forky":"3.20251202.1"},"urgency":"not yet assigned"},"sid":{"status":"open","repositories":{"sid":"3.20251202.1"},"urgency":"not yet assigned"},"trixie":{"status":"open","repositories":{"trixie":"3.20250311.1"},"urgency":"not yet assigned"}}},"CVE-2025-52534":{"description":"Improper bound check within AMD CPU microcode can allow a malicious guest to write to host memory, potentially resulting in loss of integrity.","scope":"local","releases":{"bookworm":{"status":"open","repositories":{"bookworm":"3.20250311.1~deb12u1","bookworm-security":"3.20230719.1~deb12u1"},"urgency":"not yet assigned"},"bullseye":{"status":"open","repositories":{"bullseye":"3.20240820.1~deb11u1","bullseye-security":"3.20250311.1~deb11u1"},"urgency":"not yet assigned"},"forky":{"status":"open","repositories":{"forky":"3.20251202.1"},"urgency":"not yet assigned"},"sid":{"status":"open","repositories":{"sid":"3.20251202.1"},"urgency":"not yet assigned"},"trixie":{"status":"open","repositories":{"trixie":"3.20250311.1"},"urgency":"not yet assigned"}}},"CVE-2025-52536":{"description":"Improper Prevention of Lock Bit Modification in SEV firmware could allow a privileged attacker to downgrade firmware potentially resulting in a loss of integrity.","scope":"local","releases":{"bookworm":{"status":"open","repositories":{"bookworm":"3.20250311.1~deb12u1","bookworm-security":"3.20230719.1~deb12u1"},"urgency":"not yet assigned"},"bullseye":{"status":"open","repositories":{"bullseye":"3.20240820.1~deb11u1","bullseye-security":"3.20250311.1~deb11u1"},"urgency":"not yet assigned"},"forky":{"status":"open","repositories":{"forky":"3.20251202.1"},"urgency":"not yet assigned"},"sid":{"status":"open","repositories":{"sid":"3.20251202.1"},"urgency":"not yet assigned"},"trixie":{"status":"open","repositories":{"trixie":"3.20250311.1"},"urgency":"not yet assigned"}}},"CVE-2025-54514":{"description":"Improper isolation of shared resources on a system on a chip by a malicious local attacker with high privileges could potentially lead to a partial loss of integrity.","scope":"local","releases":{"bookworm":{"status":"open","repositories":{"bookworm":"3.20250311.1~deb12u1","bookworm-security":"3.20230719.1~deb12u1"},"urgency":"not yet assigned"},"bullseye":{"status":"open","repositories":{"bullseye":"3.20240820.1~deb11u1","bullseye-security":"3.20250311.1~deb11u1"},"urgency":"not yet assigned"},"forky":{"status":"open","repositories":{"forky":"3.20251202.1"},"urgency":"not yet assigned"},"sid":{"status":"open","repositories":{"sid":"3.20251202.1"},"urgency":"not yet assigned"},"trixie":{"status":"open","repositories":{"trixie":"3.20250311.1"},"urgency":"not yet assigned"}}},"CVE-2025-62626":{"description":"Improper handling of insufficient entropy in the AMD CPUs could allow a local attacker to influence the values returned by the RDSEED instruction, potentially resulting in the consumption of insufficiently random values.","debianbug":1120005,"scope":"local","releases":{"bookworm":{"status":"open","repositories":{"bookworm":"3.20250311.1~deb12u1","bookworm-security":"3.20230719.1~deb12u1"},"urgency":"not yet assigned","nodsa":"Only affects AMD Zen 5 processors, limited support; problematic microcode update","nodsa_reason":"ignored"},"bullseye":{"status":"open","repositories":{"bullseye":"3.20240820.1~deb11u1","bullseye-security":"3.20250311.1~deb11u1"},"urgency":"not yet assigned"},"forky":{"status":"resolved","repositories":{"forky":"3.20251202.1"},"fixed_version":"3.20251202.1","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"3.20251202.1"},"fixed_version":"3.20251202.1","urgency":"not yet assigned"},"trixie":{"status":"open","repositories":{"trixie":"3.20250311.1"},"urgency":"not yet assigned","nodsa":"Only affects AMD Zen 5 processors, limited support; problematic microcode update","nodsa_reason":"ignored"}}}},"amule":{"CVE-2006-2691":{"description":"Unspecified \"information leakage\" vulnerabilities in aMuleWeb for AMule before 2.1.2 allow remote attackers to access arbitrary images, including dynamically generated images, via unknown vectors.","scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"1:2.3.3-3"},"fixed_version":"2.1.2-1","urgency":"medium"},"bullseye":{"status":"resolved","repositories":{"bullseye":"1:2.3.3-1"},"fixed_version":"2.1.2-1","urgency":"medium"},"sid":{"status":"resolved","repositories":{"sid":"1:2.3.3-3.2"},"fixed_version":"2.1.2-1","urgency":"medium"},"trixie":{"status":"resolved","repositories":{"trixie":"1:2.3.3-3.2"},"fixed_version":"2.1.2-1","urgency":"medium"}}},"CVE-2006-2692":{"description":"Multiple unspecified vulnerabilities in aMuleWeb for AMule before 2.1.2 allow remote attackers to read arbitrary image, HTML, or PHP files via unknown vectors, probably related to directory traversal.","scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"1:2.3.3-3"},"fixed_version":"2.1.2-1","urgency":"medium"},"bullseye":{"status":"resolved","repositories":{"bullseye":"1:2.3.3-1"},"fixed_version":"2.1.2-1","urgency":"medium"},"sid":{"status":"resolved","repositories":{"sid":"1:2.3.3-3.2"},"fixed_version":"2.1.2-1","urgency":"medium"},"trixie":{"status":"resolved","repositories":{"trixie":"1:2.3.3-3.2"},"fixed_version":"2.1.2-1","urgency":"medium"}}},"CVE-2008-2486":{"description":"Unspecified vulnerability in eMule Plus before 1.2d has unknown impact and attack vectors related to \"staticservers.dat processing.\"","scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"1:2.3.3-3"},"fixed_version":"0","urgency":"unimportant"},"bullseye":{"status":"resolved","repositories":{"bullseye":"1:2.3.3-1"},"fixed_version":"0","urgency":"unimportant"},"sid":{"status":"resolved","repositories":{"sid":"1:2.3.3-3.2"},"fixed_version":"0","urgency":"unimportant"},"trixie":{"status":"resolved","repositories":{"trixie":"1:2.3.3-3.2"},"fixed_version":"0","urgency":"unimportant"}}},"CVE-2009-1440":{"description":"Incomplete blacklist vulnerability in DownloadListCtrl.cpp in amule 2.2.4 allows remote attackers to conduct argument injection attacks into a command for mplayer via a crafted filename.","debianbug":525078,"scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"1:2.3.3-3"},"fixed_version":"2.2.5-1.1","urgency":"low"},"bullseye":{"status":"resolved","repositories":{"bullseye":"1:2.3.3-1"},"fixed_version":"2.2.5-1.1","urgency":"low"},"sid":{"status":"resolved","repositories":{"sid":"1:2.3.3-3.2"},"fixed_version":"2.2.5-1.1","urgency":"low"},"trixie":{"status":"resolved","repositories":{"trixie":"1:2.3.3-3.2"},"fixed_version":"2.2.5-1.1","urgency":"low"}}}},"analog":{"CVE-2002-1154":{"description":"anlgform.pl in Analog before 5.23 does not restrict access to the PROGRESSFREQ progress update command, which allows remote attackers to cause a denial of service (disk consumption) by using the command to report updates more frequently and fill the web server error log.","scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"2:6.0.17-3"},"fixed_version":"2:5.23","urgency":"not yet assigned"},"bullseye":{"status":"resolved","repositories":{"bullseye":"2:6.0-22"},"fixed_version":"2:5.23","urgency":"not yet assigned"},"forky":{"status":"resolved","repositories":{"forky":"2:6.0.17-3"},"fixed_version":"2:5.23","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"2:6.0.17-3"},"fixed_version":"2:5.23","urgency":"not yet assigned"},"trixie":{"status":"resolved","repositories":{"trixie":"2:6.0.17-3"},"fixed_version":"2:5.23","urgency":"not yet assigned"}}}},"android-framework-23":{"CVE-2017-0752":{"description":"A elevation of privilege vulnerability in the Android framework (windowmanager). Product: Android. Versions: 4.4.4, 5.0.2, 5.1.1, 6.0, 6.0.1, 7.0, 7.1.1, 7.1.2. Android ID: A-62196835.","scope":"local","releases":{"bullseye":{"status":"open","repositories":{"bullseye":"6.0.1+r72-6"},"urgency":"unimportant"},"sid":{"status":"open","repositories":{"sid":"6.0.1+r72-6"},"urgency":"unimportant"}}},"CVE-2017-0822":{"description":"An elevation of privilege vulnerability in the Android system (camera). Product: Android. Versions: 6.0.1, 7.0, 7.1.1, 7.1.2, 8.0. Android ID: A-63787722.","scope":"local","releases":{"bullseye":{"status":"open","repositories":{"bullseye":"6.0.1+r72-6"},"urgency":"unimportant"},"sid":{"status":"open","repositories":{"sid":"6.0.1+r72-6"},"urgency":"unimportant"}}}},"android-platform-dalvik":{"CVE-2016-3758":{"description":"Multiple buffer overflows in libdex/OptInvocation.cpp in DexClassLoader in Android 4.x before 4.4.4, 5.0.x before 5.0.2, 5.1.x before 5.1.1, and 6.x before 2016-07-01 allow attackers to gain privileges via a crafted application that provides a long filename, aka internal bug 27840771.","scope":"local","releases":{"bullseye":{"status":"resolved","repositories":{"bullseye":"10.0.0+r36-1"},"fixed_version":"6.0.1+r55-1","urgency":"not yet assigned"}}}},"android-platform-external-libunwind":{"CVE-2015-3239":{"description":"Off-by-one error in the dwarf_to_unw_regnum function in include/dwarf_i.h in libunwind 1.1 allows local users to have unspecified impact via invalid dwarf opcodes.","debianbug":849346,"scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"10.0.0+r36-4"},"fixed_version":"7.0.0+r1-4","urgency":"not yet assigned"},"bullseye":{"status":"resolved","repositories":{"bullseye":"10.0.0+r36-4"},"fixed_version":"7.0.0+r1-4","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"10.0.0+r36-4.1"},"fixed_version":"7.0.0+r1-4","urgency":"not yet assigned"},"trixie":{"status":"resolved","repositories":{"trixie":"10.0.0+r36-4.1"},"fixed_version":"7.0.0+r1-4","urgency":"not yet assigned"}}}},"android-platform-frameworks-base":{"CVE-2021-39796":{"description":"In HarmfulAppWarningActivity of HarmfulAppWarningActivity.java, there is a possible way to trick victim to install harmful app due to a tapjacking/overlay attack. This could lead to local escalation of privilege with User execution privileges needed. User interaction is needed for exploitation.Product: AndroidVersions: Android-10 Android-11 Android-12 Android-12LAndroid ID: A-205595291","debianbug":1009626,"scope":"local","releases":{"bookworm":{"status":"open","repositories":{"bookworm":"1:10.0.0+r36-10"},"urgency":"unimportant"},"bullseye":{"status":"open","repositories":{"bullseye":"1:10.0.0+r36-3"},"urgency":"unimportant"},"forky":{"status":"open","repositories":{"forky":"1:14~beta1-5"},"urgency":"unimportant"},"sid":{"status":"open","repositories":{"sid":"1:14~beta1-5"},"urgency":"unimportant"},"trixie":{"status":"open","repositories":{"trixie":"1:14~beta1-3"},"urgency":"unimportant"}}},"CVE-2022-20011":{"description":"In getArray of NotificationManagerService.java , there is a possible leak of one user notifications to another due to missing check. This could lead to local information disclosure with no additional execution privileges needed. User interaction is not needed for exploitation.Product: AndroidVersions: Android-10 Android-11 Android-12 Android-12LAndroid ID: A-214999128","scope":"local","releases":{"bookworm":{"status":"open","repositories":{"bookworm":"1:10.0.0+r36-10"},"urgency":"unimportant"},"bullseye":{"status":"open","repositories":{"bullseye":"1:10.0.0+r36-3"},"urgency":"unimportant"},"forky":{"status":"open","repositories":{"forky":"1:14~beta1-5"},"urgency":"unimportant"},"sid":{"status":"open","repositories":{"sid":"1:14~beta1-5"},"urgency":"unimportant"},"trixie":{"status":"open","repositories":{"trixie":"1:14~beta1-3"},"urgency":"unimportant"}}}},"android-platform-frameworks-native":{"CVE-2015-3875":{"description":"libutils in Android before 5.1.1 LMY48T allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted audio file, aka internal bug 22952485.","debianbug":806375,"scope":"local","releases":{"bookworm":{"status":"open","repositories":{"bookworm":"1:10.0.0+r36-1"},"urgency":"unimportant"},"bullseye":{"status":"open","repositories":{"bullseye":"1:10.0.0+r36-1"},"urgency":"unimportant"}}},"CVE-2015-6602":{"description":"libutils in Android through 5.1.1 LMY48M allows remote attackers to execute arbitrary code via crafted metadata in a (1) MP3 or (2) MP4 file, as demonstrated by an attack against use of libutils by libstagefright in Android 5.x.","debianbug":806375,"scope":"local","releases":{"bookworm":{"status":"open","repositories":{"bookworm":"1:10.0.0+r36-1"},"urgency":"unimportant"},"bullseye":{"status":"open","repositories":{"bullseye":"1:10.0.0+r36-1"},"urgency":"unimportant"}}},"CVE-2015-6609":{"description":"libutils in Android before 5.1.1 LMY48X and 6.0 before 2015-11-01 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted audio file, aka internal bug 22953624.","debianbug":806375,"scope":"local","releases":{"bookworm":{"status":"open","repositories":{"bookworm":"1:10.0.0+r36-1"},"urgency":"unimportant"},"bullseye":{"status":"open","repositories":{"bullseye":"1:10.0.0+r36-1"},"urgency":"unimportant"}}}},"android-platform-system-core":{"CVE-2012-5564":{"description":"android-tools 4.1.1 in Android Debug Bridge (ADB) allows local users to overwrite arbitrary files via a symlink attack on /tmp/adb.log.","debianbug":823792,"scope":"local","releases":{"bullseye":{"status":"open","repositories":{"bullseye":"1:10.0.0+r36-7"},"urgency":"unimportant"}}},"CVE-2014-1909":{"description":"Integer signedness error in system/core/adb/adb_client.c in Android Debug Bridge (ADB) for Android 4.4 in the Android SDK Platform Tools 18.0.1 allows ADB servers to execute arbitrary code via a negative length value, which bypasses a signed comparison and triggers a stack-based buffer overflow.","scope":"local","releases":{"bullseye":{"status":"resolved","repositories":{"bullseye":"1:10.0.0+r36-7"},"fixed_version":"1:6.0.0+r26-1~stage1","urgency":"not yet assigned"}}},"CVE-2016-0807":{"description":"The get_build_id function in elf_utils.cpp in Debuggerd in Android 6.x before 2016-02-01 allows attackers to gain privileges via a crafted application that mishandles a Desc Size element in an ELF Note, aka internal bug 25187394.","scope":"local","releases":{"bullseye":{"status":"resolved","repositories":{"bullseye":"1:10.0.0+r36-7"},"fixed_version":"1:7.0.0+r1-1","urgency":"unimportant"}}},"CVE-2016-3861":{"description":"LibUtils in Android 4.x before 4.4.4, 5.0.x before 5.0.2, 5.1.x before 5.1.1, 6.x before 2016-09-01, and 7.0 before 2016-09-01 mishandles conversions between Unicode character encodings with different encoding widths, which allows remote attackers to execute arbitrary code or cause a denial of service (heap-based buffer overflow) via a crafted file, aka internal bug 29250543.","debianbug":858177,"scope":"local","releases":{"bullseye":{"status":"resolved","repositories":{"bullseye":"1:10.0.0+r36-7"},"fixed_version":"1:7.0.0+r1-4","urgency":"unimportant"}}},"CVE-2016-3885":{"description":"debuggerd/debuggerd.cpp in Debuggerd in Android 5.0.x before 5.0.2, 5.1.x before 5.1.1, 6.x before 2016-09-01, and 7.0 before 2016-09-01 mishandles the interaction between PTRACE_ATTACH operations and thread exits, which allows attackers to gain privileges via a crafted application, aka internal bug 29555636.","scope":"local","releases":{"bullseye":{"status":"resolved","repositories":{"bullseye":"1:10.0.0+r36-7"},"fixed_version":"0","urgency":"unimportant"}}},"CVE-2016-3890":{"description":"The Java Debug Wire Protocol (JDWP) implementation in adb/sockets.cpp in Android 4.x before 4.4.4, 5.0.x before 5.0.2, 5.1.x before 5.1.1, and 6.x before 2016-09-01 mishandles socket close operations, which allows attackers to gain privileges via a crafted application, aka internal bug 28347842.","scope":"local","releases":{"bullseye":{"status":"resolved","repositories":{"bullseye":"1:10.0.0+r36-7"},"fixed_version":"1:6.0.1+r43-1","urgency":"not yet assigned"}}},"CVE-2016-3921":{"description":"libsysutils/src/FrameworkListener.cpp in Framework Listener in Android 4.x before 4.4.4, 5.0.x before 5.0.2, 5.1.x before 5.1.1, 6.x before 2016-10-01, and 7.0 before 2016-10-01 allows attackers to gain privileges via a crafted application, aka internal bug 29831647.","scope":"local","releases":{"bullseye":{"status":"resolved","repositories":{"bullseye":"1:10.0.0+r36-7"},"fixed_version":"0","urgency":"unimportant"}}},"CVE-2016-6762":{"description":"An elevation of privilege vulnerability in the libziparchive library could enable a local malicious application to execute arbitrary code within the context of a privileged process. This issue is rated as High because it could be used to gain local access to elevated capabilities, which are not normally accessible to a third-party application. Product: Android. Versions: 5.0.2, 5.1.1, 6.0, 6.0.1, 7.0. Android ID: A-31251826.","scope":"local","releases":{"bullseye":{"status":"resolved","repositories":{"bullseye":"1:10.0.0+r36-7"},"fixed_version":"1:7.0.0+r1-1","urgency":"not yet assigned"}}},"CVE-2017-0647":{"description":"An information disclosure vulnerability in libziparchive could enable a local malicious application to access data outside of its permission levels. This issue is rated as Moderate because it could be used to access sensitive data without permission. Product: Android. Versions: 5.0.2, 5.1.1, 6.0, 6.0.1, 7.0, 7.1.1, 7.1.2. Android ID: A-36392138.","debianbug":867229,"scope":"local","releases":{"bullseye":{"status":"resolved","repositories":{"bullseye":"1:10.0.0+r36-7"},"fixed_version":"1:7.0.0+r33-2","urgency":"unimportant"}}},"CVE-2017-0841":{"description":"A remote code execution vulnerability in the Android system (libutils). Product: Android. Versions: 5.0.2, 5.1.1, 6.0, 6.0.1, 7.0, 7.1.1, 7.1.2, 8.0. Android ID: A-37723026.","scope":"local","releases":{"bullseye":{"status":"open","repositories":{"bullseye":"1:10.0.0+r36-7"},"urgency":"unimportant"}}},"CVE-2017-13156":{"description":"An elevation of privilege vulnerability in the Android system (art). Product: Android. Versions: 5.1.1, 6.0, 6.0.1, 7.0, 7.1.1, 7.1.2, 8.0. Android ID A-64211847.","scope":"local","releases":{"bullseye":{"status":"resolved","repositories":{"bullseye":"1:10.0.0+r36-7"},"fixed_version":"0","urgency":"unimportant"}}}},"angular.js":{"CVE-2019-10768":{"description":"In AngularJS before 1.7.9 the function `merge()` could be tricked into adding or modifying properties of `Object.prototype` using a `__proto__` payload.","debianbug":945249,"scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"1.8.3-1+deb12u1"},"fixed_version":"1.7.9-1","urgency":"not yet assigned"},"bullseye":{"status":"resolved","repositories":{"bullseye":"1.8.2-2","bullseye-security":"1.8.3-1+deb12u1~deb11u1"},"fixed_version":"1.7.9-1","urgency":"not yet assigned"},"forky":{"status":"resolved","repositories":{"forky":"1.8.3-3"},"fixed_version":"1.7.9-1","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"1.8.3-3"},"fixed_version":"1.7.9-1","urgency":"not yet assigned"},"trixie":{"status":"resolved","repositories":{"trixie":"1.8.3-3"},"fixed_version":"1.7.9-1","urgency":"not yet assigned"}}},"CVE-2019-14863":{"description":"There is a vulnerability in all angular versions before 1.5.0-beta.0, where after escaping the context of the web application, the web application delivers data to its users along with other trusted dynamic content, without validating it.","debianbug":942833,"scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"1.8.3-1+deb12u1"},"fixed_version":"1.5.3-2","urgency":"not yet assigned"},"bullseye":{"status":"resolved","repositories":{"bullseye":"1.8.2-2","bullseye-security":"1.8.3-1+deb12u1~deb11u1"},"fixed_version":"1.5.3-2","urgency":"not yet assigned"},"forky":{"status":"resolved","repositories":{"forky":"1.8.3-3"},"fixed_version":"1.5.3-2","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"1.8.3-3"},"fixed_version":"1.5.3-2","urgency":"not yet assigned"},"trixie":{"status":"resolved","repositories":{"trixie":"1.8.3-3"},"fixed_version":"1.5.3-2","urgency":"not yet assigned"}}},"CVE-2020-7676":{"description":"angular.js prior to 1.8.0 allows cross site scripting. The regex-based input HTML replacement may turn sanitized code into unsanitized one. Wrapping \"<option>\" elements in \"<select>\" ones changes parsing behavior, leading to possibly unsanitizing code.","scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"1.8.3-1+deb12u1"},"fixed_version":"1.8.0-1","urgency":"not yet assigned"},"bullseye":{"status":"resolved","repositories":{"bullseye":"1.8.2-2","bullseye-security":"1.8.3-1+deb12u1~deb11u1"},"fixed_version":"1.8.0-1","urgency":"not yet assigned"},"forky":{"status":"resolved","repositories":{"forky":"1.8.3-3"},"fixed_version":"1.8.0-1","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"1.8.3-3"},"fixed_version":"1.8.0-1","urgency":"not yet assigned"},"trixie":{"status":"resolved","repositories":{"trixie":"1.8.3-3"},"fixed_version":"1.8.0-1","urgency":"not yet assigned"}}},"CVE-2022-25844":{"description":"The package angular after 1.7.0 are vulnerable to Regular Expression Denial of Service (ReDoS) by providing a custom locale rule that makes it possible to assign the parameter in posPre: ' '.repeat() of NUMBER_FORMATS.PATTERNS[1].posPre with a very high value. **Note:** 1) This package has been deprecated and is no longer maintained. 2) The vulnerable versions are 1.7.0 and higher.","debianbug":1014779,"scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"1.8.3-1+deb12u1"},"fixed_version":"1.8.3-1+deb12u1","urgency":"not yet assigned"},"bullseye":{"status":"resolved","repositories":{"bullseye":"1.8.2-2","bullseye-security":"1.8.3-1+deb12u1~deb11u1"},"fixed_version":"1.8.3-1+deb12u1~deb11u1","urgency":"not yet assigned"},"forky":{"status":"resolved","repositories":{"forky":"1.8.3-3"},"fixed_version":"1.8.3-2","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"1.8.3-3"},"fixed_version":"1.8.3-2","urgency":"not yet assigned"},"trixie":{"status":"resolved","repositories":{"trixie":"1.8.3-3"},"fixed_version":"1.8.3-2","urgency":"not yet assigned"}}},"CVE-2022-25869":{"description":"All versions of the package angular; all versions of the package angularjs.core; all versions of the package angularjs are vulnerable to Cross-site Scripting (XSS) due to insecure page caching in the Internet Explorer browser, which allows interpolation of <textarea> elements.","debianbug":1036694,"scope":"local","releases":{"bookworm":{"status":"open","repositories":{"bookworm":"1.8.3-1+deb12u1"},"urgency":"not yet assigned","nodsa":"Minor issue, revisit when fixed upstream","nodsa_reason":"postponed"},"bullseye":{"status":"open","repositories":{"bullseye":"1.8.2-2","bullseye-security":"1.8.3-1+deb12u1~deb11u1"},"urgency":"not yet assigned","nodsa":"Minor issue","nodsa_reason":""},"forky":{"status":"open","repositories":{"forky":"1.8.3-3"},"urgency":"not yet assigned"},"sid":{"status":"open","repositories":{"sid":"1.8.3-3"},"urgency":"not yet assigned"},"trixie":{"status":"open","repositories":{"trixie":"1.8.3-3"},"urgency":"not yet assigned","nodsa":"Minor issue, revisit when fixed upstream","nodsa_reason":"postponed"}}},"CVE-2023-26116":{"description":"Versions of the package angular from 1.2.21 are vulnerable to Regular Expression Denial of Service (ReDoS) via the angular.copy() utility function due to the usage of an insecure regular expression. Exploiting this vulnerability is possible by a large carefully-crafted input, which can result in catastrophic backtracking.","debianbug":1036694,"scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"1.8.3-1+deb12u1"},"fixed_version":"1.8.3-1+deb12u1","urgency":"not yet assigned"},"bullseye":{"status":"resolved","repositories":{"bullseye":"1.8.2-2","bullseye-security":"1.8.3-1+deb12u1~deb11u1"},"fixed_version":"1.8.3-1+deb12u1~deb11u1","urgency":"not yet assigned"},"forky":{"status":"resolved","repositories":{"forky":"1.8.3-3"},"fixed_version":"1.8.3-2","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"1.8.3-3"},"fixed_version":"1.8.3-2","urgency":"not yet assigned"},"trixie":{"status":"resolved","repositories":{"trixie":"1.8.3-3"},"fixed_version":"1.8.3-2","urgency":"not yet assigned"}}},"CVE-2023-26117":{"description":"Versions of the package angular from 1.0.0 are vulnerable to Regular Expression Denial of Service (ReDoS) via the $resource service due to the usage of an insecure regular expression. Exploiting this vulnerability is possible by a large carefully-crafted input, which can result in catastrophic backtracking.","debianbug":1036694,"scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"1.8.3-1+deb12u1"},"fixed_version":"1.8.3-1+deb12u1","urgency":"not yet assigned"},"bullseye":{"status":"resolved","repositories":{"bullseye":"1.8.2-2","bullseye-security":"1.8.3-1+deb12u1~deb11u1"},"fixed_version":"1.8.3-1+deb12u1~deb11u1","urgency":"not yet assigned"},"forky":{"status":"resolved","repositories":{"forky":"1.8.3-3"},"fixed_version":"1.8.3-2","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"1.8.3-3"},"fixed_version":"1.8.3-2","urgency":"not yet assigned"},"trixie":{"status":"resolved","repositories":{"trixie":"1.8.3-3"},"fixed_version":"1.8.3-2","urgency":"not yet assigned"}}},"CVE-2023-26118":{"description":"Versions of the package angular from 1.4.9 are vulnerable to Regular Expression Denial of Service (ReDoS) via the <input type=\"url\"> element due to the usage of an insecure regular expression in the input[url] functionality. Exploiting this vulnerability is possible by a large carefully-crafted input, which can result in catastrophic backtracking.","debianbug":1036694,"scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"1.8.3-1+deb12u1"},"fixed_version":"1.8.3-1+deb12u1","urgency":"not yet assigned"},"bullseye":{"status":"resolved","repositories":{"bullseye":"1.8.2-2","bullseye-security":"1.8.3-1+deb12u1~deb11u1"},"fixed_version":"1.8.3-1+deb12u1~deb11u1","urgency":"not yet assigned"},"forky":{"status":"resolved","repositories":{"forky":"1.8.3-3"},"fixed_version":"1.8.3-2","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"1.8.3-3"},"fixed_version":"1.8.3-2","urgency":"not yet assigned"},"trixie":{"status":"resolved","repositories":{"trixie":"1.8.3-3"},"fixed_version":"1.8.3-2","urgency":"not yet assigned"}}},"CVE-2024-21490":{"description":"This affects versions of the package angular from 1.3.0. A regular expression used to split the value of the ng-srcset directive is vulnerable to super-linear runtime due to backtracking. With large carefully-crafted input, this can result in catastrophic backtracking and cause a denial of service. \r\r\r**Note:**\r\rThis package is EOL and will not receive any updates to address this issue. Users should migrate to [@angular/core](https://www.npmjs.com/package/@angular/core).","debianbug":1088803,"scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"1.8.3-1+deb12u1"},"fixed_version":"1.8.3-1+deb12u1","urgency":"not yet assigned"},"bullseye":{"status":"resolved","repositories":{"bullseye":"1.8.2-2","bullseye-security":"1.8.3-1+deb12u1~deb11u1"},"fixed_version":"1.8.3-1+deb12u1~deb11u1","urgency":"not yet assigned"},"forky":{"status":"resolved","repositories":{"forky":"1.8.3-3"},"fixed_version":"1.8.3-2","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"1.8.3-3"},"fixed_version":"1.8.3-2","urgency":"not yet assigned"},"trixie":{"status":"resolved","repositories":{"trixie":"1.8.3-3"},"fixed_version":"1.8.3-2","urgency":"not yet assigned"}}},"CVE-2024-8372":{"description":"Improper sanitization of the value of the 'srcset' attribute in AngularJS allows attackers to bypass common image source restrictions, which can also lead to a form of  Content Spoofing https://owasp.org/www-community/attacks/Content_Spoofing .  This issue affects AngularJS versions 1.3.0-rc.4 and greater.  Note: The AngularJS project is End-of-Life and will not receive any updates to address this issue. For more information see  here https://docs.angularjs.org/misc/version-support-status .","debianbug":1088804,"scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"1.8.3-1+deb12u1"},"fixed_version":"1.8.3-1+deb12u1","urgency":"not yet assigned"},"bullseye":{"status":"resolved","repositories":{"bullseye":"1.8.2-2","bullseye-security":"1.8.3-1+deb12u1~deb11u1"},"fixed_version":"1.8.3-1+deb12u1~deb11u1","urgency":"not yet assigned"},"forky":{"status":"resolved","repositories":{"forky":"1.8.3-3"},"fixed_version":"1.8.3-2","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"1.8.3-3"},"fixed_version":"1.8.3-2","urgency":"not yet assigned"},"trixie":{"status":"resolved","repositories":{"trixie":"1.8.3-3"},"fixed_version":"1.8.3-2","urgency":"not yet assigned"}}},"CVE-2024-8373":{"description":"Improper sanitization of the value of the [srcset] attribute in <source> HTML elements in AngularJS allows attackers to bypass common image source restrictions, which can also lead to a form of  Content Spoofing https://owasp.org/www-community/attacks/Content_Spoofing .  This issue affects all versions of AngularJS.  Note: The AngularJS project is End-of-Life and will not receive any updates to address this issue. For more information see  here https://docs.angularjs.org/misc/version-support-status .","debianbug":1088805,"scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"1.8.3-1+deb12u1"},"fixed_version":"1.8.3-1+deb12u1","urgency":"not yet assigned"},"bullseye":{"status":"resolved","repositories":{"bullseye":"1.8.2-2","bullseye-security":"1.8.3-1+deb12u1~deb11u1"},"fixed_version":"1.8.3-1+deb12u1~deb11u1","urgency":"not yet assigned"},"forky":{"status":"resolved","repositories":{"forky":"1.8.3-3"},"fixed_version":"1.8.3-2","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"1.8.3-3"},"fixed_version":"1.8.3-2","urgency":"not yet assigned"},"trixie":{"status":"resolved","repositories":{"trixie":"1.8.3-3"},"fixed_version":"1.8.3-2","urgency":"not yet assigned"}}},"CVE-2025-0716":{"description":"Improper sanitization of the value of the 'href' and 'xlink:href' attributes in '<image>' SVG elements in AngularJS allows attackers to bypass common image source restrictions. This can lead to a form of  Content Spoofing https://owasp.org/www-community/attacks/Content_Spoofing \u00a0and also negatively affect the application's performance and behavior by using too large or slow-to-load images.  This issue affects all versions of AngularJS.  Note: The AngularJS project is End-of-Life and will not receive any updates to address this issue. For more information see  here https://docs.angularjs.org/misc/version-support-status .","debianbug":1104485,"scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"1.8.3-1+deb12u1"},"fixed_version":"1.8.3-1+deb12u1","urgency":"not yet assigned"},"bullseye":{"status":"resolved","repositories":{"bullseye":"1.8.2-2","bullseye-security":"1.8.3-1+deb12u1~deb11u1"},"fixed_version":"1.8.3-1+deb12u1~deb11u1","urgency":"not yet assigned"},"forky":{"status":"resolved","repositories":{"forky":"1.8.3-3"},"fixed_version":"1.8.3-2","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"1.8.3-3"},"fixed_version":"1.8.3-2","urgency":"not yet assigned"},"trixie":{"status":"resolved","repositories":{"trixie":"1.8.3-3"},"fixed_version":"1.8.3-2","urgency":"not yet assigned"}}},"CVE-2025-2336":{"description":"Improper sanitization of the value of the 'href' and 'xlink:href' attributes in '<image>' SVG elements in AngularJS's\u00a0'ngSanitize'\u00a0module allows attackers to bypass common image source restrictions. This can lead to a form of  Content Spoofing https://owasp.org/www-community/attacks/Content_Spoofing \u00a0and also negatively affect the application's performance and behavior by using too large or slow-to-load images.  This issue affects AngularJS versions greater than or equal to 1.3.1.  Note: The AngularJS project is End-of-Life and will not receive any updates to address this issue. For more information see  here https://docs.angularjs.org/misc/version-support-status .","debianbug":1107519,"scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"1.8.3-1+deb12u1"},"fixed_version":"1.8.3-1+deb12u1","urgency":"not yet assigned"},"bullseye":{"status":"resolved","repositories":{"bullseye":"1.8.2-2","bullseye-security":"1.8.3-1+deb12u1~deb11u1"},"fixed_version":"1.8.3-1+deb12u1~deb11u1","urgency":"not yet assigned"},"forky":{"status":"resolved","repositories":{"forky":"1.8.3-3"},"fixed_version":"1.8.3-2","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"1.8.3-3"},"fixed_version":"1.8.3-2","urgency":"not yet assigned"},"trixie":{"status":"resolved","repositories":{"trixie":"1.8.3-3"},"fixed_version":"1.8.3-2","urgency":"not yet assigned"}}},"CVE-2025-4690":{"description":"A regular expression used by AngularJS'\u00a0 linky https://docs.angularjs.org/api/ngSanitize/filter/linky \u00a0filter to detect URLs in input text is vulnerable to super-linear runtime due to backtracking. With a large carefully-crafted input, this can cause a    Regular expression Denial of Service (ReDoS) https://owasp.org/www-community/attacks/Regular_expression_Denial_of_Service_-_ReDoS \u00a0attack on\u00a0the application.  This issue affects all versions of AngularJS.  Note: The AngularJS project is End-of-Life and will not receive any updates to address this issue. For more information see  here https://docs.angularjs.org/misc/version-support-status .","debianbug":1126778,"scope":"local","releases":{"bookworm":{"status":"open","repositories":{"bookworm":"1.8.3-1+deb12u1"},"urgency":"not yet assigned","nodsa":"Minor issue","nodsa_reason":""},"bullseye":{"status":"open","repositories":{"bullseye":"1.8.2-2","bullseye-security":"1.8.3-1+deb12u1~deb11u1"},"urgency":"not yet assigned","nodsa":"Minor issue; whole API is unsafe","nodsa_reason":"postponed"},"forky":{"status":"open","repositories":{"forky":"1.8.3-3"},"urgency":"not yet assigned"},"sid":{"status":"open","repositories":{"sid":"1.8.3-3"},"urgency":"not yet assigned"},"trixie":{"status":"open","repositories":{"trixie":"1.8.3-3"},"urgency":"not yet assigned","nodsa":"Minor issue","nodsa_reason":""}}},"CVE-2025-66035":{"description":"Angular is a development platform for building mobile and desktop web applications using TypeScript/JavaScript and other languages. Prior to versions 19.2.16, 20.3.14, and 21.0.1, there is a XSRF token leakage via protocol-relative URLs in angular HTTP clients. The vulnerability is a Credential Leak by App Logic that leads to the unauthorized disclosure of the Cross-Site Request Forgery (XSRF) token to an attacker-controlled domain. Angular's HttpClient has a built-in XSRF protection mechanism that works by checking if a request URL starts with a protocol (http:// or https://) to determine if it is cross-origin. If the URL starts with protocol-relative URL (//), it is incorrectly treated as a same-origin request, and the XSRF token is automatically added to the X-XSRF-TOKEN header. This issue has been patched in versions 19.2.16, 20.3.14, and 21.0.1. A workaround for this issue involves avoiding using protocol-relative URLs (URLs starting with //) in HttpClient requests. All backend communication URLs should be hardcoded as relative paths (starting with a single /) or fully qualified, trusted absolute URLs.","scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"1.8.3-1+deb12u1"},"fixed_version":"0","urgency":"unimportant"},"bullseye":{"status":"resolved","repositories":{"bullseye":"1.8.2-2","bullseye-security":"1.8.3-1+deb12u1~deb11u1"},"fixed_version":"0","urgency":"unimportant"},"forky":{"status":"resolved","repositories":{"forky":"1.8.3-3"},"fixed_version":"0","urgency":"unimportant"},"sid":{"status":"resolved","repositories":{"sid":"1.8.3-3"},"fixed_version":"0","urgency":"unimportant"},"trixie":{"status":"resolved","repositories":{"trixie":"1.8.3-3"},"fixed_version":"0","urgency":"unimportant"}}},"CVE-2025-66412":{"description":"Angular is a development platform for building mobile and desktop web applications using TypeScript/JavaScript and other languages. Prior to 21.0.2, 20.3.15, and 19.2.17, A Stored Cross-Site Scripting (XSS) vulnerability has been identified in the Angular Template Compiler. It occurs because the compiler's internal security schema is incomplete, allowing attackers to bypass Angular's built-in security sanitization. Specifically, the schema fails to classify certain URL-holding attributes (e.g., those that could contain javascript: URLs) as requiring strict URL security, enabling the injection of malicious scripts. This vulnerability is fixed in 21.0.2, 20.3.15, and 19.2.17.","scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"1.8.3-1+deb12u1"},"fixed_version":"0","urgency":"unimportant"},"bullseye":{"status":"resolved","repositories":{"bullseye":"1.8.2-2","bullseye-security":"1.8.3-1+deb12u1~deb11u1"},"fixed_version":"0","urgency":"unimportant"},"forky":{"status":"resolved","repositories":{"forky":"1.8.3-3"},"fixed_version":"0","urgency":"unimportant"},"sid":{"status":"resolved","repositories":{"sid":"1.8.3-3"},"fixed_version":"0","urgency":"unimportant"},"trixie":{"status":"resolved","repositories":{"trixie":"1.8.3-3"},"fixed_version":"0","urgency":"unimportant"}}},"CVE-2026-22610":{"description":"Angular is a development platform for building mobile and desktop web applications using TypeScript/JavaScript and other languages. Prior to versions 19.2.18, 20.3.16, 21.0.7, and 21.1.0-rc.0, a cross-site scripting (XSS) vulnerability has been identified in the Angular Template Compiler. The vulnerability exists because Angular\u2019s internal sanitization schema fails to recognize the href and xlink:href attributes of SVG <script> elements as a Resource URL context. This issue has been patched in versions 19.2.18, 20.3.16, 21.0.7, and 21.1.0-rc.0.","scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"1.8.3-1+deb12u1"},"fixed_version":"0","urgency":"unimportant"},"bullseye":{"status":"resolved","repositories":{"bullseye":"1.8.2-2","bullseye-security":"1.8.3-1+deb12u1~deb11u1"},"fixed_version":"0","urgency":"unimportant"},"forky":{"status":"resolved","repositories":{"forky":"1.8.3-3"},"fixed_version":"0","urgency":"unimportant"},"sid":{"status":"resolved","repositories":{"sid":"1.8.3-3"},"fixed_version":"0","urgency":"unimportant"},"trixie":{"status":"resolved","repositories":{"trixie":"1.8.3-3"},"fixed_version":"0","urgency":"unimportant"}}},"CVE-2026-27970":{"description":"Angular is a development platform for building mobile and desktop web applications using TypeScript/JavaScript and other languages. Versions prior to 21.2.0, 21.1.16, 20.3.17, and 19.2.19 have a cross-Site scripting vulnerability in the Angular internationalization (i18n) pipeline. In ICU messages (International Components for Unicode), HTML from translated content was not properly sanitized and could execute arbitrary JavaScript. Angular i18n typically involves three steps, extracting all messages from an application in the source language, sending the messages to be translated, and then merging their translations back into the final source code. Translations are frequently handled by contracts with specific partner companies, and involve sending the source messages to a separate contractor before receiving final translations for display to the end user. If the returned translations have malicious content, it could be rendered into the application and execute arbitrary JavaScript. When successfully exploited, this vulnerability allows for execution of attacker controlled JavaScript in the application origin. Depending on the nature of the application being exploited this could lead to credential exfiltration and/or page vandalism. Several preconditions apply to the attack. The attacker must compromise the translation file (xliff, xtb, etc.). Unlike most XSS vulnerabilities, this issue is not exploitable by arbitrary users. An attacker must first compromise an application's translation file before they can escalate privileges into the Angular application client. The victim application must use Angular i18n, use one or more ICU messages, render an ICU message, and not defend against XSS via a safe content security policy. Versions 21.2.0, 21.1.6, 20.3.17, and 19.2.19 patch the issue. Until the patch is applied, developers should consider reviewing and verifying translated content received from untrusted third parties before incorporating it in an Angular application, enabling strict CSP controls to block unauthorized JavaScript from executing on the page, and enabling Trusted Types to enforce proper HTML sanitization.","scope":"local","releases":{"bookworm":{"status":"undetermined","repositories":{"bookworm":"1.8.3-1+deb12u1"},"urgency":"not yet assigned"},"bullseye":{"status":"undetermined","repositories":{"bullseye":"1.8.2-2","bullseye-security":"1.8.3-1+deb12u1~deb11u1"},"urgency":"not yet assigned"},"forky":{"status":"undetermined","repositories":{"forky":"1.8.3-3"},"urgency":"not yet assigned"},"sid":{"status":"undetermined","repositories":{"sid":"1.8.3-3"},"urgency":"not yet assigned"},"trixie":{"status":"undetermined","repositories":{"trixie":"1.8.3-3"},"urgency":"not yet assigned"}}}},"anjuta":{"CVE-2021-42522":{"description":"There is a Information Disclosure vulnerability in anjuta/plugins/document-manager/anjuta-bookmarks.c. This issue was caused by the incorrect use of libxml2 API. The vendor forgot to call 'g_free()' to release the return value of 'xmlGetProp()'.","scope":"local","releases":{"bookworm":{"status":"open","repositories":{"bookworm":"2:3.34.0-8"},"urgency":"unimportant"},"bullseye":{"status":"open","repositories":{"bullseye":"2:3.34.0-3"},"urgency":"unimportant"}}}},"anki":{"CVE-2024-26020":{"description":"An arbitrary script execution vulnerability exists in the MPV functionality of Ankitects Anki 24.04. A specially crafted flashcard can lead to a arbitrary code execution. An attacker can send malicious flashcard to trigger this vulnerability.","debianbug":1077548,"scope":"local","releases":{"bullseye":{"status":"open","repositories":{"bullseye":"2.1.15+dfsg-3"},"urgency":"not yet assigned","nodsa":"Minor issue; can be fixed in next update","nodsa_reason":"postponed"}}},"CVE-2024-29073":{"description":"An vulnerability in the handling of Latex exists in Ankitects Anki 24.04. When Latex is sanitized to prevent unsafe commands, the verbatim package, which comes installed by default in many Latex distributions, has been overlooked. A specially crafted flashcard can lead to an arbitrary file read. An attacker can share a flashcard to trigger this vulnerability.","debianbug":1077548,"scope":"local","releases":{"bullseye":{"status":"open","repositories":{"bullseye":"2.1.15+dfsg-3"},"urgency":"not yet assigned","nodsa":"Minor issue; can be fixed in next update","nodsa_reason":"postponed"}}},"CVE-2024-32152":{"description":"A blocklist bypass vulnerability exists in the LaTeX functionality of Ankitects Anki 24.04. A specially crafted malicious flashcard can lead to an arbitrary file creation at a fixed path. An attacker can share a malicious flashcard to trigger this vulnerability.","debianbug":1077548,"scope":"local","releases":{"bullseye":{"status":"open","repositories":{"bullseye":"2.1.15+dfsg-3"},"urgency":"not yet assigned","nodsa":"Minor issue; can be fixed in next update","nodsa_reason":"postponed"}}},"CVE-2024-32484":{"description":"An reflected XSS vulnerability exists in the handling of invalid paths in the Flask server in Ankitects Anki 24.04. A specially crafted flashcard can lead to JavaScript code execution and result in an arbitrary file read. An attacker can share a malicious flashcard to trigger this vulnerability.","debianbug":1077548,"scope":"local","releases":{"bullseye":{"status":"open","repositories":{"bullseye":"2.1.15+dfsg-3"},"urgency":"not yet assigned","nodsa":"Minor issue; can be fixed in next update","nodsa_reason":"postponed"}}},"CVE-2025-43703":{"description":"An issue was discovered in Ankitects Anki through 25.02. A crafted shared deck can result in attacker-controlled access to the internal API (even though the attacker has no knowledge of an API key) through approaches such as scripts or the SRC attribute of an IMG element. NOTE: this issue exists because of an incomplete fix for CVE-2024-32484.","scope":"local","releases":{"bullseye":{"status":"resolved","repositories":{"bullseye":"2.1.15+dfsg-3"},"fixed_version":"0","urgency":"unimportant"}}}},"anope":{"CVE-2024-30187":{"description":"Anope before 2.0.15 does not prevent resetting the password of a suspended account.","scope":"local","releases":{"bookworm":{"status":"open","repositories":{"bookworm":"2.0.12-1"},"urgency":"not yet assigned","nodsa":"Minor issue; due to apparmor bug not affecting default configurations","nodsa_reason":""},"bullseye":{"status":"open","repositories":{"bullseye":"2.0.9-1"},"urgency":"not yet assigned","nodsa":"Minor issue","nodsa_reason":""},"forky":{"status":"resolved","repositories":{"forky":"2.0.17-1.1"},"fixed_version":"2.0.15-1","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"2.0.17-1.1"},"fixed_version":"2.0.15-1","urgency":"not yet assigned"},"trixie":{"status":"resolved","repositories":{"trixie":"2.0.17-1"},"fixed_version":"2.0.15-1","urgency":"not yet assigned"}}}},"ansible":{"CVE-2013-2233":{"description":"Ansible before 1.2.1 makes it easier for remote attackers to conduct man-in-the-middle attacks by leveraging failure to cache SSH host keys.","debianbug":714822,"scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"7.7.0+dfsg-3+deb12u1"},"fixed_version":"1.3.4+dfsg-1","urgency":"not yet assigned"},"bullseye":{"status":"resolved","repositories":{"bullseye":"2.10.7+merged+base+2.10.17+dfsg-0+deb11u1","bullseye-security":"2.10.7+merged+base+2.10.17+dfsg-0+deb11u3"},"fixed_version":"1.3.4+dfsg-1","urgency":"not yet assigned"},"forky":{"status":"resolved","repositories":{"forky":"13.1.0+dfsg-1"},"fixed_version":"1.3.4+dfsg-1","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"13.1.0+dfsg-1"},"fixed_version":"1.3.4+dfsg-1","urgency":"not yet assigned"},"trixie":{"status":"resolved","repositories":{"trixie":"12.0.0+dfsg-0+deb13u1"},"fixed_version":"1.3.4+dfsg-1","urgency":"not yet assigned"}}},"CVE-2013-4259":{"description":"runner/connection_plugins/ssh.py in Ansible before 1.2.3, when using ControlPersist, allows local users to redirect a ssh session via a symlink attack on a socket file with a predictable name in /tmp/.","debianbug":721766,"scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"7.7.0+dfsg-3+deb12u1"},"fixed_version":"1.3.4+dfsg-1","urgency":"not yet assigned"},"bullseye":{"status":"resolved","repositories":{"bullseye":"2.10.7+merged+base+2.10.17+dfsg-0+deb11u1","bullseye-security":"2.10.7+merged+base+2.10.17+dfsg-0+deb11u3"},"fixed_version":"1.3.4+dfsg-1","urgency":"not yet assigned"},"forky":{"status":"resolved","repositories":{"forky":"13.1.0+dfsg-1"},"fixed_version":"1.3.4+dfsg-1","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"13.1.0+dfsg-1"},"fixed_version":"1.3.4+dfsg-1","urgency":"not yet assigned"},"trixie":{"status":"resolved","repositories":{"trixie":"12.0.0+dfsg-0+deb13u1"},"fixed_version":"1.3.4+dfsg-1","urgency":"not yet assigned"}}},"CVE-2013-4260":{"description":"lib/ansible/playbook/__init__.py in Ansible 1.2.x before 1.2.3, when playbook does not run due to an error, allows local users to overwrite arbitrary files via a symlink attack on a retry file with a predictable name in /var/tmp/ansible/.","scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"7.7.0+dfsg-3+deb12u1"},"fixed_version":"0","urgency":"unimportant"},"bullseye":{"status":"resolved","repositories":{"bullseye":"2.10.7+merged+base+2.10.17+dfsg-0+deb11u1","bullseye-security":"2.10.7+merged+base+2.10.17+dfsg-0+deb11u3"},"fixed_version":"0","urgency":"unimportant"},"forky":{"status":"resolved","repositories":{"forky":"13.1.0+dfsg-1"},"fixed_version":"0","urgency":"unimportant"},"sid":{"status":"resolved","repositories":{"sid":"13.1.0+dfsg-1"},"fixed_version":"0","urgency":"unimportant"},"trixie":{"status":"resolved","repositories":{"trixie":"12.0.0+dfsg-0+deb13u1"},"fixed_version":"0","urgency":"unimportant"}}},"CVE-2014-2686":{"description":"Ansible prior to 1.5.4 mishandles the evaluation of some strings.","scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"7.7.0+dfsg-3+deb12u1"},"fixed_version":"1.5.4+dfsg-1","urgency":"not yet assigned"},"bullseye":{"status":"resolved","repositories":{"bullseye":"2.10.7+merged+base+2.10.17+dfsg-0+deb11u1","bullseye-security":"2.10.7+merged+base+2.10.17+dfsg-0+deb11u3"},"fixed_version":"1.5.4+dfsg-1","urgency":"not yet assigned"},"forky":{"status":"resolved","repositories":{"forky":"13.1.0+dfsg-1"},"fixed_version":"1.5.4+dfsg-1","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"13.1.0+dfsg-1"},"fixed_version":"1.5.4+dfsg-1","urgency":"not yet assigned"},"trixie":{"status":"resolved","repositories":{"trixie":"12.0.0+dfsg-0+deb13u1"},"fixed_version":"1.5.4+dfsg-1","urgency":"not yet assigned"}}},"CVE-2014-3498":{"description":"The user module in ansible before 1.6.6 allows remote authenticated users to execute arbitrary commands.","scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"7.7.0+dfsg-3+deb12u1"},"fixed_version":"1.7.0+dfsg-1","urgency":"not yet assigned"},"bullseye":{"status":"resolved","repositories":{"bullseye":"2.10.7+merged+base+2.10.17+dfsg-0+deb11u1","bullseye-security":"2.10.7+merged+base+2.10.17+dfsg-0+deb11u3"},"fixed_version":"1.7.0+dfsg-1","urgency":"not yet assigned"},"forky":{"status":"resolved","repositories":{"forky":"13.1.0+dfsg-1"},"fixed_version":"1.7.0+dfsg-1","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"13.1.0+dfsg-1"},"fixed_version":"1.7.0+dfsg-1","urgency":"not yet assigned"},"trixie":{"status":"resolved","repositories":{"trixie":"12.0.0+dfsg-0+deb13u1"},"fixed_version":"1.7.0+dfsg-1","urgency":"not yet assigned"}}},"CVE-2014-4657":{"description":"The safe_eval function in Ansible before 1.5.4 does not properly restrict the code subset, which allows remote attackers to execute arbitrary code via crafted instructions.","scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"7.7.0+dfsg-3+deb12u1"},"fixed_version":"1.5.5+dfsg-1","urgency":"not yet assigned"},"bullseye":{"status":"resolved","repositories":{"bullseye":"2.10.7+merged+base+2.10.17+dfsg-0+deb11u1","bullseye-security":"2.10.7+merged+base+2.10.17+dfsg-0+deb11u3"},"fixed_version":"1.5.5+dfsg-1","urgency":"not yet assigned"},"forky":{"status":"resolved","repositories":{"forky":"13.1.0+dfsg-1"},"fixed_version":"1.5.5+dfsg-1","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"13.1.0+dfsg-1"},"fixed_version":"1.5.5+dfsg-1","urgency":"not yet assigned"},"trixie":{"status":"resolved","repositories":{"trixie":"12.0.0+dfsg-0+deb13u1"},"fixed_version":"1.5.5+dfsg-1","urgency":"not yet assigned"}}},"CVE-2014-4658":{"description":"The vault subsystem in Ansible before 1.5.5 does not set the umask before creation or modification of a vault file, which allows local users to obtain sensitive key information by reading a file.","scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"7.7.0+dfsg-3+deb12u1"},"fixed_version":"1.5.5+dfsg-1","urgency":"not yet assigned"},"bullseye":{"status":"resolved","repositories":{"bullseye":"2.10.7+merged+base+2.10.17+dfsg-0+deb11u1","bullseye-security":"2.10.7+merged+base+2.10.17+dfsg-0+deb11u3"},"fixed_version":"1.5.5+dfsg-1","urgency":"not yet assigned"},"forky":{"status":"resolved","repositories":{"forky":"13.1.0+dfsg-1"},"fixed_version":"1.5.5+dfsg-1","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"13.1.0+dfsg-1"},"fixed_version":"1.5.5+dfsg-1","urgency":"not yet assigned"},"trixie":{"status":"resolved","repositories":{"trixie":"12.0.0+dfsg-0+deb13u1"},"fixed_version":"1.5.5+dfsg-1","urgency":"not yet assigned"}}},"CVE-2014-4659":{"description":"Ansible before 1.5.5 sets 0644 permissions for sources.list, which might allow local users to obtain sensitive credential information in opportunistic circumstances by reading a file that uses the \"deb http://user:pass@server:port/\" format.","scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"7.7.0+dfsg-3+deb12u1"},"fixed_version":"1.5.5+dfsg-1","urgency":"not yet assigned"},"bullseye":{"status":"resolved","repositories":{"bullseye":"2.10.7+merged+base+2.10.17+dfsg-0+deb11u1","bullseye-security":"2.10.7+merged+base+2.10.17+dfsg-0+deb11u3"},"fixed_version":"1.5.5+dfsg-1","urgency":"not yet assigned"},"forky":{"status":"resolved","repositories":{"forky":"13.1.0+dfsg-1"},"fixed_version":"1.5.5+dfsg-1","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"13.1.0+dfsg-1"},"fixed_version":"1.5.5+dfsg-1","urgency":"not yet assigned"},"trixie":{"status":"resolved","repositories":{"trixie":"12.0.0+dfsg-0+deb13u1"},"fixed_version":"1.5.5+dfsg-1","urgency":"not yet assigned"}}},"CVE-2014-4660":{"description":"Ansible before 1.5.5 constructs filenames containing user and password fields on the basis of deb lines in sources.list, which might allow local users to obtain sensitive credential information in opportunistic circumstances by leveraging existence of a file that uses the \"deb http://user:pass@server:port/\" format.","scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"7.7.0+dfsg-3+deb12u1"},"fixed_version":"1.5.5+dfsg-1","urgency":"not yet assigned"},"bullseye":{"status":"resolved","repositories":{"bullseye":"2.10.7+merged+base+2.10.17+dfsg-0+deb11u1","bullseye-security":"2.10.7+merged+base+2.10.17+dfsg-0+deb11u3"},"fixed_version":"1.5.5+dfsg-1","urgency":"not yet assigned"},"forky":{"status":"resolved","repositories":{"forky":"13.1.0+dfsg-1"},"fixed_version":"1.5.5+dfsg-1","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"13.1.0+dfsg-1"},"fixed_version":"1.5.5+dfsg-1","urgency":"not yet assigned"},"trixie":{"status":"resolved","repositories":{"trixie":"12.0.0+dfsg-0+deb13u1"},"fixed_version":"1.5.5+dfsg-1","urgency":"not yet assigned"}}},"CVE-2014-4678":{"description":"The safe_eval function in Ansible before 1.6.4 does not properly restrict the code subset, which allows remote attackers to execute arbitrary code via crafted instructions. NOTE: this vulnerability exists because of an incomplete fix for CVE-2014-4657.","scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"7.7.0+dfsg-3+deb12u1"},"fixed_version":"1.6.6+dfsg-1","urgency":"not yet assigned"},"bullseye":{"status":"resolved","repositories":{"bullseye":"2.10.7+merged+base+2.10.17+dfsg-0+deb11u1","bullseye-security":"2.10.7+merged+base+2.10.17+dfsg-0+deb11u3"},"fixed_version":"1.6.6+dfsg-1","urgency":"not yet assigned"},"forky":{"status":"resolved","repositories":{"forky":"13.1.0+dfsg-1"},"fixed_version":"1.6.6+dfsg-1","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"13.1.0+dfsg-1"},"fixed_version":"1.6.6+dfsg-1","urgency":"not yet assigned"},"trixie":{"status":"resolved","repositories":{"trixie":"12.0.0+dfsg-0+deb13u1"},"fixed_version":"1.6.6+dfsg-1","urgency":"not yet assigned"}}},"CVE-2014-4966":{"description":"Ansible before 1.6.7 does not prevent inventory data with \"{{\" and \"lookup\" substrings, and does not prevent remote data with \"{{\" substrings, which allows remote attackers to execute arbitrary code via (1) crafted lookup('pipe') calls or (2) crafted Jinja2 data.","scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"7.7.0+dfsg-3+deb12u1"},"fixed_version":"1.6.8+dfsg-1","urgency":"not yet assigned"},"bullseye":{"status":"resolved","repositories":{"bullseye":"2.10.7+merged+base+2.10.17+dfsg-0+deb11u1","bullseye-security":"2.10.7+merged+base+2.10.17+dfsg-0+deb11u3"},"fixed_version":"1.6.8+dfsg-1","urgency":"not yet assigned"},"forky":{"status":"resolved","repositories":{"forky":"13.1.0+dfsg-1"},"fixed_version":"1.6.8+dfsg-1","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"13.1.0+dfsg-1"},"fixed_version":"1.6.8+dfsg-1","urgency":"not yet assigned"},"trixie":{"status":"resolved","repositories":{"trixie":"12.0.0+dfsg-0+deb13u1"},"fixed_version":"1.6.8+dfsg-1","urgency":"not yet assigned"}}},"CVE-2014-4967":{"description":"Multiple argument injection vulnerabilities in Ansible before 1.6.7 allow remote attackers to execute arbitrary code by leveraging access to an Ansible managed host and providing a crafted fact, as demonstrated by a fact with (1) a trailing \" src=\" clause, (2) a trailing \" temp=\" clause, or (3) a trailing \" validate=\" clause accompanied by a shell command.","scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"7.7.0+dfsg-3+deb12u1"},"fixed_version":"1.6.8+dfsg-1","urgency":"not yet assigned"},"bullseye":{"status":"resolved","repositories":{"bullseye":"2.10.7+merged+base+2.10.17+dfsg-0+deb11u1","bullseye-security":"2.10.7+merged+base+2.10.17+dfsg-0+deb11u3"},"fixed_version":"1.6.8+dfsg-1","urgency":"not yet assigned"},"forky":{"status":"resolved","repositories":{"forky":"13.1.0+dfsg-1"},"fixed_version":"1.6.8+dfsg-1","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"13.1.0+dfsg-1"},"fixed_version":"1.6.8+dfsg-1","urgency":"not yet assigned"},"trixie":{"status":"resolved","repositories":{"trixie":"12.0.0+dfsg-0+deb13u1"},"fixed_version":"1.6.8+dfsg-1","urgency":"not yet assigned"}}},"CVE-2015-3908":{"description":"Ansible before 1.9.2 does not verify that the server hostname matches a domain name in the subject's Common Name (CN) or subjectAltName field of the X.509 certificate, which allows man-in-the-middle attackers to spoof SSL servers via an arbitrary valid certificate.","scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"7.7.0+dfsg-3+deb12u1"},"fixed_version":"1.9.2+dfsg-1","urgency":"low"},"bullseye":{"status":"resolved","repositories":{"bullseye":"2.10.7+merged+base+2.10.17+dfsg-0+deb11u1","bullseye-security":"2.10.7+merged+base+2.10.17+dfsg-0+deb11u3"},"fixed_version":"1.9.2+dfsg-1","urgency":"low"},"forky":{"status":"resolved","repositories":{"forky":"13.1.0+dfsg-1"},"fixed_version":"1.9.2+dfsg-1","urgency":"low"},"sid":{"status":"resolved","repositories":{"sid":"13.1.0+dfsg-1"},"fixed_version":"1.9.2+dfsg-1","urgency":"low"},"trixie":{"status":"resolved","repositories":{"trixie":"12.0.0+dfsg-0+deb13u1"},"fixed_version":"1.9.2+dfsg-1","urgency":"low"}}},"CVE-2015-6240":{"description":"The chroot, jail, and zone connection plugins in ansible before 1.9.2 allow local users to escape a restricted environment via a symlink attack.","scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"7.7.0+dfsg-3+deb12u1"},"fixed_version":"1.9.2+dfsg-1","urgency":"low"},"bullseye":{"status":"resolved","repositories":{"bullseye":"2.10.7+merged+base+2.10.17+dfsg-0+deb11u1","bullseye-security":"2.10.7+merged+base+2.10.17+dfsg-0+deb11u3"},"fixed_version":"1.9.2+dfsg-1","urgency":"low"},"forky":{"status":"resolved","repositories":{"forky":"13.1.0+dfsg-1"},"fixed_version":"1.9.2+dfsg-1","urgency":"low"},"sid":{"status":"resolved","repositories":{"sid":"13.1.0+dfsg-1"},"fixed_version":"1.9.2+dfsg-1","urgency":"low"},"trixie":{"status":"resolved","repositories":{"trixie":"12.0.0+dfsg-0+deb13u1"},"fixed_version":"1.9.2+dfsg-1","urgency":"low"}}},"CVE-2016-3096":{"description":"The create_script function in the lxc_container module in Ansible before 1.9.6-1 and 2.x before 2.0.2.0 allows local users to write to arbitrary files or gain privileges via a symlink attack on (1) /opt/.lxc-attach-script, (2) the archived container in the archive_path directory, or the (3) lxc-attach-script.log or (4) lxc-attach-script.err files in the temporary directory.","debianbug":819676,"scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"7.7.0+dfsg-3+deb12u1"},"fixed_version":"2.0.1.0-2","urgency":"not yet assigned"},"bullseye":{"status":"resolved","repositories":{"bullseye":"2.10.7+merged+base+2.10.17+dfsg-0+deb11u1","bullseye-security":"2.10.7+merged+base+2.10.17+dfsg-0+deb11u3"},"fixed_version":"2.0.1.0-2","urgency":"not yet assigned"},"forky":{"status":"resolved","repositories":{"forky":"13.1.0+dfsg-1"},"fixed_version":"2.0.1.0-2","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"13.1.0+dfsg-1"},"fixed_version":"2.0.1.0-2","urgency":"not yet assigned"},"trixie":{"status":"resolved","repositories":{"trixie":"12.0.0+dfsg-0+deb13u1"},"fixed_version":"2.0.1.0-2","urgency":"not yet assigned"}}},"CVE-2016-8614":{"description":"A flaw was found in Ansible before version 2.2.0. The apt_key module does not properly verify key fingerprints, allowing remote adversary to create an OpenPGP key which matches the short key ID and inject this key instead of the correct key.","debianbug":842984,"scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"7.7.0+dfsg-3+deb12u1"},"fixed_version":"2.2.0.0-1","urgency":"not yet assigned"},"bullseye":{"status":"resolved","repositories":{"bullseye":"2.10.7+merged+base+2.10.17+dfsg-0+deb11u1","bullseye-security":"2.10.7+merged+base+2.10.17+dfsg-0+deb11u3"},"fixed_version":"2.2.0.0-1","urgency":"not yet assigned"},"forky":{"status":"resolved","repositories":{"forky":"13.1.0+dfsg-1"},"fixed_version":"2.2.0.0-1","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"13.1.0+dfsg-1"},"fixed_version":"2.2.0.0-1","urgency":"not yet assigned"},"trixie":{"status":"resolved","repositories":{"trixie":"12.0.0+dfsg-0+deb13u1"},"fixed_version":"2.2.0.0-1","urgency":"not yet assigned"}}},"CVE-2016-8628":{"description":"Ansible before version 2.2.0 fails to properly sanitize fact variables sent from the Ansible controller. An attacker with the ability to create special variables on the controller could execute arbitrary commands on Ansible clients as the user Ansible runs as.","debianbug":842985,"scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"7.7.0+dfsg-3+deb12u1"},"fixed_version":"2.2.0.0-1","urgency":"not yet assigned"},"bullseye":{"status":"resolved","repositories":{"bullseye":"2.10.7+merged+base+2.10.17+dfsg-0+deb11u1","bullseye-security":"2.10.7+merged+base+2.10.17+dfsg-0+deb11u3"},"fixed_version":"2.2.0.0-1","urgency":"not yet assigned"},"forky":{"status":"resolved","repositories":{"forky":"13.1.0+dfsg-1"},"fixed_version":"2.2.0.0-1","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"13.1.0+dfsg-1"},"fixed_version":"2.2.0.0-1","urgency":"not yet assigned"},"trixie":{"status":"resolved","repositories":{"trixie":"12.0.0+dfsg-0+deb13u1"},"fixed_version":"2.2.0.0-1","urgency":"not yet assigned"}}},"CVE-2016-8647":{"description":"An input validation vulnerability was found in Ansible's mysql_user module before 2.2.1.0, which may fail to correctly change a password in certain circumstances. Thus the previous password would still be active when it should have been changed.","debianbug":844691,"scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"7.7.0+dfsg-3+deb12u1"},"fixed_version":"2.2.0.0-4","urgency":"not yet assigned"},"bullseye":{"status":"resolved","repositories":{"bullseye":"2.10.7+merged+base+2.10.17+dfsg-0+deb11u1","bullseye-security":"2.10.7+merged+base+2.10.17+dfsg-0+deb11u3"},"fixed_version":"2.2.0.0-4","urgency":"not yet assigned"},"forky":{"status":"resolved","repositories":{"forky":"13.1.0+dfsg-1"},"fixed_version":"2.2.0.0-4","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"13.1.0+dfsg-1"},"fixed_version":"2.2.0.0-4","urgency":"not yet assigned"},"trixie":{"status":"resolved","repositories":{"trixie":"12.0.0+dfsg-0+deb13u1"},"fixed_version":"2.2.0.0-4","urgency":"not yet assigned"}}},"CVE-2016-9587":{"description":"Ansible before versions 2.1.4, 2.2.1 is vulnerable to an improper input validation in Ansible's handling of data sent from client systems. An attacker with control over a client system being managed by Ansible and the ability to send facts back to the Ansible server could use this flaw to execute arbitrary code on the Ansible server using the Ansible server privileges.","debianbug":850846,"scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"7.7.0+dfsg-3+deb12u1"},"fixed_version":"2.2.0.0-3","urgency":"not yet assigned"},"bullseye":{"status":"resolved","repositories":{"bullseye":"2.10.7+merged+base+2.10.17+dfsg-0+deb11u1","bullseye-security":"2.10.7+merged+base+2.10.17+dfsg-0+deb11u3"},"fixed_version":"2.2.0.0-3","urgency":"not yet assigned"},"forky":{"status":"resolved","repositories":{"forky":"13.1.0+dfsg-1"},"fixed_version":"2.2.0.0-3","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"13.1.0+dfsg-1"},"fixed_version":"2.2.0.0-3","urgency":"not yet assigned"},"trixie":{"status":"resolved","repositories":{"trixie":"12.0.0+dfsg-0+deb13u1"},"fixed_version":"2.2.0.0-3","urgency":"not yet assigned"}}},"CVE-2017-7466":{"description":"Ansible before version 2.3 has an input validation vulnerability in the handling of data sent from client systems. An attacker with control over a client system being managed by Ansible, and the ability to send facts back to the Ansible server, could use this flaw to execute arbitrary code on the Ansible server using the Ansible server privileges.","scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"7.7.0+dfsg-3+deb12u1"},"fixed_version":"2.2.1.0-2","urgency":"not yet assigned"},"bullseye":{"status":"resolved","repositories":{"bullseye":"2.10.7+merged+base+2.10.17+dfsg-0+deb11u1","bullseye-security":"2.10.7+merged+base+2.10.17+dfsg-0+deb11u3"},"fixed_version":"2.2.1.0-2","urgency":"not yet assigned"},"forky":{"status":"resolved","repositories":{"forky":"13.1.0+dfsg-1"},"fixed_version":"2.2.1.0-2","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"13.1.0+dfsg-1"},"fixed_version":"2.2.1.0-2","urgency":"not yet assigned"},"trixie":{"status":"resolved","repositories":{"trixie":"12.0.0+dfsg-0+deb13u1"},"fixed_version":"2.2.1.0-2","urgency":"not yet assigned"}}},"CVE-2017-7481":{"description":"Ansible before versions 2.3.1.0 and 2.4.0.0 fails to properly mark lookup-plugin results as unsafe. If an attacker could control the results of lookup() calls, they could inject Unicode strings to be parsed by the jinja2 templating system, resulting in code execution. By default, the jinja2 templating language is now marked as 'unsafe' and is not evaluated.","debianbug":862666,"scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"7.7.0+dfsg-3+deb12u1"},"fixed_version":"2.3.1.0+dfsg-1","urgency":"not yet assigned"},"bullseye":{"status":"resolved","repositories":{"bullseye":"2.10.7+merged+base+2.10.17+dfsg-0+deb11u1","bullseye-security":"2.10.7+merged+base+2.10.17+dfsg-0+deb11u3"},"fixed_version":"2.3.1.0+dfsg-1","urgency":"not yet assigned"},"forky":{"status":"resolved","repositories":{"forky":"13.1.0+dfsg-1"},"fixed_version":"2.3.1.0+dfsg-1","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"13.1.0+dfsg-1"},"fixed_version":"2.3.1.0+dfsg-1","urgency":"not yet assigned"},"trixie":{"status":"resolved","repositories":{"trixie":"12.0.0+dfsg-0+deb13u1"},"fixed_version":"2.3.1.0+dfsg-1","urgency":"not yet assigned"}}},"CVE-2017-7550":{"description":"A flaw was found in the way Ansible (2.3.x before 2.3.3, and 2.4.x before 2.4.1) passed certain parameters to the jenkins_plugin module. Remote attackers could use this flaw to expose sensitive information from a remote host's logs. This flaw was fixed by not allowing passwords to be specified in the \"params\" argument, and noting this in the module documentation.","scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"7.7.0+dfsg-3+deb12u1"},"fixed_version":"2.4.2.0+dfsg-1","urgency":"unimportant"},"bullseye":{"status":"resolved","repositories":{"bullseye":"2.10.7+merged+base+2.10.17+dfsg-0+deb11u1","bullseye-security":"2.10.7+merged+base+2.10.17+dfsg-0+deb11u3"},"fixed_version":"2.4.2.0+dfsg-1","urgency":"unimportant"},"forky":{"status":"resolved","repositories":{"forky":"13.1.0+dfsg-1"},"fixed_version":"2.4.2.0+dfsg-1","urgency":"unimportant"},"sid":{"status":"resolved","repositories":{"sid":"13.1.0+dfsg-1"},"fixed_version":"2.4.2.0+dfsg-1","urgency":"unimportant"},"trixie":{"status":"resolved","repositories":{"trixie":"12.0.0+dfsg-0+deb13u1"},"fixed_version":"2.4.2.0+dfsg-1","urgency":"unimportant"}}},"CVE-2018-10855":{"description":"Ansible 2.5 prior to 2.5.5, and 2.4 prior to 2.4.5, do not honor the no_log task flag for failed tasks. When the no_log flag has been used to protect sensitive data passed to a task from being logged, and that task does not run successfully, Ansible will expose sensitive data in log files and on the terminal of the user running Ansible.","scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"7.7.0+dfsg-3+deb12u1"},"fixed_version":"2.5.5+dfsg-1","urgency":"low"},"bullseye":{"status":"resolved","repositories":{"bullseye":"2.10.7+merged+base+2.10.17+dfsg-0+deb11u1","bullseye-security":"2.10.7+merged+base+2.10.17+dfsg-0+deb11u3"},"fixed_version":"2.5.5+dfsg-1","urgency":"low"},"forky":{"status":"resolved","repositories":{"forky":"13.1.0+dfsg-1"},"fixed_version":"2.5.5+dfsg-1","urgency":"low"},"sid":{"status":"resolved","repositories":{"sid":"13.1.0+dfsg-1"},"fixed_version":"2.5.5+dfsg-1","urgency":"low"},"trixie":{"status":"resolved","repositories":{"trixie":"12.0.0+dfsg-0+deb13u1"},"fixed_version":"2.5.5+dfsg-1","urgency":"low"}}},"CVE-2018-10874":{"description":"In ansible it was found that inventory variables are loaded from current working directory when running ad-hoc command which are under attacker's control, allowing to run arbitrary code as a result.","scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"7.7.0+dfsg-3+deb12u1"},"fixed_version":"2.6.1+dfsg-1","urgency":"not yet assigned"},"bullseye":{"status":"resolved","repositories":{"bullseye":"2.10.7+merged+base+2.10.17+dfsg-0+deb11u1","bullseye-security":"2.10.7+merged+base+2.10.17+dfsg-0+deb11u3"},"fixed_version":"2.6.1+dfsg-1","urgency":"not yet assigned"},"forky":{"status":"resolved","repositories":{"forky":"13.1.0+dfsg-1"},"fixed_version":"2.6.1+dfsg-1","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"13.1.0+dfsg-1"},"fixed_version":"2.6.1+dfsg-1","urgency":"not yet assigned"},"trixie":{"status":"resolved","repositories":{"trixie":"12.0.0+dfsg-0+deb13u1"},"fixed_version":"2.6.1+dfsg-1","urgency":"not yet assigned"}}},"CVE-2018-10875":{"description":"A flaw was found in ansible. ansible.cfg is read from the current working directory which can be altered to make it point to a plugin or a module path under the control of an attacker, thus allowing the attacker to execute arbitrary code.","scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"7.7.0+dfsg-3+deb12u1"},"fixed_version":"2.6.1+dfsg-1","urgency":"not yet assigned"},"bullseye":{"status":"resolved","repositories":{"bullseye":"2.10.7+merged+base+2.10.17+dfsg-0+deb11u1","bullseye-security":"2.10.7+merged+base+2.10.17+dfsg-0+deb11u3"},"fixed_version":"2.6.1+dfsg-1","urgency":"not yet assigned"},"forky":{"status":"resolved","repositories":{"forky":"13.1.0+dfsg-1"},"fixed_version":"2.6.1+dfsg-1","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"13.1.0+dfsg-1"},"fixed_version":"2.6.1+dfsg-1","urgency":"not yet assigned"},"trixie":{"status":"resolved","repositories":{"trixie":"12.0.0+dfsg-0+deb13u1"},"fixed_version":"2.6.1+dfsg-1","urgency":"not yet assigned"}}},"CVE-2018-16837":{"description":"Ansible \"User\" module leaks any data which is passed on as a parameter to ssh-keygen. This could lean in undesirable situations such as passphrases credentials passed as a parameter for the ssh-keygen executable. Showing those credentials in clear text form for every user which have access just to the process list.","debianbug":912297,"scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"7.7.0+dfsg-3+deb12u1"},"fixed_version":"2.7.1+dfsg-1","urgency":"not yet assigned"},"bullseye":{"status":"resolved","repositories":{"bullseye":"2.10.7+merged+base+2.10.17+dfsg-0+deb11u1","bullseye-security":"2.10.7+merged+base+2.10.17+dfsg-0+deb11u3"},"fixed_version":"2.7.1+dfsg-1","urgency":"not yet assigned"},"forky":{"status":"resolved","repositories":{"forky":"13.1.0+dfsg-1"},"fixed_version":"2.7.1+dfsg-1","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"13.1.0+dfsg-1"},"fixed_version":"2.7.1+dfsg-1","urgency":"not yet assigned"},"trixie":{"status":"resolved","repositories":{"trixie":"12.0.0+dfsg-0+deb13u1"},"fixed_version":"2.7.1+dfsg-1","urgency":"not yet assigned"}}},"CVE-2018-16859":{"description":"Execution of Ansible playbooks on Windows platforms with PowerShell ScriptBlock logging and Module logging enabled can allow for 'become' passwords to appear in EventLogs in plaintext. A local user with administrator privileges on the machine can view these logs and discover the plaintext password. Ansible Engine 2.8 and older are believed to be vulnerable.","scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"7.7.0+dfsg-3+deb12u1"},"fixed_version":"0","urgency":"unimportant"},"bullseye":{"status":"resolved","repositories":{"bullseye":"2.10.7+merged+base+2.10.17+dfsg-0+deb11u1","bullseye-security":"2.10.7+merged+base+2.10.17+dfsg-0+deb11u3"},"fixed_version":"0","urgency":"unimportant"},"forky":{"status":"resolved","repositories":{"forky":"13.1.0+dfsg-1"},"fixed_version":"0","urgency":"unimportant"},"sid":{"status":"resolved","repositories":{"sid":"13.1.0+dfsg-1"},"fixed_version":"0","urgency":"unimportant"},"trixie":{"status":"resolved","repositories":{"trixie":"12.0.0+dfsg-0+deb13u1"},"fixed_version":"0","urgency":"unimportant"}}},"CVE-2018-16876":{"description":"ansible before versions 2.5.14, 2.6.11, 2.7.5 is vulnerable to a information disclosure flaw in vvv+ mode with no_log on that can lead to leakage of sensible data.","debianbug":916102,"scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"7.7.0+dfsg-3+deb12u1"},"fixed_version":"2.7.6+dfsg-1","urgency":"not yet assigned"},"bullseye":{"status":"resolved","repositories":{"bullseye":"2.10.7+merged+base+2.10.17+dfsg-0+deb11u1","bullseye-security":"2.10.7+merged+base+2.10.17+dfsg-0+deb11u3"},"fixed_version":"2.7.6+dfsg-1","urgency":"not yet assigned"},"forky":{"status":"resolved","repositories":{"forky":"13.1.0+dfsg-1"},"fixed_version":"2.7.6+dfsg-1","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"13.1.0+dfsg-1"},"fixed_version":"2.7.6+dfsg-1","urgency":"not yet assigned"},"trixie":{"status":"resolved","repositories":{"trixie":"12.0.0+dfsg-0+deb13u1"},"fixed_version":"2.7.6+dfsg-1","urgency":"not yet assigned"}}},"CVE-2019-10156":{"description":"A flaw was discovered in the way Ansible templating was implemented in versions before 2.6.18, 2.7.12 and 2.8.2, causing the possibility of information disclosure through unexpected variable substitution. By taking advantage of unintended variable substitution the content of any variable may be disclosed.","debianbug":930065,"scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"7.7.0+dfsg-3+deb12u1"},"fixed_version":"2.8.3+dfsg-1","urgency":"low"},"bullseye":{"status":"resolved","repositories":{"bullseye":"2.10.7+merged+base+2.10.17+dfsg-0+deb11u1","bullseye-security":"2.10.7+merged+base+2.10.17+dfsg-0+deb11u3"},"fixed_version":"2.8.3+dfsg-1","urgency":"low"},"forky":{"status":"resolved","repositories":{"forky":"13.1.0+dfsg-1"},"fixed_version":"2.8.3+dfsg-1","urgency":"low"},"sid":{"status":"resolved","repositories":{"sid":"13.1.0+dfsg-1"},"fixed_version":"2.8.3+dfsg-1","urgency":"low"},"trixie":{"status":"resolved","repositories":{"trixie":"12.0.0+dfsg-0+deb13u1"},"fixed_version":"2.8.3+dfsg-1","urgency":"low"}}},"CVE-2019-10206":{"description":"ansible-playbook -k and ansible cli tools, all versions 2.8.x before 2.8.4, all 2.7.x before 2.7.13 and all 2.6.x before 2.6.19, prompt passwords by expanding them from templates as they could contain special characters. Passwords should be wrapped to prevent templates trigger and exposing them.","debianbug":933005,"scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"7.7.0+dfsg-3+deb12u1"},"fixed_version":"2.8.6+dfsg-1","urgency":"not yet assigned"},"bullseye":{"status":"resolved","repositories":{"bullseye":"2.10.7+merged+base+2.10.17+dfsg-0+deb11u1","bullseye-security":"2.10.7+merged+base+2.10.17+dfsg-0+deb11u3"},"fixed_version":"2.8.6+dfsg-1","urgency":"not yet assigned"},"forky":{"status":"resolved","repositories":{"forky":"13.1.0+dfsg-1"},"fixed_version":"2.8.6+dfsg-1","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"13.1.0+dfsg-1"},"fixed_version":"2.8.6+dfsg-1","urgency":"not yet assigned"},"trixie":{"status":"resolved","repositories":{"trixie":"12.0.0+dfsg-0+deb13u1"},"fixed_version":"2.8.6+dfsg-1","urgency":"not yet assigned"}}},"CVE-2019-10217":{"description":"A flaw was found in ansible 2.8.0 before 2.8.4. Fields managing sensitive data should be set as such by no_log feature. Some of these fields in GCP modules are not set properly. service_account_contents() which is common class for all gcp modules is not setting no_log to True. Any sensitive data managed by that function would be leak as an output when running ansible playbooks.","debianbug":934128,"scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"7.7.0+dfsg-3+deb12u1"},"fixed_version":"2.8.6+dfsg-1","urgency":"not yet assigned"},"bullseye":{"status":"resolved","repositories":{"bullseye":"2.10.7+merged+base+2.10.17+dfsg-0+deb11u1","bullseye-security":"2.10.7+merged+base+2.10.17+dfsg-0+deb11u3"},"fixed_version":"2.8.6+dfsg-1","urgency":"not yet assigned"},"forky":{"status":"resolved","repositories":{"forky":"13.1.0+dfsg-1"},"fixed_version":"2.8.6+dfsg-1","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"13.1.0+dfsg-1"},"fixed_version":"2.8.6+dfsg-1","urgency":"not yet assigned"},"trixie":{"status":"resolved","repositories":{"trixie":"12.0.0+dfsg-0+deb13u1"},"fixed_version":"2.8.6+dfsg-1","urgency":"not yet assigned"}}},"CVE-2019-14846":{"description":"In Ansible, all Ansible Engine versions up to ansible-engine 2.8.5, ansible-engine 2.7.13, ansible-engine 2.6.19, were logging at the DEBUG level which lead to a disclosure of credentials if a plugin used a library that logged credentials at the DEBUG level. This flaw does not affect Ansible modules, as those are executed in a separate process.","debianbug":942188,"scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"7.7.0+dfsg-3+deb12u1"},"fixed_version":"2.8.6+dfsg-1","urgency":"low"},"bullseye":{"status":"resolved","repositories":{"bullseye":"2.10.7+merged+base+2.10.17+dfsg-0+deb11u1","bullseye-security":"2.10.7+merged+base+2.10.17+dfsg-0+deb11u3"},"fixed_version":"2.8.6+dfsg-1","urgency":"low"},"forky":{"status":"resolved","repositories":{"forky":"13.1.0+dfsg-1"},"fixed_version":"2.8.6+dfsg-1","urgency":"low"},"sid":{"status":"resolved","repositories":{"sid":"13.1.0+dfsg-1"},"fixed_version":"2.8.6+dfsg-1","urgency":"low"},"trixie":{"status":"resolved","repositories":{"trixie":"12.0.0+dfsg-0+deb13u1"},"fixed_version":"2.8.6+dfsg-1","urgency":"low"}}},"CVE-2019-14856":{"description":"ansible before versions 2.8.6, 2.7.14, 2.6.20 is vulnerable to a None","scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"7.7.0+dfsg-3+deb12u1"},"fixed_version":"0","urgency":"unimportant"},"bullseye":{"status":"resolved","repositories":{"bullseye":"2.10.7+merged+base+2.10.17+dfsg-0+deb11u1","bullseye-security":"2.10.7+merged+base+2.10.17+dfsg-0+deb11u3"},"fixed_version":"0","urgency":"unimportant"},"forky":{"status":"resolved","repositories":{"forky":"13.1.0+dfsg-1"},"fixed_version":"0","urgency":"unimportant"},"sid":{"status":"resolved","repositories":{"sid":"13.1.0+dfsg-1"},"fixed_version":"0","urgency":"unimportant"},"trixie":{"status":"resolved","repositories":{"trixie":"12.0.0+dfsg-0+deb13u1"},"fixed_version":"0","urgency":"unimportant"}}},"CVE-2019-14858":{"description":"A vulnerability was found in Ansible engine 2.x up to 2.8 and Ansible tower 3.x up to 3.5. When a module has an argument_spec with sub parameters marked as no_log, passing an invalid parameter name to the module will cause the task to fail before the no_log options in the sub parameters are processed. As a result, data in the sub parameter fields will not be masked and will be displayed if Ansible is run with increased verbosity and present in the module invocation arguments for the task.","debianbug":942332,"scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"7.7.0+dfsg-3+deb12u1"},"fixed_version":"2.8.6+dfsg-1","urgency":"not yet assigned"},"bullseye":{"status":"resolved","repositories":{"bullseye":"2.10.7+merged+base+2.10.17+dfsg-0+deb11u1","bullseye-security":"2.10.7+merged+base+2.10.17+dfsg-0+deb11u3"},"fixed_version":"2.8.6+dfsg-1","urgency":"not yet assigned"},"forky":{"status":"resolved","repositories":{"forky":"13.1.0+dfsg-1"},"fixed_version":"2.8.6+dfsg-1","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"13.1.0+dfsg-1"},"fixed_version":"2.8.6+dfsg-1","urgency":"not yet assigned"},"trixie":{"status":"resolved","repositories":{"trixie":"12.0.0+dfsg-0+deb13u1"},"fixed_version":"2.8.6+dfsg-1","urgency":"not yet assigned"}}},"CVE-2019-14864":{"description":"Ansible, versions 2.9.x before 2.9.1, 2.8.x before 2.8.7 and Ansible versions 2.7.x before 2.7.15, is not respecting the flag no_log set it to True when Sumologic and Splunk callback plugins are used send tasks results events to collectors. This would discloses and collects any sensitive data.","debianbug":943768,"scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"7.7.0+dfsg-3+deb12u1"},"fixed_version":"2.9.2+dfsg-1","urgency":"low"},"bullseye":{"status":"resolved","repositories":{"bullseye":"2.10.7+merged+base+2.10.17+dfsg-0+deb11u1","bullseye-security":"2.10.7+merged+base+2.10.17+dfsg-0+deb11u3"},"fixed_version":"2.9.2+dfsg-1","urgency":"low"},"forky":{"status":"resolved","repositories":{"forky":"13.1.0+dfsg-1"},"fixed_version":"2.9.2+dfsg-1","urgency":"low"},"sid":{"status":"resolved","repositories":{"sid":"13.1.0+dfsg-1"},"fixed_version":"2.9.2+dfsg-1","urgency":"low"},"trixie":{"status":"resolved","repositories":{"trixie":"12.0.0+dfsg-0+deb13u1"},"fixed_version":"2.9.2+dfsg-1","urgency":"low"}}},"CVE-2019-14904":{"description":"A flaw was found in the solaris_zone module from the Ansible Community modules. When setting the name for the zone on the Solaris host, the zone name is checked by listing the process with the 'ps' bare command on the remote machine. An attacker could take advantage of this flaw by crafting the name of the zone and executing arbitrary commands in the remote host. Ansible Engine 2.7.15, 2.8.7, and 2.9.2 as well as previous versions are affected.","scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"7.7.0+dfsg-3+deb12u1"},"fixed_version":"2.9.4+dfsg-1","urgency":"low"},"bullseye":{"status":"resolved","repositories":{"bullseye":"2.10.7+merged+base+2.10.17+dfsg-0+deb11u1","bullseye-security":"2.10.7+merged+base+2.10.17+dfsg-0+deb11u3"},"fixed_version":"2.9.4+dfsg-1","urgency":"low"},"forky":{"status":"resolved","repositories":{"forky":"13.1.0+dfsg-1"},"fixed_version":"2.9.4+dfsg-1","urgency":"low"},"sid":{"status":"resolved","repositories":{"sid":"13.1.0+dfsg-1"},"fixed_version":"2.9.4+dfsg-1","urgency":"low"},"trixie":{"status":"resolved","repositories":{"trixie":"12.0.0+dfsg-0+deb13u1"},"fixed_version":"2.9.4+dfsg-1","urgency":"low"}}},"CVE-2019-14905":{"description":"A vulnerability was found in Ansible Engine versions 2.9.x before 2.9.3, 2.8.x before 2.8.8, 2.7.x before 2.7.16 and earlier, where in Ansible's nxos_file_copy module can be used to copy files to a flash or bootflash on NXOS devices. Malicious code could craft the filename parameter to perform OS command injections. This could result in a loss of confidentiality of the system among other issues.","scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"7.7.0+dfsg-3+deb12u1"},"fixed_version":"2.9.4+dfsg-1","urgency":"low"},"bullseye":{"status":"resolved","repositories":{"bullseye":"2.10.7+merged+base+2.10.17+dfsg-0+deb11u1","bullseye-security":"2.10.7+merged+base+2.10.17+dfsg-0+deb11u3"},"fixed_version":"2.9.4+dfsg-1","urgency":"low"},"forky":{"status":"resolved","repositories":{"forky":"13.1.0+dfsg-1"},"fixed_version":"2.9.4+dfsg-1","urgency":"low"},"sid":{"status":"resolved","repositories":{"sid":"13.1.0+dfsg-1"},"fixed_version":"2.9.4+dfsg-1","urgency":"low"},"trixie":{"status":"resolved","repositories":{"trixie":"12.0.0+dfsg-0+deb13u1"},"fixed_version":"2.9.4+dfsg-1","urgency":"low"}}},"CVE-2019-3828":{"description":"Ansible fetch module before versions 2.5.15, 2.6.14, 2.7.8 has a path traversal vulnerability which allows copying and overwriting files outside of the specified destination in the local ansible controller host, by not restricting an absolute path.","debianbug":922537,"scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"7.7.0+dfsg-3+deb12u1"},"fixed_version":"2.7.7+dfsg-1","urgency":"not yet assigned"},"bullseye":{"status":"resolved","repositories":{"bullseye":"2.10.7+merged+base+2.10.17+dfsg-0+deb11u1","bullseye-security":"2.10.7+merged+base+2.10.17+dfsg-0+deb11u3"},"fixed_version":"2.7.7+dfsg-1","urgency":"not yet assigned"},"forky":{"status":"resolved","repositories":{"forky":"13.1.0+dfsg-1"},"fixed_version":"2.7.7+dfsg-1","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"13.1.0+dfsg-1"},"fixed_version":"2.7.7+dfsg-1","urgency":"not yet assigned"},"trixie":{"status":"resolved","repositories":{"trixie":"12.0.0+dfsg-0+deb13u1"},"fixed_version":"2.7.7+dfsg-1","urgency":"not yet assigned"}}},"CVE-2020-10684":{"description":"A flaw was found in Ansible Engine, all versions 2.7.x, 2.8.x and 2.9.x prior to 2.7.17, 2.8.9 and 2.9.6 respectively, when using ansible_facts as a subkey of itself and promoting it to a variable when inject is enabled, overwriting the ansible_facts after the clean. An attacker could take advantage of this by altering the ansible_facts, such as ansible_hosts, users and any other key data which would lead into privilege escalation or code injection.","scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"7.7.0+dfsg-3+deb12u1"},"fixed_version":"2.9.7+dfsg-1","urgency":"not yet assigned"},"bullseye":{"status":"resolved","repositories":{"bullseye":"2.10.7+merged+base+2.10.17+dfsg-0+deb11u1","bullseye-security":"2.10.7+merged+base+2.10.17+dfsg-0+deb11u3"},"fixed_version":"2.9.7+dfsg-1","urgency":"not yet assigned"},"forky":{"status":"resolved","repositories":{"forky":"13.1.0+dfsg-1"},"fixed_version":"2.9.7+dfsg-1","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"13.1.0+dfsg-1"},"fixed_version":"2.9.7+dfsg-1","urgency":"not yet assigned"},"trixie":{"status":"resolved","repositories":{"trixie":"12.0.0+dfsg-0+deb13u1"},"fixed_version":"2.9.7+dfsg-1","urgency":"not yet assigned"}}},"CVE-2020-10685":{"description":"A flaw was found in Ansible Engine affecting Ansible Engine versions 2.7.x before 2.7.17 and 2.8.x before 2.8.11 and 2.9.x before 2.9.7 as well as Ansible Tower before and including versions 3.4.5 and 3.5.5 and 3.6.3 when using modules which decrypts vault files such as assemble, script, unarchive, win_copy, aws_s3 or copy modules. The temporary directory is created in /tmp leaves the s ts unencrypted. On Operating Systems which /tmp is not a tmpfs but part of the root partition, the directory is only cleared on boot and the decryp emains when the host is switched off. The system will be vulnerable when the system is not running. So decrypted data must be cleared as soon as possible and the data which normally is encrypted ble.","scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"7.7.0+dfsg-3+deb12u1"},"fixed_version":"2.9.7+dfsg-1","urgency":"not yet assigned"},"bullseye":{"status":"resolved","repositories":{"bullseye":"2.10.7+merged+base+2.10.17+dfsg-0+deb11u1","bullseye-security":"2.10.7+merged+base+2.10.17+dfsg-0+deb11u3"},"fixed_version":"2.9.7+dfsg-1","urgency":"not yet assigned"},"forky":{"status":"resolved","repositories":{"forky":"13.1.0+dfsg-1"},"fixed_version":"2.9.7+dfsg-1","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"13.1.0+dfsg-1"},"fixed_version":"2.9.7+dfsg-1","urgency":"not yet assigned"},"trixie":{"status":"resolved","repositories":{"trixie":"12.0.0+dfsg-0+deb13u1"},"fixed_version":"2.9.7+dfsg-1","urgency":"not yet assigned"}}},"CVE-2020-10691":{"description":"An archive traversal flaw was found in all ansible-engine versions 2.9.x prior to 2.9.7, when running ansible-galaxy collection install. When extracting a collection .tar.gz file, the directory is created without sanitizing the filename. An attacker could take advantage to overwrite any file within the system.","scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"7.7.0+dfsg-3+deb12u1"},"fixed_version":"2.9.7+dfsg-1","urgency":"not yet assigned"},"bullseye":{"status":"resolved","repositories":{"bullseye":"2.10.7+merged+base+2.10.17+dfsg-0+deb11u1","bullseye-security":"2.10.7+merged+base+2.10.17+dfsg-0+deb11u3"},"fixed_version":"2.9.7+dfsg-1","urgency":"not yet assigned"},"forky":{"status":"resolved","repositories":{"forky":"13.1.0+dfsg-1"},"fixed_version":"2.9.7+dfsg-1","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"13.1.0+dfsg-1"},"fixed_version":"2.9.7+dfsg-1","urgency":"not yet assigned"},"trixie":{"status":"resolved","repositories":{"trixie":"12.0.0+dfsg-0+deb13u1"},"fixed_version":"2.9.7+dfsg-1","urgency":"not yet assigned"}}},"CVE-2020-10729":{"description":"A flaw was found in the use of insufficiently random values in Ansible. Two random password lookups of the same length generate the equal value as the template caching action for the same file since no re-evaluation happens. The highest threat from this vulnerability would be that all passwords are exposed at once for the file. This flaw affects Ansible Engine versions before 2.9.6.","scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"7.7.0+dfsg-3+deb12u1"},"fixed_version":"2.9.6+dfsg-1","urgency":"not yet assigned"},"bullseye":{"status":"resolved","repositories":{"bullseye":"2.10.7+merged+base+2.10.17+dfsg-0+deb11u1","bullseye-security":"2.10.7+merged+base+2.10.17+dfsg-0+deb11u3"},"fixed_version":"2.9.6+dfsg-1","urgency":"not yet assigned"},"forky":{"status":"resolved","repositories":{"forky":"13.1.0+dfsg-1"},"fixed_version":"2.9.6+dfsg-1","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"13.1.0+dfsg-1"},"fixed_version":"2.9.6+dfsg-1","urgency":"not yet assigned"},"trixie":{"status":"resolved","repositories":{"trixie":"12.0.0+dfsg-0+deb13u1"},"fixed_version":"2.9.6+dfsg-1","urgency":"not yet assigned"}}},"CVE-2020-10744":{"description":"An incomplete fix was found for the fix of the flaw CVE-2020-1733 ansible: insecure temporary directory when running become_user from become directive. The provided fix is insufficient to prevent the race condition on systems using ACLs and FUSE filesystems. Ansible Engine 2.7.18, 2.8.12, and 2.9.9 as well as previous versions are affected and Ansible Tower 3.4.5, 3.5.6 and 3.6.4 as well as previous versions are affected.","debianbug":966660,"scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"7.7.0+dfsg-3+deb12u1"},"fixed_version":"2.9.13+dfsg-1","urgency":"not yet assigned"},"bullseye":{"status":"resolved","repositories":{"bullseye":"2.10.7+merged+base+2.10.17+dfsg-0+deb11u1","bullseye-security":"2.10.7+merged+base+2.10.17+dfsg-0+deb11u3"},"fixed_version":"2.9.13+dfsg-1","urgency":"not yet assigned"},"forky":{"status":"resolved","repositories":{"forky":"13.1.0+dfsg-1"},"fixed_version":"2.9.13+dfsg-1","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"13.1.0+dfsg-1"},"fixed_version":"2.9.13+dfsg-1","urgency":"not yet assigned"},"trixie":{"status":"resolved","repositories":{"trixie":"12.0.0+dfsg-0+deb13u1"},"fixed_version":"2.9.13+dfsg-1","urgency":"not yet assigned"}}},"CVE-2020-14330":{"description":"An Improper Output Neutralization for Logs flaw was found in Ansible when using the uri module, where sensitive data is exposed to content and json output. This flaw allows an attacker to access the logs or outputs of performed tasks to read keys used in playbooks from other users within the uri module. The highest threat from this vulnerability is to data confidentiality.","scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"7.7.0+dfsg-3+deb12u1"},"fixed_version":"2.9.13+dfsg-1","urgency":"not yet assigned"},"bullseye":{"status":"resolved","repositories":{"bullseye":"2.10.7+merged+base+2.10.17+dfsg-0+deb11u1","bullseye-security":"2.10.7+merged+base+2.10.17+dfsg-0+deb11u3"},"fixed_version":"2.9.13+dfsg-1","urgency":"not yet assigned"},"forky":{"status":"resolved","repositories":{"forky":"13.1.0+dfsg-1"},"fixed_version":"2.9.13+dfsg-1","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"13.1.0+dfsg-1"},"fixed_version":"2.9.13+dfsg-1","urgency":"not yet assigned"},"trixie":{"status":"resolved","repositories":{"trixie":"12.0.0+dfsg-0+deb13u1"},"fixed_version":"2.9.13+dfsg-1","urgency":"not yet assigned"}}},"CVE-2020-14332":{"description":"A flaw was found in the Ansible Engine when using module_args. Tasks executed with check mode (--check-mode) do not properly neutralize sensitive data exposed in the event data. This flaw allows unauthorized users to read this data. The highest threat from this vulnerability is to confidentiality.","debianbug":966672,"scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"7.7.0+dfsg-3+deb12u1"},"fixed_version":"2.9.13+dfsg-1","urgency":"not yet assigned"},"bullseye":{"status":"resolved","repositories":{"bullseye":"2.10.7+merged+base+2.10.17+dfsg-0+deb11u1","bullseye-security":"2.10.7+merged+base+2.10.17+dfsg-0+deb11u3"},"fixed_version":"2.9.13+dfsg-1","urgency":"not yet assigned"},"forky":{"status":"resolved","repositories":{"forky":"13.1.0+dfsg-1"},"fixed_version":"2.9.13+dfsg-1","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"13.1.0+dfsg-1"},"fixed_version":"2.9.13+dfsg-1","urgency":"not yet assigned"},"trixie":{"status":"resolved","repositories":{"trixie":"12.0.0+dfsg-0+deb13u1"},"fixed_version":"2.9.13+dfsg-1","urgency":"not yet assigned"}}},"CVE-2020-14365":{"description":"A flaw was found in the Ansible Engine, in ansible-engine 2.8.x before 2.8.15 and ansible-engine 2.9.x before 2.9.13, when installing packages using the dnf module. GPG signatures are ignored during installation even when disable_gpg_check is set to False, which is the default behavior. This flaw leads to malicious packages being installed on the system and arbitrary code executed via package installation scripts. The highest threat from this vulnerability is to integrity and system availability.","scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"7.7.0+dfsg-3+deb12u1"},"fixed_version":"2.9.13+dfsg-1","urgency":"unimportant"},"bullseye":{"status":"resolved","repositories":{"bullseye":"2.10.7+merged+base+2.10.17+dfsg-0+deb11u1","bullseye-security":"2.10.7+merged+base+2.10.17+dfsg-0+deb11u3"},"fixed_version":"2.9.13+dfsg-1","urgency":"unimportant"},"forky":{"status":"resolved","repositories":{"forky":"13.1.0+dfsg-1"},"fixed_version":"2.9.13+dfsg-1","urgency":"unimportant"},"sid":{"status":"resolved","repositories":{"sid":"13.1.0+dfsg-1"},"fixed_version":"2.9.13+dfsg-1","urgency":"unimportant"},"trixie":{"status":"resolved","repositories":{"trixie":"12.0.0+dfsg-0+deb13u1"},"fixed_version":"2.9.13+dfsg-1","urgency":"unimportant"}}},"CVE-2020-1733":{"description":"A race condition flaw was found in Ansible Engine 2.7.17 and prior, 2.8.9 and prior, 2.9.6 and prior when running a playbook with an unprivileged become user. When Ansible needs to run a module with become user, the temporary directory is created in /var/tmp. This directory is created with \"umask 77 && mkdir -p <dir>\"; this operation does not fail if the directory already exists and is owned by another user. An attacker could take advantage to gain control of the become user as the target directory can be retrieved by iterating '/proc/<pid>/cmdline'.","scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"7.7.0+dfsg-3+deb12u1"},"fixed_version":"2.9.7+dfsg-1","urgency":"not yet assigned"},"bullseye":{"status":"resolved","repositories":{"bullseye":"2.10.7+merged+base+2.10.17+dfsg-0+deb11u1","bullseye-security":"2.10.7+merged+base+2.10.17+dfsg-0+deb11u3"},"fixed_version":"2.9.7+dfsg-1","urgency":"not yet assigned"},"forky":{"status":"resolved","repositories":{"forky":"13.1.0+dfsg-1"},"fixed_version":"2.9.7+dfsg-1","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"13.1.0+dfsg-1"},"fixed_version":"2.9.7+dfsg-1","urgency":"not yet assigned"},"trixie":{"status":"resolved","repositories":{"trixie":"12.0.0+dfsg-0+deb13u1"},"fixed_version":"2.9.7+dfsg-1","urgency":"not yet assigned"}}},"CVE-2020-1734":{"description":"A flaw was found in the pipe lookup plugin of ansible. Arbitrary commands can be run, when the pipe lookup plugin uses subprocess.Popen() with shell=True, by overwriting ansible facts and the variable is not escaped by quote plugin. An attacker could take advantage and run arbitrary commands by overwriting the ansible facts.","scope":"local","releases":{"bookworm":{"status":"open","repositories":{"bookworm":"7.7.0+dfsg-3+deb12u1"},"urgency":"unimportant"},"bullseye":{"status":"open","repositories":{"bullseye":"2.10.7+merged+base+2.10.17+dfsg-0+deb11u1","bullseye-security":"2.10.7+merged+base+2.10.17+dfsg-0+deb11u3"},"urgency":"unimportant"},"forky":{"status":"open","repositories":{"forky":"13.1.0+dfsg-1"},"urgency":"unimportant"},"sid":{"status":"open","repositories":{"sid":"13.1.0+dfsg-1"},"urgency":"unimportant"},"trixie":{"status":"open","repositories":{"trixie":"12.0.0+dfsg-0+deb13u1"},"urgency":"unimportant"}}},"CVE-2020-1735":{"description":"A flaw was found in the Ansible Engine when the fetch module is used. An attacker could intercept the module, inject a new path, and then choose a new destination path on the controller node. All versions in 2.7.x, 2.8.x and 2.9.x branches are believed to be vulnerable.","scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"7.7.0+dfsg-3+deb12u1"},"fixed_version":"2.9.7+dfsg-1","urgency":"not yet assigned"},"bullseye":{"status":"resolved","repositories":{"bullseye":"2.10.7+merged+base+2.10.17+dfsg-0+deb11u1","bullseye-security":"2.10.7+merged+base+2.10.17+dfsg-0+deb11u3"},"fixed_version":"2.9.7+dfsg-1","urgency":"not yet assigned"},"forky":{"status":"resolved","repositories":{"forky":"13.1.0+dfsg-1"},"fixed_version":"2.9.7+dfsg-1","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"13.1.0+dfsg-1"},"fixed_version":"2.9.7+dfsg-1","urgency":"not yet assigned"},"trixie":{"status":"resolved","repositories":{"trixie":"12.0.0+dfsg-0+deb13u1"},"fixed_version":"2.9.7+dfsg-1","urgency":"not yet assigned"}}},"CVE-2020-1736":{"description":"A flaw was found in Ansible Engine when a file is moved using atomic_move primitive as the file mode cannot be specified. This sets the destination files world-readable if the destination file does not exist and if the file exists, the file could be changed to have less restrictive permissions before the move. This could lead to the disclosure of sensitive data. All versions in 2.7.x, 2.8.x and 2.9.x branches are believed to be vulnerable.","debianbug":966663,"scope":"local","releases":{"bookworm":{"status":"open","repositories":{"bookworm":"7.7.0+dfsg-3+deb12u1"},"urgency":"unimportant"},"bullseye":{"status":"open","repositories":{"bullseye":"2.10.7+merged+base+2.10.17+dfsg-0+deb11u1","bullseye-security":"2.10.7+merged+base+2.10.17+dfsg-0+deb11u3"},"urgency":"unimportant"},"forky":{"status":"open","repositories":{"forky":"13.1.0+dfsg-1"},"urgency":"unimportant"},"sid":{"status":"open","repositories":{"sid":"13.1.0+dfsg-1"},"urgency":"unimportant"},"trixie":{"status":"open","repositories":{"trixie":"12.0.0+dfsg-0+deb13u1"},"urgency":"unimportant"}}},"CVE-2020-1737":{"description":"A flaw was found in Ansible 2.7.17 and prior, 2.8.9 and prior, and 2.9.6 and prior when using the Extract-Zip function from the win_unzip module as the extracted file(s) are not checked if they belong to the destination folder. An attacker could take advantage of this flaw by crafting an archive anywhere in the file system, using a path traversal. This issue is fixed in 2.10.","scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"7.7.0+dfsg-3+deb12u1"},"fixed_version":"2.9.7+dfsg-1","urgency":"unimportant"},"bullseye":{"status":"resolved","repositories":{"bullseye":"2.10.7+merged+base+2.10.17+dfsg-0+deb11u1","bullseye-security":"2.10.7+merged+base+2.10.17+dfsg-0+deb11u3"},"fixed_version":"2.9.7+dfsg-1","urgency":"unimportant"},"forky":{"status":"resolved","repositories":{"forky":"13.1.0+dfsg-1"},"fixed_version":"2.9.7+dfsg-1","urgency":"unimportant"},"sid":{"status":"resolved","repositories":{"sid":"13.1.0+dfsg-1"},"fixed_version":"2.9.7+dfsg-1","urgency":"unimportant"},"trixie":{"status":"resolved","repositories":{"trixie":"12.0.0+dfsg-0+deb13u1"},"fixed_version":"2.9.7+dfsg-1","urgency":"unimportant"}}},"CVE-2020-1738":{"description":"A flaw was found in Ansible Engine when the module package or service is used and the parameter 'use' is not specified. If a previous task is executed with a malicious user, the module sent can be selected by the attacker using the ansible facts file. All versions in 2.7.x, 2.8.x and 2.9.x branches are believed to be vulnerable.","scope":"local","releases":{"bookworm":{"status":"open","repositories":{"bookworm":"7.7.0+dfsg-3+deb12u1"},"urgency":"unimportant"},"bullseye":{"status":"open","repositories":{"bullseye":"2.10.7+merged+base+2.10.17+dfsg-0+deb11u1","bullseye-security":"2.10.7+merged+base+2.10.17+dfsg-0+deb11u3"},"urgency":"unimportant"},"forky":{"status":"open","repositories":{"forky":"13.1.0+dfsg-1"},"urgency":"unimportant"},"sid":{"status":"open","repositories":{"sid":"13.1.0+dfsg-1"},"urgency":"unimportant"},"trixie":{"status":"open","repositories":{"trixie":"12.0.0+dfsg-0+deb13u1"},"urgency":"unimportant"}}},"CVE-2020-1739":{"description":"A flaw was found in Ansible 2.7.16 and prior, 2.8.8 and prior, and 2.9.5 and prior when a password is set with the argument \"password\" of svn module, it is used on svn command line, disclosing to other users within the same node. An attacker could take advantage by reading the cmdline file from that particular PID on the procfs.","scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"7.7.0+dfsg-3+deb12u1"},"fixed_version":"2.9.7+dfsg-1","urgency":"not yet assigned"},"bullseye":{"status":"resolved","repositories":{"bullseye":"2.10.7+merged+base+2.10.17+dfsg-0+deb11u1","bullseye-security":"2.10.7+merged+base+2.10.17+dfsg-0+deb11u3"},"fixed_version":"2.9.7+dfsg-1","urgency":"not yet assigned"},"forky":{"status":"resolved","repositories":{"forky":"13.1.0+dfsg-1"},"fixed_version":"2.9.7+dfsg-1","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"13.1.0+dfsg-1"},"fixed_version":"2.9.7+dfsg-1","urgency":"not yet assigned"},"trixie":{"status":"resolved","repositories":{"trixie":"12.0.0+dfsg-0+deb13u1"},"fixed_version":"2.9.7+dfsg-1","urgency":"not yet assigned"}}},"CVE-2020-1740":{"description":"A flaw was found in Ansible Engine when using Ansible Vault for editing encrypted files. When a user executes \"ansible-vault edit\", another user on the same computer can read the old and new secret, as it is created in a temporary file with mkstemp and the returned file descriptor is closed and the method write_data is called to write the existing secret in the file. This method will delete the file before recreating it insecurely. All versions in 2.7.x, 2.8.x and 2.9.x branches are believed to be vulnerable.","scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"7.7.0+dfsg-3+deb12u1"},"fixed_version":"2.9.7+dfsg-1","urgency":"not yet assigned"},"bullseye":{"status":"resolved","repositories":{"bullseye":"2.10.7+merged+base+2.10.17+dfsg-0+deb11u1","bullseye-security":"2.10.7+merged+base+2.10.17+dfsg-0+deb11u3"},"fixed_version":"2.9.7+dfsg-1","urgency":"not yet assigned"},"forky":{"status":"resolved","repositories":{"forky":"13.1.0+dfsg-1"},"fixed_version":"2.9.7+dfsg-1","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"13.1.0+dfsg-1"},"fixed_version":"2.9.7+dfsg-1","urgency":"not yet assigned"},"trixie":{"status":"resolved","repositories":{"trixie":"12.0.0+dfsg-0+deb13u1"},"fixed_version":"2.9.7+dfsg-1","urgency":"not yet assigned"}}},"CVE-2020-1746":{"description":"A flaw was found in the Ansible Engine affecting Ansible Engine versions 2.7.x before 2.7.17 and 2.8.x before 2.8.11 and 2.9.x before 2.9.7 as well as Ansible Tower before and including versions 3.4.5 and 3.5.5 and 3.6.3 when the ldap_attr and ldap_entry community modules are used. The issue discloses the LDAP bind password to stdout or a log file if a playbook task is written using the bind_pw in the parameters field. The highest threat from this vulnerability is data confidentiality.","scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"7.7.0+dfsg-3+deb12u1"},"fixed_version":"2.9.7+dfsg-1","urgency":"not yet assigned"},"bullseye":{"status":"resolved","repositories":{"bullseye":"2.10.7+merged+base+2.10.17+dfsg-0+deb11u1","bullseye-security":"2.10.7+merged+base+2.10.17+dfsg-0+deb11u3"},"fixed_version":"2.9.7+dfsg-1","urgency":"not yet assigned"},"forky":{"status":"resolved","repositories":{"forky":"13.1.0+dfsg-1"},"fixed_version":"2.9.7+dfsg-1","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"13.1.0+dfsg-1"},"fixed_version":"2.9.7+dfsg-1","urgency":"not yet assigned"},"trixie":{"status":"resolved","repositories":{"trixie":"12.0.0+dfsg-0+deb13u1"},"fixed_version":"2.9.7+dfsg-1","urgency":"not yet assigned"}}},"CVE-2020-1753":{"description":"A security flaw was found in Ansible Engine, all Ansible 2.7.x versions prior to 2.7.17, all Ansible 2.8.x versions prior to 2.8.11 and all Ansible 2.9.x versions prior to 2.9.7, when managing kubernetes using the k8s module. Sensitive parameters such as passwords and tokens are passed to kubectl from the command line, not using an environment variable or an input configuration file. This will disclose passwords and tokens from process list and no_log directive from debug module would not have any effect making these secrets being disclosed on stdout and log files.","scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"7.7.0+dfsg-3+deb12u1"},"fixed_version":"2.9.16+dfsg-1","urgency":"not yet assigned"},"bullseye":{"status":"resolved","repositories":{"bullseye":"2.10.7+merged+base+2.10.17+dfsg-0+deb11u1","bullseye-security":"2.10.7+merged+base+2.10.17+dfsg-0+deb11u3"},"fixed_version":"2.9.16+dfsg-1","urgency":"not yet assigned"},"forky":{"status":"resolved","repositories":{"forky":"13.1.0+dfsg-1"},"fixed_version":"2.9.16+dfsg-1","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"13.1.0+dfsg-1"},"fixed_version":"2.9.16+dfsg-1","urgency":"not yet assigned"},"trixie":{"status":"resolved","repositories":{"trixie":"12.0.0+dfsg-0+deb13u1"},"fixed_version":"2.9.16+dfsg-1","urgency":"not yet assigned"}}},"CVE-2020-25635":{"description":"A flaw was found in Ansible Base when using the aws_ssm connection plugin as garbage collector is not happening after playbook run is completed. Files would remain in the bucket exposing the data. This issue affects directly data confidentiality.","scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"7.7.0+dfsg-3+deb12u1"},"fixed_version":"0","urgency":"unimportant"},"bullseye":{"status":"resolved","repositories":{"bullseye":"2.10.7+merged+base+2.10.17+dfsg-0+deb11u1","bullseye-security":"2.10.7+merged+base+2.10.17+dfsg-0+deb11u3"},"fixed_version":"0","urgency":"unimportant"},"forky":{"status":"resolved","repositories":{"forky":"13.1.0+dfsg-1"},"fixed_version":"0","urgency":"unimportant"},"sid":{"status":"resolved","repositories":{"sid":"13.1.0+dfsg-1"},"fixed_version":"0","urgency":"unimportant"},"trixie":{"status":"resolved","repositories":{"trixie":"12.0.0+dfsg-0+deb13u1"},"fixed_version":"0","urgency":"unimportant"}}},"CVE-2020-25636":{"description":"A flaw was found in Ansible Base when using the aws_ssm connection plugin as there is no namespace separation for file transfers. Files are written directly to the root bucket, making possible to have collisions when running multiple ansible processes. This issue affects mainly the service availability.","scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"7.7.0+dfsg-3+deb12u1"},"fixed_version":"0","urgency":"unimportant"},"bullseye":{"status":"resolved","repositories":{"bullseye":"2.10.7+merged+base+2.10.17+dfsg-0+deb11u1","bullseye-security":"2.10.7+merged+base+2.10.17+dfsg-0+deb11u3"},"fixed_version":"0","urgency":"unimportant"},"forky":{"status":"resolved","repositories":{"forky":"13.1.0+dfsg-1"},"fixed_version":"0","urgency":"unimportant"},"sid":{"status":"resolved","repositories":{"sid":"13.1.0+dfsg-1"},"fixed_version":"0","urgency":"unimportant"},"trixie":{"status":"resolved","repositories":{"trixie":"12.0.0+dfsg-0+deb13u1"},"fixed_version":"0","urgency":"unimportant"}}},"CVE-2020-25646":{"description":"A flaw was found in Ansible Collection community.crypto. openssl_privatekey_info exposes private key in logs. This directly impacts confidentiality","scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"7.7.0+dfsg-3+deb12u1"},"fixed_version":"0","urgency":"unimportant"},"bullseye":{"status":"resolved","repositories":{"bullseye":"2.10.7+merged+base+2.10.17+dfsg-0+deb11u1","bullseye-security":"2.10.7+merged+base+2.10.17+dfsg-0+deb11u3"},"fixed_version":"0","urgency":"unimportant"},"forky":{"status":"resolved","repositories":{"forky":"13.1.0+dfsg-1"},"fixed_version":"0","urgency":"unimportant"},"sid":{"status":"resolved","repositories":{"sid":"13.1.0+dfsg-1"},"fixed_version":"0","urgency":"unimportant"},"trixie":{"status":"resolved","repositories":{"trixie":"12.0.0+dfsg-0+deb13u1"},"fixed_version":"0","urgency":"unimportant"}}},"CVE-2021-20178":{"description":"A flaw was found in ansible module where credentials are disclosed in the console log by default and not protected by the security feature when using the bitbucket_pipeline_variable module. This flaw allows an attacker to steal bitbucket_pipeline credentials. The highest threat from this vulnerability is to confidentiality.","debianbug":985753,"scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"7.7.0+dfsg-3+deb12u1"},"fixed_version":"2.10.7-1","urgency":"not yet assigned"},"bullseye":{"status":"resolved","repositories":{"bullseye":"2.10.7+merged+base+2.10.17+dfsg-0+deb11u1","bullseye-security":"2.10.7+merged+base+2.10.17+dfsg-0+deb11u3"},"fixed_version":"2.10.7-1","urgency":"not yet assigned"},"forky":{"status":"resolved","repositories":{"forky":"13.1.0+dfsg-1"},"fixed_version":"2.10.7-1","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"13.1.0+dfsg-1"},"fixed_version":"2.10.7-1","urgency":"not yet assigned"},"trixie":{"status":"resolved","repositories":{"trixie":"12.0.0+dfsg-0+deb13u1"},"fixed_version":"2.10.7-1","urgency":"not yet assigned"}}},"CVE-2021-20180":{"description":"A flaw was found in ansible module where credentials are disclosed in the console log by default and not protected by the security feature when using the bitbucket_pipeline_variable module. This flaw allows an attacker to steal bitbucket_pipeline credentials. The highest threat from this vulnerability is to confidentiality.","debianbug":985753,"scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"7.7.0+dfsg-3+deb12u1"},"fixed_version":"2.10.7-1","urgency":"not yet assigned"},"bullseye":{"status":"resolved","repositories":{"bullseye":"2.10.7+merged+base+2.10.17+dfsg-0+deb11u1","bullseye-security":"2.10.7+merged+base+2.10.17+dfsg-0+deb11u3"},"fixed_version":"2.10.7-1","urgency":"not yet assigned"},"forky":{"status":"resolved","repositories":{"forky":"13.1.0+dfsg-1"},"fixed_version":"2.10.7-1","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"13.1.0+dfsg-1"},"fixed_version":"2.10.7-1","urgency":"not yet assigned"},"trixie":{"status":"resolved","repositories":{"trixie":"12.0.0+dfsg-0+deb13u1"},"fixed_version":"2.10.7-1","urgency":"not yet assigned"}}},"CVE-2021-20191":{"description":"A flaw was found in ansible. Credentials, such as secrets, are being disclosed in console log by default and not protected by no_log feature when using those modules. An attacker can take advantage of this information to steal those credentials. The highest threat from this vulnerability is to data confidentiality. Versions before ansible 2.9.18 are affected.","debianbug":985753,"scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"7.7.0+dfsg-3+deb12u1"},"fixed_version":"2.10.7-1","urgency":"not yet assigned"},"bullseye":{"status":"resolved","repositories":{"bullseye":"2.10.7+merged+base+2.10.17+dfsg-0+deb11u1","bullseye-security":"2.10.7+merged+base+2.10.17+dfsg-0+deb11u3"},"fixed_version":"2.10.7-1","urgency":"not yet assigned"},"forky":{"status":"resolved","repositories":{"forky":"13.1.0+dfsg-1"},"fixed_version":"2.10.7-1","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"13.1.0+dfsg-1"},"fixed_version":"2.10.7-1","urgency":"not yet assigned"},"trixie":{"status":"resolved","repositories":{"trixie":"12.0.0+dfsg-0+deb13u1"},"fixed_version":"2.10.7-1","urgency":"not yet assigned"}}},"CVE-2021-20228":{"description":"A flaw was found in the Ansible Engine 2.9.18, where sensitive info is not masked by default and is not protected by the no_log feature when using the sub-option feature of the basic.py module. This flaw allows an attacker to obtain sensitive information. The highest threat from this vulnerability is to confidentiality.","scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"7.7.0+dfsg-3+deb12u1"},"fixed_version":"2.10.7+merged+base+2.10.8+dfsg-1","urgency":"not yet assigned"},"bullseye":{"status":"resolved","repositories":{"bullseye":"2.10.7+merged+base+2.10.17+dfsg-0+deb11u1","bullseye-security":"2.10.7+merged+base+2.10.17+dfsg-0+deb11u3"},"fixed_version":"2.10.7+merged+base+2.10.8+dfsg-1","urgency":"not yet assigned"},"forky":{"status":"resolved","repositories":{"forky":"13.1.0+dfsg-1"},"fixed_version":"2.10.7+merged+base+2.10.8+dfsg-1","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"13.1.0+dfsg-1"},"fixed_version":"2.10.7+merged+base+2.10.8+dfsg-1","urgency":"not yet assigned"},"trixie":{"status":"resolved","repositories":{"trixie":"12.0.0+dfsg-0+deb13u1"},"fixed_version":"2.10.7+merged+base+2.10.8+dfsg-1","urgency":"not yet assigned"}}},"CVE-2021-3447":{"description":"A flaw was found in several ansible modules, where parameters containing credentials, such as secrets, were being logged in plain-text on managed nodes, as well as being made visible on the controller node when run in verbose mode. These parameters were not protected by the no_log feature. An attacker can take advantage of this information to steal those credentials, provided when they have access to the log files containing them. The highest threat from this vulnerability is to data confidentiality. This flaw affects Red Hat Ansible Automation Platform in versions before 1.2.2 and Ansible Tower in versions before 3.8.2.","debianbug":1014721,"scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"7.7.0+dfsg-3+deb12u1"},"fixed_version":"2.10.7+merged+base+2.10.8+dfsg-1","urgency":"not yet assigned"},"bullseye":{"status":"resolved","repositories":{"bullseye":"2.10.7+merged+base+2.10.17+dfsg-0+deb11u1","bullseye-security":"2.10.7+merged+base+2.10.17+dfsg-0+deb11u3"},"fixed_version":"2.10.7+merged+base+2.10.8+dfsg-1","urgency":"not yet assigned"},"forky":{"status":"resolved","repositories":{"forky":"13.1.0+dfsg-1"},"fixed_version":"2.10.7+merged+base+2.10.8+dfsg-1","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"13.1.0+dfsg-1"},"fixed_version":"2.10.7+merged+base+2.10.8+dfsg-1","urgency":"not yet assigned"},"trixie":{"status":"resolved","repositories":{"trixie":"12.0.0+dfsg-0+deb13u1"},"fixed_version":"2.10.7+merged+base+2.10.8+dfsg-1","urgency":"not yet assigned"}}},"CVE-2021-3583":{"description":"A flaw was found in Ansible, where a user's controller is vulnerable to template injection. This issue can occur through facts used in the template if the user is trying to put templates in multi-line YAML strings and the facts being handled do not routinely include special template characters. This flaw allows attackers to perform command injection, which discloses sensitive information. The highest threat from this vulnerability is to confidentiality and integrity.","scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"7.7.0+dfsg-3+deb12u1"},"fixed_version":"5.4.0-1","urgency":"not yet assigned"},"bullseye":{"status":"resolved","repositories":{"bullseye":"2.10.7+merged+base+2.10.17+dfsg-0+deb11u1","bullseye-security":"2.10.7+merged+base+2.10.17+dfsg-0+deb11u3"},"fixed_version":"2.10.7+merged+base+2.10.17+dfsg-0+deb11u1","urgency":"not yet assigned"},"forky":{"status":"resolved","repositories":{"forky":"13.1.0+dfsg-1"},"fixed_version":"5.4.0-1","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"13.1.0+dfsg-1"},"fixed_version":"5.4.0-1","urgency":"not yet assigned"},"trixie":{"status":"resolved","repositories":{"trixie":"12.0.0+dfsg-0+deb13u1"},"fixed_version":"5.4.0-1","urgency":"not yet assigned"}}},"CVE-2021-3620":{"description":"A flaw was found in Ansible Engine's ansible-connection module, where sensitive information such as the Ansible user credentials is disclosed by default in the traceback error message. The highest threat from this vulnerability is to confidentiality.","scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"7.7.0+dfsg-3+deb12u1"},"fixed_version":"5.4.0-1","urgency":"not yet assigned"},"bullseye":{"status":"resolved","repositories":{"bullseye":"2.10.7+merged+base+2.10.17+dfsg-0+deb11u1","bullseye-security":"2.10.7+merged+base+2.10.17+dfsg-0+deb11u3"},"fixed_version":"2.10.7+merged+base+2.10.17+dfsg-0+deb11u1","urgency":"not yet assigned"},"forky":{"status":"resolved","repositories":{"forky":"13.1.0+dfsg-1"},"fixed_version":"5.4.0-1","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"13.1.0+dfsg-1"},"fixed_version":"5.4.0-1","urgency":"not yet assigned"},"trixie":{"status":"resolved","repositories":{"trixie":"12.0.0+dfsg-0+deb13u1"},"fixed_version":"5.4.0-1","urgency":"not yet assigned"}}},"CVE-2022-3697":{"description":"A flaw was found in Ansible in the amazon.aws collection when using the tower_callback parameter from the amazon.aws.ec2_instance module. This flaw allows an attacker to take advantage of this issue as the module is handling the parameter insecurely, leading to the password leaking in the logs.","scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"7.7.0+dfsg-3+deb12u1"},"fixed_version":"7.0.0+dfsg-1","urgency":"not yet assigned"},"bullseye":{"status":"resolved","repositories":{"bullseye":"2.10.7+merged+base+2.10.17+dfsg-0+deb11u1","bullseye-security":"2.10.7+merged+base+2.10.17+dfsg-0+deb11u3"},"fixed_version":"2.10.7+merged+base+2.10.17+dfsg-0+deb11u1","urgency":"not yet assigned"},"forky":{"status":"resolved","repositories":{"forky":"13.1.0+dfsg-1"},"fixed_version":"7.0.0+dfsg-1","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"13.1.0+dfsg-1"},"fixed_version":"7.0.0+dfsg-1","urgency":"not yet assigned"},"trixie":{"status":"resolved","repositories":{"trixie":"12.0.0+dfsg-0+deb13u1"},"fixed_version":"7.0.0+dfsg-1","urgency":"not yet assigned"}}},"CVE-2023-4237":{"description":"A flaw was found in the Ansible Automation Platform. When creating a new keypair, the ec2_key module prints out the private key directly to the standard output. This flaw allows an attacker to fetch those keys from the log files, compromising the system's confidentiality, integrity, and availability.","debianbug":1055300,"scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"7.7.0+dfsg-3+deb12u1"},"fixed_version":"7.7.0+dfsg-3+deb12u1","urgency":"not yet assigned"},"bullseye":{"status":"resolved","repositories":{"bullseye":"2.10.7+merged+base+2.10.17+dfsg-0+deb11u1","bullseye-security":"2.10.7+merged+base+2.10.17+dfsg-0+deb11u3"},"fixed_version":"2.10.7+merged+base+2.10.17+dfsg-0+deb11u1","urgency":"not yet assigned"},"forky":{"status":"resolved","repositories":{"forky":"13.1.0+dfsg-1"},"fixed_version":"9.4.0+dfsg-1","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"13.1.0+dfsg-1"},"fixed_version":"9.4.0+dfsg-1","urgency":"not yet assigned"},"trixie":{"status":"resolved","repositories":{"trixie":"12.0.0+dfsg-0+deb13u1"},"fixed_version":"9.4.0+dfsg-1","urgency":"not yet assigned"}}},"CVE-2023-5115":{"description":"An absolute path traversal attack exists in the Ansible automation platform. This flaw allows an attacker to craft a malicious Ansible role and make the victim execute the role. A symlink can be used to overwrite a file outside of the extraction path.","scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"7.7.0+dfsg-3+deb12u1"},"fixed_version":"5.4.0-1","urgency":"not yet assigned"},"bullseye":{"status":"resolved","repositories":{"bullseye":"2.10.7+merged+base+2.10.17+dfsg-0+deb11u1","bullseye-security":"2.10.7+merged+base+2.10.17+dfsg-0+deb11u3"},"fixed_version":"2.10.7+merged+base+2.10.17+dfsg-0+deb11u1","urgency":"not yet assigned"},"forky":{"status":"resolved","repositories":{"forky":"13.1.0+dfsg-1"},"fixed_version":"5.4.0-1","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"13.1.0+dfsg-1"},"fixed_version":"5.4.0-1","urgency":"not yet assigned"},"trixie":{"status":"resolved","repositories":{"trixie":"12.0.0+dfsg-0+deb13u1"},"fixed_version":"5.4.0-1","urgency":"not yet assigned"}}},"CVE-2023-5764":{"description":"A template injection flaw was found in Ansible where a user's controller internal templating operations may remove the unsafe designation from template data. This issue could allow an attacker to use a specially crafted file to introduce templating injection when supplying templating data.","scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"7.7.0+dfsg-3+deb12u1"},"fixed_version":"5.4.0-1","urgency":"not yet assigned"},"bullseye":{"status":"resolved","repositories":{"bullseye":"2.10.7+merged+base+2.10.17+dfsg-0+deb11u1","bullseye-security":"2.10.7+merged+base+2.10.17+dfsg-0+deb11u3"},"fixed_version":"2.10.7+merged+base+2.10.17+dfsg-0+deb11u1","urgency":"not yet assigned"},"forky":{"status":"resolved","repositories":{"forky":"13.1.0+dfsg-1"},"fixed_version":"5.4.0-1","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"13.1.0+dfsg-1"},"fixed_version":"5.4.0-1","urgency":"not yet assigned"},"trixie":{"status":"resolved","repositories":{"trixie":"12.0.0+dfsg-0+deb13u1"},"fixed_version":"5.4.0-1","urgency":"not yet assigned"}}},"CVE-2024-0690":{"description":"An information disclosure flaw was found in ansible-core due to a failure to respect the ANSIBLE_NO_LOG configuration in some scenarios. Information is still included in the output in certain tasks, such as loop items. Depending on the task, this issue may include sensitive information, such as decrypted secret values.","scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"7.7.0+dfsg-3+deb12u1"},"fixed_version":"5.4.0-1","urgency":"not yet assigned"},"bullseye":{"status":"resolved","repositories":{"bullseye":"2.10.7+merged+base+2.10.17+dfsg-0+deb11u1","bullseye-security":"2.10.7+merged+base+2.10.17+dfsg-0+deb11u3"},"fixed_version":"2.10.7+merged+base+2.10.17+dfsg-0+deb11u1","urgency":"not yet assigned"},"forky":{"status":"resolved","repositories":{"forky":"13.1.0+dfsg-1"},"fixed_version":"5.4.0-1","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"13.1.0+dfsg-1"},"fixed_version":"5.4.0-1","urgency":"not yet assigned"},"trixie":{"status":"resolved","repositories":{"trixie":"12.0.0+dfsg-0+deb13u1"},"fixed_version":"5.4.0-1","urgency":"not yet assigned"}}},"CVE-2024-11079":{"description":"A flaw was found in Ansible-Core. This vulnerability allows attackers to bypass unsafe content protections using the hostvars object to reference and execute templated content. This issue can lead to arbitrary code execution if remote data or module outputs are improperly templated within playbooks.","scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"7.7.0+dfsg-3+deb12u1"},"fixed_version":"5.4.0-1","urgency":"not yet assigned"},"bullseye":{"status":"open","repositories":{"bullseye":"2.10.7+merged+base+2.10.17+dfsg-0+deb11u1","bullseye-security":"2.10.7+merged+base+2.10.17+dfsg-0+deb11u3"},"urgency":"not yet assigned"},"forky":{"status":"resolved","repositories":{"forky":"13.1.0+dfsg-1"},"fixed_version":"5.4.0-1","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"13.1.0+dfsg-1"},"fixed_version":"5.4.0-1","urgency":"not yet assigned"},"trixie":{"status":"resolved","repositories":{"trixie":"12.0.0+dfsg-0+deb13u1"},"fixed_version":"5.4.0-1","urgency":"not yet assigned"}}},"CVE-2024-8775":{"description":"A flaw was found in Ansible, where sensitive information stored in Ansible Vault files can be exposed in plaintext during the execution of a playbook. This occurs when using tasks such as include_vars to load vaulted variables without setting the no_log: true parameter, resulting in sensitive data being printed in the playbook output or logs. This can lead to the unintentional disclosure of secrets like passwords or API keys, compromising security and potentially allowing unauthorized access or actions.","scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"7.7.0+dfsg-3+deb12u1"},"fixed_version":"5.4.0-1","urgency":"not yet assigned"},"bullseye":{"status":"resolved","repositories":{"bullseye":"2.10.7+merged+base+2.10.17+dfsg-0+deb11u1","bullseye-security":"2.10.7+merged+base+2.10.17+dfsg-0+deb11u3"},"fixed_version":"2.10.7+merged+base+2.10.17+dfsg-0+deb11u2","urgency":"not yet assigned"},"forky":{"status":"resolved","repositories":{"forky":"13.1.0+dfsg-1"},"fixed_version":"5.4.0-1","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"13.1.0+dfsg-1"},"fixed_version":"5.4.0-1","urgency":"not yet assigned"},"trixie":{"status":"resolved","repositories":{"trixie":"12.0.0+dfsg-0+deb13u1"},"fixed_version":"5.4.0-1","urgency":"not yet assigned"}}},"CVE-2024-9902":{"description":"A flaw was found in Ansible. The ansible-core `user` module can allow an unprivileged user to silently create or replace the contents of any file on any system path and take ownership of it when a privileged user executes the `user` module against the unprivileged user's home directory. If the unprivileged user has traversal permissions on the directory containing the exploited target file, they retain full control over the contents of the file as its owner.","scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"7.7.0+dfsg-3+deb12u1"},"fixed_version":"5.4.0-1","urgency":"not yet assigned"},"bullseye":{"status":"resolved","repositories":{"bullseye":"2.10.7+merged+base+2.10.17+dfsg-0+deb11u1","bullseye-security":"2.10.7+merged+base+2.10.17+dfsg-0+deb11u3"},"fixed_version":"2.10.7+merged+base+2.10.17+dfsg-0+deb11u2","urgency":"not yet assigned"},"forky":{"status":"resolved","repositories":{"forky":"13.1.0+dfsg-1"},"fixed_version":"5.4.0-1","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"13.1.0+dfsg-1"},"fixed_version":"5.4.0-1","urgency":"not yet assigned"},"trixie":{"status":"resolved","repositories":{"trixie":"12.0.0+dfsg-0+deb13u1"},"fixed_version":"5.4.0-1","urgency":"not yet assigned"}}},"CVE-2025-14010":{"description":"A flaw was found in ansible-collection-community-general. This vulnerability allows for information exposure (IE) of sensitive credentials, specifically plaintext passwords, via verbose output when running Ansible with debug modes. Attackers with access to logs could retrieve these secrets and potentially compromise Keycloak accounts or administrative access.","debianbug":1121951,"scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"7.7.0+dfsg-3+deb12u1"},"fixed_version":"0","urgency":"unimportant"},"bullseye":{"status":"resolved","repositories":{"bullseye":"2.10.7+merged+base+2.10.17+dfsg-0+deb11u1","bullseye-security":"2.10.7+merged+base+2.10.17+dfsg-0+deb11u3"},"fixed_version":"0","urgency":"unimportant"},"forky":{"status":"resolved","repositories":{"forky":"13.1.0+dfsg-1"},"fixed_version":"12.2.0+dfsg-1","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"13.1.0+dfsg-1"},"fixed_version":"12.2.0+dfsg-1","urgency":"not yet assigned"},"trixie":{"status":"resolved","repositories":{"trixie":"12.0.0+dfsg-0+deb13u1"},"fixed_version":"12.0.0+dfsg-0+deb13u1","urgency":"not yet assigned"}}}},"ansible-core":{"CVE-2021-3583":{"description":"A flaw was found in Ansible, where a user's controller is vulnerable to template injection. This issue can occur through facts used in the template if the user is trying to put templates in multi-line YAML strings and the facts being handled do not routinely include special template characters. This flaw allows attackers to perform command injection, which discloses sensitive information. The highest threat from this vulnerability is to confidentiality and integrity.","scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"2.14.18-0+deb12u2"},"fixed_version":"2.12.0-1","urgency":"not yet assigned"},"forky":{"status":"resolved","repositories":{"forky":"2.20.1-1"},"fixed_version":"2.12.0-1","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"2.20.1-1"},"fixed_version":"2.12.0-1","urgency":"not yet assigned"},"trixie":{"status":"resolved","repositories":{"trixie":"2.19.4-0+deb13u1"},"fixed_version":"2.12.0-1","urgency":"not yet assigned"}}},"CVE-2021-3620":{"description":"A flaw was found in Ansible Engine's ansible-connection module, where sensitive information such as the Ansible user credentials is disclosed by default in the traceback error message. The highest threat from this vulnerability is to confidentiality.","scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"2.14.18-0+deb12u2"},"fixed_version":"2.12.0-1","urgency":"not yet assigned"},"forky":{"status":"resolved","repositories":{"forky":"2.20.1-1"},"fixed_version":"2.12.0-1","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"2.20.1-1"},"fixed_version":"2.12.0-1","urgency":"not yet assigned"},"trixie":{"status":"resolved","repositories":{"trixie":"2.19.4-0+deb13u1"},"fixed_version":"2.12.0-1","urgency":"not yet assigned"}}},"CVE-2023-5115":{"description":"An absolute path traversal attack exists in the Ansible automation platform. This flaw allows an attacker to craft a malicious Ansible role and make the victim execute the role. A symlink can be used to overwrite a file outside of the extraction path.","debianbug":1053693,"scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"2.14.18-0+deb12u2"},"fixed_version":"2.14.16-0+deb12u1","urgency":"not yet assigned"},"forky":{"status":"resolved","repositories":{"forky":"2.20.1-1"},"fixed_version":"2.14.11-1","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"2.20.1-1"},"fixed_version":"2.14.11-1","urgency":"not yet assigned"},"trixie":{"status":"resolved","repositories":{"trixie":"2.19.4-0+deb13u1"},"fixed_version":"2.14.11-1","urgency":"not yet assigned"}}},"CVE-2023-5764":{"description":"A template injection flaw was found in Ansible where a user's controller internal templating operations may remove the unsafe designation from template data. This issue could allow an attacker to use a specially crafted file to introduce templating injection when supplying templating data.","debianbug":1057427,"scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"2.14.18-0+deb12u2"},"fixed_version":"2.14.16-0+deb12u1","urgency":"not yet assigned"},"forky":{"status":"resolved","repositories":{"forky":"2.20.1-1"},"fixed_version":"2.14.13-1","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"2.20.1-1"},"fixed_version":"2.14.13-1","urgency":"not yet assigned"},"trixie":{"status":"resolved","repositories":{"trixie":"2.19.4-0+deb13u1"},"fixed_version":"2.14.13-1","urgency":"not yet assigned"}}},"CVE-2024-0690":{"description":"An information disclosure flaw was found in ansible-core due to a failure to respect the ANSIBLE_NO_LOG configuration in some scenarios. Information is still included in the output in certain tasks, such as loop items. Depending on the task, this issue may include sensitive information, such as decrypted secret values.","debianbug":1061156,"scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"2.14.18-0+deb12u2"},"fixed_version":"2.14.16-0+deb12u1","urgency":"not yet assigned"},"forky":{"status":"resolved","repositories":{"forky":"2.20.1-1"},"fixed_version":"2.16.5-1","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"2.20.1-1"},"fixed_version":"2.16.5-1","urgency":"not yet assigned"},"trixie":{"status":"resolved","repositories":{"trixie":"2.19.4-0+deb13u1"},"fixed_version":"2.16.5-1","urgency":"not yet assigned"}}},"CVE-2024-11079":{"description":"A flaw was found in Ansible-Core. This vulnerability allows attackers to bypass unsafe content protections using the hostvars object to reference and execute templated content. This issue can lead to arbitrary code execution if remote data or module outputs are improperly templated within playbooks.","debianbug":1088106,"scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"2.14.18-0+deb12u2"},"fixed_version":"2.14.18-0+deb12u1","urgency":"not yet assigned"},"forky":{"status":"resolved","repositories":{"forky":"2.20.1-1"},"fixed_version":"2.18.0-2","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"2.20.1-1"},"fixed_version":"2.18.0-2","urgency":"not yet assigned"},"trixie":{"status":"resolved","repositories":{"trixie":"2.19.4-0+deb13u1"},"fixed_version":"2.18.0-2","urgency":"not yet assigned"}}},"CVE-2024-8775":{"description":"A flaw was found in Ansible, where sensitive information stored in Ansible Vault files can be exposed in plaintext during the execution of a playbook. This occurs when using tasks such as include_vars to load vaulted variables without setting the no_log: true parameter, resulting in sensitive data being printed in the playbook output or logs. This can lead to the unintentional disclosure of secrets like passwords or API keys, compromising security and potentially allowing unauthorized access or actions.","debianbug":1082851,"scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"2.14.18-0+deb12u2"},"fixed_version":"2.14.18-0+deb12u1","urgency":"not yet assigned"},"forky":{"status":"resolved","repositories":{"forky":"2.20.1-1"},"fixed_version":"2.17.5-5","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"2.20.1-1"},"fixed_version":"2.17.5-5","urgency":"not yet assigned"},"trixie":{"status":"resolved","repositories":{"trixie":"2.19.4-0+deb13u1"},"fixed_version":"2.17.5-5","urgency":"not yet assigned"}}},"CVE-2024-9902":{"description":"A flaw was found in Ansible. The ansible-core `user` module can allow an unprivileged user to silently create or replace the contents of any file on any system path and take ownership of it when a privileged user executes the `user` module against the unprivileged user's home directory. If the unprivileged user has traversal permissions on the directory containing the exploited target file, they retain full control over the contents of the file as its owner.","debianbug":1086883,"scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"2.14.18-0+deb12u2"},"fixed_version":"2.14.18-0+deb12u1","urgency":"not yet assigned"},"forky":{"status":"resolved","repositories":{"forky":"2.20.1-1"},"fixed_version":"2.18.0-1","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"2.20.1-1"},"fixed_version":"2.18.0-1","urgency":"not yet assigned"},"trixie":{"status":"resolved","repositories":{"trixie":"2.19.4-0+deb13u1"},"fixed_version":"2.18.0-1","urgency":"not yet assigned"}}}},"ansible-runner":{"CVE-2021-3701":{"description":"A flaw was found in ansible-runner where the default temporary files configuration in ansible-2.0.0 are written to world R/W locations. This flaw allows an attacker to pre-create the directory, resulting in reading private information or forcing ansible-runner to write files as the legitimate user in a place they did not expect. The highest threat from this vulnerability is to confidentiality and integrity.","scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"2.3.1-2"},"fixed_version":"2.1.1-1","urgency":"not yet assigned"},"forky":{"status":"resolved","repositories":{"forky":"2.4.1-1"},"fixed_version":"2.1.1-1","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"2.4.2+dfsg-1"},"fixed_version":"2.1.1-1","urgency":"not yet assigned"},"trixie":{"status":"resolved","repositories":{"trixie":"2.4.1-1"},"fixed_version":"2.1.1-1","urgency":"not yet assigned"}}},"CVE-2021-3702":{"description":"A race condition flaw was found in ansible-runner, where an attacker could watch for rapid creation and deletion of a temporary directory, substitute their directory at that name, and then have access to ansible-runner's private_data_dir the next time ansible-runner made use of the private_data_dir. The highest Threat out of this flaw is to integrity and confidentiality.","scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"2.3.1-2"},"fixed_version":"0","urgency":"unimportant"},"forky":{"status":"resolved","repositories":{"forky":"2.4.1-1"},"fixed_version":"0","urgency":"unimportant"},"sid":{"status":"resolved","repositories":{"sid":"2.4.2+dfsg-1"},"fixed_version":"0","urgency":"unimportant"},"trixie":{"status":"resolved","repositories":{"trixie":"2.4.1-1"},"fixed_version":"0","urgency":"unimportant"}}},"CVE-2021-4041":{"description":"A flaw was found in ansible-runner. An improper escaping of the shell command, while calling the ansible_runner.interface.run_command, can lead to parameters getting executed as host's shell command. A developer could unintentionally write code that gets executed in the host rather than the virtual environment.","scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"2.3.1-2"},"fixed_version":"2.1.1-1","urgency":"not yet assigned"},"forky":{"status":"resolved","repositories":{"forky":"2.4.1-1"},"fixed_version":"2.1.1-1","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"2.4.2+dfsg-1"},"fixed_version":"2.1.1-1","urgency":"not yet assigned"},"trixie":{"status":"resolved","repositories":{"trixie":"2.4.1-1"},"fixed_version":"2.1.1-1","urgency":"not yet assigned"}}}},"ant":{"CVE-2018-10886":{"scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"1.10.13-1"},"fixed_version":"1.10.4-1","urgency":"not yet assigned"},"bullseye":{"status":"resolved","repositories":{"bullseye":"1.10.9-4"},"fixed_version":"1.10.4-1","urgency":"not yet assigned"},"forky":{"status":"resolved","repositories":{"forky":"1.10.15-1"},"fixed_version":"1.10.4-1","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"1.10.15-1"},"fixed_version":"1.10.4-1","urgency":"not yet assigned"},"trixie":{"status":"resolved","repositories":{"trixie":"1.10.15-1"},"fixed_version":"1.10.4-1","urgency":"not yet assigned"}}},"CVE-2020-11979":{"description":"As mitigation for CVE-2020-1945 Apache Ant 1.10.8 changed the permissions of temporary files it created so that only the current user was allowed to access them. Unfortunately the fixcrlf task deleted the temporary file and created a new one without said protection, effectively nullifying the effort. This would still allow an attacker to inject modified source files into the build process.","debianbug":971612,"scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"1.10.13-1"},"fixed_version":"1.10.9-1","urgency":"not yet assigned"},"bullseye":{"status":"resolved","repositories":{"bullseye":"1.10.9-4"},"fixed_version":"1.10.9-1","urgency":"not yet assigned"},"forky":{"status":"resolved","repositories":{"forky":"1.10.15-1"},"fixed_version":"1.10.9-1","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"1.10.15-1"},"fixed_version":"1.10.9-1","urgency":"not yet assigned"},"trixie":{"status":"resolved","repositories":{"trixie":"1.10.15-1"},"fixed_version":"1.10.9-1","urgency":"not yet assigned"}}},"CVE-2020-1945":{"description":"Apache Ant 1.1 to 1.9.14 and 1.10.0 to 1.10.7 uses the default temporary directory identified by the Java system property java.io.tmpdir for several tasks and may thus leak sensitive information. The fixcrlf and replaceregexp tasks also copy files from the temporary directory back into the build tree allowing an attacker to inject modified source files into the build process.","debianbug":960630,"scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"1.10.13-1"},"fixed_version":"1.10.8-1","urgency":"low"},"bullseye":{"status":"resolved","repositories":{"bullseye":"1.10.9-4"},"fixed_version":"1.10.8-1","urgency":"low"},"forky":{"status":"resolved","repositories":{"forky":"1.10.15-1"},"fixed_version":"1.10.8-1","urgency":"low"},"sid":{"status":"resolved","repositories":{"sid":"1.10.15-1"},"fixed_version":"1.10.8-1","urgency":"low"},"trixie":{"status":"resolved","repositories":{"trixie":"1.10.15-1"},"fixed_version":"1.10.8-1","urgency":"low"}}},"CVE-2021-36373":{"description":"When reading a specially crafted TAR archive an Apache Ant build can be made to allocate large amounts of memory that finally leads to an out of memory error, even for small inputs. This can be used to disrupt builds using Apache Ant. Apache Ant prior to 1.9.16 and 1.10.11 were affected.","scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"1.10.13-1"},"fixed_version":"1.10.11-1","urgency":"unimportant"},"bullseye":{"status":"open","repositories":{"bullseye":"1.10.9-4"},"urgency":"unimportant"},"forky":{"status":"resolved","repositories":{"forky":"1.10.15-1"},"fixed_version":"1.10.11-1","urgency":"unimportant"},"sid":{"status":"resolved","repositories":{"sid":"1.10.15-1"},"fixed_version":"1.10.11-1","urgency":"unimportant"},"trixie":{"status":"resolved","repositories":{"trixie":"1.10.15-1"},"fixed_version":"1.10.11-1","urgency":"unimportant"}}},"CVE-2021-36374":{"description":"When reading a specially crafted ZIP archive, or a derived formats, an Apache Ant build can be made to allocate large amounts of memory that leads to an out of memory error, even for small inputs. This can be used to disrupt builds using Apache Ant. Commonly used derived formats from ZIP archives are for instance JAR files and many office files. Apache Ant prior to 1.9.16 and 1.10.11 were affected.","scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"1.10.13-1"},"fixed_version":"1.10.11-1","urgency":"unimportant"},"bullseye":{"status":"open","repositories":{"bullseye":"1.10.9-4"},"urgency":"unimportant"},"forky":{"status":"resolved","repositories":{"forky":"1.10.15-1"},"fixed_version":"1.10.11-1","urgency":"unimportant"},"sid":{"status":"resolved","repositories":{"sid":"1.10.15-1"},"fixed_version":"1.10.11-1","urgency":"unimportant"},"trixie":{"status":"resolved","repositories":{"trixie":"1.10.15-1"},"fixed_version":"1.10.11-1","urgency":"unimportant"}}},"TEMP-0904191-9063D5":{"debianbug":904191,"releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"1.10.13-1"},"fixed_version":"1.10.5-1","urgency":"not yet assigned"},"bullseye":{"status":"resolved","repositories":{"bullseye":"1.10.9-4"},"fixed_version":"1.10.5-1","urgency":"not yet assigned"},"forky":{"status":"resolved","repositories":{"forky":"1.10.15-1"},"fixed_version":"1.10.5-1","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"1.10.15-1"},"fixed_version":"1.10.5-1","urgency":"not yet assigned"},"trixie":{"status":"resolved","repositories":{"trixie":"1.10.15-1"},"fixed_version":"1.10.5-1","urgency":"not yet assigned"}}}},"antiword":{"CVE-2005-3126":{"description":"The (1) kantiword (kantiword.sh) and (2) gantiword (gantiword.sh) scripts in antiword 0.35 and earlier allow local users to overwrite arbitrary files via a symlink attack on temporary (a) output and (b) error files.","scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"0.37-16"},"fixed_version":"0.35-2","urgency":"low"},"bullseye":{"status":"resolved","repositories":{"bullseye":"0.37-16"},"fixed_version":"0.35-2","urgency":"low"},"forky":{"status":"resolved","repositories":{"forky":"0.37-17"},"fixed_version":"0.35-2","urgency":"low"},"sid":{"status":"resolved","repositories":{"sid":"0.37-17"},"fixed_version":"0.35-2","urgency":"low"},"trixie":{"status":"resolved","repositories":{"trixie":"0.37-17"},"fixed_version":"0.35-2","urgency":"low"}}},"CVE-2014-8123":{"description":"Buffer overflow in the bGetPPS function in wordole.c in Antiword 0.37 allows remote attackers to cause a denial of service (crash) via a crafted document.","debianbug":771768,"scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"0.37-16"},"fixed_version":"0.37-5","urgency":"not yet assigned"},"bullseye":{"status":"resolved","repositories":{"bullseye":"0.37-16"},"fixed_version":"0.37-5","urgency":"not yet assigned"},"forky":{"status":"resolved","repositories":{"forky":"0.37-17"},"fixed_version":"0.37-5","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"0.37-17"},"fixed_version":"0.37-5","urgency":"not yet assigned"},"trixie":{"status":"resolved","repositories":{"trixie":"0.37-17"},"fixed_version":"0.37-5","urgency":"not yet assigned"}}}},"aodh":{"CVE-2017-12440":{"description":"Aodh as packaged in Openstack Ocata and Newton before change-ID I8fd11a7f9fe3c0ea5f9843a89686ac06713b7851 and before Pike-rc1 does not verify that trust IDs belong to the user when creating alarm action with the scheme trust+http, which allows remote authenticated users with knowledge of trust IDs where Aodh is the trustee to obtain a Keystone token and perform unspecified authenticated actions by adding an alarm action with the scheme trust+http, and providing a trust id where Aodh is the trustee.","debianbug":872605,"scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"15.0.0-3"},"fixed_version":"5.0.0-2","urgency":"not yet assigned"},"bullseye":{"status":"resolved","repositories":{"bullseye":"11.0.0-2"},"fixed_version":"5.0.0-2","urgency":"not yet assigned"},"forky":{"status":"resolved","repositories":{"forky":"21.0.0-4"},"fixed_version":"5.0.0-2","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"21.0.0-4"},"fixed_version":"5.0.0-2","urgency":"not yet assigned"},"trixie":{"status":"resolved","repositories":{"trixie":"20.0.0-2"},"fixed_version":"5.0.0-2","urgency":"not yet assigned"}}}},"aom":{"CVE-2020-0478":{"description":"In extend_frame_lowbd of restoration.c, there is a possible out of bounds write due to a missing bounds check. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is needed for exploitation.Product: AndroidVersions: Android-11Android ID: A-150780418","scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"3.6.0-1+deb12u2","bookworm-security":"3.6.0-1+deb12u1"},"fixed_version":"1.0.0.errata1.avif-1","urgency":"not yet assigned"},"bullseye":{"status":"open","repositories":{"bullseye":"1.0.0.errata1-3+deb11u1","bullseye-security":"1.0.0.errata1-3+deb11u2"},"urgency":"not yet assigned","nodsa":"Minor issue","nodsa_reason":"ignored"},"forky":{"status":"resolved","repositories":{"forky":"3.13.1-2"},"fixed_version":"1.0.0.errata1.avif-1","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"3.13.1-2"},"fixed_version":"1.0.0.errata1.avif-1","urgency":"not yet assigned"},"trixie":{"status":"resolved","repositories":{"trixie":"3.12.1-1"},"fixed_version":"1.0.0.errata1.avif-1","urgency":"not yet assigned"}}},"CVE-2020-36129":{"description":"AOM v2.0.1 was discovered to contain a stack buffer overflow via the component src/aom_image.c.","scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"3.6.0-1+deb12u2","bookworm-security":"3.6.0-1+deb12u1"},"fixed_version":"3.2.0-1","urgency":"not yet assigned"},"bullseye":{"status":"resolved","repositories":{"bullseye":"1.0.0.errata1-3+deb11u1","bullseye-security":"1.0.0.errata1-3+deb11u2"},"fixed_version":"0","urgency":"unimportant"},"forky":{"status":"resolved","repositories":{"forky":"3.13.1-2"},"fixed_version":"3.2.0-1","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"3.13.1-2"},"fixed_version":"3.2.0-1","urgency":"not yet assigned"},"trixie":{"status":"resolved","repositories":{"trixie":"3.12.1-1"},"fixed_version":"3.2.0-1","urgency":"not yet assigned"}}},"CVE-2020-36130":{"description":"AOM v2.0.1 was discovered to contain a NULL pointer dereference via the component av1/av1_dx_iface.c.","scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"3.6.0-1+deb12u2","bookworm-security":"3.6.0-1+deb12u1"},"fixed_version":"3.2.0-1","urgency":"not yet assigned"},"bullseye":{"status":"resolved","repositories":{"bullseye":"1.0.0.errata1-3+deb11u1","bullseye-security":"1.0.0.errata1-3+deb11u2"},"fixed_version":"1.0.0.errata1-3+deb11u1","urgency":"not yet assigned"},"forky":{"status":"resolved","repositories":{"forky":"3.13.1-2"},"fixed_version":"3.2.0-1","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"3.13.1-2"},"fixed_version":"3.2.0-1","urgency":"not yet assigned"},"trixie":{"status":"resolved","repositories":{"trixie":"3.12.1-1"},"fixed_version":"3.2.0-1","urgency":"not yet assigned"}}},"CVE-2020-36131":{"description":"AOM v2.0.1 was discovered to contain a stack buffer overflow via the component stats/rate_hist.c.","scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"3.6.0-1+deb12u2","bookworm-security":"3.6.0-1+deb12u1"},"fixed_version":"3.2.0-1","urgency":"not yet assigned"},"bullseye":{"status":"resolved","repositories":{"bullseye":"1.0.0.errata1-3+deb11u1","bullseye-security":"1.0.0.errata1-3+deb11u2"},"fixed_version":"1.0.0.errata1-3+deb11u1","urgency":"not yet assigned"},"forky":{"status":"resolved","repositories":{"forky":"3.13.1-2"},"fixed_version":"3.2.0-1","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"3.13.1-2"},"fixed_version":"3.2.0-1","urgency":"not yet assigned"},"trixie":{"status":"resolved","repositories":{"trixie":"3.12.1-1"},"fixed_version":"3.2.0-1","urgency":"not yet assigned"}}},"CVE-2020-36133":{"description":"AOM v2.0.1 was discovered to contain a global buffer overflow via the component av1/encoder/partition_search.h.","scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"3.6.0-1+deb12u2","bookworm-security":"3.6.0-1+deb12u1"},"fixed_version":"3.2.0-1","urgency":"not yet assigned"},"bullseye":{"status":"resolved","repositories":{"bullseye":"1.0.0.errata1-3+deb11u1","bullseye-security":"1.0.0.errata1-3+deb11u2"},"fixed_version":"1.0.0.errata1-3+deb11u1","urgency":"not yet assigned"},"forky":{"status":"resolved","repositories":{"forky":"3.13.1-2"},"fixed_version":"3.2.0-1","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"3.13.1-2"},"fixed_version":"3.2.0-1","urgency":"not yet assigned"},"trixie":{"status":"resolved","repositories":{"trixie":"3.12.1-1"},"fixed_version":"3.2.0-1","urgency":"not yet assigned"}}},"CVE-2020-36134":{"description":"AOM v2.0.1 was discovered to contain a segmentation violation via the component aom_dsp/x86/obmc_sad_avx2.c.","scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"3.6.0-1+deb12u2","bookworm-security":"3.6.0-1+deb12u1"},"fixed_version":"0","urgency":"unimportant"},"bullseye":{"status":"resolved","repositories":{"bullseye":"1.0.0.errata1-3+deb11u1","bullseye-security":"1.0.0.errata1-3+deb11u2"},"fixed_version":"0","urgency":"unimportant"},"forky":{"status":"resolved","repositories":{"forky":"3.13.1-2"},"fixed_version":"0","urgency":"unimportant"},"sid":{"status":"resolved","repositories":{"sid":"3.13.1-2"},"fixed_version":"0","urgency":"unimportant"},"trixie":{"status":"resolved","repositories":{"trixie":"3.12.1-1"},"fixed_version":"0","urgency":"unimportant"}}},"CVE-2020-36135":{"description":"AOM v2.0.1 was discovered to contain a NULL pointer dereference via the component rate_hist.c.","scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"3.6.0-1+deb12u2","bookworm-security":"3.6.0-1+deb12u1"},"fixed_version":"3.2.0-1","urgency":"not yet assigned"},"bullseye":{"status":"resolved","repositories":{"bullseye":"1.0.0.errata1-3+deb11u1","bullseye-security":"1.0.0.errata1-3+deb11u2"},"fixed_version":"1.0.0.errata1-3+deb11u1","urgency":"not yet assigned"},"forky":{"status":"resolved","repositories":{"forky":"3.13.1-2"},"fixed_version":"3.2.0-1","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"3.13.1-2"},"fixed_version":"3.2.0-1","urgency":"not yet assigned"},"trixie":{"status":"resolved","repositories":{"trixie":"3.12.1-1"},"fixed_version":"3.2.0-1","urgency":"not yet assigned"}}},"CVE-2021-30473":{"description":"aom_image.c in libaom in AOMedia before 2021-04-07 frees memory that is not located on the heap.","debianbug":988211,"scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"3.6.0-1+deb12u2","bookworm-security":"3.6.0-1+deb12u1"},"fixed_version":"3.2.0-1","urgency":"not yet assigned"},"bullseye":{"status":"resolved","repositories":{"bullseye":"1.0.0.errata1-3+deb11u1","bullseye-security":"1.0.0.errata1-3+deb11u2"},"fixed_version":"1.0.0.errata1-3+deb11u1","urgency":"not yet assigned"},"forky":{"status":"resolved","repositories":{"forky":"3.13.1-2"},"fixed_version":"3.2.0-1","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"3.13.1-2"},"fixed_version":"3.2.0-1","urgency":"not yet assigned"},"trixie":{"status":"resolved","repositories":{"trixie":"3.12.1-1"},"fixed_version":"3.2.0-1","urgency":"not yet assigned"}}},"CVE-2021-30474":{"description":"aom_dsp/grain_table.c in libaom in AOMedia before 2021-03-30 has a use-after-free.","scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"3.6.0-1+deb12u2","bookworm-security":"3.6.0-1+deb12u1"},"fixed_version":"3.2.0-1","urgency":"not yet assigned"},"bullseye":{"status":"resolved","repositories":{"bullseye":"1.0.0.errata1-3+deb11u1","bullseye-security":"1.0.0.errata1-3+deb11u2"},"fixed_version":"1.0.0.errata1-3+deb11u1","urgency":"not yet assigned"},"forky":{"status":"resolved","repositories":{"forky":"3.13.1-2"},"fixed_version":"3.2.0-1","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"3.13.1-2"},"fixed_version":"3.2.0-1","urgency":"not yet assigned"},"trixie":{"status":"resolved","repositories":{"trixie":"3.12.1-1"},"fixed_version":"3.2.0-1","urgency":"not yet assigned"}}},"CVE-2021-30475":{"description":"aom_dsp/noise_model.c in libaom in AOMedia before 2021-03-24 has a buffer overflow.","scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"3.6.0-1+deb12u2","bookworm-security":"3.6.0-1+deb12u1"},"fixed_version":"3.2.0-1","urgency":"not yet assigned"},"bullseye":{"status":"resolved","repositories":{"bullseye":"1.0.0.errata1-3+deb11u1","bullseye-security":"1.0.0.errata1-3+deb11u2"},"fixed_version":"1.0.0.errata1-3+deb11u1","urgency":"not yet assigned"},"forky":{"status":"resolved","repositories":{"forky":"3.13.1-2"},"fixed_version":"3.2.0-1","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"3.13.1-2"},"fixed_version":"3.2.0-1","urgency":"not yet assigned"},"trixie":{"status":"resolved","repositories":{"trixie":"3.12.1-1"},"fixed_version":"3.2.0-1","urgency":"not yet assigned"}}},"CVE-2023-39616":{"description":"AOMedia v3.0.0 to v3.5.0 was discovered to contain an invalid read memory access via the component assign_frame_buffer_p in av1/common/av1_common_int.h.","scope":"local","releases":{"bookworm":{"status":"open","repositories":{"bookworm":"3.6.0-1+deb12u2","bookworm-security":"3.6.0-1+deb12u1"},"urgency":"not yet assigned","nodsa":"Minor issue","nodsa_reason":"ignored"},"bullseye":{"status":"resolved","repositories":{"bullseye":"1.0.0.errata1-3+deb11u1","bullseye-security":"1.0.0.errata1-3+deb11u2"},"fixed_version":"0","urgency":"unimportant"},"forky":{"status":"resolved","repositories":{"forky":"3.13.1-2"},"fixed_version":"3.7.0-1","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"3.13.1-2"},"fixed_version":"3.7.0-1","urgency":"not yet assigned"},"trixie":{"status":"resolved","repositories":{"trixie":"3.12.1-1"},"fixed_version":"3.7.0-1","urgency":"not yet assigned"}}},"CVE-2023-6879":{"description":"Increasing the resolution of video frames, while performing a multi-threaded encode, can result in a heap overflow in av1_loop_restoration_dealloc().","scope":"local","releases":{"bookworm":{"status":"open","repositories":{"bookworm":"3.6.0-1+deb12u2","bookworm-security":"3.6.0-1+deb12u1"},"urgency":"not yet assigned","nodsa":"Minor issue","nodsa_reason":""},"bullseye":{"status":"open","repositories":{"bullseye":"1.0.0.errata1-3+deb11u1","bullseye-security":"1.0.0.errata1-3+deb11u2"},"urgency":"not yet assigned","nodsa":"Minor issue","nodsa_reason":""},"forky":{"status":"resolved","repositories":{"forky":"3.13.1-2"},"fixed_version":"3.7.1-1","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"3.13.1-2"},"fixed_version":"3.7.1-1","urgency":"not yet assigned"},"trixie":{"status":"resolved","repositories":{"trixie":"3.12.1-1"},"fixed_version":"3.7.1-1","urgency":"not yet assigned"}}},"CVE-2024-5171":{"description":"Integer overflow in libaom internal function\u00a0img_alloc_helper can lead to heap buffer overflow. This function can be reached via 3 callers:     *  Calling aom_img_alloc() with a large value of the d_w, d_h, or align parameter may result in integer overflows in the calculations of buffer sizes and offsets and some fields of the returned aom_image_t struct may be invalid.   *  Calling aom_img_wrap() with a large value of the d_w, d_h, or align parameter may result in integer overflows in the calculations of buffer sizes and offsets and some fields of the returned aom_image_t struct may be invalid.   *  Calling aom_img_alloc_with_border() with a large value of the d_w, d_h, align, size_align, or border parameter may result in integer overflows in the calculations of buffer sizes and offsets and some fields of the returned aom_image_t struct may be invalid.","scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"3.6.0-1+deb12u2","bookworm-security":"3.6.0-1+deb12u1"},"fixed_version":"3.6.0-1+deb12u1","urgency":"not yet assigned"},"bullseye":{"status":"resolved","repositories":{"bullseye":"1.0.0.errata1-3+deb11u1","bullseye-security":"1.0.0.errata1-3+deb11u2"},"fixed_version":"1.0.0.errata1-3+deb11u2","urgency":"not yet assigned"},"forky":{"status":"resolved","repositories":{"forky":"3.13.1-2"},"fixed_version":"3.8.2-3","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"3.13.1-2"},"fixed_version":"3.8.2-3","urgency":"not yet assigned"},"trixie":{"status":"resolved","repositories":{"trixie":"3.12.1-1"},"fixed_version":"3.8.2-3","urgency":"not yet assigned"}}}},"apache-arrow":{"CVE-2019-12408":{"description":"It was discovered that the C++ implementation (which underlies the R, Python and Ruby implementations) of Apache Arrow 0.14.0 to 0.14.1 had a uninitialized memory bug when building arrays with null values in some cases. This can lead to uninitialized memory being unintentionally shared if Arrow Arrays are transmitted over the wire (for instance with Flight) or persisted in the streaming IPC and file formats.","scope":"local","releases":{"sid":{"status":"resolved","repositories":{"sid":"23.0.1-6"},"fixed_version":"0","urgency":"unimportant"}}},"CVE-2019-12410":{"description":"While investigating UBSAN errors in https://github.com/apache/arrow/pull/5365 it was discovered Apache Arrow versions 0.12.0 to 0.14.1, left memory Array data uninitialized when reading RLE null data from parquet. This affected the C++, Python, Ruby and R implementations. The uninitialized memory could potentially be shared if are transmitted over the wire (for instance with Flight) or persisted in the streaming IPC and file formats.","scope":"local","releases":{"sid":{"status":"resolved","repositories":{"sid":"23.0.1-6"},"fixed_version":"0","urgency":"unimportant"}}},"CVE-2023-47248":{"description":"Deserialization of untrusted data in IPC and Parquet readers in PyArrow versions 0.14.0 to 14.0.0 allows arbitrary code execution. An application is vulnerable if it reads Arrow IPC, Feather or Parquet data from untrusted sources (for example user-supplied input files).  This vulnerability only affects PyArrow, not other Apache Arrow implementations or bindings.  It is recommended that users of PyArrow upgrade to 14.0.1. Similarly, it is recommended that downstream libraries upgrade their dependency requirements to PyArrow 14.0.1 or later. PyPI packages are already available, and we hope that conda-forge packages will be available soon.  If it is not possible to upgrade, we provide a separate package `pyarrow-hotfix` that disables the vulnerability on older PyArrow versions. See  https://pypi.org/project/pyarrow-hotfix/  for instructions.","scope":"local","releases":{"sid":{"status":"resolved","repositories":{"sid":"23.0.1-6"},"fixed_version":"0","urgency":"unimportant"}}},"CVE-2026-25087":{"description":"Use After Free vulnerability in Apache Arrow C++.  This issue affects Apache Arrow C++ from 15.0.0 through 23.0.0. It can be triggered when reading an Arrow IPC file (but not an IPC stream) with pre-buffering enabled, if the IPC file contains data with variadic buffers (such as Binary View and String View data). Depending on the number of variadic buffers in a record batch column and on the temporal sequence of multi-threaded IO, a write to a dangling pointer could occur. The value (a `std::shared_ptr<Buffer>` object)\u00a0that is written to the dangling pointer is not under direct control of the attacker.  Pre-buffering is disabled by default but can be enabled using a specific C++ API call (`RecordBatchFileReader::PreBufferMetadata`). The functionality is not exposed in language bindings (Python, Ruby, C GLib), so these bindings are not vulnerable.  The most likely consequence of this issue would be random crashes or memory corruption when reading specific kinds of IPC files. If the application allows ingesting IPC files from untrusted sources, this could plausibly be exploited for denial of service. Inducing more targeted kinds of misbehavior (such as confidential data extraction from the running process) depends on memory allocation and multi-threaded IO temporal patterns that are unlikely to be easily controlled by an attacker.  Advice for users of Arrow C++:  1. check whether you enable pre-buffering on the IPC file reader (using\u00a0`RecordBatchFileReader::PreBufferMetadata`)  2. if so, either disable pre-buffering (which may have adverse performance consequences), or switch to Arrow 23.0.1 which is not vulnerable","scope":"local","releases":{"sid":{"status":"resolved","repositories":{"sid":"23.0.1-6"},"fixed_version":"23.0.1-1","urgency":"not yet assigned"}}}},"apache-directory-api":{"CVE-2015-3250":{"description":"Apache Directory LDAP API before 1.0.0-M31 allows attackers to conduct timing attacks via unspecified vectors.","debianbug":791957,"scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"2.1.2-1"},"fixed_version":"1.0.0~M20-3","urgency":"not yet assigned"},"bullseye":{"status":"resolved","repositories":{"bullseye":"1.0.0-2"},"fixed_version":"1.0.0~M20-3","urgency":"not yet assigned"},"forky":{"status":"resolved","repositories":{"forky":"2.1.2-2"},"fixed_version":"1.0.0~M20-3","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"2.1.2-2"},"fixed_version":"1.0.0~M20-3","urgency":"not yet assigned"},"trixie":{"status":"resolved","repositories":{"trixie":"2.1.2-2"},"fixed_version":"1.0.0~M20-3","urgency":"not yet assigned"}}}},"apache-directory-server":{"CVE-2015-5349":{"description":"The CSV export in Apache LDAP Studio and Apache Directory Studio before 2.0.0-M10 does not properly escape field values, which might allow attackers to execute arbitrary commands by leveraging a crafted LDAP entry that is interpreted as a formula when imported into a spreadsheet.","scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"2.0.0~M26-1"},"fixed_version":"0","urgency":"unimportant"},"bullseye":{"status":"resolved","repositories":{"bullseye":"2.0.0~M24-4"},"fixed_version":"0","urgency":"unimportant"},"forky":{"status":"resolved","repositories":{"forky":"2.0.0~M26-5"},"fixed_version":"0","urgency":"unimportant"},"sid":{"status":"resolved","repositories":{"sid":"2.0.0~M26-5"},"fixed_version":"0","urgency":"unimportant"},"trixie":{"status":"resolved","repositories":{"trixie":"2.0.0~M26-5"},"fixed_version":"0","urgency":"unimportant"}}}},"apache-jena":{"CVE-2021-33192":{"description":"A vulnerability in the HTML pages of Apache Jena Fuseki allows an attacker to execute arbitrary javascript on certain page views. This issue affects Apache Jena Fuseki from version 2.0.0 to version 4.0.0 (inclusive).","debianbug":1014982,"scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"4.5.0-2"},"fixed_version":"4.5.0-1","urgency":"not yet assigned"},"forky":{"status":"resolved","repositories":{"forky":"4.9.0-1"},"fixed_version":"4.5.0-1","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"4.9.0-1"},"fixed_version":"4.5.0-1","urgency":"not yet assigned"},"trixie":{"status":"resolved","repositories":{"trixie":"4.9.0-1"},"fixed_version":"4.5.0-1","urgency":"not yet assigned"}}},"CVE-2021-39239":{"description":"A vulnerability in XML processing in Apache Jena, in versions up to 4.1.0, may allow an attacker to execute XML External Entities (XXE), including exposing the contents of local files to a remote server.","debianbug":1014982,"scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"4.5.0-2"},"fixed_version":"4.5.0-1","urgency":"not yet assigned"},"forky":{"status":"resolved","repositories":{"forky":"4.9.0-1"},"fixed_version":"4.5.0-1","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"4.9.0-1"},"fixed_version":"4.5.0-1","urgency":"not yet assigned"},"trixie":{"status":"resolved","repositories":{"trixie":"4.9.0-1"},"fixed_version":"4.5.0-1","urgency":"not yet assigned"}}},"CVE-2022-28890":{"description":"A vulnerability in the RDF/XML parser of Apache Jena allows an attacker to cause an external DTD to be retrieved. This issue affects Apache Jena version 4.4.0 and prior versions. Apache Jena 4.2.x and 4.3.x do not allow external entities.","debianbug":1014982,"scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"4.5.0-2"},"fixed_version":"4.5.0-1","urgency":"not yet assigned"},"forky":{"status":"resolved","repositories":{"forky":"4.9.0-1"},"fixed_version":"4.5.0-1","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"4.9.0-1"},"fixed_version":"4.5.0-1","urgency":"not yet assigned"},"trixie":{"status":"resolved","repositories":{"trixie":"4.9.0-1"},"fixed_version":"4.5.0-1","urgency":"not yet assigned"}}},"CVE-2022-45136":{"description":"Apache Jena SDB 3.17.0 and earlier is vulnerable to a JDBC Deserialisation attack if the attacker is able to control the JDBC URL used or cause the underlying database server to return malicious data. The mySQL JDBC driver in particular is known to be vulnerable to this class of attack. As a result an application using Apache Jena SDB can be subject to RCE when connected to a malicious database server. Apache Jena SDB has been EOL since December 2020 and users should migrate to alternative options e.g. Apache Jena TDB 2.","debianbug":1024738,"scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"4.5.0-2"},"fixed_version":"4.5.0-1","urgency":"not yet assigned"},"forky":{"status":"resolved","repositories":{"forky":"4.9.0-1"},"fixed_version":"4.5.0-1","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"4.9.0-1"},"fixed_version":"4.5.0-1","urgency":"not yet assigned"},"trixie":{"status":"resolved","repositories":{"trixie":"4.9.0-1"},"fixed_version":"4.5.0-1","urgency":"not yet assigned"}}},"CVE-2023-22665":{"description":"There is insufficient checking of user queries in Apache Jena versions 4.7.0 and earlier, when invoking custom scripts. It allows a remote user to execute arbitrary javascript via a SPARQL query.","debianbug":1035952,"scope":"local","releases":{"bookworm":{"status":"open","repositories":{"bookworm":"4.5.0-2"},"urgency":"not yet assigned","nodsa":"Minor issue","nodsa_reason":"ignored"},"forky":{"status":"resolved","repositories":{"forky":"4.9.0-1"},"fixed_version":"4.9.0-1","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"4.9.0-1"},"fixed_version":"4.9.0-1","urgency":"not yet assigned"},"trixie":{"status":"resolved","repositories":{"trixie":"4.9.0-1"},"fixed_version":"4.9.0-1","urgency":"not yet assigned"}}},"CVE-2023-32200":{"description":"There is insufficient restrictions of called script functions in Apache Jena  versions 4.8.0 and earlier. It allows a  remote user to execute javascript via a SPARQL query. This issue affects Apache Jena: from 3.7.0 through 4.8.0.","debianbug":1041108,"scope":"local","releases":{"bookworm":{"status":"open","repositories":{"bookworm":"4.5.0-2"},"urgency":"not yet assigned","nodsa":"Minor issue","nodsa_reason":"ignored"},"forky":{"status":"resolved","repositories":{"forky":"4.9.0-1"},"fixed_version":"4.9.0-1","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"4.9.0-1"},"fixed_version":"4.9.0-1","urgency":"not yet assigned"},"trixie":{"status":"resolved","repositories":{"trixie":"4.9.0-1"},"fixed_version":"4.9.0-1","urgency":"not yet assigned"}}},"CVE-2025-49656":{"description":"Users with administrator access can create databases files outside the files area of the Fuseki server.  This issue affects Apache Jena version up to 5.4.0.  Users are recommended to upgrade to version 5.5.0, which fixes the issue.","debianbug":1110262,"scope":"local","releases":{"bookworm":{"status":"open","repositories":{"bookworm":"4.5.0-2"},"urgency":"not yet assigned","nodsa":"Minor issue","nodsa_reason":""},"forky":{"status":"open","repositories":{"forky":"4.9.0-1"},"urgency":"not yet assigned"},"sid":{"status":"open","repositories":{"sid":"4.9.0-1"},"urgency":"not yet assigned"},"trixie":{"status":"open","repositories":{"trixie":"4.9.0-1"},"urgency":"not yet assigned","nodsa":"Minor issue","nodsa_reason":""}}},"CVE-2025-50151":{"description":"File access paths in configuration files uploaded by users with administrator access are not validated.  This issue affects Apache Jena version up to 5.4.0.  Users are recommended to upgrade to version 5.5.0, which does not allow arbitrary configuration upload.","debianbug":1109807,"scope":"local","releases":{"bookworm":{"status":"open","repositories":{"bookworm":"4.5.0-2"},"urgency":"not yet assigned","nodsa":"Minor issue","nodsa_reason":""},"forky":{"status":"open","repositories":{"forky":"4.9.0-1"},"urgency":"not yet assigned"},"sid":{"status":"open","repositories":{"sid":"4.9.0-1"},"urgency":"not yet assigned"},"trixie":{"status":"open","repositories":{"trixie":"4.9.0-1"},"urgency":"not yet assigned","nodsa":"Minor issue","nodsa_reason":""}}}},"apache-log4j1.2":{"CVE-2019-17571":{"description":"Included in Log4j 1.2 is a SocketServer class that is vulnerable to deserialization of untrusted data which can be exploited to remotely execute arbitrary code when combined with a deserialization gadget when listening to untrusted network traffic for log data. This affects Log4j versions up to 1.2 up to 1.2.17.","debianbug":947124,"scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"1.2.17-11"},"fixed_version":"1.2.17-9","urgency":"not yet assigned"},"bullseye":{"status":"resolved","repositories":{"bullseye":"1.2.17-10+deb11u1"},"fixed_version":"1.2.17-9","urgency":"not yet assigned"},"forky":{"status":"resolved","repositories":{"forky":"1.2.17-11"},"fixed_version":"1.2.17-9","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"1.2.17-11"},"fixed_version":"1.2.17-9","urgency":"not yet assigned"},"trixie":{"status":"resolved","repositories":{"trixie":"1.2.17-11"},"fixed_version":"1.2.17-9","urgency":"not yet assigned"}}},"CVE-2021-4104":{"description":"JMSAppender in Log4j 1.2 is vulnerable to deserialization of untrusted data when the attacker has write access to the Log4j configuration. The attacker can provide TopicBindingName and TopicConnectionFactoryBindingName configurations causing JMSAppender to perform JNDI requests that result in remote code execution in a similar fashion to CVE-2021-44228. Note this issue only affects Log4j 1.2 when specifically configured to use JMSAppender, which is not the default. Apache Log4j 1.2 reached end of life in August 2015. Users should upgrade to Log4j 2 as it addresses numerous other issues from the previous versions.","scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"1.2.17-11"},"fixed_version":"1.2.17-11","urgency":"not yet assigned"},"bullseye":{"status":"resolved","repositories":{"bullseye":"1.2.17-10+deb11u1"},"fixed_version":"1.2.17-10+deb11u1","urgency":"not yet assigned"},"forky":{"status":"resolved","repositories":{"forky":"1.2.17-11"},"fixed_version":"1.2.17-11","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"1.2.17-11"},"fixed_version":"1.2.17-11","urgency":"not yet assigned"},"trixie":{"status":"resolved","repositories":{"trixie":"1.2.17-11"},"fixed_version":"1.2.17-11","urgency":"not yet assigned"}}},"CVE-2021-44228":{"description":"Apache Log4j2 2.0-beta9 through 2.15.0 (excluding security releases 2.12.2, 2.12.3, and 2.3.1) JNDI features used in configuration, log messages, and parameters do not protect against attacker controlled LDAP and other JNDI related endpoints. An attacker who can control log messages or log message parameters can execute arbitrary code loaded from LDAP servers when message lookup substitution is enabled. From log4j 2.15.0, this behavior has been disabled by default. From version 2.16.0 (along with 2.12.2, 2.12.3, and 2.3.1), this functionality has been completely removed. Note that this vulnerability is specific to log4j-core and does not affect log4net, log4cxx, or other Apache Logging Services projects.","scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"1.2.17-11"},"fixed_version":"0","urgency":"unimportant"},"bullseye":{"status":"resolved","repositories":{"bullseye":"1.2.17-10+deb11u1"},"fixed_version":"0","urgency":"unimportant"},"forky":{"status":"resolved","repositories":{"forky":"1.2.17-11"},"fixed_version":"0","urgency":"unimportant"},"sid":{"status":"resolved","repositories":{"sid":"1.2.17-11"},"fixed_version":"0","urgency":"unimportant"},"trixie":{"status":"resolved","repositories":{"trixie":"1.2.17-11"},"fixed_version":"0","urgency":"unimportant"}}},"CVE-2022-23302":{"description":"JMSSink in all versions of Log4j 1.x is vulnerable to deserialization of untrusted data when the attacker has write access to the Log4j configuration or if the configuration references an LDAP service the attacker has access to. The attacker can provide a TopicConnectionFactoryBindingName configuration causing JMSSink to perform JNDI requests that result in remote code execution in a similar fashion to CVE-2021-4104. Note this issue only affects Log4j 1.x when specifically configured to use JMSSink, which is not the default. Apache Log4j 1.2 reached end of life in August 2015. Users should upgrade to Log4j 2 as it addresses numerous other issues from the previous versions.","debianbug":1004482,"scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"1.2.17-11"},"fixed_version":"1.2.17-11","urgency":"not yet assigned"},"bullseye":{"status":"resolved","repositories":{"bullseye":"1.2.17-10+deb11u1"},"fixed_version":"1.2.17-10+deb11u1","urgency":"not yet assigned"},"forky":{"status":"resolved","repositories":{"forky":"1.2.17-11"},"fixed_version":"1.2.17-11","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"1.2.17-11"},"fixed_version":"1.2.17-11","urgency":"not yet assigned"},"trixie":{"status":"resolved","repositories":{"trixie":"1.2.17-11"},"fixed_version":"1.2.17-11","urgency":"not yet assigned"}}},"CVE-2022-23305":{"description":"By design, the JDBCAppender in Log4j 1.2.x accepts an SQL statement as a configuration parameter where the values to be inserted are converters from PatternLayout. The message converter, %m, is likely to always be included. This allows attackers to manipulate the SQL by entering crafted strings into input fields or headers of an application that are logged allowing unintended SQL queries to be executed. Note this issue only affects Log4j 1.x when specifically configured to use the JDBCAppender, which is not the default. Beginning in version 2.0-beta8, the JDBCAppender was re-introduced with proper support for parameterized SQL queries and further customization over the columns written to in logs. Apache Log4j 1.2 reached end of life in August 2015. Users should upgrade to Log4j 2 as it addresses numerous other issues from the previous versions.","debianbug":1004482,"scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"1.2.17-11"},"fixed_version":"1.2.17-11","urgency":"not yet assigned"},"bullseye":{"status":"resolved","repositories":{"bullseye":"1.2.17-10+deb11u1"},"fixed_version":"1.2.17-10+deb11u1","urgency":"not yet assigned"},"forky":{"status":"resolved","repositories":{"forky":"1.2.17-11"},"fixed_version":"1.2.17-11","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"1.2.17-11"},"fixed_version":"1.2.17-11","urgency":"not yet assigned"},"trixie":{"status":"resolved","repositories":{"trixie":"1.2.17-11"},"fixed_version":"1.2.17-11","urgency":"not yet assigned"}}},"CVE-2022-23307":{"description":"CVE-2020-9493 identified a deserialization issue that was present in Apache Chainsaw. Prior to Chainsaw V2.0 Chainsaw was a component of Apache Log4j 1.2.x where the same issue exists.","debianbug":1004482,"scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"1.2.17-11"},"fixed_version":"1.2.17-11","urgency":"not yet assigned"},"bullseye":{"status":"resolved","repositories":{"bullseye":"1.2.17-10+deb11u1"},"fixed_version":"1.2.17-10+deb11u1","urgency":"not yet assigned"},"forky":{"status":"resolved","repositories":{"forky":"1.2.17-11"},"fixed_version":"1.2.17-11","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"1.2.17-11"},"fixed_version":"1.2.17-11","urgency":"not yet assigned"},"trixie":{"status":"resolved","repositories":{"trixie":"1.2.17-11"},"fixed_version":"1.2.17-11","urgency":"not yet assigned"}}},"CVE-2023-26464":{"description":"** UNSUPPORTED WHEN ASSIGNED **  When using the Chainsaw or SocketAppender components with Log4j 1.x on JRE less than 1.7, an attacker that manages to cause a logging entry involving a specially-crafted (ie, deeply nested)  hashmap or hashtable (depending on which logging component is in use) to be processed could exhaust the available memory in the virtual machine and achieve Denial of Service when the object is deserialized.  This issue affects Apache Log4j before 2. Affected users are recommended to update to Log4j 2.x.  NOTE: This vulnerability only affects products that are no longer supported by the maintainer.","scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"1.2.17-11"},"fixed_version":"0","urgency":"unimportant"},"bullseye":{"status":"resolved","repositories":{"bullseye":"1.2.17-10+deb11u1"},"fixed_version":"0","urgency":"unimportant"},"forky":{"status":"resolved","repositories":{"forky":"1.2.17-11"},"fixed_version":"0","urgency":"unimportant"},"sid":{"status":"resolved","repositories":{"sid":"1.2.17-11"},"fixed_version":"0","urgency":"unimportant"},"trixie":{"status":"resolved","repositories":{"trixie":"1.2.17-11"},"fixed_version":"0","urgency":"unimportant"}}}},"apache-log4j2":{"CVE-2017-5645":{"description":"In Apache Log4j 2.x before 2.8.2, when using the TCP socket server or UDP socket server to receive serialized log events from another application, a specially crafted binary payload can be sent that, when deserialized, can execute arbitrary code.","debianbug":860489,"scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"2.19.0-2"},"fixed_version":"2.7-2","urgency":"not yet assigned"},"bullseye":{"status":"resolved","repositories":{"bullseye":"2.17.1-1~deb11u1","bullseye-security":"2.17.1-1~deb11u2"},"fixed_version":"2.7-2","urgency":"not yet assigned"},"forky":{"status":"resolved","repositories":{"forky":"2.19.0-2"},"fixed_version":"2.7-2","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"2.19.0-2"},"fixed_version":"2.7-2","urgency":"not yet assigned"},"trixie":{"status":"resolved","repositories":{"trixie":"2.19.0-2"},"fixed_version":"2.7-2","urgency":"not yet assigned"}}},"CVE-2020-9488":{"description":"Improper validation of certificate with host mismatch in Apache Log4j SMTP appender. This could allow an SMTPS connection to be intercepted by a man-in-the-middle attack which could leak any log messages sent through that appender. Fixed in Apache Log4j 2.12.3 and 2.13.1","debianbug":959450,"scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"2.19.0-2"},"fixed_version":"2.13.3-1","urgency":"not yet assigned"},"bullseye":{"status":"resolved","repositories":{"bullseye":"2.17.1-1~deb11u1","bullseye-security":"2.17.1-1~deb11u2"},"fixed_version":"2.13.3-1","urgency":"not yet assigned"},"forky":{"status":"resolved","repositories":{"forky":"2.19.0-2"},"fixed_version":"2.13.3-1","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"2.19.0-2"},"fixed_version":"2.13.3-1","urgency":"not yet assigned"},"trixie":{"status":"resolved","repositories":{"trixie":"2.19.0-2"},"fixed_version":"2.13.3-1","urgency":"not yet assigned"}}},"CVE-2021-44228":{"description":"Apache Log4j2 2.0-beta9 through 2.15.0 (excluding security releases 2.12.2, 2.12.3, and 2.3.1) JNDI features used in configuration, log messages, and parameters do not protect against attacker controlled LDAP and other JNDI related endpoints. An attacker who can control log messages or log message parameters can execute arbitrary code loaded from LDAP servers when message lookup substitution is enabled. From log4j 2.15.0, this behavior has been disabled by default. From version 2.16.0 (along with 2.12.2, 2.12.3, and 2.3.1), this functionality has been completely removed. Note that this vulnerability is specific to log4j-core and does not affect log4net, log4cxx, or other Apache Logging Services projects.","debianbug":1001478,"scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"2.19.0-2"},"fixed_version":"2.15.0-1","urgency":"not yet assigned"},"bullseye":{"status":"resolved","repositories":{"bullseye":"2.17.1-1~deb11u1","bullseye-security":"2.17.1-1~deb11u2"},"fixed_version":"2.15.0-1~deb11u1","urgency":"not yet assigned"},"forky":{"status":"resolved","repositories":{"forky":"2.19.0-2"},"fixed_version":"2.15.0-1","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"2.19.0-2"},"fixed_version":"2.15.0-1","urgency":"not yet assigned"},"trixie":{"status":"resolved","repositories":{"trixie":"2.19.0-2"},"fixed_version":"2.15.0-1","urgency":"not yet assigned"}}},"CVE-2021-44832":{"description":"Apache Log4j2 versions 2.0-beta7 through 2.17.0 (excluding security fix releases 2.3.2 and 2.12.4) are vulnerable to a remote code execution (RCE) attack when a configuration uses a JDBC Appender with a JNDI LDAP data source URI when an attacker has control of the target LDAP server. This issue is fixed by limiting JNDI data source names to the java protocol in Log4j2 versions 2.17.1, 2.12.4, and 2.3.2.","debianbug":1002813,"scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"2.19.0-2"},"fixed_version":"2.17.1-1","urgency":"not yet assigned"},"bullseye":{"status":"resolved","repositories":{"bullseye":"2.17.1-1~deb11u1","bullseye-security":"2.17.1-1~deb11u2"},"fixed_version":"2.17.1-1~deb11u1","urgency":"not yet assigned"},"forky":{"status":"resolved","repositories":{"forky":"2.19.0-2"},"fixed_version":"2.17.1-1","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"2.19.0-2"},"fixed_version":"2.17.1-1","urgency":"not yet assigned"},"trixie":{"status":"resolved","repositories":{"trixie":"2.19.0-2"},"fixed_version":"2.17.1-1","urgency":"not yet assigned"}}},"CVE-2021-45046":{"description":"It was found that the fix to address CVE-2021-44228 in Apache Log4j 2.15.0 was incomplete in certain non-default configurations. This could allows attackers with control over Thread Context Map (MDC) input data when the logging configuration uses a non-default Pattern Layout with either a Context Lookup (for example, $${ctx:loginId}) or a Thread Context Map pattern (%X, %mdc, or %MDC) to craft malicious input data using a JNDI Lookup pattern resulting in an information leak and remote code execution in some environments and local code execution in all environments. Log4j 2.16.0 (Java 8) and 2.12.2 (Java 7) fix this issue by removing support for message lookup patterns and disabling JNDI functionality by default.","debianbug":1001729,"scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"2.19.0-2"},"fixed_version":"2.16.0-1","urgency":"not yet assigned"},"bullseye":{"status":"resolved","repositories":{"bullseye":"2.17.1-1~deb11u1","bullseye-security":"2.17.1-1~deb11u2"},"fixed_version":"2.16.0-1~deb11u1","urgency":"not yet assigned"},"forky":{"status":"resolved","repositories":{"forky":"2.19.0-2"},"fixed_version":"2.16.0-1","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"2.19.0-2"},"fixed_version":"2.16.0-1","urgency":"not yet assigned"},"trixie":{"status":"resolved","repositories":{"trixie":"2.19.0-2"},"fixed_version":"2.16.0-1","urgency":"not yet assigned"}}},"CVE-2021-45105":{"description":"Apache Log4j2 versions 2.0-alpha1 through 2.16.0 (excluding 2.12.3 and 2.3.1) did not protect from uncontrolled recursion from self-referential lookups. This allows an attacker with control over Thread Context Map data to cause a denial of service when a crafted string is interpreted. This issue was fixed in Log4j 2.17.0, 2.12.3, and 2.3.1.","debianbug":1001891,"scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"2.19.0-2"},"fixed_version":"2.17.0-1","urgency":"not yet assigned"},"bullseye":{"status":"resolved","repositories":{"bullseye":"2.17.1-1~deb11u1","bullseye-security":"2.17.1-1~deb11u2"},"fixed_version":"2.17.0-1~deb11u1","urgency":"not yet assigned"},"forky":{"status":"resolved","repositories":{"forky":"2.19.0-2"},"fixed_version":"2.17.0-1","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"2.19.0-2"},"fixed_version":"2.17.0-1","urgency":"not yet assigned"},"trixie":{"status":"resolved","repositories":{"trixie":"2.19.0-2"},"fixed_version":"2.17.0-1","urgency":"not yet assigned"}}},"CVE-2025-68161":{"description":"The Socket Appender in Apache Log4j Core versions 2.0-beta9 through 2.25.2 does not perform TLS hostname verification of the peer certificate, even when the  verifyHostName https://logging.apache.org/log4j/2.x/manual/appenders/network.html#SslConfiguration-attr-verifyHostName  configuration attribute or the  log4j2.sslVerifyHostName https://logging.apache.org/log4j/2.x/manual/systemproperties.html#log4j2.sslVerifyHostName  system property is set to true.  This issue may allow a man-in-the-middle attacker to intercept or redirect log traffic under the following conditions:    *  The attacker is able to intercept or redirect network traffic between the client and the log receiver.   *  The attacker can present a server certificate issued by a certification authority trusted by the Socket Appender\u2019s configured trust store (or by the default Java trust store if no custom trust store is configured).   Users are advised to upgrade to Apache Log4j Core version 2.25.3, which addresses this issue.  As an alternative mitigation, the Socket Appender may be configured to use a private or restricted trust root to limit the set of trusted certificates.","debianbug":1123744,"scope":"local","releases":{"bookworm":{"status":"open","repositories":{"bookworm":"2.19.0-2"},"urgency":"not yet assigned","nodsa":"Minor issue","nodsa_reason":""},"bullseye":{"status":"resolved","repositories":{"bullseye":"2.17.1-1~deb11u1","bullseye-security":"2.17.1-1~deb11u2"},"fixed_version":"2.17.1-1~deb11u2","urgency":"not yet assigned"},"forky":{"status":"open","repositories":{"forky":"2.19.0-2"},"urgency":"not yet assigned"},"sid":{"status":"open","repositories":{"sid":"2.19.0-2"},"urgency":"not yet assigned"},"trixie":{"status":"open","repositories":{"trixie":"2.19.0-2"},"urgency":"not yet assigned","nodsa":"Minor issue","nodsa_reason":""}}}},"apache-mime4j":{"CVE-2024-21742":{"description":"Improper input validation allows for header injection in MIME4J library when using MIME4J DOM for composing message. This can be exploited by an attacker to add unintended headers to MIME messages.","debianbug":1064966,"scope":"local","releases":{"bookworm":{"status":"open","repositories":{"bookworm":"0.8.2-1"},"urgency":"not yet assigned","nodsa":"Minor issue","nodsa_reason":""},"bullseye":{"status":"open","repositories":{"bullseye":"0.8.2-1"},"urgency":"not yet assigned","nodsa":"Minor issue","nodsa_reason":""},"forky":{"status":"resolved","repositories":{"forky":"0.8.13-1"},"fixed_version":"0.8.10-1","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"0.8.13-1"},"fixed_version":"0.8.10-1","urgency":"not yet assigned"},"trixie":{"status":"resolved","repositories":{"trixie":"0.8.12-1"},"fixed_version":"0.8.10-1","urgency":"not yet assigned"}}}},"apache2":{"CVE-2001-1534":{"description":"mod_usertrack in Apache 1.3.11 through 1.3.20 generates session ID's using predictable information including host IP address, system time and server process ID, which allows local users to obtain session ID's and bypass authentication when these session ID's are used for authentication.","scope":"local","releases":{"bookworm":{"status":"open","repositories":{"bookworm":"2.4.66-1~deb12u1","bookworm-security":"2.4.62-1~deb12u2"},"urgency":"unimportant"},"bullseye":{"status":"open","repositories":{"bullseye":"2.4.62-1~deb11u1","bullseye-security":"2.4.66-1~deb11u1"},"urgency":"unimportant"},"forky":{"status":"open","repositories":{"forky":"2.4.66-8"},"urgency":"unimportant"},"sid":{"status":"open","repositories":{"sid":"2.4.66-8"},"urgency":"unimportant"},"trixie":{"status":"open","repositories":{"trixie":"2.4.66-1~deb13u1"},"urgency":"unimportant"}}},"CVE-2002-0392":{"description":"Apache 1.3 through 1.3.24, and Apache 2.0 through 2.0.36, allows remote attackers to cause a denial of service and possibly execute arbitrary code via a chunk-encoded HTTP request that causes Apache to use an incorrect size.","scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"2.4.66-1~deb12u1","bookworm-security":"2.4.62-1~deb12u2"},"fixed_version":"2.0.37","urgency":"not yet assigned"},"bullseye":{"status":"resolved","repositories":{"bullseye":"2.4.62-1~deb11u1","bullseye-security":"2.4.66-1~deb11u1"},"fixed_version":"2.0.37","urgency":"not yet assigned"},"forky":{"status":"resolved","repositories":{"forky":"2.4.66-8"},"fixed_version":"2.0.37","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"2.4.66-8"},"fixed_version":"2.0.37","urgency":"not yet assigned"},"trixie":{"status":"resolved","repositories":{"trixie":"2.4.66-1~deb13u1"},"fixed_version":"2.0.37","urgency":"not yet assigned"}}},"CVE-2002-0654":{"description":"Apache 2.0 through 2.0.39 on Windows, OS2, and Netware allows remote attackers to determine the full pathname of the server via (1) a request for a .var file, which leaks the pathname in the resulting error message, or (2) via an error message that occurs when a script (child process) cannot be invoked.","scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"2.4.66-1~deb12u1","bookworm-security":"2.4.62-1~deb12u2"},"fixed_version":"2.0.40","urgency":"not yet assigned"},"bullseye":{"status":"resolved","repositories":{"bullseye":"2.4.62-1~deb11u1","bullseye-security":"2.4.66-1~deb11u1"},"fixed_version":"2.0.40","urgency":"not yet assigned"},"forky":{"status":"resolved","repositories":{"forky":"2.4.66-8"},"fixed_version":"2.0.40","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"2.4.66-8"},"fixed_version":"2.0.40","urgency":"not yet assigned"},"trixie":{"status":"resolved","repositories":{"trixie":"2.4.66-1~deb13u1"},"fixed_version":"2.0.40","urgency":"not yet assigned"}}},"CVE-2002-0661":{"description":"Directory traversal vulnerability in Apache 2.0 through 2.0.39 on Windows, OS2, and Netware allows remote attackers to read arbitrary files and execute commands via .. (dot dot) sequences containing \\ (backslash) characters.","scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"2.4.66-1~deb12u1","bookworm-security":"2.4.62-1~deb12u2"},"fixed_version":"2.0.40","urgency":"not yet assigned"},"bullseye":{"status":"resolved","repositories":{"bullseye":"2.4.62-1~deb11u1","bullseye-security":"2.4.66-1~deb11u1"},"fixed_version":"2.0.40","urgency":"not yet assigned"},"forky":{"status":"resolved","repositories":{"forky":"2.4.66-8"},"fixed_version":"2.0.40","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"2.4.66-8"},"fixed_version":"2.0.40","urgency":"not yet assigned"},"trixie":{"status":"resolved","repositories":{"trixie":"2.4.66-1~deb13u1"},"fixed_version":"2.0.40","urgency":"not yet assigned"}}},"CVE-2002-0840":{"description":"Cross-site scripting (XSS) vulnerability in the default error page of Apache 2.0 before 2.0.43, and 1.3.x up to 1.3.26, when UseCanonicalName is \"Off\" and support for wildcard DNS is present, allows remote attackers to execute script as other web page visitors via the Host: header, a different vulnerability than CAN-2002-1157.","scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"2.4.66-1~deb12u1","bookworm-security":"2.4.62-1~deb12u2"},"fixed_version":"2.0.43-1","urgency":"not yet assigned"},"bullseye":{"status":"resolved","repositories":{"bullseye":"2.4.62-1~deb11u1","bullseye-security":"2.4.66-1~deb11u1"},"fixed_version":"2.0.43-1","urgency":"not yet assigned"},"forky":{"status":"resolved","repositories":{"forky":"2.4.66-8"},"fixed_version":"2.0.43-1","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"2.4.66-8"},"fixed_version":"2.0.43-1","urgency":"not yet assigned"},"trixie":{"status":"resolved","repositories":{"trixie":"2.4.66-1~deb13u1"},"fixed_version":"2.0.43-1","urgency":"not yet assigned"}}},"CVE-2002-1156":{"description":"Apache 2.0.42 allows remote attackers to view the source code of a CGI script via a POST request to a directory with both WebDAV and CGI enabled.","scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"2.4.66-1~deb12u1","bookworm-security":"2.4.62-1~deb12u2"},"fixed_version":"2.0.43","urgency":"not yet assigned"},"bullseye":{"status":"resolved","repositories":{"bullseye":"2.4.62-1~deb11u1","bullseye-security":"2.4.66-1~deb11u1"},"fixed_version":"2.0.43","urgency":"not yet assigned"},"forky":{"status":"resolved","repositories":{"forky":"2.4.66-8"},"fixed_version":"2.0.43","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"2.4.66-8"},"fixed_version":"2.0.43","urgency":"not yet assigned"},"trixie":{"status":"resolved","repositories":{"trixie":"2.4.66-1~deb13u1"},"fixed_version":"2.0.43","urgency":"not yet assigned"}}},"CVE-2002-1592":{"description":"The ap_log_rerror function in Apache 2.0 through 2.035, when a CGI application encounters an error, sends error messages to the client that include the full path for the server, which allows remote attackers to obtain sensitive information.","scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"2.4.66-1~deb12u1","bookworm-security":"2.4.62-1~deb12u2"},"fixed_version":"2.0.36","urgency":"not yet assigned"},"bullseye":{"status":"resolved","repositories":{"bullseye":"2.4.62-1~deb11u1","bullseye-security":"2.4.66-1~deb11u1"},"fixed_version":"2.0.36","urgency":"not yet assigned"},"forky":{"status":"resolved","repositories":{"forky":"2.4.66-8"},"fixed_version":"2.0.36","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"2.4.66-8"},"fixed_version":"2.0.36","urgency":"not yet assigned"},"trixie":{"status":"resolved","repositories":{"trixie":"2.4.66-1~deb13u1"},"fixed_version":"2.0.36","urgency":"not yet assigned"}}},"CVE-2002-1593":{"description":"mod_dav in Apache before 2.0.42 does not properly handle versioning hooks, which may allow remote attackers to kill a child process via a null dereference and cause a denial of service (CPU consumption) in a preforked multi-processing module.","scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"2.4.66-1~deb12u1","bookworm-security":"2.4.62-1~deb12u2"},"fixed_version":"2.0.42","urgency":"not yet assigned"},"bullseye":{"status":"resolved","repositories":{"bullseye":"2.4.62-1~deb11u1","bullseye-security":"2.4.66-1~deb11u1"},"fixed_version":"2.0.42","urgency":"not yet assigned"},"forky":{"status":"resolved","repositories":{"forky":"2.4.66-8"},"fixed_version":"2.0.42","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"2.4.66-8"},"fixed_version":"2.0.42","urgency":"not yet assigned"},"trixie":{"status":"resolved","repositories":{"trixie":"2.4.66-1~deb13u1"},"fixed_version":"2.0.42","urgency":"not yet assigned"}}},"CVE-2002-1850":{"description":"mod_cgi in Apache 2.0.39 and 2.0.40 allows local users and possibly remote attackers to cause a denial of service (hang and memory consumption) by causing a CGI script to send a large amount of data to stderr, which results in a read/write deadlock between httpd and the CGI script.","scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"2.4.66-1~deb12u1","bookworm-security":"2.4.62-1~deb12u2"},"fixed_version":"2.0.42-1","urgency":"not yet assigned"},"bullseye":{"status":"resolved","repositories":{"bullseye":"2.4.62-1~deb11u1","bullseye-security":"2.4.66-1~deb11u1"},"fixed_version":"2.0.42-1","urgency":"not yet assigned"},"forky":{"status":"resolved","repositories":{"forky":"2.4.66-8"},"fixed_version":"2.0.42-1","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"2.4.66-8"},"fixed_version":"2.0.42-1","urgency":"not yet assigned"},"trixie":{"status":"resolved","repositories":{"trixie":"2.4.66-1~deb13u1"},"fixed_version":"2.0.42-1","urgency":"not yet assigned"}}},"CVE-2003-0020":{"description":"Apache does not filter terminal escape sequences from its error logs, which could make it easier for attackers to insert those sequences into terminal emulators containing vulnerabilities related to escape sequences.","scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"2.4.66-1~deb12u1","bookworm-security":"2.4.62-1~deb12u2"},"fixed_version":"2.0.49","urgency":"not yet assigned"},"bullseye":{"status":"resolved","repositories":{"bullseye":"2.4.62-1~deb11u1","bullseye-security":"2.4.66-1~deb11u1"},"fixed_version":"2.0.49","urgency":"not yet assigned"},"forky":{"status":"resolved","repositories":{"forky":"2.4.66-8"},"fixed_version":"2.0.49","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"2.4.66-8"},"fixed_version":"2.0.49","urgency":"not yet assigned"},"trixie":{"status":"resolved","repositories":{"trixie":"2.4.66-1~deb13u1"},"fixed_version":"2.0.49","urgency":"not yet assigned"}}},"CVE-2003-0083":{"description":"Apache 1.3 before 1.3.25 and Apache 2.0 before version 2.0.46 does not filter terminal escape sequences from its access logs, which could make it easier for attackers to insert those sequences into terminal emulators containing vulnerabilities related to escape sequences, a different vulnerability than CVE-2003-0020.","scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"2.4.66-1~deb12u1","bookworm-security":"2.4.62-1~deb12u2"},"fixed_version":"2.0.46","urgency":"not yet assigned"},"bullseye":{"status":"resolved","repositories":{"bullseye":"2.4.62-1~deb11u1","bullseye-security":"2.4.66-1~deb11u1"},"fixed_version":"2.0.46","urgency":"not yet assigned"},"forky":{"status":"resolved","repositories":{"forky":"2.4.66-8"},"fixed_version":"2.0.46","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"2.4.66-8"},"fixed_version":"2.0.46","urgency":"not yet assigned"},"trixie":{"status":"resolved","repositories":{"trixie":"2.4.66-1~deb13u1"},"fixed_version":"2.0.46","urgency":"not yet assigned"}}},"CVE-2003-0132":{"description":"A memory leak in Apache 2.0 through 2.0.44 allows remote attackers to cause a denial of service (memory consumption) via large chunks of linefeed characters, which causes Apache to allocate 80 bytes for each linefeed.","scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"2.4.66-1~deb12u1","bookworm-security":"2.4.62-1~deb12u2"},"fixed_version":"2.0.45","urgency":"not yet assigned"},"bullseye":{"status":"resolved","repositories":{"bullseye":"2.4.62-1~deb11u1","bullseye-security":"2.4.66-1~deb11u1"},"fixed_version":"2.0.45","urgency":"not yet assigned"},"forky":{"status":"resolved","repositories":{"forky":"2.4.66-8"},"fixed_version":"2.0.45","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"2.4.66-8"},"fixed_version":"2.0.45","urgency":"not yet assigned"},"trixie":{"status":"resolved","repositories":{"trixie":"2.4.66-1~deb13u1"},"fixed_version":"2.0.45","urgency":"not yet assigned"}}},"CVE-2003-0134":{"description":"Unknown vulnerability in filestat.c for Apache running on OS2, versions 2.0 through 2.0.45, allows unknown attackers to cause a denial of service via requests related to device names.","scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"2.4.66-1~deb12u1","bookworm-security":"2.4.62-1~deb12u2"},"fixed_version":"2.0.46","urgency":"not yet assigned"},"bullseye":{"status":"resolved","repositories":{"bullseye":"2.4.62-1~deb11u1","bullseye-security":"2.4.66-1~deb11u1"},"fixed_version":"2.0.46","urgency":"not yet assigned"},"forky":{"status":"resolved","repositories":{"forky":"2.4.66-8"},"fixed_version":"2.0.46","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"2.4.66-8"},"fixed_version":"2.0.46","urgency":"not yet assigned"},"trixie":{"status":"resolved","repositories":{"trixie":"2.4.66-1~deb13u1"},"fixed_version":"2.0.46","urgency":"not yet assigned"}}},"CVE-2003-0189":{"description":"The authentication module for Apache 2.0.40 through 2.0.45 on Unix does not properly handle threads safely when using the crypt_r or crypt functions, which allows remote attackers to cause a denial of service (failed Basic authentication with valid usernames and passwords) when a threaded MPM is used.","scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"2.4.66-1~deb12u1","bookworm-security":"2.4.62-1~deb12u2"},"fixed_version":"2.0.46","urgency":"not yet assigned"},"bullseye":{"status":"resolved","repositories":{"bullseye":"2.4.62-1~deb11u1","bullseye-security":"2.4.66-1~deb11u1"},"fixed_version":"2.0.46","urgency":"not yet assigned"},"forky":{"status":"resolved","repositories":{"forky":"2.4.66-8"},"fixed_version":"2.0.46","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"2.4.66-8"},"fixed_version":"2.0.46","urgency":"not yet assigned"},"trixie":{"status":"resolved","repositories":{"trixie":"2.4.66-1~deb13u1"},"fixed_version":"2.0.46","urgency":"not yet assigned"}}},"CVE-2003-0192":{"description":"Apache 2 before 2.0.47, and certain versions of mod_ssl for Apache 1.3, do not properly handle \"certain sequences of per-directory renegotiations and the SSLCipherSuite directive being used to upgrade from a weak ciphersuite to a strong one,\" which could cause Apache to use the weak ciphersuite.","scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"2.4.66-1~deb12u1","bookworm-security":"2.4.62-1~deb12u2"},"fixed_version":"2.0.47","urgency":"not yet assigned"},"bullseye":{"status":"resolved","repositories":{"bullseye":"2.4.62-1~deb11u1","bullseye-security":"2.4.66-1~deb11u1"},"fixed_version":"2.0.47","urgency":"not yet assigned"},"forky":{"status":"resolved","repositories":{"forky":"2.4.66-8"},"fixed_version":"2.0.47","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"2.4.66-8"},"fixed_version":"2.0.47","urgency":"not yet assigned"},"trixie":{"status":"resolved","repositories":{"trixie":"2.4.66-1~deb13u1"},"fixed_version":"2.0.47","urgency":"not yet assigned"}}},"CVE-2003-0245":{"description":"Vulnerability in the apr_psprintf function in the Apache Portable Runtime (APR) library for Apache 2.0.37 through 2.0.45 allows remote attackers to cause a denial of service (crash) and possibly execute arbitrary code via long strings, as demonstrated using XML objects to mod_dav, and possibly other vectors.","scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"2.4.66-1~deb12u1","bookworm-security":"2.4.62-1~deb12u2"},"fixed_version":"2.0.46","urgency":"not yet assigned"},"bullseye":{"status":"resolved","repositories":{"bullseye":"2.4.62-1~deb11u1","bullseye-security":"2.4.66-1~deb11u1"},"fixed_version":"2.0.46","urgency":"not yet assigned"},"forky":{"status":"resolved","repositories":{"forky":"2.4.66-8"},"fixed_version":"2.0.46","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"2.4.66-8"},"fixed_version":"2.0.46","urgency":"not yet assigned"},"trixie":{"status":"resolved","repositories":{"trixie":"2.4.66-1~deb13u1"},"fixed_version":"2.0.46","urgency":"not yet assigned"}}},"CVE-2003-0253":{"description":"The prefork MPM in Apache 2 before 2.0.47 does not properly handle certain errors from accept, which could lead to a denial of service.","scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"2.4.66-1~deb12u1","bookworm-security":"2.4.62-1~deb12u2"},"fixed_version":"2.0.47","urgency":"not yet assigned"},"bullseye":{"status":"resolved","repositories":{"bullseye":"2.4.62-1~deb11u1","bullseye-security":"2.4.66-1~deb11u1"},"fixed_version":"2.0.47","urgency":"not yet assigned"},"forky":{"status":"resolved","repositories":{"forky":"2.4.66-8"},"fixed_version":"2.0.47","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"2.4.66-8"},"fixed_version":"2.0.47","urgency":"not yet assigned"},"trixie":{"status":"resolved","repositories":{"trixie":"2.4.66-1~deb13u1"},"fixed_version":"2.0.47","urgency":"not yet assigned"}}},"CVE-2003-0254":{"description":"Apache 2 before 2.0.47, when running on an IPv6 host, allows attackers to cause a denial of service (CPU consumption by infinite loop) when the FTP proxy server fails to create an IPv6 socket.","scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"2.4.66-1~deb12u1","bookworm-security":"2.4.62-1~deb12u2"},"fixed_version":"2.0.47","urgency":"not yet assigned"},"bullseye":{"status":"resolved","repositories":{"bullseye":"2.4.62-1~deb11u1","bullseye-security":"2.4.66-1~deb11u1"},"fixed_version":"2.0.47","urgency":"not yet assigned"},"forky":{"status":"resolved","repositories":{"forky":"2.4.66-8"},"fixed_version":"2.0.47","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"2.4.66-8"},"fixed_version":"2.0.47","urgency":"not yet assigned"},"trixie":{"status":"resolved","repositories":{"trixie":"2.4.66-1~deb13u1"},"fixed_version":"2.0.47","urgency":"not yet assigned"}}},"CVE-2003-0542":{"description":"Multiple stack-based buffer overflows in (1) mod_alias and (2) mod_rewrite for Apache before 1.3.29 allow attackers to create configuration files to cause a denial of service (crash) or execute arbitrary code via a regular expression with more than 9 captures.","scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"2.4.66-1~deb12u1","bookworm-security":"2.4.62-1~deb12u2"},"fixed_version":"2.0.48","urgency":"not yet assigned"},"bullseye":{"status":"resolved","repositories":{"bullseye":"2.4.62-1~deb11u1","bullseye-security":"2.4.66-1~deb11u1"},"fixed_version":"2.0.48","urgency":"not yet assigned"},"forky":{"status":"resolved","repositories":{"forky":"2.4.66-8"},"fixed_version":"2.0.48","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"2.4.66-8"},"fixed_version":"2.0.48","urgency":"not yet assigned"},"trixie":{"status":"resolved","repositories":{"trixie":"2.4.66-1~deb13u1"},"fixed_version":"2.0.48","urgency":"not yet assigned"}}},"CVE-2003-0789":{"description":"mod_cgid in Apache before 2.0.48, when using a threaded MPM, does not properly handle CGI redirect paths, which could cause Apache to send the output of a CGI program to the wrong client.","scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"2.4.66-1~deb12u1","bookworm-security":"2.4.62-1~deb12u2"},"fixed_version":"2.0.48","urgency":"not yet assigned"},"bullseye":{"status":"resolved","repositories":{"bullseye":"2.4.62-1~deb11u1","bullseye-security":"2.4.66-1~deb11u1"},"fixed_version":"2.0.48","urgency":"not yet assigned"},"forky":{"status":"resolved","repositories":{"forky":"2.4.66-8"},"fixed_version":"2.0.48","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"2.4.66-8"},"fixed_version":"2.0.48","urgency":"not yet assigned"},"trixie":{"status":"resolved","repositories":{"trixie":"2.4.66-1~deb13u1"},"fixed_version":"2.0.48","urgency":"not yet assigned"}}},"CVE-2003-1138":{"description":"The default configuration of Apache 2.0.40, as shipped with Red Hat Linux 9.0, allows remote attackers to list directory contents, even if auto indexing is turned off and there is a default web page configured, via a GET request containing a double slash (//).","scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"2.4.66-1~deb12u1","bookworm-security":"2.4.62-1~deb12u2"},"fixed_version":"0","urgency":"unimportant"},"bullseye":{"status":"resolved","repositories":{"bullseye":"2.4.62-1~deb11u1","bullseye-security":"2.4.66-1~deb11u1"},"fixed_version":"0","urgency":"unimportant"},"forky":{"status":"resolved","repositories":{"forky":"2.4.66-8"},"fixed_version":"0","urgency":"unimportant"},"sid":{"status":"resolved","repositories":{"sid":"2.4.66-8"},"fixed_version":"0","urgency":"unimportant"},"trixie":{"status":"resolved","repositories":{"trixie":"2.4.66-1~deb13u1"},"fixed_version":"0","urgency":"unimportant"}}},"CVE-2003-1307":{"description":"The mod_php module for the Apache HTTP Server allows local users with write access to PHP scripts to send signals to the server's process group and use the server's file descriptors, as demonstrated by sending a STOP signal, then intercepting incoming connections on the server's TCP port.  NOTE: the PHP developer has disputed this vulnerability, saying \"The opened file descriptors are opened by Apache. It is the job of Apache to protect them ... Not a bug in PHP.","scope":"local","releases":{"bookworm":{"status":"open","repositories":{"bookworm":"2.4.66-1~deb12u1","bookworm-security":"2.4.62-1~deb12u2"},"urgency":"unimportant"},"bullseye":{"status":"open","repositories":{"bullseye":"2.4.62-1~deb11u1","bullseye-security":"2.4.66-1~deb11u1"},"urgency":"unimportant"},"forky":{"status":"open","repositories":{"forky":"2.4.66-8"},"urgency":"unimportant"},"sid":{"status":"open","repositories":{"sid":"2.4.66-8"},"urgency":"unimportant"},"trixie":{"status":"open","repositories":{"trixie":"2.4.66-1~deb13u1"},"urgency":"unimportant"}}},"CVE-2003-1580":{"description":"The Apache HTTP Server 2.0.44, when DNS resolution is enabled for client IP addresses, uses a logging format that does not identify whether a dotted quad represents an unresolved IP address, which allows remote attackers to spoof IP addresses via crafted DNS responses containing numerical top-level domains, as demonstrated by a forged 123.123.123.123 domain name, related to an \"Inverse Lookup Log Corruption (ILLC)\" issue.","debianbug":570740,"scope":"local","releases":{"bookworm":{"status":"open","repositories":{"bookworm":"2.4.66-1~deb12u1","bookworm-security":"2.4.62-1~deb12u2"},"urgency":"unimportant"},"bullseye":{"status":"open","repositories":{"bullseye":"2.4.62-1~deb11u1","bullseye-security":"2.4.66-1~deb11u1"},"urgency":"unimportant"},"forky":{"status":"open","repositories":{"forky":"2.4.66-8"},"urgency":"unimportant"},"sid":{"status":"open","repositories":{"sid":"2.4.66-8"},"urgency":"unimportant"},"trixie":{"status":"open","repositories":{"trixie":"2.4.66-1~deb13u1"},"urgency":"unimportant"}}},"CVE-2003-1581":{"description":"The Apache HTTP Server 2.0.44, when DNS resolution is enabled for client IP addresses, allows remote attackers to inject arbitrary text into log files via an HTTP request in conjunction with a crafted DNS response, as demonstrated by injecting XSS sequences, related to an \"Inverse Lookup Log Corruption (ILLC)\" issue.","debianbug":570740,"scope":"local","releases":{"bookworm":{"status":"open","repositories":{"bookworm":"2.4.66-1~deb12u1","bookworm-security":"2.4.62-1~deb12u2"},"urgency":"unimportant"},"bullseye":{"status":"open","repositories":{"bullseye":"2.4.62-1~deb11u1","bullseye-security":"2.4.66-1~deb11u1"},"urgency":"unimportant"},"forky":{"status":"open","repositories":{"forky":"2.4.66-8"},"urgency":"unimportant"},"sid":{"status":"open","repositories":{"sid":"2.4.66-8"},"urgency":"unimportant"},"trixie":{"status":"open","repositories":{"trixie":"2.4.66-1~deb13u1"},"urgency":"unimportant"}}},"CVE-2004-0113":{"description":"Memory leak in ssl_engine_io.c for mod_ssl in Apache 2 before 2.0.49 allows remote attackers to cause a denial of service (memory consumption) via plain HTTP requests to the SSL port of an SSL-enabled server.","scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"2.4.66-1~deb12u1","bookworm-security":"2.4.62-1~deb12u2"},"fixed_version":"2.0.52","urgency":"not yet assigned"},"bullseye":{"status":"resolved","repositories":{"bullseye":"2.4.62-1~deb11u1","bullseye-security":"2.4.66-1~deb11u1"},"fixed_version":"2.0.52","urgency":"not yet assigned"},"forky":{"status":"resolved","repositories":{"forky":"2.4.66-8"},"fixed_version":"2.0.52","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"2.4.66-8"},"fixed_version":"2.0.52","urgency":"not yet assigned"},"trixie":{"status":"resolved","repositories":{"trixie":"2.4.66-1~deb13u1"},"fixed_version":"2.0.52","urgency":"not yet assigned"}}},"CVE-2004-0488":{"description":"Stack-based buffer overflow in the ssl_util_uuencode_binary function in ssl_util.c for Apache mod_ssl, when mod_ssl is configured to trust the issuing CA, may allow remote attackers to execute arbitrary code via a client certificate with a long subject DN.","scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"2.4.66-1~deb12u1","bookworm-security":"2.4.62-1~deb12u2"},"fixed_version":"2.0.50-1","urgency":"not yet assigned"},"bullseye":{"status":"resolved","repositories":{"bullseye":"2.4.62-1~deb11u1","bullseye-security":"2.4.66-1~deb11u1"},"fixed_version":"2.0.50-1","urgency":"not yet assigned"},"forky":{"status":"resolved","repositories":{"forky":"2.4.66-8"},"fixed_version":"2.0.50-1","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"2.4.66-8"},"fixed_version":"2.0.50-1","urgency":"not yet assigned"},"trixie":{"status":"resolved","repositories":{"trixie":"2.4.66-1~deb13u1"},"fixed_version":"2.0.50-1","urgency":"not yet assigned"}}},"CVE-2004-0493":{"description":"The ap_get_mime_headers_core function in Apache httpd 2.0.49 allows remote attackers to cause a denial of service (memory exhaustion), and possibly an integer signedness error leading to a heap-based buffer overflow on 64 bit systems, via long header lines with large numbers of space or tab characters.","scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"2.4.66-1~deb12u1","bookworm-security":"2.4.62-1~deb12u2"},"fixed_version":"2.0.50-1","urgency":"not yet assigned"},"bullseye":{"status":"resolved","repositories":{"bullseye":"2.4.62-1~deb11u1","bullseye-security":"2.4.66-1~deb11u1"},"fixed_version":"2.0.50-1","urgency":"not yet assigned"},"forky":{"status":"resolved","repositories":{"forky":"2.4.66-8"},"fixed_version":"2.0.50-1","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"2.4.66-8"},"fixed_version":"2.0.50-1","urgency":"not yet assigned"},"trixie":{"status":"resolved","repositories":{"trixie":"2.4.66-1~deb13u1"},"fixed_version":"2.0.50-1","urgency":"not yet assigned"}}},"CVE-2004-0747":{"description":"Buffer overflow in Apache 2.0.50 and earlier allows local users to gain apache privileges via a .htaccess file that causes the overflow during expansion of environment variables.","scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"2.4.66-1~deb12u1","bookworm-security":"2.4.62-1~deb12u2"},"fixed_version":"2.0.51","urgency":"not yet assigned"},"bullseye":{"status":"resolved","repositories":{"bullseye":"2.4.62-1~deb11u1","bullseye-security":"2.4.66-1~deb11u1"},"fixed_version":"2.0.51","urgency":"not yet assigned"},"forky":{"status":"resolved","repositories":{"forky":"2.4.66-8"},"fixed_version":"2.0.51","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"2.4.66-8"},"fixed_version":"2.0.51","urgency":"not yet assigned"},"trixie":{"status":"resolved","repositories":{"trixie":"2.4.66-1~deb13u1"},"fixed_version":"2.0.51","urgency":"not yet assigned"}}},"CVE-2004-0748":{"description":"mod_ssl in Apache 2.0.50 and earlier allows remote attackers to cause a denial of service (CPU consumption) by aborting an SSL connection in a way that causes an Apache child process to enter an infinite loop.","scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"2.4.66-1~deb12u1","bookworm-security":"2.4.62-1~deb12u2"},"fixed_version":"2.0.51","urgency":"not yet assigned"},"bullseye":{"status":"resolved","repositories":{"bullseye":"2.4.62-1~deb11u1","bullseye-security":"2.4.66-1~deb11u1"},"fixed_version":"2.0.51","urgency":"not yet assigned"},"forky":{"status":"resolved","repositories":{"forky":"2.4.66-8"},"fixed_version":"2.0.51","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"2.4.66-8"},"fixed_version":"2.0.51","urgency":"not yet assigned"},"trixie":{"status":"resolved","repositories":{"trixie":"2.4.66-1~deb13u1"},"fixed_version":"2.0.51","urgency":"not yet assigned"}}},"CVE-2004-0751":{"description":"The char_buffer_read function in the mod_ssl module for Apache 2.x, when using reverse proxying to an SSL server, allows remote attackers to cause a denial of service (segmentation fault).","scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"2.4.66-1~deb12u1","bookworm-security":"2.4.62-1~deb12u2"},"fixed_version":"2.0.50-11","urgency":"not yet assigned"},"bullseye":{"status":"resolved","repositories":{"bullseye":"2.4.62-1~deb11u1","bullseye-security":"2.4.66-1~deb11u1"},"fixed_version":"2.0.50-11","urgency":"not yet assigned"},"forky":{"status":"resolved","repositories":{"forky":"2.4.66-8"},"fixed_version":"2.0.50-11","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"2.4.66-8"},"fixed_version":"2.0.50-11","urgency":"not yet assigned"},"trixie":{"status":"resolved","repositories":{"trixie":"2.4.66-1~deb13u1"},"fixed_version":"2.0.50-11","urgency":"not yet assigned"}}},"CVE-2004-0786":{"description":"The IPv6 URI parsing routines in the apr-util library for Apache 2.0.50 and earlier allow remote attackers to cause a denial of service (child process crash) via a certain URI, as demonstrated using the Codenomicon HTTP Test Tool.","scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"2.4.66-1~deb12u1","bookworm-security":"2.4.62-1~deb12u2"},"fixed_version":"2.0.51","urgency":"not yet assigned"},"bullseye":{"status":"resolved","repositories":{"bullseye":"2.4.62-1~deb11u1","bullseye-security":"2.4.66-1~deb11u1"},"fixed_version":"2.0.51","urgency":"not yet assigned"},"forky":{"status":"resolved","repositories":{"forky":"2.4.66-8"},"fixed_version":"2.0.51","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"2.4.66-8"},"fixed_version":"2.0.51","urgency":"not yet assigned"},"trixie":{"status":"resolved","repositories":{"trixie":"2.4.66-1~deb13u1"},"fixed_version":"2.0.51","urgency":"not yet assigned"}}},"CVE-2004-0809":{"description":"The mod_dav module in Apache 2.0.50 and earlier allows remote attackers to cause a denial of service (child process crash) via a certain sequence of LOCK requests for a location that allows WebDAV authoring access.","scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"2.4.66-1~deb12u1","bookworm-security":"2.4.62-1~deb12u2"},"fixed_version":"2.0.51-1","urgency":"not yet assigned"},"bullseye":{"status":"resolved","repositories":{"bullseye":"2.4.62-1~deb11u1","bullseye-security":"2.4.66-1~deb11u1"},"fixed_version":"2.0.51-1","urgency":"not yet assigned"},"forky":{"status":"resolved","repositories":{"forky":"2.4.66-8"},"fixed_version":"2.0.51-1","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"2.4.66-8"},"fixed_version":"2.0.51-1","urgency":"not yet assigned"},"trixie":{"status":"resolved","repositories":{"trixie":"2.4.66-1~deb13u1"},"fixed_version":"2.0.51-1","urgency":"not yet assigned"}}},"CVE-2004-0811":{"description":"Unknown vulnerability in Apache 2.0.51 prevents \"the merging of the Satisfy directive,\" which could allow attackers to obtain access to restricted resources contrary to the specified authentication configuration.","scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"2.4.66-1~deb12u1","bookworm-security":"2.4.62-1~deb12u2"},"fixed_version":"2.0.52","urgency":"not yet assigned"},"bullseye":{"status":"resolved","repositories":{"bullseye":"2.4.62-1~deb11u1","bullseye-security":"2.4.66-1~deb11u1"},"fixed_version":"2.0.52","urgency":"not yet assigned"},"forky":{"status":"resolved","repositories":{"forky":"2.4.66-8"},"fixed_version":"2.0.52","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"2.4.66-8"},"fixed_version":"2.0.52","urgency":"not yet assigned"},"trixie":{"status":"resolved","repositories":{"trixie":"2.4.66-1~deb13u1"},"fixed_version":"2.0.52","urgency":"not yet assigned"}}},"CVE-2004-0885":{"description":"The mod_ssl module in Apache 2.0.35 through 2.0.52, when using the \"SSLCipherSuite\" directive in directory or location context, allows remote clients to bypass intended restrictions by using any cipher suite that is allowed by the virtual host configuration.","scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"2.4.66-1~deb12u1","bookworm-security":"2.4.62-1~deb12u2"},"fixed_version":"2.0.52-2","urgency":"not yet assigned"},"bullseye":{"status":"resolved","repositories":{"bullseye":"2.4.62-1~deb11u1","bullseye-security":"2.4.66-1~deb11u1"},"fixed_version":"2.0.52-2","urgency":"not yet assigned"},"forky":{"status":"resolved","repositories":{"forky":"2.4.66-8"},"fixed_version":"2.0.52-2","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"2.4.66-8"},"fixed_version":"2.0.52-2","urgency":"not yet assigned"},"trixie":{"status":"resolved","repositories":{"trixie":"2.4.66-1~deb13u1"},"fixed_version":"2.0.52-2","urgency":"not yet assigned"}}},"CVE-2004-0942":{"description":"Apache webserver 2.0.52 and earlier allows remote attackers to cause a denial of service (CPU consumption) via an HTTP GET request with a MIME header containing multiple lines with a large number of space characters.","scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"2.4.66-1~deb12u1","bookworm-security":"2.4.62-1~deb12u2"},"fixed_version":"2.0.52-2","urgency":"not yet assigned"},"bullseye":{"status":"resolved","repositories":{"bullseye":"2.4.62-1~deb11u1","bullseye-security":"2.4.66-1~deb11u1"},"fixed_version":"2.0.52-2","urgency":"not yet assigned"},"forky":{"status":"resolved","repositories":{"forky":"2.4.66-8"},"fixed_version":"2.0.52-2","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"2.4.66-8"},"fixed_version":"2.0.52-2","urgency":"not yet assigned"},"trixie":{"status":"resolved","repositories":{"trixie":"2.4.66-1~deb13u1"},"fixed_version":"2.0.52-2","urgency":"not yet assigned"}}},"CVE-2004-1834":{"description":"mod_disk_cache in Apache 2.0 through 2.0.49 stores client headers, including authentication information, on the hard disk, which could allow local users to gain sensitive information.","scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"2.4.66-1~deb12u1","bookworm-security":"2.4.62-1~deb12u2"},"fixed_version":"2.0.53-1","urgency":"not yet assigned"},"bullseye":{"status":"resolved","repositories":{"bullseye":"2.4.62-1~deb11u1","bullseye-security":"2.4.66-1~deb11u1"},"fixed_version":"2.0.53-1","urgency":"not yet assigned"},"forky":{"status":"resolved","repositories":{"forky":"2.4.66-8"},"fixed_version":"2.0.53-1","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"2.4.66-8"},"fixed_version":"2.0.53-1","urgency":"not yet assigned"},"trixie":{"status":"resolved","repositories":{"trixie":"2.4.66-1~deb13u1"},"fixed_version":"2.0.53-1","urgency":"not yet assigned"}}},"CVE-2005-1268":{"description":"Off-by-one error in the mod_ssl Certificate Revocation List (CRL) verification callback in Apache, when configured to use a CRL, allows remote attackers to cause a denial of service (child process crash) via a CRL that causes a buffer overflow of one null byte.","debianbug":320048,"scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"2.4.66-1~deb12u1","bookworm-security":"2.4.62-1~deb12u2"},"fixed_version":"2.0.54-5","urgency":"low"},"bullseye":{"status":"resolved","repositories":{"bullseye":"2.4.62-1~deb11u1","bullseye-security":"2.4.66-1~deb11u1"},"fixed_version":"2.0.54-5","urgency":"low"},"forky":{"status":"resolved","repositories":{"forky":"2.4.66-8"},"fixed_version":"2.0.54-5","urgency":"low"},"sid":{"status":"resolved","repositories":{"sid":"2.4.66-8"},"fixed_version":"2.0.54-5","urgency":"low"},"trixie":{"status":"resolved","repositories":{"trixie":"2.4.66-1~deb13u1"},"fixed_version":"2.0.54-5","urgency":"low"}}},"CVE-2005-1344":{"description":"Buffer overflow in htdigest in Apache 2.0.52 may allow attackers to execute arbitrary code via a long realm argument.  NOTE: since htdigest is normally only locally accessible and not setuid or setgid, there are few attack vectors which would lead to an escalation of privileges, unless htdigest is executed from a CGI program.  Therefore this may not be a vulnerability.","debianbug":322604,"scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"2.4.66-1~deb12u1","bookworm-security":"2.4.62-1~deb12u2"},"fixed_version":"2.0.54-3","urgency":"not yet assigned"},"bullseye":{"status":"resolved","repositories":{"bullseye":"2.4.62-1~deb11u1","bullseye-security":"2.4.66-1~deb11u1"},"fixed_version":"2.0.54-3","urgency":"not yet assigned"},"forky":{"status":"resolved","repositories":{"forky":"2.4.66-8"},"fixed_version":"2.0.54-3","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"2.4.66-8"},"fixed_version":"2.0.54-3","urgency":"not yet assigned"},"trixie":{"status":"resolved","repositories":{"trixie":"2.4.66-1~deb13u1"},"fixed_version":"2.0.54-3","urgency":"not yet assigned"}}},"CVE-2005-2088":{"description":"The Apache HTTP server before 1.3.34, and 2.0.x before 2.0.55, when acting as an HTTP proxy, allows remote attackers to poison the web cache, bypass web application firewall protection, and conduct XSS attacks via an HTTP request with both a \"Transfer-Encoding: chunked\" header and a Content-Length header, which causes Apache to incorrectly handle and forward the body of the request in a way that causes the receiving server to process it as a separate HTTP request, aka \"HTTP Request Smuggling.\"","debianbug":316173,"scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"2.4.66-1~deb12u1","bookworm-security":"2.4.62-1~deb12u2"},"fixed_version":"2.0.54-5","urgency":"medium"},"bullseye":{"status":"resolved","repositories":{"bullseye":"2.4.62-1~deb11u1","bullseye-security":"2.4.66-1~deb11u1"},"fixed_version":"2.0.54-5","urgency":"medium"},"forky":{"status":"resolved","repositories":{"forky":"2.4.66-8"},"fixed_version":"2.0.54-5","urgency":"medium"},"sid":{"status":"resolved","repositories":{"sid":"2.4.66-8"},"fixed_version":"2.0.54-5","urgency":"medium"},"trixie":{"status":"resolved","repositories":{"trixie":"2.4.66-1~deb13u1"},"fixed_version":"2.0.54-5","urgency":"medium"}}},"CVE-2005-2700":{"description":"ssl_engine_kernel.c in mod_ssl before 2.8.24, when using \"SSLVerifyClient optional\" in the global virtual host configuration, does not properly enforce \"SSLVerifyClient require\" in a per-location context, which allows remote attackers to bypass intended access restrictions.","debianbug":327210,"scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"2.4.66-1~deb12u1","bookworm-security":"2.4.62-1~deb12u2"},"fixed_version":"2.0.54-5","urgency":"medium"},"bullseye":{"status":"resolved","repositories":{"bullseye":"2.4.62-1~deb11u1","bullseye-security":"2.4.66-1~deb11u1"},"fixed_version":"2.0.54-5","urgency":"medium"},"forky":{"status":"resolved","repositories":{"forky":"2.4.66-8"},"fixed_version":"2.0.54-5","urgency":"medium"},"sid":{"status":"resolved","repositories":{"sid":"2.4.66-8"},"fixed_version":"2.0.54-5","urgency":"medium"},"trixie":{"status":"resolved","repositories":{"trixie":"2.4.66-1~deb13u1"},"fixed_version":"2.0.54-5","urgency":"medium"}}},"CVE-2005-2728":{"description":"The byte-range filter in Apache 2.0 before 2.0.54 allows remote attackers to cause a denial of service (memory consumption) via an HTTP header with a large Range field.","debianbug":326435,"scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"2.4.66-1~deb12u1","bookworm-security":"2.4.62-1~deb12u2"},"fixed_version":"2.0.54-5","urgency":"medium"},"bullseye":{"status":"resolved","repositories":{"bullseye":"2.4.62-1~deb11u1","bullseye-security":"2.4.66-1~deb11u1"},"fixed_version":"2.0.54-5","urgency":"medium"},"forky":{"status":"resolved","repositories":{"forky":"2.4.66-8"},"fixed_version":"2.0.54-5","urgency":"medium"},"sid":{"status":"resolved","repositories":{"sid":"2.4.66-8"},"fixed_version":"2.0.54-5","urgency":"medium"},"trixie":{"status":"resolved","repositories":{"trixie":"2.4.66-1~deb13u1"},"fixed_version":"2.0.54-5","urgency":"medium"}}},"CVE-2005-2970":{"description":"Memory leak in the worker MPM (worker.c) for Apache 2, in certain circumstances, allows remote attackers to cause a denial of service (memory consumption) via aborted connections, which prevents the memory for the transaction pool from being reused for other connections.","debianbug":340337,"scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"2.4.66-1~deb12u1","bookworm-security":"2.4.62-1~deb12u2"},"fixed_version":"2.0.55-1","urgency":"low"},"bullseye":{"status":"resolved","repositories":{"bullseye":"2.4.62-1~deb11u1","bullseye-security":"2.4.66-1~deb11u1"},"fixed_version":"2.0.55-1","urgency":"low"},"forky":{"status":"resolved","repositories":{"forky":"2.4.66-8"},"fixed_version":"2.0.55-1","urgency":"low"},"sid":{"status":"resolved","repositories":{"sid":"2.4.66-8"},"fixed_version":"2.0.55-1","urgency":"low"},"trixie":{"status":"resolved","repositories":{"trixie":"2.4.66-1~deb13u1"},"fixed_version":"2.0.55-1","urgency":"low"}}},"CVE-2005-3352":{"description":"Cross-site scripting (XSS) vulnerability in the mod_imap module of Apache httpd before 1.3.35-dev and Apache httpd 2.0.x before 2.0.56-dev allows remote attackers to inject arbitrary web script or HTML via the Referer when using image maps.","debianbug":343467,"scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"2.4.66-1~deb12u1","bookworm-security":"2.4.62-1~deb12u2"},"fixed_version":"2.0.55-4","urgency":"low"},"bullseye":{"status":"resolved","repositories":{"bullseye":"2.4.62-1~deb11u1","bullseye-security":"2.4.66-1~deb11u1"},"fixed_version":"2.0.55-4","urgency":"low"},"forky":{"status":"resolved","repositories":{"forky":"2.4.66-8"},"fixed_version":"2.0.55-4","urgency":"low"},"sid":{"status":"resolved","repositories":{"sid":"2.4.66-8"},"fixed_version":"2.0.55-4","urgency":"low"},"trixie":{"status":"resolved","repositories":{"trixie":"2.4.66-1~deb13u1"},"fixed_version":"2.0.55-4","urgency":"low"}}},"CVE-2005-3357":{"description":"mod_ssl in Apache 2.0 up to 2.0.55, when configured with an SSL vhost with access control and a custom error 400 error page, allows remote attackers to cause a denial of service (application crash) via a non-SSL request to an SSL port, which triggers a NULL pointer dereference.","debianbug":351246,"scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"2.4.66-1~deb12u1","bookworm-security":"2.4.62-1~deb12u2"},"fixed_version":"2.0.55-4","urgency":"low"},"bullseye":{"status":"resolved","repositories":{"bullseye":"2.4.62-1~deb11u1","bullseye-security":"2.4.66-1~deb11u1"},"fixed_version":"2.0.55-4","urgency":"low"},"forky":{"status":"resolved","repositories":{"forky":"2.4.66-8"},"fixed_version":"2.0.55-4","urgency":"low"},"sid":{"status":"resolved","repositories":{"sid":"2.4.66-8"},"fixed_version":"2.0.55-4","urgency":"low"},"trixie":{"status":"resolved","repositories":{"trixie":"2.4.66-1~deb13u1"},"fixed_version":"2.0.55-4","urgency":"low"}}},"CVE-2006-20001":{"description":"A carefully crafted If: request header can cause a memory read, or write of a single zero byte, in a pool (heap) memory location beyond the header value sent. This could cause the process to crash.  This issue affects Apache HTTP Server 2.4.54 and earlier.","scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"2.4.66-1~deb12u1","bookworm-security":"2.4.62-1~deb12u2"},"fixed_version":"2.4.55-1","urgency":"not yet assigned"},"bullseye":{"status":"resolved","repositories":{"bullseye":"2.4.62-1~deb11u1","bullseye-security":"2.4.66-1~deb11u1"},"fixed_version":"2.4.56-1~deb11u1","urgency":"not yet assigned"},"forky":{"status":"resolved","repositories":{"forky":"2.4.66-8"},"fixed_version":"2.4.55-1","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"2.4.66-8"},"fixed_version":"2.4.55-1","urgency":"not yet assigned"},"trixie":{"status":"resolved","repositories":{"trixie":"2.4.66-1~deb13u1"},"fixed_version":"2.4.55-1","urgency":"not yet assigned"}}},"CVE-2006-3747":{"description":"Off-by-one error in the ldap scheme handling in the Rewrite module (mod_rewrite) in Apache 1.3 from 1.3.28, 2.0.46 and other versions before 2.0.59, and 2.2, when RewriteEngine is enabled, allows remote attackers to cause a denial of service (application crash) and possibly execute arbitrary code via crafted URLs that are not properly handled using certain rewrite rules.","debianbug":380182,"scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"2.4.66-1~deb12u1","bookworm-security":"2.4.62-1~deb12u2"},"fixed_version":"2.0.55-4.1","urgency":"medium"},"bullseye":{"status":"resolved","repositories":{"bullseye":"2.4.62-1~deb11u1","bullseye-security":"2.4.66-1~deb11u1"},"fixed_version":"2.0.55-4.1","urgency":"medium"},"forky":{"status":"resolved","repositories":{"forky":"2.4.66-8"},"fixed_version":"2.0.55-4.1","urgency":"medium"},"sid":{"status":"resolved","repositories":{"sid":"2.4.66-8"},"fixed_version":"2.0.55-4.1","urgency":"medium"},"trixie":{"status":"resolved","repositories":{"trixie":"2.4.66-1~deb13u1"},"fixed_version":"2.0.55-4.1","urgency":"medium"}}},"CVE-2006-3918":{"description":"http_protocol.c in (1) IBM HTTP Server 6.0 before 6.0.2.13 and 6.1 before 6.1.0.1, and (2) Apache HTTP Server 1.3 before 1.3.35, 2.0 before 2.0.58, and 2.2 before 2.2.2, does not sanitize the Expect header from an HTTP request when it is reflected back in an error message, which might allow cross-site scripting (XSS) style attacks using web client components that can send arbitrary headers in requests, as demonstrated using a Flash SWF file.","debianbug":381376,"scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"2.4.66-1~deb12u1","bookworm-security":"2.4.62-1~deb12u2"},"fixed_version":"2.0.55-4.1","urgency":"low"},"bullseye":{"status":"resolved","repositories":{"bullseye":"2.4.62-1~deb11u1","bullseye-security":"2.4.66-1~deb11u1"},"fixed_version":"2.0.55-4.1","urgency":"low"},"forky":{"status":"resolved","repositories":{"forky":"2.4.66-8"},"fixed_version":"2.0.55-4.1","urgency":"low"},"sid":{"status":"resolved","repositories":{"sid":"2.4.66-8"},"fixed_version":"2.0.55-4.1","urgency":"low"},"trixie":{"status":"resolved","repositories":{"trixie":"2.4.66-1~deb13u1"},"fixed_version":"2.0.55-4.1","urgency":"low"}}},"CVE-2006-4110":{"description":"Apache 2.2.2, when running on Windows, allows remote attackers to read source code of CGI programs via a request that contains uppercase (or alternate case) characters that bypass the case-sensitive ScriptAlias directive, but allow access to the file on case-insensitive file systems.","scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"2.4.66-1~deb12u1","bookworm-security":"2.4.62-1~deb12u2"},"fixed_version":"0","urgency":"unimportant"},"bullseye":{"status":"resolved","repositories":{"bullseye":"2.4.62-1~deb11u1","bullseye-security":"2.4.66-1~deb11u1"},"fixed_version":"0","urgency":"unimportant"},"forky":{"status":"resolved","repositories":{"forky":"2.4.66-8"},"fixed_version":"0","urgency":"unimportant"},"sid":{"status":"resolved","repositories":{"sid":"2.4.66-8"},"fixed_version":"0","urgency":"unimportant"},"trixie":{"status":"resolved","repositories":{"trixie":"2.4.66-1~deb13u1"},"fixed_version":"0","urgency":"unimportant"}}},"CVE-2006-5752":{"description":"Cross-site scripting (XSS) vulnerability in mod_status.c in the mod_status module in Apache HTTP Server (httpd), when ExtendedStatus is enabled and a public server-status page is used, allows remote attackers to inject arbitrary web script or HTML via unspecified vectors involving charsets with browsers that perform \"charset detection\" when the content-type is not specified.","scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"2.4.66-1~deb12u1","bookworm-security":"2.4.62-1~deb12u2"},"fixed_version":"2.2.4-2","urgency":"low"},"bullseye":{"status":"resolved","repositories":{"bullseye":"2.4.62-1~deb11u1","bullseye-security":"2.4.66-1~deb11u1"},"fixed_version":"2.2.4-2","urgency":"low"},"forky":{"status":"resolved","repositories":{"forky":"2.4.66-8"},"fixed_version":"2.2.4-2","urgency":"low"},"sid":{"status":"resolved","repositories":{"sid":"2.4.66-8"},"fixed_version":"2.2.4-2","urgency":"low"},"trixie":{"status":"resolved","repositories":{"trixie":"2.4.66-1~deb13u1"},"fixed_version":"2.2.4-2","urgency":"low"}}},"CVE-2007-0086":{"description":"The Apache HTTP Server, when accessed through a TCP connection with a large window size, allows remote attackers to cause a denial of service (network bandwidth consumption) via a Range header that specifies multiple copies of the same fragment.  NOTE: the severity of this issue has been disputed by third parties, who state that the large window size required by the attack is not normally supported or configured by the server, or that a DDoS-style attack would accomplish the same goal","scope":"local","releases":{"bookworm":{"status":"open","repositories":{"bookworm":"2.4.66-1~deb12u1","bookworm-security":"2.4.62-1~deb12u2"},"urgency":"unimportant"},"bullseye":{"status":"open","repositories":{"bullseye":"2.4.62-1~deb11u1","bullseye-security":"2.4.66-1~deb11u1"},"urgency":"unimportant"},"forky":{"status":"open","repositories":{"forky":"2.4.66-8"},"urgency":"unimportant"},"sid":{"status":"open","repositories":{"sid":"2.4.66-8"},"urgency":"unimportant"},"trixie":{"status":"open","repositories":{"trixie":"2.4.66-1~deb13u1"},"urgency":"unimportant"}}},"CVE-2007-1741":{"description":"Multiple race conditions in suexec in Apache HTTP Server (httpd) 2.2.3 between directory and file validation, and their usage, allow local users to gain privileges and execute arbitrary code by renaming directories or performing symlink attacks. NOTE: the researcher, who is reliable, claims that the vendor disputes the issue because \"the attacks described rely on an insecure server configuration\" in which the user \"has write access to the document root.\"","scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"2.4.66-1~deb12u1","bookworm-security":"2.4.62-1~deb12u2"},"fixed_version":"2.2.8-5","urgency":"unimportant"},"bullseye":{"status":"resolved","repositories":{"bullseye":"2.4.62-1~deb11u1","bullseye-security":"2.4.66-1~deb11u1"},"fixed_version":"2.2.8-5","urgency":"unimportant"},"forky":{"status":"resolved","repositories":{"forky":"2.4.66-8"},"fixed_version":"2.2.8-5","urgency":"unimportant"},"sid":{"status":"resolved","repositories":{"sid":"2.4.66-8"},"fixed_version":"2.2.8-5","urgency":"unimportant"},"trixie":{"status":"resolved","repositories":{"trixie":"2.4.66-1~deb13u1"},"fixed_version":"2.2.8-5","urgency":"unimportant"}}},"CVE-2007-1742":{"description":"suexec in Apache HTTP Server (httpd) 2.2.3 uses a partial comparison for verifying whether the current directory is within the document root, which might allow local users to perform unauthorized operations on incorrect directories, as demonstrated using \"html_backup\" and \"htmleditor\" under an \"html\" directory.  NOTE: the researcher, who is reliable, claims that the vendor disputes the issue because \"the attacks described rely on an insecure server configuration\" in which the user \"has write access to the document root.\"","scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"2.4.66-1~deb12u1","bookworm-security":"2.4.62-1~deb12u2"},"fixed_version":"2.2.8-5","urgency":"unimportant"},"bullseye":{"status":"resolved","repositories":{"bullseye":"2.4.62-1~deb11u1","bullseye-security":"2.4.66-1~deb11u1"},"fixed_version":"2.2.8-5","urgency":"unimportant"},"forky":{"status":"resolved","repositories":{"forky":"2.4.66-8"},"fixed_version":"2.2.8-5","urgency":"unimportant"},"sid":{"status":"resolved","repositories":{"sid":"2.4.66-8"},"fixed_version":"2.2.8-5","urgency":"unimportant"},"trixie":{"status":"resolved","repositories":{"trixie":"2.4.66-1~deb13u1"},"fixed_version":"2.2.8-5","urgency":"unimportant"}}},"CVE-2007-1743":{"description":"suexec in Apache HTTP Server (httpd) 2.2.3 does not verify combinations of user and group IDs on the command line, which might allow local users to leverage other vulnerabilities to create arbitrary UID/GID owned files if /proc is mounted.  NOTE: the researcher, who is reliable, claims that the vendor disputes the issue because \"the attacks described rely on an insecure server configuration\" in which the user \"has write access to the document root.\"  In addition, because this is dependent on other vulnerabilities, perhaps this is resultant and should not be included in CVE.","scope":"local","releases":{"bookworm":{"status":"open","repositories":{"bookworm":"2.4.66-1~deb12u1","bookworm-security":"2.4.62-1~deb12u2"},"urgency":"unimportant"},"bullseye":{"status":"open","repositories":{"bullseye":"2.4.62-1~deb11u1","bullseye-security":"2.4.66-1~deb11u1"},"urgency":"unimportant"},"forky":{"status":"open","repositories":{"forky":"2.4.66-8"},"urgency":"unimportant"},"sid":{"status":"open","repositories":{"sid":"2.4.66-8"},"urgency":"unimportant"},"trixie":{"status":"open","repositories":{"trixie":"2.4.66-1~deb13u1"},"urgency":"unimportant"}}},"CVE-2007-1862":{"description":"The recall_headers function in mod_mem_cache in Apache 2.2.4 does not properly copy all levels of header data, which can cause Apache to return HTTP headers containing previously used data, which could be used by remote attackers to obtain potentially sensitive information.","scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"2.4.66-1~deb12u1","bookworm-security":"2.4.62-1~deb12u2"},"fixed_version":"0","urgency":"unimportant"},"bullseye":{"status":"resolved","repositories":{"bullseye":"2.4.62-1~deb11u1","bullseye-security":"2.4.66-1~deb11u1"},"fixed_version":"0","urgency":"unimportant"},"forky":{"status":"resolved","repositories":{"forky":"2.4.66-8"},"fixed_version":"0","urgency":"unimportant"},"sid":{"status":"resolved","repositories":{"sid":"2.4.66-8"},"fixed_version":"0","urgency":"unimportant"},"trixie":{"status":"resolved","repositories":{"trixie":"2.4.66-1~deb13u1"},"fixed_version":"0","urgency":"unimportant"}}},"CVE-2007-1863":{"description":"cache_util.c in the mod_cache module in Apache HTTP Server (httpd), when caching is enabled and a threaded Multi-Processing Module (MPM) is used, allows remote attackers to cause a denial of service (child processing handler crash) via a request with the (1) s-maxage, (2) max-age, (3) min-fresh, or (4) max-stale Cache-Control headers without a value.","scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"2.4.66-1~deb12u1","bookworm-security":"2.4.62-1~deb12u2"},"fixed_version":"2.2.4-1","urgency":"low"},"bullseye":{"status":"resolved","repositories":{"bullseye":"2.4.62-1~deb11u1","bullseye-security":"2.4.66-1~deb11u1"},"fixed_version":"2.2.4-1","urgency":"low"},"forky":{"status":"resolved","repositories":{"forky":"2.4.66-8"},"fixed_version":"2.2.4-1","urgency":"low"},"sid":{"status":"resolved","repositories":{"sid":"2.4.66-8"},"fixed_version":"2.2.4-1","urgency":"low"},"trixie":{"status":"resolved","repositories":{"trixie":"2.4.66-1~deb13u1"},"fixed_version":"2.2.4-1","urgency":"low"}}},"CVE-2007-3303":{"description":"Apache httpd 2.0.59 and 2.2.4, with the Prefork MPM module, allows local users to cause a denial of service via certain code sequences executed in a worker process that (1) stop request processing by killing all worker processes and preventing creation of replacements or (2) hang the system by forcing the master process to fork an arbitrarily large number of worker processes.  NOTE: This might be an inherent design limitation of Apache with respect to worker processes in hosted environments.","scope":"local","releases":{"bookworm":{"status":"open","repositories":{"bookworm":"2.4.66-1~deb12u1","bookworm-security":"2.4.62-1~deb12u2"},"urgency":"unimportant"},"bullseye":{"status":"open","repositories":{"bullseye":"2.4.62-1~deb11u1","bullseye-security":"2.4.66-1~deb11u1"},"urgency":"unimportant"},"forky":{"status":"open","repositories":{"forky":"2.4.66-8"},"urgency":"unimportant"},"sid":{"status":"open","repositories":{"sid":"2.4.66-8"},"urgency":"unimportant"},"trixie":{"status":"open","repositories":{"trixie":"2.4.66-1~deb13u1"},"urgency":"unimportant"}}},"CVE-2007-3304":{"description":"Apache httpd 1.3.37, 2.0.59, and 2.2.4 with the Prefork MPM module, allows local users to cause a denial of service by modifying the worker_score and process_score arrays to reference an arbitrary process ID, which is sent a SIGUSR1 signal from the master process, aka \"SIGUSR1 killer.\"","scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"2.4.66-1~deb12u1","bookworm-security":"2.4.62-1~deb12u2"},"fixed_version":"2.2.4-2","urgency":"low"},"bullseye":{"status":"resolved","repositories":{"bullseye":"2.4.62-1~deb11u1","bullseye-security":"2.4.66-1~deb11u1"},"fixed_version":"2.2.4-2","urgency":"low"},"forky":{"status":"resolved","repositories":{"forky":"2.4.66-8"},"fixed_version":"2.2.4-2","urgency":"low"},"sid":{"status":"resolved","repositories":{"sid":"2.4.66-8"},"fixed_version":"2.2.4-2","urgency":"low"},"trixie":{"status":"resolved","repositories":{"trixie":"2.4.66-1~deb13u1"},"fixed_version":"2.2.4-2","urgency":"low"}}},"CVE-2007-3847":{"description":"The date handling code in modules/proxy/proxy_util.c (mod_proxy) in Apache 2.3.0, when using a threaded MPM, allows remote origin servers to cause a denial of service (caching forward proxy process crash) via crafted date headers that trigger a buffer over-read.","debianbug":441845,"scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"2.4.66-1~deb12u1","bookworm-security":"2.4.62-1~deb12u2"},"fixed_version":"2.2.6-1","urgency":"low"},"bullseye":{"status":"resolved","repositories":{"bullseye":"2.4.62-1~deb11u1","bullseye-security":"2.4.66-1~deb11u1"},"fixed_version":"2.2.6-1","urgency":"low"},"forky":{"status":"resolved","repositories":{"forky":"2.4.66-8"},"fixed_version":"2.2.6-1","urgency":"low"},"sid":{"status":"resolved","repositories":{"sid":"2.4.66-8"},"fixed_version":"2.2.6-1","urgency":"low"},"trixie":{"status":"resolved","repositories":{"trixie":"2.4.66-1~deb13u1"},"fixed_version":"2.2.6-1","urgency":"low"}}},"CVE-2007-4465":{"description":"Cross-site scripting (XSS) vulnerability in mod_autoindex.c in the Apache HTTP Server before 2.2.6, when the charset on a server-generated page is not defined, allows remote attackers to inject arbitrary web script or HTML via the P parameter using the UTF-7 charset.  NOTE: it could be argued that this issue is due to a design limitation of browsers that attempt to perform automatic content type detection.","debianbug":453783,"scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"2.4.66-1~deb12u1","bookworm-security":"2.4.62-1~deb12u2"},"fixed_version":"2.2.6-1","urgency":"not yet assigned"},"bullseye":{"status":"resolved","repositories":{"bullseye":"2.4.62-1~deb11u1","bullseye-security":"2.4.66-1~deb11u1"},"fixed_version":"2.2.6-1","urgency":"not yet assigned"},"forky":{"status":"resolved","repositories":{"forky":"2.4.66-8"},"fixed_version":"2.2.6-1","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"2.4.66-8"},"fixed_version":"2.2.6-1","urgency":"not yet assigned"},"trixie":{"status":"resolved","repositories":{"trixie":"2.4.66-1~deb13u1"},"fixed_version":"2.2.6-1","urgency":"not yet assigned"}}},"CVE-2007-5000":{"description":"Cross-site scripting (XSS) vulnerability in the (1) mod_imap module in the Apache HTTP Server 1.3.0 through 1.3.39 and 2.0.35 through 2.0.61 and the (2) mod_imagemap module in the Apache HTTP Server 2.2.0 through 2.2.6 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors.","scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"2.4.66-1~deb12u1","bookworm-security":"2.4.62-1~deb12u2"},"fixed_version":"2.2.8-1","urgency":"low"},"bullseye":{"status":"resolved","repositories":{"bullseye":"2.4.62-1~deb11u1","bullseye-security":"2.4.66-1~deb11u1"},"fixed_version":"2.2.8-1","urgency":"low"},"forky":{"status":"resolved","repositories":{"forky":"2.4.66-8"},"fixed_version":"2.2.8-1","urgency":"low"},"sid":{"status":"resolved","repositories":{"sid":"2.4.66-8"},"fixed_version":"2.2.8-1","urgency":"low"},"trixie":{"status":"resolved","repositories":{"trixie":"2.4.66-1~deb13u1"},"fixed_version":"2.2.8-1","urgency":"low"}}},"CVE-2007-6203":{"description":"Apache HTTP Server 2.0.x and 2.2.x does not sanitize the HTTP Method specifier header from an HTTP request when it is reflected back in a \"413 Request Entity Too Large\" error message, which might allow cross-site scripting (XSS) style attacks using web client components that can send arbitrary headers in requests, as demonstrated via an HTTP request containing an invalid Content-length value, a similar issue to CVE-2006-3918.","scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"2.4.66-1~deb12u1","bookworm-security":"2.4.62-1~deb12u2"},"fixed_version":"2.2.6-3","urgency":"low"},"bullseye":{"status":"resolved","repositories":{"bullseye":"2.4.62-1~deb11u1","bullseye-security":"2.4.66-1~deb11u1"},"fixed_version":"2.2.6-3","urgency":"low"},"forky":{"status":"resolved","repositories":{"forky":"2.4.66-8"},"fixed_version":"2.2.6-3","urgency":"low"},"sid":{"status":"resolved","repositories":{"sid":"2.4.66-8"},"fixed_version":"2.2.6-3","urgency":"low"},"trixie":{"status":"resolved","repositories":{"trixie":"2.4.66-1~deb13u1"},"fixed_version":"2.2.6-3","urgency":"low"}}},"CVE-2007-6388":{"description":"Cross-site scripting (XSS) vulnerability in mod_status in the Apache HTTP Server 2.2.0 through 2.2.6, 2.0.35 through 2.0.61, and 1.3.2 through 1.3.39, when the server-status page is enabled, allows remote attackers to inject arbitrary web script or HTML via unspecified vectors.","scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"2.4.66-1~deb12u1","bookworm-security":"2.4.62-1~deb12u2"},"fixed_version":"2.2.8-1","urgency":"low"},"bullseye":{"status":"resolved","repositories":{"bullseye":"2.4.62-1~deb11u1","bullseye-security":"2.4.66-1~deb11u1"},"fixed_version":"2.2.8-1","urgency":"low"},"forky":{"status":"resolved","repositories":{"forky":"2.4.66-8"},"fixed_version":"2.2.8-1","urgency":"low"},"sid":{"status":"resolved","repositories":{"sid":"2.4.66-8"},"fixed_version":"2.2.8-1","urgency":"low"},"trixie":{"status":"resolved","repositories":{"trixie":"2.4.66-1~deb13u1"},"fixed_version":"2.2.8-1","urgency":"low"}}},"CVE-2007-6420":{"description":"Cross-site request forgery (CSRF) vulnerability in the balancer-manager in mod_proxy_balancer for Apache HTTP Server 2.2.x allows remote attackers to gain privileges via unspecified vectors.","scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"2.4.66-1~deb12u1","bookworm-security":"2.4.62-1~deb12u2"},"fixed_version":"2.2.9-1","urgency":"low"},"bullseye":{"status":"resolved","repositories":{"bullseye":"2.4.62-1~deb11u1","bullseye-security":"2.4.66-1~deb11u1"},"fixed_version":"2.2.9-1","urgency":"low"},"forky":{"status":"resolved","repositories":{"forky":"2.4.66-8"},"fixed_version":"2.2.9-1","urgency":"low"},"sid":{"status":"resolved","repositories":{"sid":"2.4.66-8"},"fixed_version":"2.2.9-1","urgency":"low"},"trixie":{"status":"resolved","repositories":{"trixie":"2.4.66-1~deb13u1"},"fixed_version":"2.2.9-1","urgency":"low"}}},"CVE-2007-6421":{"description":"Cross-site scripting (XSS) vulnerability in balancer-manager in mod_proxy_balancer in the Apache HTTP Server 2.2.0 through 2.2.6 allows remote attackers to inject arbitrary web script or HTML via the (1) ss, (2) wr, or (3) rr parameters, or (4) the URL.","scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"2.4.66-1~deb12u1","bookworm-security":"2.4.62-1~deb12u2"},"fixed_version":"2.2.8-1","urgency":"low"},"bullseye":{"status":"resolved","repositories":{"bullseye":"2.4.62-1~deb11u1","bullseye-security":"2.4.66-1~deb11u1"},"fixed_version":"2.2.8-1","urgency":"low"},"forky":{"status":"resolved","repositories":{"forky":"2.4.66-8"},"fixed_version":"2.2.8-1","urgency":"low"},"sid":{"status":"resolved","repositories":{"sid":"2.4.66-8"},"fixed_version":"2.2.8-1","urgency":"low"},"trixie":{"status":"resolved","repositories":{"trixie":"2.4.66-1~deb13u1"},"fixed_version":"2.2.8-1","urgency":"low"}}},"CVE-2007-6422":{"description":"The balancer_handler function in mod_proxy_balancer in the Apache HTTP Server 2.2.0 through 2.2.6, when a threaded Multi-Processing Module is used, allows remote authenticated users to cause a denial of service (child process crash) via an invalid bb variable.","scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"2.4.66-1~deb12u1","bookworm-security":"2.4.62-1~deb12u2"},"fixed_version":"2.2.8-1","urgency":"low"},"bullseye":{"status":"resolved","repositories":{"bullseye":"2.4.62-1~deb11u1","bullseye-security":"2.4.66-1~deb11u1"},"fixed_version":"2.2.8-1","urgency":"low"},"forky":{"status":"resolved","repositories":{"forky":"2.4.66-8"},"fixed_version":"2.2.8-1","urgency":"low"},"sid":{"status":"resolved","repositories":{"sid":"2.4.66-8"},"fixed_version":"2.2.8-1","urgency":"low"},"trixie":{"status":"resolved","repositories":{"trixie":"2.4.66-1~deb13u1"},"fixed_version":"2.2.8-1","urgency":"low"}}},"CVE-2007-6423":{"description":"Unspecified vulnerability in mod_proxy_balancer for Apache HTTP Server 2.2.x before 2.2.7-dev, when running on Windows, allows remote attackers to trigger memory corruption via a long URL.  NOTE: the vendor could not reproduce this issue","scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"2.4.66-1~deb12u1","bookworm-security":"2.4.62-1~deb12u2"},"fixed_version":"0","urgency":"unimportant"},"bullseye":{"status":"resolved","repositories":{"bullseye":"2.4.62-1~deb11u1","bullseye-security":"2.4.66-1~deb11u1"},"fixed_version":"0","urgency":"unimportant"},"forky":{"status":"resolved","repositories":{"forky":"2.4.66-8"},"fixed_version":"0","urgency":"unimportant"},"sid":{"status":"resolved","repositories":{"sid":"2.4.66-8"},"fixed_version":"0","urgency":"unimportant"},"trixie":{"status":"resolved","repositories":{"trixie":"2.4.66-1~deb13u1"},"fixed_version":"0","urgency":"unimportant"}}},"CVE-2007-6750":{"description":"The Apache HTTP Server 1.x and 2.x allows remote attackers to cause a denial of service (daemon outage) via partial HTTP requests, as demonstrated by Slowloris, related to the lack of the mod_reqtimeout module in versions before 2.2.15.","debianbug":533661,"scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"2.4.66-1~deb12u1","bookworm-security":"2.4.62-1~deb12u2"},"fixed_version":"2.2.15-3","urgency":"medium"},"bullseye":{"status":"resolved","repositories":{"bullseye":"2.4.62-1~deb11u1","bullseye-security":"2.4.66-1~deb11u1"},"fixed_version":"2.2.15-3","urgency":"medium"},"forky":{"status":"resolved","repositories":{"forky":"2.4.66-8"},"fixed_version":"2.2.15-3","urgency":"medium"},"sid":{"status":"resolved","repositories":{"sid":"2.4.66-8"},"fixed_version":"2.2.15-3","urgency":"medium"},"trixie":{"status":"resolved","repositories":{"trixie":"2.4.66-1~deb13u1"},"fixed_version":"2.2.15-3","urgency":"medium"}}},"CVE-2008-0005":{"description":"mod_proxy_ftp in Apache 2.2.x before 2.2.7-dev, 2.0.x before 2.0.62-dev, and 1.3.x before 1.3.40-dev does not define a charset, which allows remote attackers to conduct cross-site scripting (XSS) attacks using UTF-7 encoding.","scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"2.4.66-1~deb12u1","bookworm-security":"2.4.62-1~deb12u2"},"fixed_version":"2.2.8-1","urgency":"low"},"bullseye":{"status":"resolved","repositories":{"bullseye":"2.4.62-1~deb11u1","bullseye-security":"2.4.66-1~deb11u1"},"fixed_version":"2.2.8-1","urgency":"low"},"forky":{"status":"resolved","repositories":{"forky":"2.4.66-8"},"fixed_version":"2.2.8-1","urgency":"low"},"sid":{"status":"resolved","repositories":{"sid":"2.4.66-8"},"fixed_version":"2.2.8-1","urgency":"low"},"trixie":{"status":"resolved","repositories":{"trixie":"2.4.66-1~deb13u1"},"fixed_version":"2.2.8-1","urgency":"low"}}},"CVE-2008-0455":{"description":"Cross-site scripting (XSS) vulnerability in the mod_negotiation module in the Apache HTTP Server 2.2.6 and earlier in the 2.2.x series, 2.0.61 and earlier in the 2.0.x series, and 1.3.39 and earlier in the 1.3.x series allows remote authenticated users to inject arbitrary web script or HTML by uploading a file with a name containing XSS sequences and a file extension, which leads to injection within a (1) \"406 Not Acceptable\" or (2) \"300 Multiple Choices\" HTTP response when the extension is omitted in a request for the file.","scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"2.4.66-1~deb12u1","bookworm-security":"2.4.62-1~deb12u2"},"fixed_version":"2.2.22-8","urgency":"unimportant"},"bullseye":{"status":"resolved","repositories":{"bullseye":"2.4.62-1~deb11u1","bullseye-security":"2.4.66-1~deb11u1"},"fixed_version":"2.2.22-8","urgency":"unimportant"},"forky":{"status":"resolved","repositories":{"forky":"2.4.66-8"},"fixed_version":"2.2.22-8","urgency":"unimportant"},"sid":{"status":"resolved","repositories":{"sid":"2.4.66-8"},"fixed_version":"2.2.22-8","urgency":"unimportant"},"trixie":{"status":"resolved","repositories":{"trixie":"2.4.66-1~deb13u1"},"fixed_version":"2.2.22-8","urgency":"unimportant"}}},"CVE-2008-0456":{"description":"CRLF injection vulnerability in the mod_negotiation module in the Apache HTTP Server 2.2.6 and earlier in the 2.2.x series, 2.0.61 and earlier in the 2.0.x series, and 1.3.39 and earlier in the 1.3.x series allows remote authenticated users to inject arbitrary HTTP headers and conduct HTTP response splitting attacks by uploading a file with a multi-line name containing HTTP header sequences and a file extension, which leads to injection within a (1) \"406 Not Acceptable\" or (2) \"300 Multiple Choices\" HTTP response when the extension is omitted in a request for the file.","scope":"local","releases":{"bookworm":{"status":"open","repositories":{"bookworm":"2.4.66-1~deb12u1","bookworm-security":"2.4.62-1~deb12u2"},"urgency":"unimportant"},"bullseye":{"status":"open","repositories":{"bullseye":"2.4.62-1~deb11u1","bullseye-security":"2.4.66-1~deb11u1"},"urgency":"unimportant"},"forky":{"status":"open","repositories":{"forky":"2.4.66-8"},"urgency":"unimportant"},"sid":{"status":"open","repositories":{"sid":"2.4.66-8"},"urgency":"unimportant"},"trixie":{"status":"open","repositories":{"trixie":"2.4.66-1~deb13u1"},"urgency":"unimportant"}}},"CVE-2008-1678":{"description":"Memory leak in the zlib_stateful_init function in crypto/comp/c_zlib.c in libssl in OpenSSL 0.9.8f through 0.9.8h allows remote attackers to cause a denial of service (memory consumption) via multiple calls, as demonstrated by initial SSL client handshakes to the Apache HTTP Server mod_ssl that specify a compression algorithm.","scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"2.4.66-1~deb12u1","bookworm-security":"2.4.62-1~deb12u2"},"fixed_version":"2.2.8-4","urgency":"not yet assigned"},"bullseye":{"status":"resolved","repositories":{"bullseye":"2.4.62-1~deb11u1","bullseye-security":"2.4.66-1~deb11u1"},"fixed_version":"2.2.8-4","urgency":"not yet assigned"},"forky":{"status":"resolved","repositories":{"forky":"2.4.66-8"},"fixed_version":"2.2.8-4","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"2.4.66-8"},"fixed_version":"2.2.8-4","urgency":"not yet assigned"},"trixie":{"status":"resolved","repositories":{"trixie":"2.4.66-1~deb13u1"},"fixed_version":"2.2.8-4","urgency":"not yet assigned"}}},"CVE-2008-2168":{"description":"Cross-site scripting (XSS) vulnerability in Apache 2.2.6 and earlier allows remote attackers to inject arbitrary web script or HTML via UTF-7 encoded URLs that are not properly handled when displaying the 403 Forbidden error page.","scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"2.4.66-1~deb12u1","bookworm-security":"2.4.62-1~deb12u2"},"fixed_version":"2.2.8-1","urgency":"low"},"bullseye":{"status":"resolved","repositories":{"bullseye":"2.4.62-1~deb11u1","bullseye-security":"2.4.66-1~deb11u1"},"fixed_version":"2.2.8-1","urgency":"low"},"forky":{"status":"resolved","repositories":{"forky":"2.4.66-8"},"fixed_version":"2.2.8-1","urgency":"low"},"sid":{"status":"resolved","repositories":{"sid":"2.4.66-8"},"fixed_version":"2.2.8-1","urgency":"low"},"trixie":{"status":"resolved","repositories":{"trixie":"2.4.66-1~deb13u1"},"fixed_version":"2.2.8-1","urgency":"low"}}},"CVE-2008-2364":{"description":"The ap_proxy_http_process_response function in mod_proxy_http.c in the mod_proxy module in the Apache HTTP Server 2.0.63 and 2.2.8 does not limit the number of forwarded interim responses, which allows remote HTTP servers to cause a denial of service (memory consumption) via a large number of interim responses.","scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"2.4.66-1~deb12u1","bookworm-security":"2.4.62-1~deb12u2"},"fixed_version":"2.2.9-1","urgency":"low"},"bullseye":{"status":"resolved","repositories":{"bullseye":"2.4.62-1~deb11u1","bullseye-security":"2.4.66-1~deb11u1"},"fixed_version":"2.2.9-1","urgency":"low"},"forky":{"status":"resolved","repositories":{"forky":"2.4.66-8"},"fixed_version":"2.2.9-1","urgency":"low"},"sid":{"status":"resolved","repositories":{"sid":"2.4.66-8"},"fixed_version":"2.2.9-1","urgency":"low"},"trixie":{"status":"resolved","repositories":{"trixie":"2.4.66-1~deb13u1"},"fixed_version":"2.2.9-1","urgency":"low"}}},"CVE-2008-2939":{"description":"Cross-site scripting (XSS) vulnerability in proxy_ftp.c in the mod_proxy_ftp module in Apache 2.0.63 and earlier, and mod_proxy_ftp.c in the mod_proxy_ftp module in Apache 2.2.9 and earlier 2.2 versions, allows remote attackers to inject arbitrary web script or HTML via a wildcard in the last directory component in the pathname in an FTP URI.","scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"2.4.66-1~deb12u1","bookworm-security":"2.4.62-1~deb12u2"},"fixed_version":"2.2.9-7","urgency":"low"},"bullseye":{"status":"resolved","repositories":{"bullseye":"2.4.62-1~deb11u1","bullseye-security":"2.4.66-1~deb11u1"},"fixed_version":"2.2.9-7","urgency":"low"},"forky":{"status":"resolved","repositories":{"forky":"2.4.66-8"},"fixed_version":"2.2.9-7","urgency":"low"},"sid":{"status":"resolved","repositories":{"sid":"2.4.66-8"},"fixed_version":"2.2.9-7","urgency":"low"},"trixie":{"status":"resolved","repositories":{"trixie":"2.4.66-1~deb13u1"},"fixed_version":"2.2.9-7","urgency":"low"}}},"CVE-2009-1191":{"description":"mod_proxy_ajp.c in the mod_proxy_ajp module in the Apache HTTP Server 2.2.11 allows remote attackers to obtain sensitive response data, intended for a client that sent an earlier POST request with no request body, via an HTTP request.","scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"2.4.66-1~deb12u1","bookworm-security":"2.4.62-1~deb12u2"},"fixed_version":"2.2.11-4","urgency":"low"},"bullseye":{"status":"resolved","repositories":{"bullseye":"2.4.62-1~deb11u1","bullseye-security":"2.4.66-1~deb11u1"},"fixed_version":"2.2.11-4","urgency":"low"},"forky":{"status":"resolved","repositories":{"forky":"2.4.66-8"},"fixed_version":"2.2.11-4","urgency":"low"},"sid":{"status":"resolved","repositories":{"sid":"2.4.66-8"},"fixed_version":"2.2.11-4","urgency":"low"},"trixie":{"status":"resolved","repositories":{"trixie":"2.4.66-1~deb13u1"},"fixed_version":"2.2.11-4","urgency":"low"}}},"CVE-2009-1195":{"description":"The Apache HTTP Server 2.2.11 and earlier 2.2 versions does not properly handle Options=IncludesNOEXEC in the AllowOverride directive, which allows local users to gain privileges by configuring (1) Options Includes, (2) Options +Includes, or (3) Options +IncludesNOEXEC in a .htaccess file, and then inserting an exec element in a .shtml file.","debianbug":530834,"scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"2.4.66-1~deb12u1","bookworm-security":"2.4.62-1~deb12u2"},"fixed_version":"2.2.11-6","urgency":"low"},"bullseye":{"status":"resolved","repositories":{"bullseye":"2.4.62-1~deb11u1","bullseye-security":"2.4.66-1~deb11u1"},"fixed_version":"2.2.11-6","urgency":"low"},"forky":{"status":"resolved","repositories":{"forky":"2.4.66-8"},"fixed_version":"2.2.11-6","urgency":"low"},"sid":{"status":"resolved","repositories":{"sid":"2.4.66-8"},"fixed_version":"2.2.11-6","urgency":"low"},"trixie":{"status":"resolved","repositories":{"trixie":"2.4.66-1~deb13u1"},"fixed_version":"2.2.11-6","urgency":"low"}}},"CVE-2009-1890":{"description":"The stream_reqbody_cl function in mod_proxy_http.c in the mod_proxy module in the Apache HTTP Server before 2.3.3, when a reverse proxy is configured, does not properly handle an amount of streamed data that exceeds the Content-Length value, which allows remote attackers to cause a denial of service (CPU consumption) via crafted requests.","debianbug":536718,"scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"2.4.66-1~deb12u1","bookworm-security":"2.4.62-1~deb12u2"},"fixed_version":"2.2.11-7","urgency":"medium"},"bullseye":{"status":"resolved","repositories":{"bullseye":"2.4.62-1~deb11u1","bullseye-security":"2.4.66-1~deb11u1"},"fixed_version":"2.2.11-7","urgency":"medium"},"forky":{"status":"resolved","repositories":{"forky":"2.4.66-8"},"fixed_version":"2.2.11-7","urgency":"medium"},"sid":{"status":"resolved","repositories":{"sid":"2.4.66-8"},"fixed_version":"2.2.11-7","urgency":"medium"},"trixie":{"status":"resolved","repositories":{"trixie":"2.4.66-1~deb13u1"},"fixed_version":"2.2.11-7","urgency":"medium"}}},"CVE-2009-1891":{"description":"The mod_deflate module in Apache httpd 2.2.11 and earlier compresses large files until completion even after the associated network connection is closed, which allows remote attackers to cause a denial of service (CPU consumption).","debianbug":534712,"scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"2.4.66-1~deb12u1","bookworm-security":"2.4.62-1~deb12u2"},"fixed_version":"2.2.11-7","urgency":"medium"},"bullseye":{"status":"resolved","repositories":{"bullseye":"2.4.62-1~deb11u1","bullseye-security":"2.4.66-1~deb11u1"},"fixed_version":"2.2.11-7","urgency":"medium"},"forky":{"status":"resolved","repositories":{"forky":"2.4.66-8"},"fixed_version":"2.2.11-7","urgency":"medium"},"sid":{"status":"resolved","repositories":{"sid":"2.4.66-8"},"fixed_version":"2.2.11-7","urgency":"medium"},"trixie":{"status":"resolved","repositories":{"trixie":"2.4.66-1~deb13u1"},"fixed_version":"2.2.11-7","urgency":"medium"}}},"CVE-2009-3094":{"description":"The ap_proxy_ftp_handler function in modules/proxy/proxy_ftp.c in the mod_proxy_ftp module in the Apache HTTP Server 2.0.63 and 2.2.13 allows remote FTP servers to cause a denial of service (NULL pointer dereference and child process crash) via a malformed reply to an EPSV command.","debianbug":545951,"scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"2.4.66-1~deb12u1","bookworm-security":"2.4.62-1~deb12u2"},"fixed_version":"2.2.13-2","urgency":"low"},"bullseye":{"status":"resolved","repositories":{"bullseye":"2.4.62-1~deb11u1","bullseye-security":"2.4.66-1~deb11u1"},"fixed_version":"2.2.13-2","urgency":"low"},"forky":{"status":"resolved","repositories":{"forky":"2.4.66-8"},"fixed_version":"2.2.13-2","urgency":"low"},"sid":{"status":"resolved","repositories":{"sid":"2.4.66-8"},"fixed_version":"2.2.13-2","urgency":"low"},"trixie":{"status":"resolved","repositories":{"trixie":"2.4.66-1~deb13u1"},"fixed_version":"2.2.13-2","urgency":"low"}}},"CVE-2009-3095":{"description":"The mod_proxy_ftp module in the Apache HTTP Server allows remote attackers to bypass intended access restrictions and send arbitrary commands to an FTP server via vectors related to the embedding of these commands in the Authorization HTTP header, as demonstrated by a certain module in VulnDisco Pack Professional 8.11.","debianbug":545951,"scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"2.4.66-1~deb12u1","bookworm-security":"2.4.62-1~deb12u2"},"fixed_version":"2.2.13-2","urgency":"low"},"bullseye":{"status":"resolved","repositories":{"bullseye":"2.4.62-1~deb11u1","bullseye-security":"2.4.66-1~deb11u1"},"fixed_version":"2.2.13-2","urgency":"low"},"forky":{"status":"resolved","repositories":{"forky":"2.4.66-8"},"fixed_version":"2.2.13-2","urgency":"low"},"sid":{"status":"resolved","repositories":{"sid":"2.4.66-8"},"fixed_version":"2.2.13-2","urgency":"low"},"trixie":{"status":"resolved","repositories":{"trixie":"2.4.66-1~deb13u1"},"fixed_version":"2.2.13-2","urgency":"low"}}},"CVE-2009-3555":{"description":"The TLS protocol, and the SSL protocol 3.0 and possibly earlier, as used in Microsoft Internet Information Services (IIS) 7.0, mod_ssl in the Apache HTTP Server 2.2.14 and earlier, OpenSSL before 0.9.8l, GnuTLS 2.8.5 and earlier, Mozilla Network Security Services (NSS) 3.12.4 and earlier, multiple Cisco products, and other products, does not properly associate renegotiation handshakes with an existing connection, which allows man-in-the-middle attackers to insert data into HTTPS sessions, and possibly other types of sessions protected by TLS or SSL, by sending an unauthenticated request that is processed retroactively by a server in a post-renegotiation context, related to a \"plaintext injection\" attack, aka the \"Project Mogul\" issue.","scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"2.4.66-1~deb12u1","bookworm-security":"2.4.62-1~deb12u2"},"fixed_version":"2.2.14-2","urgency":"not yet assigned"},"bullseye":{"status":"resolved","repositories":{"bullseye":"2.4.62-1~deb11u1","bullseye-security":"2.4.66-1~deb11u1"},"fixed_version":"2.2.14-2","urgency":"not yet assigned"},"forky":{"status":"resolved","repositories":{"forky":"2.4.66-8"},"fixed_version":"2.2.14-2","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"2.4.66-8"},"fixed_version":"2.2.14-2","urgency":"not yet assigned"},"trixie":{"status":"resolved","repositories":{"trixie":"2.4.66-1~deb13u1"},"fixed_version":"2.2.14-2","urgency":"not yet assigned"}}},"CVE-2010-0408":{"description":"The ap_proxy_ajp_request function in mod_proxy_ajp.c in mod_proxy_ajp in the Apache HTTP Server 2.2.x before 2.2.15 does not properly handle certain situations in which a client sends no request body, which allows remote attackers to cause a denial of service (backend server outage) via a crafted request, related to use of a 500 error code instead of the appropriate 400 error code.","scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"2.4.66-1~deb12u1","bookworm-security":"2.4.62-1~deb12u2"},"fixed_version":"2.2.15-1","urgency":"low"},"bullseye":{"status":"resolved","repositories":{"bullseye":"2.4.62-1~deb11u1","bullseye-security":"2.4.66-1~deb11u1"},"fixed_version":"2.2.15-1","urgency":"low"},"forky":{"status":"resolved","repositories":{"forky":"2.4.66-8"},"fixed_version":"2.2.15-1","urgency":"low"},"sid":{"status":"resolved","repositories":{"sid":"2.4.66-8"},"fixed_version":"2.2.15-1","urgency":"low"},"trixie":{"status":"resolved","repositories":{"trixie":"2.4.66-1~deb13u1"},"fixed_version":"2.2.15-1","urgency":"low"}}},"CVE-2010-0425":{"description":"modules/arch/win32/mod_isapi.c in mod_isapi in the Apache HTTP Server 2.0.37 through 2.0.63, 2.2.0 through 2.2.14, and 2.3.x before 2.3.7, when running on Windows, does not ensure that request processing is complete before calling isapi_unload for an ISAPI .dll module, which allows remote attackers to execute arbitrary code via unspecified vectors related to a crafted request, a reset packet, and \"orphaned callback pointers.\"","scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"2.4.66-1~deb12u1","bookworm-security":"2.4.62-1~deb12u2"},"fixed_version":"0","urgency":"unimportant"},"bullseye":{"status":"resolved","repositories":{"bullseye":"2.4.62-1~deb11u1","bullseye-security":"2.4.66-1~deb11u1"},"fixed_version":"0","urgency":"unimportant"},"forky":{"status":"resolved","repositories":{"forky":"2.4.66-8"},"fixed_version":"0","urgency":"unimportant"},"sid":{"status":"resolved","repositories":{"sid":"2.4.66-8"},"fixed_version":"0","urgency":"unimportant"},"trixie":{"status":"resolved","repositories":{"trixie":"2.4.66-1~deb13u1"},"fixed_version":"0","urgency":"unimportant"}}},"CVE-2010-0434":{"description":"The ap_read_request function in server/protocol.c in the Apache HTTP Server 2.2.x before 2.2.15, when a multithreaded MPM is used, does not properly handle headers in subrequests in certain circumstances involving a parent request that has a body, which might allow remote attackers to obtain sensitive information via a crafted request that triggers access to memory locations associated with an earlier request.","scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"2.4.66-1~deb12u1","bookworm-security":"2.4.62-1~deb12u2"},"fixed_version":"2.2.15-1","urgency":"not yet assigned"},"bullseye":{"status":"resolved","repositories":{"bullseye":"2.4.62-1~deb11u1","bullseye-security":"2.4.66-1~deb11u1"},"fixed_version":"2.2.15-1","urgency":"not yet assigned"},"forky":{"status":"resolved","repositories":{"forky":"2.4.66-8"},"fixed_version":"2.2.15-1","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"2.4.66-8"},"fixed_version":"2.2.15-1","urgency":"not yet assigned"},"trixie":{"status":"resolved","repositories":{"trixie":"2.4.66-1~deb13u1"},"fixed_version":"2.2.15-1","urgency":"not yet assigned"}}},"CVE-2010-1452":{"description":"The (1) mod_cache and (2) mod_dav modules in the Apache HTTP Server 2.2.x before 2.2.16 allow remote attackers to cause a denial of service (process crash) via a request that lacks a path.","scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"2.4.66-1~deb12u1","bookworm-security":"2.4.62-1~deb12u2"},"fixed_version":"2.2.16-1","urgency":"low"},"bullseye":{"status":"resolved","repositories":{"bullseye":"2.4.62-1~deb11u1","bullseye-security":"2.4.66-1~deb11u1"},"fixed_version":"2.2.16-1","urgency":"low"},"forky":{"status":"resolved","repositories":{"forky":"2.4.66-8"},"fixed_version":"2.2.16-1","urgency":"low"},"sid":{"status":"resolved","repositories":{"sid":"2.4.66-8"},"fixed_version":"2.2.16-1","urgency":"low"},"trixie":{"status":"resolved","repositories":{"trixie":"2.4.66-1~deb13u1"},"fixed_version":"2.2.16-1","urgency":"low"}}},"CVE-2010-1623":{"description":"Memory leak in the apr_brigade_split_line function in buckets/apr_brigade.c in the Apache Portable Runtime Utility library (aka APR-util) before 1.3.10, as used in the mod_reqtimeout module in the Apache HTTP Server and other software, allows remote attackers to cause a denial of service (memory consumption) via unspecified vectors related to the destruction of an APR bucket.","scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"2.4.66-1~deb12u1","bookworm-security":"2.4.62-1~deb12u2"},"fixed_version":"2.2.16-3","urgency":"not yet assigned"},"bullseye":{"status":"resolved","repositories":{"bullseye":"2.4.62-1~deb11u1","bullseye-security":"2.4.66-1~deb11u1"},"fixed_version":"2.2.16-3","urgency":"not yet assigned"},"forky":{"status":"resolved","repositories":{"forky":"2.4.66-8"},"fixed_version":"2.2.16-3","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"2.4.66-8"},"fixed_version":"2.2.16-3","urgency":"not yet assigned"},"trixie":{"status":"resolved","repositories":{"trixie":"2.4.66-1~deb13u1"},"fixed_version":"2.2.16-3","urgency":"not yet assigned"}}},"CVE-2010-2068":{"description":"mod_proxy_http.c in mod_proxy_http in the Apache HTTP Server 2.2.9 through 2.2.15, 2.3.4-alpha, and 2.3.5-alpha on Windows, NetWare, and OS/2, in certain configurations involving proxy worker pools, does not properly detect timeouts, which allows remote attackers to obtain a potentially sensitive response intended for a different client in opportunistic circumstances via a normal HTTP request.","scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"2.4.66-1~deb12u1","bookworm-security":"2.4.62-1~deb12u2"},"fixed_version":"0","urgency":"unimportant"},"bullseye":{"status":"resolved","repositories":{"bullseye":"2.4.62-1~deb11u1","bullseye-security":"2.4.66-1~deb11u1"},"fixed_version":"0","urgency":"unimportant"},"forky":{"status":"resolved","repositories":{"forky":"2.4.66-8"},"fixed_version":"0","urgency":"unimportant"},"sid":{"status":"resolved","repositories":{"sid":"2.4.66-8"},"fixed_version":"0","urgency":"unimportant"},"trixie":{"status":"resolved","repositories":{"trixie":"2.4.66-1~deb13u1"},"fixed_version":"0","urgency":"unimportant"}}},"CVE-2010-2791":{"description":"mod_proxy in httpd in Apache HTTP Server 2.2.9, when running on Unix, does not close the backend connection if a timeout occurs when reading a response from a persistent connection, which allows remote attackers to obtain a potentially sensitive response intended for a different client in opportunistic circumstances via a normal HTTP request.  NOTE: this is the same issue as CVE-2010-2068, but for a different OS and set of affected versions.","scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"2.4.66-1~deb12u1","bookworm-security":"2.4.62-1~deb12u2"},"fixed_version":"2.2.9-10","urgency":"low"},"bullseye":{"status":"resolved","repositories":{"bullseye":"2.4.62-1~deb11u1","bullseye-security":"2.4.66-1~deb11u1"},"fixed_version":"2.2.9-10","urgency":"low"},"forky":{"status":"resolved","repositories":{"forky":"2.4.66-8"},"fixed_version":"2.2.9-10","urgency":"low"},"sid":{"status":"resolved","repositories":{"sid":"2.4.66-8"},"fixed_version":"2.2.9-10","urgency":"low"},"trixie":{"status":"resolved","repositories":{"trixie":"2.4.66-1~deb13u1"},"fixed_version":"2.2.9-10","urgency":"low"}}},"CVE-2011-1176":{"description":"The configuration merger in itk.c in the Steinar H. Gunderson mpm-itk Multi-Processing Module 2.2.11-01 and 2.2.11-02 for the Apache HTTP Server does not properly handle certain configuration sections that specify NiceValue but not AssignUserID, which might allow remote attackers to gain privileges by leveraging the root uid and root gid of an mpm-itk process.","debianbug":618857,"scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"2.4.66-1~deb12u1","bookworm-security":"2.4.62-1~deb12u2"},"fixed_version":"2.2.17-2","urgency":"medium"},"bullseye":{"status":"resolved","repositories":{"bullseye":"2.4.62-1~deb11u1","bullseye-security":"2.4.66-1~deb11u1"},"fixed_version":"2.2.17-2","urgency":"medium"},"forky":{"status":"resolved","repositories":{"forky":"2.4.66-8"},"fixed_version":"2.2.17-2","urgency":"medium"},"sid":{"status":"resolved","repositories":{"sid":"2.4.66-8"},"fixed_version":"2.2.17-2","urgency":"medium"},"trixie":{"status":"resolved","repositories":{"trixie":"2.4.66-1~deb13u1"},"fixed_version":"2.2.17-2","urgency":"medium"}}},"CVE-2011-3192":{"description":"The byterange filter in the Apache HTTP Server 1.3.x, 2.0.x through 2.0.64, and 2.2.x through 2.2.19 allows remote attackers to cause a denial of service (memory and CPU consumption) via a Range header that expresses multiple overlapping ranges, as exploited in the wild in August 2011, a different vulnerability than CVE-2007-0086.","scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"2.4.66-1~deb12u1","bookworm-security":"2.4.62-1~deb12u2"},"fixed_version":"2.2.19-2","urgency":"not yet assigned"},"bullseye":{"status":"resolved","repositories":{"bullseye":"2.4.62-1~deb11u1","bullseye-security":"2.4.66-1~deb11u1"},"fixed_version":"2.2.19-2","urgency":"not yet assigned"},"forky":{"status":"resolved","repositories":{"forky":"2.4.66-8"},"fixed_version":"2.2.19-2","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"2.4.66-8"},"fixed_version":"2.2.19-2","urgency":"not yet assigned"},"trixie":{"status":"resolved","repositories":{"trixie":"2.4.66-1~deb13u1"},"fixed_version":"2.2.19-2","urgency":"not yet assigned"}}},"CVE-2011-3348":{"description":"The mod_proxy_ajp module in the Apache HTTP Server before 2.2.21, when used with mod_proxy_balancer in certain configurations, allows remote attackers to cause a denial of service (temporary \"error state\" in the backend server) via a malformed HTTP request.","scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"2.4.66-1~deb12u1","bookworm-security":"2.4.62-1~deb12u2"},"fixed_version":"2.2.21-1","urgency":"not yet assigned"},"bullseye":{"status":"resolved","repositories":{"bullseye":"2.4.62-1~deb11u1","bullseye-security":"2.4.66-1~deb11u1"},"fixed_version":"2.2.21-1","urgency":"not yet assigned"},"forky":{"status":"resolved","repositories":{"forky":"2.4.66-8"},"fixed_version":"2.2.21-1","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"2.4.66-8"},"fixed_version":"2.2.21-1","urgency":"not yet assigned"},"trixie":{"status":"resolved","repositories":{"trixie":"2.4.66-1~deb13u1"},"fixed_version":"2.2.21-1","urgency":"not yet assigned"}}},"CVE-2011-3368":{"description":"The mod_proxy module in the Apache HTTP Server 1.3.x through 1.3.42, 2.0.x through 2.0.64, and 2.2.x through 2.2.21 does not properly interact with use of (1) RewriteRule and (2) ProxyPassMatch pattern matches for configuration of a reverse proxy, which allows remote attackers to send requests to intranet servers via a malformed URI containing an initial @ (at sign) character.","scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"2.4.66-1~deb12u1","bookworm-security":"2.4.62-1~deb12u2"},"fixed_version":"2.2.21-2","urgency":"medium"},"bullseye":{"status":"resolved","repositories":{"bullseye":"2.4.62-1~deb11u1","bullseye-security":"2.4.66-1~deb11u1"},"fixed_version":"2.2.21-2","urgency":"medium"},"forky":{"status":"resolved","repositories":{"forky":"2.4.66-8"},"fixed_version":"2.2.21-2","urgency":"medium"},"sid":{"status":"resolved","repositories":{"sid":"2.4.66-8"},"fixed_version":"2.2.21-2","urgency":"medium"},"trixie":{"status":"resolved","repositories":{"trixie":"2.4.66-1~deb13u1"},"fixed_version":"2.2.21-2","urgency":"medium"}}},"CVE-2011-3607":{"description":"Integer overflow in the ap_pregsub function in server/util.c in the Apache HTTP Server 2.0.x through 2.0.64 and 2.2.x through 2.2.21, when the mod_setenvif module is enabled, allows local users to gain privileges via a .htaccess file with a crafted SetEnvIf directive, in conjunction with a crafted HTTP request header, leading to a heap-based buffer overflow.","scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"2.4.66-1~deb12u1","bookworm-security":"2.4.62-1~deb12u2"},"fixed_version":"2.2.21-4","urgency":"not yet assigned"},"bullseye":{"status":"resolved","repositories":{"bullseye":"2.4.62-1~deb11u1","bullseye-security":"2.4.66-1~deb11u1"},"fixed_version":"2.2.21-4","urgency":"not yet assigned"},"forky":{"status":"resolved","repositories":{"forky":"2.4.66-8"},"fixed_version":"2.2.21-4","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"2.4.66-8"},"fixed_version":"2.2.21-4","urgency":"not yet assigned"},"trixie":{"status":"resolved","repositories":{"trixie":"2.4.66-1~deb13u1"},"fixed_version":"2.2.21-4","urgency":"not yet assigned"}}},"CVE-2011-3639":{"description":"The mod_proxy module in the Apache HTTP Server 2.0.x through 2.0.64 and 2.2.x before 2.2.18, when the Revision 1179239 patch is in place, does not properly interact with use of (1) RewriteRule and (2) ProxyPassMatch pattern matches for configuration of a reverse proxy, which allows remote attackers to send requests to intranet servers by using the HTTP/0.9 protocol with a malformed URI containing an initial @ (at sign) character.  NOTE: this vulnerability exists because of an incomplete fix for CVE-2011-3368.","scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"2.4.66-1~deb12u1","bookworm-security":"2.4.62-1~deb12u2"},"fixed_version":"2.2.18-1","urgency":"not yet assigned"},"bullseye":{"status":"resolved","repositories":{"bullseye":"2.4.62-1~deb11u1","bullseye-security":"2.4.66-1~deb11u1"},"fixed_version":"2.2.18-1","urgency":"not yet assigned"},"forky":{"status":"resolved","repositories":{"forky":"2.4.66-8"},"fixed_version":"2.2.18-1","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"2.4.66-8"},"fixed_version":"2.2.18-1","urgency":"not yet assigned"},"trixie":{"status":"resolved","repositories":{"trixie":"2.4.66-1~deb13u1"},"fixed_version":"2.2.18-1","urgency":"not yet assigned"}}},"CVE-2011-4317":{"description":"The mod_proxy module in the Apache HTTP Server 1.3.x through 1.3.42, 2.0.x through 2.0.64, and 2.2.x through 2.2.21, when the Revision 1179239 patch is in place, does not properly interact with use of (1) RewriteRule and (2) ProxyPassMatch pattern matches for configuration of a reverse proxy, which allows remote attackers to send requests to intranet servers via a malformed URI containing an @ (at sign) character and a : (colon) character in invalid positions.  NOTE: this vulnerability exists because of an incomplete fix for CVE-2011-3368.","scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"2.4.66-1~deb12u1","bookworm-security":"2.4.62-1~deb12u2"},"fixed_version":"2.2.21-3","urgency":"not yet assigned"},"bullseye":{"status":"resolved","repositories":{"bullseye":"2.4.62-1~deb11u1","bullseye-security":"2.4.66-1~deb11u1"},"fixed_version":"2.2.21-3","urgency":"not yet assigned"},"forky":{"status":"resolved","repositories":{"forky":"2.4.66-8"},"fixed_version":"2.2.21-3","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"2.4.66-8"},"fixed_version":"2.2.21-3","urgency":"not yet assigned"},"trixie":{"status":"resolved","repositories":{"trixie":"2.4.66-1~deb13u1"},"fixed_version":"2.2.21-3","urgency":"not yet assigned"}}},"CVE-2011-4415":{"description":"The ap_pregsub function in server/util.c in the Apache HTTP Server 2.0.x through 2.0.64 and 2.2.x through 2.2.21, when the mod_setenvif module is enabled, does not restrict the size of values of environment variables, which allows local users to cause a denial of service (memory consumption or NULL pointer dereference) via a .htaccess file with a crafted SetEnvIf directive, in conjunction with a crafted HTTP request header, related to (1) the \"len +=\" statement and (2) the apr_pcalloc function call, a different vulnerability than CVE-2011-3607.","scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"2.4.66-1~deb12u1","bookworm-security":"2.4.62-1~deb12u2"},"fixed_version":"2.4.1-1","urgency":"unimportant"},"bullseye":{"status":"resolved","repositories":{"bullseye":"2.4.62-1~deb11u1","bullseye-security":"2.4.66-1~deb11u1"},"fixed_version":"2.4.1-1","urgency":"unimportant"},"forky":{"status":"resolved","repositories":{"forky":"2.4.66-8"},"fixed_version":"2.4.1-1","urgency":"unimportant"},"sid":{"status":"resolved","repositories":{"sid":"2.4.66-8"},"fixed_version":"2.4.1-1","urgency":"unimportant"},"trixie":{"status":"resolved","repositories":{"trixie":"2.4.66-1~deb13u1"},"fixed_version":"2.4.1-1","urgency":"unimportant"}}},"CVE-2012-0021":{"description":"The log_cookie function in mod_log_config.c in the mod_log_config module in the Apache HTTP Server 2.2.17 through 2.2.21, when a threaded MPM is used, does not properly handle a %{}C format string, which allows remote attackers to cause a denial of service (daemon crash) via a cookie that lacks both a name and a value.","scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"2.4.66-1~deb12u1","bookworm-security":"2.4.62-1~deb12u2"},"fixed_version":"2.2.22-1","urgency":"not yet assigned"},"bullseye":{"status":"resolved","repositories":{"bullseye":"2.4.62-1~deb11u1","bullseye-security":"2.4.66-1~deb11u1"},"fixed_version":"2.2.22-1","urgency":"not yet assigned"},"forky":{"status":"resolved","repositories":{"forky":"2.4.66-8"},"fixed_version":"2.2.22-1","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"2.4.66-8"},"fixed_version":"2.2.22-1","urgency":"not yet assigned"},"trixie":{"status":"resolved","repositories":{"trixie":"2.4.66-1~deb13u1"},"fixed_version":"2.2.22-1","urgency":"not yet assigned"}}},"CVE-2012-0031":{"description":"scoreboard.c in the Apache HTTP Server 2.2.21 and earlier might allow local users to cause a denial of service (daemon crash during shutdown) or possibly have unspecified other impact by modifying a certain type field within a scoreboard shared memory segment, leading to an invalid call to the free function.","scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"2.4.66-1~deb12u1","bookworm-security":"2.4.62-1~deb12u2"},"fixed_version":"2.2.22-1","urgency":"low"},"bullseye":{"status":"resolved","repositories":{"bullseye":"2.4.62-1~deb11u1","bullseye-security":"2.4.66-1~deb11u1"},"fixed_version":"2.2.22-1","urgency":"low"},"forky":{"status":"resolved","repositories":{"forky":"2.4.66-8"},"fixed_version":"2.2.22-1","urgency":"low"},"sid":{"status":"resolved","repositories":{"sid":"2.4.66-8"},"fixed_version":"2.2.22-1","urgency":"low"},"trixie":{"status":"resolved","repositories":{"trixie":"2.4.66-1~deb13u1"},"fixed_version":"2.2.22-1","urgency":"low"}}},"CVE-2012-0053":{"description":"protocol.c in the Apache HTTP Server 2.2.x through 2.2.21 does not properly restrict header information during construction of Bad Request (aka 400) error documents, which allows remote attackers to obtain the values of HTTPOnly cookies via vectors involving a (1) long or (2) malformed header in conjunction with crafted web script.","scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"2.4.66-1~deb12u1","bookworm-security":"2.4.62-1~deb12u2"},"fixed_version":"2.2.22-1","urgency":"low"},"bullseye":{"status":"resolved","repositories":{"bullseye":"2.4.62-1~deb11u1","bullseye-security":"2.4.66-1~deb11u1"},"fixed_version":"2.2.22-1","urgency":"low"},"forky":{"status":"resolved","repositories":{"forky":"2.4.66-8"},"fixed_version":"2.2.22-1","urgency":"low"},"sid":{"status":"resolved","repositories":{"sid":"2.4.66-8"},"fixed_version":"2.2.22-1","urgency":"low"},"trixie":{"status":"resolved","repositories":{"trixie":"2.4.66-1~deb13u1"},"fixed_version":"2.2.22-1","urgency":"low"}}},"CVE-2012-0216":{"description":"The default configuration of the apache2 package in Debian GNU/Linux squeeze before 2.2.16-6+squeeze7, wheezy before 2.2.22-4, and sid before 2.2.22-4, when mod_php or mod_rivet is used, provides example scripts under the doc/ URI, which might allow local users to conduct cross-site scripting (XSS) attacks, gain privileges, or obtain sensitive information via vectors involving localhost HTTP requests to the Apache HTTP Server.","scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"2.4.66-1~deb12u1","bookworm-security":"2.4.62-1~deb12u2"},"fixed_version":"2.2.22-4","urgency":"low"},"bullseye":{"status":"resolved","repositories":{"bullseye":"2.4.62-1~deb11u1","bullseye-security":"2.4.66-1~deb11u1"},"fixed_version":"2.2.22-4","urgency":"low"},"forky":{"status":"resolved","repositories":{"forky":"2.4.66-8"},"fixed_version":"2.2.22-4","urgency":"low"},"sid":{"status":"resolved","repositories":{"sid":"2.4.66-8"},"fixed_version":"2.2.22-4","urgency":"low"},"trixie":{"status":"resolved","repositories":{"trixie":"2.4.66-1~deb13u1"},"fixed_version":"2.2.22-4","urgency":"low"}}},"CVE-2012-0883":{"description":"envvars (aka envvars-std) in the Apache HTTP Server before 2.4.2 places a zero-length directory name in the LD_LIBRARY_PATH, which allows local users to gain privileges via a Trojan horse DSO in the current working directory during execution of apachectl.","scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"2.4.66-1~deb12u1","bookworm-security":"2.4.62-1~deb12u2"},"fixed_version":"0","urgency":"unimportant"},"bullseye":{"status":"resolved","repositories":{"bullseye":"2.4.62-1~deb11u1","bullseye-security":"2.4.66-1~deb11u1"},"fixed_version":"0","urgency":"unimportant"},"forky":{"status":"resolved","repositories":{"forky":"2.4.66-8"},"fixed_version":"0","urgency":"unimportant"},"sid":{"status":"resolved","repositories":{"sid":"2.4.66-8"},"fixed_version":"0","urgency":"unimportant"},"trixie":{"status":"resolved","repositories":{"trixie":"2.4.66-1~deb13u1"},"fixed_version":"0","urgency":"unimportant"}}},"CVE-2012-2687":{"description":"Multiple cross-site scripting (XSS) vulnerabilities in the make_variant_list function in mod_negotiation.c in the mod_negotiation module in the Apache HTTP Server 2.4.x before 2.4.3, when the MultiViews option is enabled, allow remote attackers to inject arbitrary web script or HTML via a crafted filename that is not properly handled during construction of a variant list.","scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"2.4.66-1~deb12u1","bookworm-security":"2.4.62-1~deb12u2"},"fixed_version":"2.2.22-8","urgency":"low"},"bullseye":{"status":"resolved","repositories":{"bullseye":"2.4.62-1~deb11u1","bullseye-security":"2.4.66-1~deb11u1"},"fixed_version":"2.2.22-8","urgency":"low"},"forky":{"status":"resolved","repositories":{"forky":"2.4.66-8"},"fixed_version":"2.2.22-8","urgency":"low"},"sid":{"status":"resolved","repositories":{"sid":"2.4.66-8"},"fixed_version":"2.2.22-8","urgency":"low"},"trixie":{"status":"resolved","repositories":{"trixie":"2.4.66-1~deb13u1"},"fixed_version":"2.2.22-8","urgency":"low"}}},"CVE-2012-3499":{"description":"Multiple cross-site scripting (XSS) vulnerabilities in the Apache HTTP Server 2.2.x before 2.2.24-dev and 2.4.x before 2.4.4 allow remote attackers to inject arbitrary web script or HTML via vectors involving hostnames and URIs in the (1) mod_imagemap, (2) mod_info, (3) mod_ldap, (4) mod_proxy_ftp, and (5) mod_status modules.","scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"2.4.66-1~deb12u1","bookworm-security":"2.4.62-1~deb12u2"},"fixed_version":"2.2.22-13","urgency":"low"},"bullseye":{"status":"resolved","repositories":{"bullseye":"2.4.62-1~deb11u1","bullseye-security":"2.4.66-1~deb11u1"},"fixed_version":"2.2.22-13","urgency":"low"},"forky":{"status":"resolved","repositories":{"forky":"2.4.66-8"},"fixed_version":"2.2.22-13","urgency":"low"},"sid":{"status":"resolved","repositories":{"sid":"2.4.66-8"},"fixed_version":"2.2.22-13","urgency":"low"},"trixie":{"status":"resolved","repositories":{"trixie":"2.4.66-1~deb13u1"},"fixed_version":"2.2.22-13","urgency":"low"}}},"CVE-2012-3502":{"description":"The proxy functionality in (1) mod_proxy_ajp.c in the mod_proxy_ajp module and (2) mod_proxy_http.c in the mod_proxy_http module in the Apache HTTP Server 2.4.x before 2.4.3 does not properly determine the situations that require closing a back-end connection, which allows remote attackers to obtain sensitive information in opportunistic circumstances by reading a response that was intended for a different client.","scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"2.4.66-1~deb12u1","bookworm-security":"2.4.62-1~deb12u2"},"fixed_version":"0","urgency":"unimportant"},"bullseye":{"status":"resolved","repositories":{"bullseye":"2.4.62-1~deb11u1","bullseye-security":"2.4.66-1~deb11u1"},"fixed_version":"0","urgency":"unimportant"},"forky":{"status":"resolved","repositories":{"forky":"2.4.66-8"},"fixed_version":"0","urgency":"unimportant"},"sid":{"status":"resolved","repositories":{"sid":"2.4.66-8"},"fixed_version":"0","urgency":"unimportant"},"trixie":{"status":"resolved","repositories":{"trixie":"2.4.66-1~deb13u1"},"fixed_version":"0","urgency":"unimportant"}}},"CVE-2012-4557":{"description":"The mod_proxy_ajp module in the Apache HTTP Server 2.2.12 through 2.2.21 places a worker node into an error state upon detection of a long request-processing time, which allows remote attackers to cause a denial of service (worker consumption) via an expensive request.","scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"2.4.66-1~deb12u1","bookworm-security":"2.4.62-1~deb12u2"},"fixed_version":"2.2.22-1","urgency":"not yet assigned"},"bullseye":{"status":"resolved","repositories":{"bullseye":"2.4.62-1~deb11u1","bullseye-security":"2.4.66-1~deb11u1"},"fixed_version":"2.2.22-1","urgency":"not yet assigned"},"forky":{"status":"resolved","repositories":{"forky":"2.4.66-8"},"fixed_version":"2.2.22-1","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"2.4.66-8"},"fixed_version":"2.2.22-1","urgency":"not yet assigned"},"trixie":{"status":"resolved","repositories":{"trixie":"2.4.66-1~deb13u1"},"fixed_version":"2.2.22-1","urgency":"not yet assigned"}}},"CVE-2012-4558":{"description":"Multiple cross-site scripting (XSS) vulnerabilities in the balancer_handler function in the manager interface in mod_proxy_balancer.c in the mod_proxy_balancer module in the Apache HTTP Server 2.2.x before 2.2.24-dev and 2.4.x before 2.4.4 allow remote attackers to inject arbitrary web script or HTML via a crafted string.","scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"2.4.66-1~deb12u1","bookworm-security":"2.4.62-1~deb12u2"},"fixed_version":"2.2.22-13","urgency":"low"},"bullseye":{"status":"resolved","repositories":{"bullseye":"2.4.62-1~deb11u1","bullseye-security":"2.4.66-1~deb11u1"},"fixed_version":"2.2.22-13","urgency":"low"},"forky":{"status":"resolved","repositories":{"forky":"2.4.66-8"},"fixed_version":"2.2.22-13","urgency":"low"},"sid":{"status":"resolved","repositories":{"sid":"2.4.66-8"},"fixed_version":"2.2.22-13","urgency":"low"},"trixie":{"status":"resolved","repositories":{"trixie":"2.4.66-1~deb13u1"},"fixed_version":"2.2.22-13","urgency":"low"}}},"CVE-2012-4929":{"description":"The TLS protocol 1.2 and earlier, as used in Mozilla Firefox, Google Chrome, Qt, and other products, can encrypt compressed data without properly obfuscating the length of the unencrypted data, which allows man-in-the-middle attackers to obtain plaintext HTTP headers by observing length differences during a series of guesses in which a string in an HTTP request potentially matches an unknown string in an HTTP header, aka a \"CRIME\" attack.","debianbug":689936,"scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"2.4.66-1~deb12u1","bookworm-security":"2.4.62-1~deb12u2"},"fixed_version":"2.2.22-12","urgency":"not yet assigned"},"bullseye":{"status":"resolved","repositories":{"bullseye":"2.4.62-1~deb11u1","bullseye-security":"2.4.66-1~deb11u1"},"fixed_version":"2.2.22-12","urgency":"not yet assigned"},"forky":{"status":"resolved","repositories":{"forky":"2.4.66-8"},"fixed_version":"2.2.22-12","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"2.4.66-8"},"fixed_version":"2.2.22-12","urgency":"not yet assigned"},"trixie":{"status":"resolved","repositories":{"trixie":"2.4.66-1~deb13u1"},"fixed_version":"2.2.22-12","urgency":"not yet assigned"}}},"CVE-2013-1048":{"description":"The Debian apache2ctl script in the apache2 package squeeze before 2.2.16-6+squeeze11, wheezy before 2.2.22-13, and sid before 2.2.22-13 for the Apache HTTP Server on Debian GNU/Linux does not properly create the /var/lock/apache2 lock directory, which allows local users to gain privileges via an unspecified symlink attack.","scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"2.4.66-1~deb12u1","bookworm-security":"2.4.62-1~deb12u2"},"fixed_version":"2.2.22-13","urgency":"not yet assigned"},"bullseye":{"status":"resolved","repositories":{"bullseye":"2.4.62-1~deb11u1","bullseye-security":"2.4.66-1~deb11u1"},"fixed_version":"2.2.22-13","urgency":"not yet assigned"},"forky":{"status":"resolved","repositories":{"forky":"2.4.66-8"},"fixed_version":"2.2.22-13","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"2.4.66-8"},"fixed_version":"2.2.22-13","urgency":"not yet assigned"},"trixie":{"status":"resolved","repositories":{"trixie":"2.4.66-1~deb13u1"},"fixed_version":"2.2.22-13","urgency":"not yet assigned"}}},"CVE-2013-1862":{"description":"mod_rewrite.c in the mod_rewrite module in the Apache HTTP Server 2.2.x before 2.2.25 writes data to a log file without sanitizing non-printable characters, which might allow remote attackers to execute arbitrary commands via an HTTP request containing an escape sequence for a terminal emulator.","scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"2.4.66-1~deb12u1","bookworm-security":"2.4.62-1~deb12u2"},"fixed_version":"2.4.1-1","urgency":"unimportant"},"bullseye":{"status":"resolved","repositories":{"bullseye":"2.4.62-1~deb11u1","bullseye-security":"2.4.66-1~deb11u1"},"fixed_version":"2.4.1-1","urgency":"unimportant"},"forky":{"status":"resolved","repositories":{"forky":"2.4.66-8"},"fixed_version":"2.4.1-1","urgency":"unimportant"},"sid":{"status":"resolved","repositories":{"sid":"2.4.66-8"},"fixed_version":"2.4.1-1","urgency":"unimportant"},"trixie":{"status":"resolved","repositories":{"trixie":"2.4.66-1~deb13u1"},"fixed_version":"2.4.1-1","urgency":"unimportant"}}},"CVE-2013-1896":{"description":"mod_dav.c in the Apache HTTP Server before 2.2.25 does not properly determine whether DAV is enabled for a URI, which allows remote attackers to cause a denial of service (segmentation fault) via a MERGE request in which the URI is configured for handling by the mod_dav_svn module, but a certain href attribute in XML data refers to a non-DAV URI.","debianbug":717272,"scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"2.4.66-1~deb12u1","bookworm-security":"2.4.62-1~deb12u2"},"fixed_version":"2.4.6-1","urgency":"low"},"bullseye":{"status":"resolved","repositories":{"bullseye":"2.4.62-1~deb11u1","bullseye-security":"2.4.66-1~deb11u1"},"fixed_version":"2.4.6-1","urgency":"low"},"forky":{"status":"resolved","repositories":{"forky":"2.4.66-8"},"fixed_version":"2.4.6-1","urgency":"low"},"sid":{"status":"resolved","repositories":{"sid":"2.4.66-8"},"fixed_version":"2.4.6-1","urgency":"low"},"trixie":{"status":"resolved","repositories":{"trixie":"2.4.66-1~deb13u1"},"fixed_version":"2.4.6-1","urgency":"low"}}},"CVE-2013-2249":{"description":"mod_session_dbd.c in the mod_session_dbd module in the Apache HTTP Server before 2.4.5 proceeds with save operations for a session without considering the dirty flag and the requirement for a new session ID, which has unspecified impact and remote attack vectors.","scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"2.4.66-1~deb12u1","bookworm-security":"2.4.62-1~deb12u2"},"fixed_version":"2.4.6-1","urgency":"not yet assigned"},"bullseye":{"status":"resolved","repositories":{"bullseye":"2.4.62-1~deb11u1","bullseye-security":"2.4.66-1~deb11u1"},"fixed_version":"2.4.6-1","urgency":"not yet assigned"},"forky":{"status":"resolved","repositories":{"forky":"2.4.66-8"},"fixed_version":"2.4.6-1","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"2.4.66-8"},"fixed_version":"2.4.6-1","urgency":"not yet assigned"},"trixie":{"status":"resolved","repositories":{"trixie":"2.4.66-1~deb13u1"},"fixed_version":"2.4.6-1","urgency":"not yet assigned"}}},"CVE-2013-4352":{"description":"The cache_invalidate function in modules/cache/cache_storage.c in the mod_cache module in the Apache HTTP Server 2.4.6, when a caching forward proxy is enabled, allows remote HTTP servers to cause a denial of service (NULL pointer dereference and daemon crash) via vectors that trigger a missing hostname value.","scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"2.4.66-1~deb12u1","bookworm-security":"2.4.62-1~deb12u2"},"fixed_version":"2.4.7-1","urgency":"low"},"bullseye":{"status":"resolved","repositories":{"bullseye":"2.4.62-1~deb11u1","bullseye-security":"2.4.66-1~deb11u1"},"fixed_version":"2.4.7-1","urgency":"low"},"forky":{"status":"resolved","repositories":{"forky":"2.4.66-8"},"fixed_version":"2.4.7-1","urgency":"low"},"sid":{"status":"resolved","repositories":{"sid":"2.4.66-8"},"fixed_version":"2.4.7-1","urgency":"low"},"trixie":{"status":"resolved","repositories":{"trixie":"2.4.66-1~deb13u1"},"fixed_version":"2.4.7-1","urgency":"low"}}},"CVE-2013-5704":{"description":"The mod_headers module in the Apache HTTP Server 2.2.22 allows remote attackers to bypass \"RequestHeader unset\" directives by placing a header in the trailer portion of data sent with chunked transfer coding.  NOTE: the vendor states \"this is not a security issue in httpd as such.\"","scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"2.4.66-1~deb12u1","bookworm-security":"2.4.62-1~deb12u2"},"fixed_version":"2.4.10-2","urgency":"medium"},"bullseye":{"status":"resolved","repositories":{"bullseye":"2.4.62-1~deb11u1","bullseye-security":"2.4.66-1~deb11u1"},"fixed_version":"2.4.10-2","urgency":"medium"},"forky":{"status":"resolved","repositories":{"forky":"2.4.66-8"},"fixed_version":"2.4.10-2","urgency":"medium"},"sid":{"status":"resolved","repositories":{"sid":"2.4.66-8"},"fixed_version":"2.4.10-2","urgency":"medium"},"trixie":{"status":"resolved","repositories":{"trixie":"2.4.66-1~deb13u1"},"fixed_version":"2.4.10-2","urgency":"medium"}}},"CVE-2013-6438":{"description":"The dav_xml_get_cdata function in main/util.c in the mod_dav module in the Apache HTTP Server before 2.4.8 does not properly remove whitespace characters from CDATA sections, which allows remote attackers to cause a denial of service (daemon crash) via a crafted DAV WRITE request.","scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"2.4.66-1~deb12u1","bookworm-security":"2.4.62-1~deb12u2"},"fixed_version":"2.4.9-1","urgency":"not yet assigned"},"bullseye":{"status":"resolved","repositories":{"bullseye":"2.4.62-1~deb11u1","bullseye-security":"2.4.66-1~deb11u1"},"fixed_version":"2.4.9-1","urgency":"not yet assigned"},"forky":{"status":"resolved","repositories":{"forky":"2.4.66-8"},"fixed_version":"2.4.9-1","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"2.4.66-8"},"fixed_version":"2.4.9-1","urgency":"not yet assigned"},"trixie":{"status":"resolved","repositories":{"trixie":"2.4.66-1~deb13u1"},"fixed_version":"2.4.9-1","urgency":"not yet assigned"}}},"CVE-2014-0098":{"description":"The log_cookie function in mod_log_config.c in the mod_log_config module in the Apache HTTP Server before 2.4.8 allows remote attackers to cause a denial of service (segmentation fault and daemon crash) via a crafted cookie that is not properly handled during truncation.","scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"2.4.66-1~deb12u1","bookworm-security":"2.4.62-1~deb12u2"},"fixed_version":"2.4.9-1","urgency":"not yet assigned"},"bullseye":{"status":"resolved","repositories":{"bullseye":"2.4.62-1~deb11u1","bullseye-security":"2.4.66-1~deb11u1"},"fixed_version":"2.4.9-1","urgency":"not yet assigned"},"forky":{"status":"resolved","repositories":{"forky":"2.4.66-8"},"fixed_version":"2.4.9-1","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"2.4.66-8"},"fixed_version":"2.4.9-1","urgency":"not yet assigned"},"trixie":{"status":"resolved","repositories":{"trixie":"2.4.66-1~deb13u1"},"fixed_version":"2.4.9-1","urgency":"not yet assigned"}}},"CVE-2014-0117":{"description":"The mod_proxy module in the Apache HTTP Server 2.4.x before 2.4.10, when a reverse proxy is enabled, allows remote attackers to cause a denial of service (child-process crash) via a crafted HTTP Connection header.","scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"2.4.66-1~deb12u1","bookworm-security":"2.4.62-1~deb12u2"},"fixed_version":"2.4.10-1","urgency":"not yet assigned"},"bullseye":{"status":"resolved","repositories":{"bullseye":"2.4.62-1~deb11u1","bullseye-security":"2.4.66-1~deb11u1"},"fixed_version":"2.4.10-1","urgency":"not yet assigned"},"forky":{"status":"resolved","repositories":{"forky":"2.4.66-8"},"fixed_version":"2.4.10-1","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"2.4.66-8"},"fixed_version":"2.4.10-1","urgency":"not yet assigned"},"trixie":{"status":"resolved","repositories":{"trixie":"2.4.66-1~deb13u1"},"fixed_version":"2.4.10-1","urgency":"not yet assigned"}}},"CVE-2014-0118":{"description":"The deflate_in_filter function in mod_deflate.c in the mod_deflate module in the Apache HTTP Server before 2.4.10, when request body decompression is enabled, allows remote attackers to cause a denial of service (resource consumption) via crafted request data that decompresses to a much larger size.","scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"2.4.66-1~deb12u1","bookworm-security":"2.4.62-1~deb12u2"},"fixed_version":"2.4.10-1","urgency":"not yet assigned"},"bullseye":{"status":"resolved","repositories":{"bullseye":"2.4.62-1~deb11u1","bullseye-security":"2.4.66-1~deb11u1"},"fixed_version":"2.4.10-1","urgency":"not yet assigned"},"forky":{"status":"resolved","repositories":{"forky":"2.4.66-8"},"fixed_version":"2.4.10-1","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"2.4.66-8"},"fixed_version":"2.4.10-1","urgency":"not yet assigned"},"trixie":{"status":"resolved","repositories":{"trixie":"2.4.66-1~deb13u1"},"fixed_version":"2.4.10-1","urgency":"not yet assigned"}}},"CVE-2014-0226":{"description":"Race condition in the mod_status module in the Apache HTTP Server before 2.4.10 allows remote attackers to cause a denial of service (heap-based buffer overflow), or possibly obtain sensitive credential information or execute arbitrary code, via a crafted request that triggers improper scoreboard handling within the status_handler function in modules/generators/mod_status.c and the lua_ap_scoreboard_worker function in modules/lua/lua_request.c.","scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"2.4.66-1~deb12u1","bookworm-security":"2.4.62-1~deb12u2"},"fixed_version":"2.4.10-1","urgency":"not yet assigned"},"bullseye":{"status":"resolved","repositories":{"bullseye":"2.4.62-1~deb11u1","bullseye-security":"2.4.66-1~deb11u1"},"fixed_version":"2.4.10-1","urgency":"not yet assigned"},"forky":{"status":"resolved","repositories":{"forky":"2.4.66-8"},"fixed_version":"2.4.10-1","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"2.4.66-8"},"fixed_version":"2.4.10-1","urgency":"not yet assigned"},"trixie":{"status":"resolved","repositories":{"trixie":"2.4.66-1~deb13u1"},"fixed_version":"2.4.10-1","urgency":"not yet assigned"}}},"CVE-2014-0231":{"description":"The mod_cgid module in the Apache HTTP Server before 2.4.10 does not have a timeout mechanism, which allows remote attackers to cause a denial of service (process hang) via a request to a CGI script that does not read from its stdin file descriptor.","scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"2.4.66-1~deb12u1","bookworm-security":"2.4.62-1~deb12u2"},"fixed_version":"2.4.10-1","urgency":"not yet assigned"},"bullseye":{"status":"resolved","repositories":{"bullseye":"2.4.62-1~deb11u1","bullseye-security":"2.4.66-1~deb11u1"},"fixed_version":"2.4.10-1","urgency":"not yet assigned"},"forky":{"status":"resolved","repositories":{"forky":"2.4.66-8"},"fixed_version":"2.4.10-1","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"2.4.66-8"},"fixed_version":"2.4.10-1","urgency":"not yet assigned"},"trixie":{"status":"resolved","repositories":{"trixie":"2.4.66-1~deb13u1"},"fixed_version":"2.4.10-1","urgency":"not yet assigned"}}},"CVE-2014-3523":{"description":"Memory leak in the winnt_accept function in server/mpm/winnt/child.c in the WinNT MPM in the Apache HTTP Server 2.4.x before 2.4.10 on Windows, when the default AcceptFilter is enabled, allows remote attackers to cause a denial of service (memory consumption) via crafted requests.","scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"2.4.66-1~deb12u1","bookworm-security":"2.4.62-1~deb12u2"},"fixed_version":"0","urgency":"unimportant"},"bullseye":{"status":"resolved","repositories":{"bullseye":"2.4.62-1~deb11u1","bullseye-security":"2.4.66-1~deb11u1"},"fixed_version":"0","urgency":"unimportant"},"forky":{"status":"resolved","repositories":{"forky":"2.4.66-8"},"fixed_version":"0","urgency":"unimportant"},"sid":{"status":"resolved","repositories":{"sid":"2.4.66-8"},"fixed_version":"0","urgency":"unimportant"},"trixie":{"status":"resolved","repositories":{"trixie":"2.4.66-1~deb13u1"},"fixed_version":"0","urgency":"unimportant"}}},"CVE-2014-3581":{"description":"The cache_merge_headers_out function in modules/cache/cache_util.c in the mod_cache module in the Apache HTTP Server before 2.4.11 allows remote attackers to cause a denial of service (NULL pointer dereference and application crash) via an empty HTTP Content-Type header.","scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"2.4.66-1~deb12u1","bookworm-security":"2.4.62-1~deb12u2"},"fixed_version":"2.4.10-3","urgency":"not yet assigned"},"bullseye":{"status":"resolved","repositories":{"bullseye":"2.4.62-1~deb11u1","bullseye-security":"2.4.66-1~deb11u1"},"fixed_version":"2.4.10-3","urgency":"not yet assigned"},"forky":{"status":"resolved","repositories":{"forky":"2.4.66-8"},"fixed_version":"2.4.10-3","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"2.4.66-8"},"fixed_version":"2.4.10-3","urgency":"not yet assigned"},"trixie":{"status":"resolved","repositories":{"trixie":"2.4.66-1~deb13u1"},"fixed_version":"2.4.10-3","urgency":"not yet assigned"}}},"CVE-2014-3583":{"description":"The handle_headers function in mod_proxy_fcgi.c in the mod_proxy_fcgi module in the Apache HTTP Server 2.4.10 allows remote FastCGI servers to cause a denial of service (buffer over-read and daemon crash) via long response headers.","scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"2.4.66-1~deb12u1","bookworm-security":"2.4.62-1~deb12u2"},"fixed_version":"2.4.10-8","urgency":"low"},"bullseye":{"status":"resolved","repositories":{"bullseye":"2.4.62-1~deb11u1","bullseye-security":"2.4.66-1~deb11u1"},"fixed_version":"2.4.10-8","urgency":"low"},"forky":{"status":"resolved","repositories":{"forky":"2.4.66-8"},"fixed_version":"2.4.10-8","urgency":"low"},"sid":{"status":"resolved","repositories":{"sid":"2.4.66-8"},"fixed_version":"2.4.10-8","urgency":"low"},"trixie":{"status":"resolved","repositories":{"trixie":"2.4.66-1~deb13u1"},"fixed_version":"2.4.10-8","urgency":"low"}}},"CVE-2014-8109":{"description":"mod_lua.c in the mod_lua module in the Apache HTTP Server 2.3.x and 2.4.x through 2.4.10 does not support an httpd configuration in which the same Lua authorization provider is used with different arguments within different contexts, which allows remote attackers to bypass intended access restrictions in opportunistic circumstances by leveraging multiple Require directives, as demonstrated by a configuration that specifies authorization for one group to access a certain directory, and authorization for a second group to access a second directory.","scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"2.4.66-1~deb12u1","bookworm-security":"2.4.62-1~deb12u2"},"fixed_version":"2.4.10-9","urgency":"not yet assigned"},"bullseye":{"status":"resolved","repositories":{"bullseye":"2.4.62-1~deb11u1","bullseye-security":"2.4.66-1~deb11u1"},"fixed_version":"2.4.10-9","urgency":"not yet assigned"},"forky":{"status":"resolved","repositories":{"forky":"2.4.66-8"},"fixed_version":"2.4.10-9","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"2.4.66-8"},"fixed_version":"2.4.10-9","urgency":"not yet assigned"},"trixie":{"status":"resolved","repositories":{"trixie":"2.4.66-1~deb13u1"},"fixed_version":"2.4.10-9","urgency":"not yet assigned"}}},"CVE-2015-0228":{"description":"The lua_websocket_read function in lua_request.c in the mod_lua module in the Apache HTTP Server through 2.4.12 allows remote attackers to cause a denial of service (child-process crash) by sending a crafted WebSocket Ping frame after a Lua script has called the wsupgrade function.","scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"2.4.66-1~deb12u1","bookworm-security":"2.4.62-1~deb12u2"},"fixed_version":"2.4.10-10","urgency":"low"},"bullseye":{"status":"resolved","repositories":{"bullseye":"2.4.62-1~deb11u1","bullseye-security":"2.4.66-1~deb11u1"},"fixed_version":"2.4.10-10","urgency":"low"},"forky":{"status":"resolved","repositories":{"forky":"2.4.66-8"},"fixed_version":"2.4.10-10","urgency":"low"},"sid":{"status":"resolved","repositories":{"sid":"2.4.66-8"},"fixed_version":"2.4.10-10","urgency":"low"},"trixie":{"status":"resolved","repositories":{"trixie":"2.4.66-1~deb13u1"},"fixed_version":"2.4.10-10","urgency":"low"}}},"CVE-2015-0253":{"description":"The read_request_line function in server/protocol.c in the Apache HTTP Server 2.4.12 does not initialize the protocol structure member, which allows remote attackers to cause a denial of service (NULL pointer dereference and process crash) by sending a request that lacks a method to an installation that enables the INCLUDES filter and has an ErrorDocument 400 directive specifying a local URI.","scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"2.4.66-1~deb12u1","bookworm-security":"2.4.62-1~deb12u2"},"fixed_version":"0","urgency":"unimportant"},"bullseye":{"status":"resolved","repositories":{"bullseye":"2.4.62-1~deb11u1","bullseye-security":"2.4.66-1~deb11u1"},"fixed_version":"0","urgency":"unimportant"},"forky":{"status":"resolved","repositories":{"forky":"2.4.66-8"},"fixed_version":"0","urgency":"unimportant"},"sid":{"status":"resolved","repositories":{"sid":"2.4.66-8"},"fixed_version":"0","urgency":"unimportant"},"trixie":{"status":"resolved","repositories":{"trixie":"2.4.66-1~deb13u1"},"fixed_version":"0","urgency":"unimportant"}}},"CVE-2015-3183":{"description":"The chunked transfer coding implementation in the Apache HTTP Server before 2.4.14 does not properly parse chunk headers, which allows remote attackers to conduct HTTP request smuggling attacks via a crafted request, related to mishandling of large chunk-size values and invalid chunk-extension characters in modules/http/http_filters.c.","scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"2.4.66-1~deb12u1","bookworm-security":"2.4.62-1~deb12u2"},"fixed_version":"2.4.16-1","urgency":"not yet assigned"},"bullseye":{"status":"resolved","repositories":{"bullseye":"2.4.62-1~deb11u1","bullseye-security":"2.4.66-1~deb11u1"},"fixed_version":"2.4.16-1","urgency":"not yet assigned"},"forky":{"status":"resolved","repositories":{"forky":"2.4.66-8"},"fixed_version":"2.4.16-1","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"2.4.66-8"},"fixed_version":"2.4.16-1","urgency":"not yet assigned"},"trixie":{"status":"resolved","repositories":{"trixie":"2.4.66-1~deb13u1"},"fixed_version":"2.4.16-1","urgency":"not yet assigned"}}},"CVE-2015-3185":{"description":"The ap_some_auth_required function in server/request.c in the Apache HTTP Server 2.4.x before 2.4.14 does not consider that a Require directive may be associated with an authorization setting rather than an authentication setting, which allows remote attackers to bypass intended access restrictions in opportunistic circumstances by leveraging the presence of a module that relies on the 2.2 API behavior.","scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"2.4.66-1~deb12u1","bookworm-security":"2.4.62-1~deb12u2"},"fixed_version":"2.4.16-1","urgency":"not yet assigned"},"bullseye":{"status":"resolved","repositories":{"bullseye":"2.4.62-1~deb11u1","bullseye-security":"2.4.66-1~deb11u1"},"fixed_version":"2.4.16-1","urgency":"not yet assigned"},"forky":{"status":"resolved","repositories":{"forky":"2.4.66-8"},"fixed_version":"2.4.16-1","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"2.4.66-8"},"fixed_version":"2.4.16-1","urgency":"not yet assigned"},"trixie":{"status":"resolved","repositories":{"trixie":"2.4.66-1~deb13u1"},"fixed_version":"2.4.16-1","urgency":"not yet assigned"}}},"CVE-2015-3675":{"description":"The default configuration of the Apache HTTP Server on Apple OS X before 10.10.4 does not enable the mod_hfs_apple module, which allows remote attackers to bypass HTTP authentication via a crafted URL.","scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"2.4.66-1~deb12u1","bookworm-security":"2.4.62-1~deb12u2"},"fixed_version":"0","urgency":"unimportant"},"bullseye":{"status":"resolved","repositories":{"bullseye":"2.4.62-1~deb11u1","bullseye-security":"2.4.66-1~deb11u1"},"fixed_version":"0","urgency":"unimportant"},"forky":{"status":"resolved","repositories":{"forky":"2.4.66-8"},"fixed_version":"0","urgency":"unimportant"},"sid":{"status":"resolved","repositories":{"sid":"2.4.66-8"},"fixed_version":"0","urgency":"unimportant"},"trixie":{"status":"resolved","repositories":{"trixie":"2.4.66-1~deb13u1"},"fixed_version":"0","urgency":"unimportant"}}},"CVE-2016-0736":{"description":"In Apache HTTP Server versions 2.4.0 to 2.4.23, mod_session_crypto was encrypting its data/cookie using the configured ciphers with possibly either CBC or ECB modes of operation (AES256-CBC by default), hence no selectable or builtin authenticated encryption. This made it vulnerable to padding oracle attacks, particularly with CBC.","scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"2.4.66-1~deb12u1","bookworm-security":"2.4.62-1~deb12u2"},"fixed_version":"2.4.25-1","urgency":"not yet assigned"},"bullseye":{"status":"resolved","repositories":{"bullseye":"2.4.62-1~deb11u1","bullseye-security":"2.4.66-1~deb11u1"},"fixed_version":"2.4.25-1","urgency":"not yet assigned"},"forky":{"status":"resolved","repositories":{"forky":"2.4.66-8"},"fixed_version":"2.4.25-1","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"2.4.66-8"},"fixed_version":"2.4.25-1","urgency":"not yet assigned"},"trixie":{"status":"resolved","repositories":{"trixie":"2.4.66-1~deb13u1"},"fixed_version":"2.4.25-1","urgency":"not yet assigned"}}},"CVE-2016-1546":{"description":"The Apache HTTP Server 2.4.17 and 2.4.18, when mod_http2 is enabled, does not limit the number of simultaneous stream workers for a single HTTP/2 connection, which allows remote attackers to cause a denial of service (stream-processing outage) via modified flow-control windows.","scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"2.4.66-1~deb12u1","bookworm-security":"2.4.62-1~deb12u2"},"fixed_version":"2.4.20-1","urgency":"not yet assigned"},"bullseye":{"status":"resolved","repositories":{"bullseye":"2.4.62-1~deb11u1","bullseye-security":"2.4.66-1~deb11u1"},"fixed_version":"2.4.20-1","urgency":"not yet assigned"},"forky":{"status":"resolved","repositories":{"forky":"2.4.66-8"},"fixed_version":"2.4.20-1","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"2.4.66-8"},"fixed_version":"2.4.20-1","urgency":"not yet assigned"},"trixie":{"status":"resolved","repositories":{"trixie":"2.4.66-1~deb13u1"},"fixed_version":"2.4.20-1","urgency":"not yet assigned"}}},"CVE-2016-2161":{"description":"In Apache HTTP Server versions 2.4.0 to 2.4.23, malicious input to mod_auth_digest can cause the server to crash, and each instance continues to crash even for subsequently valid requests.","scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"2.4.66-1~deb12u1","bookworm-security":"2.4.62-1~deb12u2"},"fixed_version":"2.4.25-1","urgency":"not yet assigned"},"bullseye":{"status":"resolved","repositories":{"bullseye":"2.4.62-1~deb11u1","bullseye-security":"2.4.66-1~deb11u1"},"fixed_version":"2.4.25-1","urgency":"not yet assigned"},"forky":{"status":"resolved","repositories":{"forky":"2.4.66-8"},"fixed_version":"2.4.25-1","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"2.4.66-8"},"fixed_version":"2.4.25-1","urgency":"not yet assigned"},"trixie":{"status":"resolved","repositories":{"trixie":"2.4.66-1~deb13u1"},"fixed_version":"2.4.25-1","urgency":"not yet assigned"}}},"CVE-2016-4975":{"description":"Possible CRLF injection allowing HTTP response splitting attacks for sites which use mod_userdir. This issue was mitigated by changes made in 2.4.25 and 2.2.32 which prohibit CR or LF injection into the \"Location\" or other outbound header key or value. Fixed in Apache HTTP Server 2.4.25 (Affected 2.4.1-2.4.23). Fixed in Apache HTTP Server 2.2.32 (Affected 2.2.0-2.2.31).","scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"2.4.66-1~deb12u1","bookworm-security":"2.4.62-1~deb12u2"},"fixed_version":"2.4.25-1","urgency":"low"},"bullseye":{"status":"resolved","repositories":{"bullseye":"2.4.62-1~deb11u1","bullseye-security":"2.4.66-1~deb11u1"},"fixed_version":"2.4.25-1","urgency":"low"},"forky":{"status":"resolved","repositories":{"forky":"2.4.66-8"},"fixed_version":"2.4.25-1","urgency":"low"},"sid":{"status":"resolved","repositories":{"sid":"2.4.66-8"},"fixed_version":"2.4.25-1","urgency":"low"},"trixie":{"status":"resolved","repositories":{"trixie":"2.4.66-1~deb13u1"},"fixed_version":"2.4.25-1","urgency":"low"}}},"CVE-2016-4979":{"description":"The Apache HTTP Server 2.4.18 through 2.4.20, when mod_http2 and mod_ssl are enabled, does not properly recognize the \"SSLVerifyClient require\" directive for HTTP/2 request authorization, which allows remote attackers to bypass intended access restrictions by leveraging the ability to send multiple requests over a single connection and aborting a renegotiation.","scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"2.4.66-1~deb12u1","bookworm-security":"2.4.62-1~deb12u2"},"fixed_version":"2.4.23-1","urgency":"not yet assigned"},"bullseye":{"status":"resolved","repositories":{"bullseye":"2.4.62-1~deb11u1","bullseye-security":"2.4.66-1~deb11u1"},"fixed_version":"2.4.23-1","urgency":"not yet assigned"},"forky":{"status":"resolved","repositories":{"forky":"2.4.66-8"},"fixed_version":"2.4.23-1","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"2.4.66-8"},"fixed_version":"2.4.23-1","urgency":"not yet assigned"},"trixie":{"status":"resolved","repositories":{"trixie":"2.4.66-1~deb13u1"},"fixed_version":"2.4.23-1","urgency":"not yet assigned"}}},"CVE-2016-5387":{"description":"The Apache HTTP Server through 2.4.23 follows RFC 3875 section 4.1.18 and therefore does not protect applications from the presence of untrusted client data in the HTTP_PROXY environment variable, which might allow remote attackers to redirect an application's outbound HTTP traffic to an arbitrary proxy server via a crafted Proxy header in an HTTP request, aka an \"httpoxy\" issue.  NOTE: the vendor states \"This mitigation has been assigned the identifier CVE-2016-5387\"; in other words, this is not a CVE ID for a vulnerability.","scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"2.4.66-1~deb12u1","bookworm-security":"2.4.62-1~deb12u2"},"fixed_version":"2.4.23-2","urgency":"not yet assigned"},"bullseye":{"status":"resolved","repositories":{"bullseye":"2.4.62-1~deb11u1","bullseye-security":"2.4.66-1~deb11u1"},"fixed_version":"2.4.23-2","urgency":"not yet assigned"},"forky":{"status":"resolved","repositories":{"forky":"2.4.66-8"},"fixed_version":"2.4.23-2","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"2.4.66-8"},"fixed_version":"2.4.23-2","urgency":"not yet assigned"},"trixie":{"status":"resolved","repositories":{"trixie":"2.4.66-1~deb13u1"},"fixed_version":"2.4.23-2","urgency":"not yet assigned"}}},"CVE-2016-8740":{"description":"The mod_http2 module in the Apache HTTP Server 2.4.17 through 2.4.23, when the Protocols configuration includes h2 or h2c, does not restrict request-header length, which allows remote attackers to cause a denial of service (memory consumption) via crafted CONTINUATION frames in an HTTP/2 request.","debianbug":847124,"scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"2.4.66-1~deb12u1","bookworm-security":"2.4.62-1~deb12u2"},"fixed_version":"2.4.25-1","urgency":"not yet assigned"},"bullseye":{"status":"resolved","repositories":{"bullseye":"2.4.62-1~deb11u1","bullseye-security":"2.4.66-1~deb11u1"},"fixed_version":"2.4.25-1","urgency":"not yet assigned"},"forky":{"status":"resolved","repositories":{"forky":"2.4.66-8"},"fixed_version":"2.4.25-1","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"2.4.66-8"},"fixed_version":"2.4.25-1","urgency":"not yet assigned"},"trixie":{"status":"resolved","repositories":{"trixie":"2.4.66-1~deb13u1"},"fixed_version":"2.4.25-1","urgency":"not yet assigned"}}},"CVE-2016-8743":{"description":"Apache HTTP Server, in all releases prior to 2.2.32 and 2.4.25, was liberal in the whitespace accepted from requests and sent in response lines and headers. Accepting these different behaviors represented a security concern when httpd participates in any chain of proxies or interacts with back-end application servers, either through mod_proxy or using conventional CGI mechanisms, and may result in request smuggling, response splitting and cache pollution.","scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"2.4.66-1~deb12u1","bookworm-security":"2.4.62-1~deb12u2"},"fixed_version":"2.4.25-1","urgency":"not yet assigned"},"bullseye":{"status":"resolved","repositories":{"bullseye":"2.4.62-1~deb11u1","bullseye-security":"2.4.66-1~deb11u1"},"fixed_version":"2.4.25-1","urgency":"not yet assigned"},"forky":{"status":"resolved","repositories":{"forky":"2.4.66-8"},"fixed_version":"2.4.25-1","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"2.4.66-8"},"fixed_version":"2.4.25-1","urgency":"not yet assigned"},"trixie":{"status":"resolved","repositories":{"trixie":"2.4.66-1~deb13u1"},"fixed_version":"2.4.25-1","urgency":"not yet assigned"}}},"CVE-2017-12171":{"description":"A regression was found in the Red Hat Enterprise Linux 6.9 version of httpd 2.2.15-60, causing comments in the \"Allow\" and \"Deny\" configuration lines to be parsed incorrectly. A web administrator could unintentionally allow any client to access a restricted HTTP resource.","scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"2.4.66-1~deb12u1","bookworm-security":"2.4.62-1~deb12u2"},"fixed_version":"0","urgency":"unimportant"},"bullseye":{"status":"resolved","repositories":{"bullseye":"2.4.62-1~deb11u1","bullseye-security":"2.4.66-1~deb11u1"},"fixed_version":"0","urgency":"unimportant"},"forky":{"status":"resolved","repositories":{"forky":"2.4.66-8"},"fixed_version":"0","urgency":"unimportant"},"sid":{"status":"resolved","repositories":{"sid":"2.4.66-8"},"fixed_version":"0","urgency":"unimportant"},"trixie":{"status":"resolved","repositories":{"trixie":"2.4.66-1~deb13u1"},"fixed_version":"0","urgency":"unimportant"}}},"CVE-2017-15710":{"description":"In Apache httpd 2.0.23 to 2.0.65, 2.2.0 to 2.2.34, and 2.4.0 to 2.4.29, mod_authnz_ldap, if configured with AuthLDAPCharsetConfig, uses the Accept-Language header value to lookup the right charset encoding when verifying the user's credentials. If the header value is not present in the charset conversion table, a fallback mechanism is used to truncate it to a two characters value to allow a quick retry (for example, 'en-US' is truncated to 'en'). A header value of less than two characters forces an out of bound write of one NUL byte to a memory location that is not part of the string. In the worst case, quite unlikely, the process would crash which could be used as a Denial of Service attack. In the more likely case, this memory is already reserved for future use and the issue has no effect at all.","scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"2.4.66-1~deb12u1","bookworm-security":"2.4.62-1~deb12u2"},"fixed_version":"2.4.33-1","urgency":"not yet assigned"},"bullseye":{"status":"resolved","repositories":{"bullseye":"2.4.62-1~deb11u1","bullseye-security":"2.4.66-1~deb11u1"},"fixed_version":"2.4.33-1","urgency":"not yet assigned"},"forky":{"status":"resolved","repositories":{"forky":"2.4.66-8"},"fixed_version":"2.4.33-1","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"2.4.66-8"},"fixed_version":"2.4.33-1","urgency":"not yet assigned"},"trixie":{"status":"resolved","repositories":{"trixie":"2.4.66-1~deb13u1"},"fixed_version":"2.4.33-1","urgency":"not yet assigned"}}},"CVE-2017-15715":{"description":"In Apache httpd 2.4.0 to 2.4.29, the expression specified in <FilesMatch> could match '$' to a newline character in a malicious filename, rather than matching only the end of the filename. This could be exploited in environments where uploads of some files are are externally blocked, but only by matching the trailing portion of the filename.","scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"2.4.66-1~deb12u1","bookworm-security":"2.4.62-1~deb12u2"},"fixed_version":"2.4.33-1","urgency":"not yet assigned"},"bullseye":{"status":"resolved","repositories":{"bullseye":"2.4.62-1~deb11u1","bullseye-security":"2.4.66-1~deb11u1"},"fixed_version":"2.4.33-1","urgency":"not yet assigned"},"forky":{"status":"resolved","repositories":{"forky":"2.4.66-8"},"fixed_version":"2.4.33-1","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"2.4.66-8"},"fixed_version":"2.4.33-1","urgency":"not yet assigned"},"trixie":{"status":"resolved","repositories":{"trixie":"2.4.66-1~deb13u1"},"fixed_version":"2.4.33-1","urgency":"not yet assigned"}}},"CVE-2017-3167":{"description":"In Apache httpd 2.2.x before 2.2.33 and 2.4.x before 2.4.26, use of the ap_get_basic_auth_pw() by third-party modules outside of the authentication phase may lead to authentication requirements being bypassed.","scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"2.4.66-1~deb12u1","bookworm-security":"2.4.62-1~deb12u2"},"fixed_version":"2.4.25-4","urgency":"not yet assigned"},"bullseye":{"status":"resolved","repositories":{"bullseye":"2.4.62-1~deb11u1","bullseye-security":"2.4.66-1~deb11u1"},"fixed_version":"2.4.25-4","urgency":"not yet assigned"},"forky":{"status":"resolved","repositories":{"forky":"2.4.66-8"},"fixed_version":"2.4.25-4","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"2.4.66-8"},"fixed_version":"2.4.25-4","urgency":"not yet assigned"},"trixie":{"status":"resolved","repositories":{"trixie":"2.4.66-1~deb13u1"},"fixed_version":"2.4.25-4","urgency":"not yet assigned"}}},"CVE-2017-3169":{"description":"In Apache httpd 2.2.x before 2.2.33 and 2.4.x before 2.4.26, mod_ssl may dereference a NULL pointer when third-party modules call ap_hook_process_connection() during an HTTP request to an HTTPS port.","scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"2.4.66-1~deb12u1","bookworm-security":"2.4.62-1~deb12u2"},"fixed_version":"2.4.25-4","urgency":"not yet assigned"},"bullseye":{"status":"resolved","repositories":{"bullseye":"2.4.62-1~deb11u1","bullseye-security":"2.4.66-1~deb11u1"},"fixed_version":"2.4.25-4","urgency":"not yet assigned"},"forky":{"status":"resolved","repositories":{"forky":"2.4.66-8"},"fixed_version":"2.4.25-4","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"2.4.66-8"},"fixed_version":"2.4.25-4","urgency":"not yet assigned"},"trixie":{"status":"resolved","repositories":{"trixie":"2.4.66-1~deb13u1"},"fixed_version":"2.4.25-4","urgency":"not yet assigned"}}},"CVE-2017-7659":{"description":"A maliciously constructed HTTP/2 request could cause mod_http2 in Apache HTTP Server 2.4.24, 2.4.25 to dereference a NULL pointer and crash the server process.","scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"2.4.66-1~deb12u1","bookworm-security":"2.4.62-1~deb12u2"},"fixed_version":"2.4.25-4","urgency":"not yet assigned"},"bullseye":{"status":"resolved","repositories":{"bullseye":"2.4.62-1~deb11u1","bullseye-security":"2.4.66-1~deb11u1"},"fixed_version":"2.4.25-4","urgency":"not yet assigned"},"forky":{"status":"resolved","repositories":{"forky":"2.4.66-8"},"fixed_version":"2.4.25-4","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"2.4.66-8"},"fixed_version":"2.4.25-4","urgency":"not yet assigned"},"trixie":{"status":"resolved","repositories":{"trixie":"2.4.66-1~deb13u1"},"fixed_version":"2.4.25-4","urgency":"not yet assigned"}}},"CVE-2017-7668":{"description":"The HTTP strict parsing changes added in Apache httpd 2.2.32 and 2.4.24 introduced a bug in token list parsing, which allows ap_find_token() to search past the end of its input string. By maliciously crafting a sequence of request headers, an attacker may be able to cause a segmentation fault, or to force ap_find_token() to return an incorrect value.","scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"2.4.66-1~deb12u1","bookworm-security":"2.4.62-1~deb12u2"},"fixed_version":"2.4.25-4","urgency":"not yet assigned"},"bullseye":{"status":"resolved","repositories":{"bullseye":"2.4.62-1~deb11u1","bullseye-security":"2.4.66-1~deb11u1"},"fixed_version":"2.4.25-4","urgency":"not yet assigned"},"forky":{"status":"resolved","repositories":{"forky":"2.4.66-8"},"fixed_version":"2.4.25-4","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"2.4.66-8"},"fixed_version":"2.4.25-4","urgency":"not yet assigned"},"trixie":{"status":"resolved","repositories":{"trixie":"2.4.66-1~deb13u1"},"fixed_version":"2.4.25-4","urgency":"not yet assigned"}}},"CVE-2017-7679":{"description":"In Apache httpd 2.2.x before 2.2.33 and 2.4.x before 2.4.26, mod_mime can read one byte past the end of a buffer when sending a malicious Content-Type response header.","scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"2.4.66-1~deb12u1","bookworm-security":"2.4.62-1~deb12u2"},"fixed_version":"2.4.25-4","urgency":"not yet assigned"},"bullseye":{"status":"resolved","repositories":{"bullseye":"2.4.62-1~deb11u1","bullseye-security":"2.4.66-1~deb11u1"},"fixed_version":"2.4.25-4","urgency":"not yet assigned"},"forky":{"status":"resolved","repositories":{"forky":"2.4.66-8"},"fixed_version":"2.4.25-4","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"2.4.66-8"},"fixed_version":"2.4.25-4","urgency":"not yet assigned"},"trixie":{"status":"resolved","repositories":{"trixie":"2.4.66-1~deb13u1"},"fixed_version":"2.4.25-4","urgency":"not yet assigned"}}},"CVE-2017-9788":{"description":"In Apache httpd before 2.2.34 and 2.4.x before 2.4.27, the value placeholder in [Proxy-]Authorization headers of type 'Digest' was not initialized or reset before or between successive key=value assignments by mod_auth_digest. Providing an initial key with no '=' assignment could reflect the stale value of uninitialized pool memory used by the prior request, leading to leakage of potentially confidential information, and a segfault in other cases resulting in denial of service.","debianbug":868467,"scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"2.4.66-1~deb12u1","bookworm-security":"2.4.62-1~deb12u2"},"fixed_version":"2.4.27-1","urgency":"not yet assigned"},"bullseye":{"status":"resolved","repositories":{"bullseye":"2.4.62-1~deb11u1","bullseye-security":"2.4.66-1~deb11u1"},"fixed_version":"2.4.27-1","urgency":"not yet assigned"},"forky":{"status":"resolved","repositories":{"forky":"2.4.66-8"},"fixed_version":"2.4.27-1","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"2.4.66-8"},"fixed_version":"2.4.27-1","urgency":"not yet assigned"},"trixie":{"status":"resolved","repositories":{"trixie":"2.4.66-1~deb13u1"},"fixed_version":"2.4.27-1","urgency":"not yet assigned"}}},"CVE-2017-9789":{"description":"When under stress, closing many connections, the HTTP/2 handling code in Apache httpd 2.4.26 would sometimes access memory after it has been freed, resulting in potentially erratic behaviour.","scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"2.4.66-1~deb12u1","bookworm-security":"2.4.62-1~deb12u2"},"fixed_version":"0","urgency":"unimportant"},"bullseye":{"status":"resolved","repositories":{"bullseye":"2.4.62-1~deb11u1","bullseye-security":"2.4.66-1~deb11u1"},"fixed_version":"0","urgency":"unimportant"},"forky":{"status":"resolved","repositories":{"forky":"2.4.66-8"},"fixed_version":"0","urgency":"unimportant"},"sid":{"status":"resolved","repositories":{"sid":"2.4.66-8"},"fixed_version":"0","urgency":"unimportant"},"trixie":{"status":"resolved","repositories":{"trixie":"2.4.66-1~deb13u1"},"fixed_version":"0","urgency":"unimportant"}}},"CVE-2017-9798":{"description":"Apache httpd allows remote attackers to read secret data from process memory if the Limit directive can be set in a user's .htaccess file, or if httpd.conf has certain misconfigurations, aka Optionsbleed. This affects the Apache HTTP Server through 2.2.34 and 2.4.x through 2.4.27. The attacker sends an unauthenticated OPTIONS HTTP request when attempting to read secret data. This is a use-after-free issue and thus secret data is not always sent, and the specific data depends on many factors including configuration. Exploitation with .htaccess can be blocked with a patch to the ap_limit_section function in server/core.c.","debianbug":876109,"scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"2.4.66-1~deb12u1","bookworm-security":"2.4.62-1~deb12u2"},"fixed_version":"2.4.27-6","urgency":"not yet assigned"},"bullseye":{"status":"resolved","repositories":{"bullseye":"2.4.62-1~deb11u1","bullseye-security":"2.4.66-1~deb11u1"},"fixed_version":"2.4.27-6","urgency":"not yet assigned"},"forky":{"status":"resolved","repositories":{"forky":"2.4.66-8"},"fixed_version":"2.4.27-6","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"2.4.66-8"},"fixed_version":"2.4.27-6","urgency":"not yet assigned"},"trixie":{"status":"resolved","repositories":{"trixie":"2.4.66-1~deb13u1"},"fixed_version":"2.4.27-6","urgency":"not yet assigned"}}},"CVE-2018-11763":{"description":"In Apache HTTP Server 2.4.17 to 2.4.34, by sending continuous, large SETTINGS frames a client can occupy a connection, server thread and CPU time without any connection timeout coming to effect. This affects only HTTP/2 connections. A possible mitigation is to not enable the h2 protocol.","debianbug":909591,"scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"2.4.66-1~deb12u1","bookworm-security":"2.4.62-1~deb12u2"},"fixed_version":"2.4.35-1","urgency":"not yet assigned"},"bullseye":{"status":"resolved","repositories":{"bullseye":"2.4.62-1~deb11u1","bullseye-security":"2.4.66-1~deb11u1"},"fixed_version":"2.4.35-1","urgency":"not yet assigned"},"forky":{"status":"resolved","repositories":{"forky":"2.4.66-8"},"fixed_version":"2.4.35-1","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"2.4.66-8"},"fixed_version":"2.4.35-1","urgency":"not yet assigned"},"trixie":{"status":"resolved","repositories":{"trixie":"2.4.66-1~deb13u1"},"fixed_version":"2.4.35-1","urgency":"not yet assigned"}}},"CVE-2018-1283":{"description":"In Apache httpd 2.4.0 to 2.4.29, when mod_session is configured to forward its session data to CGI applications (SessionEnv on, not the default), a remote user may influence their content by using a \"Session\" header. This comes from the \"HTTP_SESSION\" variable name used by mod_session to forward its data to CGIs, since the prefix \"HTTP_\" is also used by the Apache HTTP Server to pass HTTP header fields, per CGI specifications.","scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"2.4.66-1~deb12u1","bookworm-security":"2.4.62-1~deb12u2"},"fixed_version":"2.4.33-1","urgency":"not yet assigned"},"bullseye":{"status":"resolved","repositories":{"bullseye":"2.4.62-1~deb11u1","bullseye-security":"2.4.66-1~deb11u1"},"fixed_version":"2.4.33-1","urgency":"not yet assigned"},"forky":{"status":"resolved","repositories":{"forky":"2.4.66-8"},"fixed_version":"2.4.33-1","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"2.4.66-8"},"fixed_version":"2.4.33-1","urgency":"not yet assigned"},"trixie":{"status":"resolved","repositories":{"trixie":"2.4.66-1~deb13u1"},"fixed_version":"2.4.33-1","urgency":"not yet assigned"}}},"CVE-2018-1301":{"description":"A specially crafted request could have crashed the Apache HTTP Server prior to version 2.4.30, due to an out of bound access after a size limit is reached by reading the HTTP header. This vulnerability is considered very hard if not impossible to trigger in non-debug mode (both log and build level), so it is classified as low risk for common server usage.","scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"2.4.66-1~deb12u1","bookworm-security":"2.4.62-1~deb12u2"},"fixed_version":"2.4.33-1","urgency":"not yet assigned"},"bullseye":{"status":"resolved","repositories":{"bullseye":"2.4.62-1~deb11u1","bullseye-security":"2.4.66-1~deb11u1"},"fixed_version":"2.4.33-1","urgency":"not yet assigned"},"forky":{"status":"resolved","repositories":{"forky":"2.4.66-8"},"fixed_version":"2.4.33-1","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"2.4.66-8"},"fixed_version":"2.4.33-1","urgency":"not yet assigned"},"trixie":{"status":"resolved","repositories":{"trixie":"2.4.66-1~deb13u1"},"fixed_version":"2.4.33-1","urgency":"not yet assigned"}}},"CVE-2018-1302":{"description":"When an HTTP/2 stream was destroyed after being handled, the Apache HTTP Server prior to version 2.4.30 could have written a NULL pointer potentially to an already freed memory. The memory pools maintained by the server make this vulnerability hard to trigger in usual configurations, the reporter and the team could not reproduce it outside debug builds, so it is classified as low risk.","scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"2.4.66-1~deb12u1","bookworm-security":"2.4.62-1~deb12u2"},"fixed_version":"2.4.33-1","urgency":"not yet assigned"},"bullseye":{"status":"resolved","repositories":{"bullseye":"2.4.62-1~deb11u1","bullseye-security":"2.4.66-1~deb11u1"},"fixed_version":"2.4.33-1","urgency":"not yet assigned"},"forky":{"status":"resolved","repositories":{"forky":"2.4.66-8"},"fixed_version":"2.4.33-1","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"2.4.66-8"},"fixed_version":"2.4.33-1","urgency":"not yet assigned"},"trixie":{"status":"resolved","repositories":{"trixie":"2.4.66-1~deb13u1"},"fixed_version":"2.4.33-1","urgency":"not yet assigned"}}},"CVE-2018-1303":{"description":"A specially crafted HTTP request header could have crashed the Apache HTTP Server prior to version 2.4.30 due to an out of bound read while preparing data to be cached in shared memory. It could be used as a Denial of Service attack against users of mod_cache_socache. The vulnerability is considered as low risk since mod_cache_socache is not widely used, mod_cache_disk is not concerned by this vulnerability.","scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"2.4.66-1~deb12u1","bookworm-security":"2.4.62-1~deb12u2"},"fixed_version":"2.4.33-1","urgency":"not yet assigned"},"bullseye":{"status":"resolved","repositories":{"bullseye":"2.4.62-1~deb11u1","bullseye-security":"2.4.66-1~deb11u1"},"fixed_version":"2.4.33-1","urgency":"not yet assigned"},"forky":{"status":"resolved","repositories":{"forky":"2.4.66-8"},"fixed_version":"2.4.33-1","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"2.4.66-8"},"fixed_version":"2.4.33-1","urgency":"not yet assigned"},"trixie":{"status":"resolved","repositories":{"trixie":"2.4.66-1~deb13u1"},"fixed_version":"2.4.33-1","urgency":"not yet assigned"}}},"CVE-2018-1312":{"description":"In Apache httpd 2.2.0 to 2.4.29, when generating an HTTP Digest authentication challenge, the nonce sent to prevent reply attacks was not correctly generated using a pseudo-random seed. In a cluster of servers using a common Digest authentication configuration, HTTP requests could be replayed across servers by an attacker without detection.","scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"2.4.66-1~deb12u1","bookworm-security":"2.4.62-1~deb12u2"},"fixed_version":"2.4.33-1","urgency":"not yet assigned"},"bullseye":{"status":"resolved","repositories":{"bullseye":"2.4.62-1~deb11u1","bullseye-security":"2.4.66-1~deb11u1"},"fixed_version":"2.4.33-1","urgency":"not yet assigned"},"forky":{"status":"resolved","repositories":{"forky":"2.4.66-8"},"fixed_version":"2.4.33-1","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"2.4.66-8"},"fixed_version":"2.4.33-1","urgency":"not yet assigned"},"trixie":{"status":"resolved","repositories":{"trixie":"2.4.66-1~deb13u1"},"fixed_version":"2.4.33-1","urgency":"not yet assigned"}}},"CVE-2018-1333":{"description":"By specially crafting HTTP/2 requests, workers would be allocated 60 seconds longer than necessary, leading to worker exhaustion and a denial of service. Fixed in Apache HTTP Server 2.4.34 (Affected 2.4.18-2.4.30,2.4.33).","debianbug":904106,"scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"2.4.66-1~deb12u1","bookworm-security":"2.4.62-1~deb12u2"},"fixed_version":"2.4.34-1","urgency":"not yet assigned"},"bullseye":{"status":"resolved","repositories":{"bullseye":"2.4.62-1~deb11u1","bullseye-security":"2.4.66-1~deb11u1"},"fixed_version":"2.4.34-1","urgency":"not yet assigned"},"forky":{"status":"resolved","repositories":{"forky":"2.4.66-8"},"fixed_version":"2.4.34-1","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"2.4.66-8"},"fixed_version":"2.4.34-1","urgency":"not yet assigned"},"trixie":{"status":"resolved","repositories":{"trixie":"2.4.66-1~deb13u1"},"fixed_version":"2.4.34-1","urgency":"not yet assigned"}}},"CVE-2018-17189":{"description":"In Apache HTTP server versions 2.4.37 and prior, by sending request bodies in a slow loris way to plain resources, the h2 stream for that request unnecessarily occupied a server thread cleaning up that incoming data. This affects only HTTP/2 (mod_http2) connections.","debianbug":920302,"scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"2.4.66-1~deb12u1","bookworm-security":"2.4.62-1~deb12u2"},"fixed_version":"2.4.38-1","urgency":"low"},"bullseye":{"status":"resolved","repositories":{"bullseye":"2.4.62-1~deb11u1","bullseye-security":"2.4.66-1~deb11u1"},"fixed_version":"2.4.38-1","urgency":"low"},"forky":{"status":"resolved","repositories":{"forky":"2.4.66-8"},"fixed_version":"2.4.38-1","urgency":"low"},"sid":{"status":"resolved","repositories":{"sid":"2.4.66-8"},"fixed_version":"2.4.38-1","urgency":"low"},"trixie":{"status":"resolved","repositories":{"trixie":"2.4.66-1~deb13u1"},"fixed_version":"2.4.38-1","urgency":"low"}}},"CVE-2018-17199":{"description":"In Apache HTTP Server 2.4 release 2.4.37 and prior, mod_session checks the session expiry time before decoding the session. This causes session expiry time to be ignored for mod_session_cookie sessions since the expiry time is loaded when the session is decoded.","debianbug":920303,"scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"2.4.66-1~deb12u1","bookworm-security":"2.4.62-1~deb12u2"},"fixed_version":"2.4.38-1","urgency":"low"},"bullseye":{"status":"resolved","repositories":{"bullseye":"2.4.62-1~deb11u1","bullseye-security":"2.4.66-1~deb11u1"},"fixed_version":"2.4.38-1","urgency":"low"},"forky":{"status":"resolved","repositories":{"forky":"2.4.66-8"},"fixed_version":"2.4.38-1","urgency":"low"},"sid":{"status":"resolved","repositories":{"sid":"2.4.66-8"},"fixed_version":"2.4.38-1","urgency":"low"},"trixie":{"status":"resolved","repositories":{"trixie":"2.4.66-1~deb13u1"},"fixed_version":"2.4.38-1","urgency":"low"}}},"CVE-2018-8011":{"description":"By specially crafting HTTP requests, the mod_md challenge handler would dereference a NULL pointer and cause the child process to segfault. This could be used to DoS the server. Fixed in Apache HTTP Server 2.4.34 (Affected 2.4.33).","debianbug":904107,"scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"2.4.66-1~deb12u1","bookworm-security":"2.4.62-1~deb12u2"},"fixed_version":"2.4.34-1","urgency":"not yet assigned"},"bullseye":{"status":"resolved","repositories":{"bullseye":"2.4.62-1~deb11u1","bullseye-security":"2.4.66-1~deb11u1"},"fixed_version":"2.4.34-1","urgency":"not yet assigned"},"forky":{"status":"resolved","repositories":{"forky":"2.4.66-8"},"fixed_version":"2.4.34-1","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"2.4.66-8"},"fixed_version":"2.4.34-1","urgency":"not yet assigned"},"trixie":{"status":"resolved","repositories":{"trixie":"2.4.66-1~deb13u1"},"fixed_version":"2.4.34-1","urgency":"not yet assigned"}}},"CVE-2019-0190":{"description":"A bug exists in the way mod_ssl handled client renegotiations. A remote attacker could send a carefully crafted request that would cause mod_ssl to enter a loop leading to a denial of service. This bug can be only triggered with Apache HTTP Server version 2.4.37 when using OpenSSL version 1.1.1 or later, due to an interaction in changes to handling of renegotiation attempts.","debianbug":920220,"scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"2.4.66-1~deb12u1","bookworm-security":"2.4.62-1~deb12u2"},"fixed_version":"2.4.38-1","urgency":"not yet assigned"},"bullseye":{"status":"resolved","repositories":{"bullseye":"2.4.62-1~deb11u1","bullseye-security":"2.4.66-1~deb11u1"},"fixed_version":"2.4.38-1","urgency":"not yet assigned"},"forky":{"status":"resolved","repositories":{"forky":"2.4.66-8"},"fixed_version":"2.4.38-1","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"2.4.66-8"},"fixed_version":"2.4.38-1","urgency":"not yet assigned"},"trixie":{"status":"resolved","repositories":{"trixie":"2.4.66-1~deb13u1"},"fixed_version":"2.4.38-1","urgency":"not yet assigned"}}},"CVE-2019-0196":{"description":"A vulnerability was found in Apache HTTP Server 2.4.17 to 2.4.38. Using fuzzed network input, the http/2 request handling could be made to access freed memory in string comparison when determining the method of a request and thus process the request incorrectly.","scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"2.4.66-1~deb12u1","bookworm-security":"2.4.62-1~deb12u2"},"fixed_version":"2.4.38-3","urgency":"not yet assigned"},"bullseye":{"status":"resolved","repositories":{"bullseye":"2.4.62-1~deb11u1","bullseye-security":"2.4.66-1~deb11u1"},"fixed_version":"2.4.38-3","urgency":"not yet assigned"},"forky":{"status":"resolved","repositories":{"forky":"2.4.66-8"},"fixed_version":"2.4.38-3","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"2.4.66-8"},"fixed_version":"2.4.38-3","urgency":"not yet assigned"},"trixie":{"status":"resolved","repositories":{"trixie":"2.4.66-1~deb13u1"},"fixed_version":"2.4.38-3","urgency":"not yet assigned"}}},"CVE-2019-0197":{"description":"A vulnerability was found in Apache HTTP Server 2.4.34 to 2.4.38. When HTTP/2 was enabled for a http: host or H2Upgrade was enabled for h2 on a https: host, an Upgrade request from http/1.1 to http/2 that was not the first request on a connection could lead to a misconfiguration and crash. Server that never enabled the h2 protocol or that only enabled it for https: and did not set \"H2Upgrade on\" are unaffected by this issue.","scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"2.4.66-1~deb12u1","bookworm-security":"2.4.62-1~deb12u2"},"fixed_version":"2.4.38-3","urgency":"not yet assigned"},"bullseye":{"status":"resolved","repositories":{"bullseye":"2.4.62-1~deb11u1","bullseye-security":"2.4.66-1~deb11u1"},"fixed_version":"2.4.38-3","urgency":"not yet assigned"},"forky":{"status":"resolved","repositories":{"forky":"2.4.66-8"},"fixed_version":"2.4.38-3","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"2.4.66-8"},"fixed_version":"2.4.38-3","urgency":"not yet assigned"},"trixie":{"status":"resolved","repositories":{"trixie":"2.4.66-1~deb13u1"},"fixed_version":"2.4.38-3","urgency":"not yet assigned"}}},"CVE-2019-0211":{"description":"In Apache HTTP Server 2.4 releases 2.4.17 to 2.4.38, with MPM event, worker or prefork, code executing in less-privileged child processes or threads (including scripts executed by an in-process scripting interpreter) could execute arbitrary code with the privileges of the parent process (usually root) by manipulating the scoreboard. Non-Unix systems are not affected.","scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"2.4.66-1~deb12u1","bookworm-security":"2.4.62-1~deb12u2"},"fixed_version":"2.4.38-3","urgency":"not yet assigned"},"bullseye":{"status":"resolved","repositories":{"bullseye":"2.4.62-1~deb11u1","bullseye-security":"2.4.66-1~deb11u1"},"fixed_version":"2.4.38-3","urgency":"not yet assigned"},"forky":{"status":"resolved","repositories":{"forky":"2.4.66-8"},"fixed_version":"2.4.38-3","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"2.4.66-8"},"fixed_version":"2.4.38-3","urgency":"not yet assigned"},"trixie":{"status":"resolved","repositories":{"trixie":"2.4.66-1~deb13u1"},"fixed_version":"2.4.38-3","urgency":"not yet assigned"}}},"CVE-2019-0215":{"description":"In Apache HTTP Server 2.4 releases 2.4.37 and 2.4.38, a bug in mod_ssl when using per-location client certificate verification with TLSv1.3 allowed a client to bypass configured access control restrictions.","scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"2.4.66-1~deb12u1","bookworm-security":"2.4.62-1~deb12u2"},"fixed_version":"2.4.38-3","urgency":"not yet assigned"},"bullseye":{"status":"resolved","repositories":{"bullseye":"2.4.62-1~deb11u1","bullseye-security":"2.4.66-1~deb11u1"},"fixed_version":"2.4.38-3","urgency":"not yet assigned"},"forky":{"status":"resolved","repositories":{"forky":"2.4.66-8"},"fixed_version":"2.4.38-3","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"2.4.66-8"},"fixed_version":"2.4.38-3","urgency":"not yet assigned"},"trixie":{"status":"resolved","repositories":{"trixie":"2.4.66-1~deb13u1"},"fixed_version":"2.4.38-3","urgency":"not yet assigned"}}},"CVE-2019-0217":{"description":"In Apache HTTP Server 2.4 release 2.4.38 and prior, a race condition in mod_auth_digest when running in a threaded server could allow a user with valid credentials to authenticate using another username, bypassing configured access control restrictions.","scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"2.4.66-1~deb12u1","bookworm-security":"2.4.62-1~deb12u2"},"fixed_version":"2.4.38-3","urgency":"not yet assigned"},"bullseye":{"status":"resolved","repositories":{"bullseye":"2.4.62-1~deb11u1","bullseye-security":"2.4.66-1~deb11u1"},"fixed_version":"2.4.38-3","urgency":"not yet assigned"},"forky":{"status":"resolved","repositories":{"forky":"2.4.66-8"},"fixed_version":"2.4.38-3","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"2.4.66-8"},"fixed_version":"2.4.38-3","urgency":"not yet assigned"},"trixie":{"status":"resolved","repositories":{"trixie":"2.4.66-1~deb13u1"},"fixed_version":"2.4.38-3","urgency":"not yet assigned"}}},"CVE-2019-0220":{"description":"A vulnerability was found in Apache HTTP Server 2.4.0 to 2.4.38. When the path component of a request URL contains multiple consecutive slashes ('/'), directives such as LocationMatch and RewriteRule must account for duplicates in regular expressions while other aspects of the servers processing will implicitly collapse them.","scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"2.4.66-1~deb12u1","bookworm-security":"2.4.62-1~deb12u2"},"fixed_version":"2.4.38-3","urgency":"not yet assigned"},"bullseye":{"status":"resolved","repositories":{"bullseye":"2.4.62-1~deb11u1","bullseye-security":"2.4.66-1~deb11u1"},"fixed_version":"2.4.38-3","urgency":"not yet assigned"},"forky":{"status":"resolved","repositories":{"forky":"2.4.66-8"},"fixed_version":"2.4.38-3","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"2.4.66-8"},"fixed_version":"2.4.38-3","urgency":"not yet assigned"},"trixie":{"status":"resolved","repositories":{"trixie":"2.4.66-1~deb13u1"},"fixed_version":"2.4.38-3","urgency":"not yet assigned"}}},"CVE-2019-10081":{"description":"HTTP/2 (2.4.20 through 2.4.39) very early pushes, for example configured with \"H2PushResource\", could lead to an overwrite of memory in the pushing request's pool, leading to crashes. The memory copied is that of the configured push link header values, not data supplied by the client.","scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"2.4.66-1~deb12u1","bookworm-security":"2.4.62-1~deb12u2"},"fixed_version":"2.4.41-1","urgency":"not yet assigned"},"bullseye":{"status":"resolved","repositories":{"bullseye":"2.4.62-1~deb11u1","bullseye-security":"2.4.66-1~deb11u1"},"fixed_version":"2.4.41-1","urgency":"not yet assigned"},"forky":{"status":"resolved","repositories":{"forky":"2.4.66-8"},"fixed_version":"2.4.41-1","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"2.4.66-8"},"fixed_version":"2.4.41-1","urgency":"not yet assigned"},"trixie":{"status":"resolved","repositories":{"trixie":"2.4.66-1~deb13u1"},"fixed_version":"2.4.41-1","urgency":"not yet assigned"}}},"CVE-2019-10082":{"description":"In Apache HTTP Server 2.4.18-2.4.39, using fuzzed network input, the http/2 session handling could be made to read memory after being freed, during connection shutdown.","scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"2.4.66-1~deb12u1","bookworm-security":"2.4.62-1~deb12u2"},"fixed_version":"2.4.41-1","urgency":"not yet assigned"},"bullseye":{"status":"resolved","repositories":{"bullseye":"2.4.62-1~deb11u1","bullseye-security":"2.4.66-1~deb11u1"},"fixed_version":"2.4.41-1","urgency":"not yet assigned"},"forky":{"status":"resolved","repositories":{"forky":"2.4.66-8"},"fixed_version":"2.4.41-1","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"2.4.66-8"},"fixed_version":"2.4.41-1","urgency":"not yet assigned"},"trixie":{"status":"resolved","repositories":{"trixie":"2.4.66-1~deb13u1"},"fixed_version":"2.4.41-1","urgency":"not yet assigned"}}},"CVE-2019-10092":{"description":"In Apache HTTP Server 2.4.0-2.4.39, a limited cross-site scripting issue was reported affecting the mod_proxy error page. An attacker could cause the link on the error page to be malformed and instead point to a page of their choice. This would only be exploitable where a server was set up with proxying enabled but was misconfigured in such a way that the Proxy Error page was displayed.","scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"2.4.66-1~deb12u1","bookworm-security":"2.4.62-1~deb12u2"},"fixed_version":"2.4.41-1","urgency":"not yet assigned"},"bullseye":{"status":"resolved","repositories":{"bullseye":"2.4.62-1~deb11u1","bullseye-security":"2.4.66-1~deb11u1"},"fixed_version":"2.4.41-1","urgency":"not yet assigned"},"forky":{"status":"resolved","repositories":{"forky":"2.4.66-8"},"fixed_version":"2.4.41-1","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"2.4.66-8"},"fixed_version":"2.4.41-1","urgency":"not yet assigned"},"trixie":{"status":"resolved","repositories":{"trixie":"2.4.66-1~deb13u1"},"fixed_version":"2.4.41-1","urgency":"not yet assigned"}}},"CVE-2019-10097":{"description":"In Apache HTTP Server 2.4.32-2.4.39, when mod_remoteip was configured to use a trusted intermediary proxy server using the \"PROXY\" protocol, a specially crafted PROXY header could trigger a stack buffer overflow or NULL pointer deference. This vulnerability could only be triggered by a trusted proxy and not by untrusted HTTP clients.","scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"2.4.66-1~deb12u1","bookworm-security":"2.4.62-1~deb12u2"},"fixed_version":"2.4.41-1","urgency":"not yet assigned"},"bullseye":{"status":"resolved","repositories":{"bullseye":"2.4.62-1~deb11u1","bullseye-security":"2.4.66-1~deb11u1"},"fixed_version":"2.4.41-1","urgency":"not yet assigned"},"forky":{"status":"resolved","repositories":{"forky":"2.4.66-8"},"fixed_version":"2.4.41-1","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"2.4.66-8"},"fixed_version":"2.4.41-1","urgency":"not yet assigned"},"trixie":{"status":"resolved","repositories":{"trixie":"2.4.66-1~deb13u1"},"fixed_version":"2.4.41-1","urgency":"not yet assigned"}}},"CVE-2019-10098":{"description":"In Apache HTTP server 2.4.0 to 2.4.39, Redirects configured with mod_rewrite that were intended to be self-referential might be fooled by encoded newlines and redirect instead to an unexpected URL within the request URL.","scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"2.4.66-1~deb12u1","bookworm-security":"2.4.62-1~deb12u2"},"fixed_version":"2.4.41-1","urgency":"not yet assigned"},"bullseye":{"status":"resolved","repositories":{"bullseye":"2.4.62-1~deb11u1","bullseye-security":"2.4.66-1~deb11u1"},"fixed_version":"2.4.41-1","urgency":"not yet assigned"},"forky":{"status":"resolved","repositories":{"forky":"2.4.66-8"},"fixed_version":"2.4.41-1","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"2.4.66-8"},"fixed_version":"2.4.41-1","urgency":"not yet assigned"},"trixie":{"status":"resolved","repositories":{"trixie":"2.4.66-1~deb13u1"},"fixed_version":"2.4.41-1","urgency":"not yet assigned"}}},"CVE-2019-17567":{"description":"Apache HTTP Server versions 2.4.6 to 2.4.46 mod_proxy_wstunnel configured on an URL that is not necessarily Upgraded by the origin server was tunneling the whole connection regardless, thus allowing for subsequent requests on the same connection to pass through with no HTTP validation, authentication or authorization possibly configured.","scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"2.4.66-1~deb12u1","bookworm-security":"2.4.62-1~deb12u2"},"fixed_version":"2.4.48-2","urgency":"not yet assigned"},"bullseye":{"status":"resolved","repositories":{"bullseye":"2.4.62-1~deb11u1","bullseye-security":"2.4.66-1~deb11u1"},"fixed_version":"2.4.48-2","urgency":"not yet assigned"},"forky":{"status":"resolved","repositories":{"forky":"2.4.66-8"},"fixed_version":"2.4.48-2","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"2.4.66-8"},"fixed_version":"2.4.48-2","urgency":"not yet assigned"},"trixie":{"status":"resolved","repositories":{"trixie":"2.4.66-1~deb13u1"},"fixed_version":"2.4.48-2","urgency":"not yet assigned"}}},"CVE-2019-9517":{"description":"Some HTTP/2 implementations are vulnerable to unconstrained interal data buffering, potentially leading to a denial of service. The attacker opens the HTTP/2 window so the peer can send without constraint; however, they leave the TCP window closed so the peer cannot actually write (many of) the bytes on the wire. The attacker then sends a stream of requests for a large response object. Depending on how the servers queue the responses, this can consume excess memory, CPU, or both.","scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"2.4.66-1~deb12u1","bookworm-security":"2.4.62-1~deb12u2"},"fixed_version":"2.4.41-1","urgency":"not yet assigned"},"bullseye":{"status":"resolved","repositories":{"bullseye":"2.4.62-1~deb11u1","bullseye-security":"2.4.66-1~deb11u1"},"fixed_version":"2.4.41-1","urgency":"not yet assigned"},"forky":{"status":"resolved","repositories":{"forky":"2.4.66-8"},"fixed_version":"2.4.41-1","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"2.4.66-8"},"fixed_version":"2.4.41-1","urgency":"not yet assigned"},"trixie":{"status":"resolved","repositories":{"trixie":"2.4.66-1~deb13u1"},"fixed_version":"2.4.41-1","urgency":"not yet assigned"}}},"CVE-2020-11984":{"description":"Apache HTTP server 2.4.32 to 2.4.44 mod_proxy_uwsgi info disclosure and possible RCE","scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"2.4.66-1~deb12u1","bookworm-security":"2.4.62-1~deb12u2"},"fixed_version":"2.4.46-1","urgency":"not yet assigned"},"bullseye":{"status":"resolved","repositories":{"bullseye":"2.4.62-1~deb11u1","bullseye-security":"2.4.66-1~deb11u1"},"fixed_version":"2.4.46-1","urgency":"not yet assigned"},"forky":{"status":"resolved","repositories":{"forky":"2.4.66-8"},"fixed_version":"2.4.46-1","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"2.4.66-8"},"fixed_version":"2.4.46-1","urgency":"not yet assigned"},"trixie":{"status":"resolved","repositories":{"trixie":"2.4.66-1~deb13u1"},"fixed_version":"2.4.46-1","urgency":"not yet assigned"}}},"CVE-2020-11985":{"description":"IP address spoofing when proxying using mod_remoteip and mod_rewrite For configurations using proxying with mod_remoteip and certain mod_rewrite rules, an attacker could spoof their IP address for logging and PHP scripts. Note this issue was fixed in Apache HTTP Server 2.4.24 but was retrospectively allocated a low severity CVE in 2020.","scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"2.4.66-1~deb12u1","bookworm-security":"2.4.62-1~deb12u2"},"fixed_version":"2.4.25-1","urgency":"not yet assigned"},"bullseye":{"status":"resolved","repositories":{"bullseye":"2.4.62-1~deb11u1","bullseye-security":"2.4.66-1~deb11u1"},"fixed_version":"2.4.25-1","urgency":"not yet assigned"},"forky":{"status":"resolved","repositories":{"forky":"2.4.66-8"},"fixed_version":"2.4.25-1","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"2.4.66-8"},"fixed_version":"2.4.25-1","urgency":"not yet assigned"},"trixie":{"status":"resolved","repositories":{"trixie":"2.4.66-1~deb13u1"},"fixed_version":"2.4.25-1","urgency":"not yet assigned"}}},"CVE-2020-11993":{"description":"Apache HTTP Server versions 2.4.20 to 2.4.43 When trace/debug was enabled for the HTTP/2 module and on certain traffic edge patterns, logging statements were made on the wrong connection, causing concurrent use of memory pools. Configuring the LogLevel of mod_http2 above \"info\" will mitigate this vulnerability for unpatched servers.","scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"2.4.66-1~deb12u1","bookworm-security":"2.4.62-1~deb12u2"},"fixed_version":"2.4.46-1","urgency":"not yet assigned"},"bullseye":{"status":"resolved","repositories":{"bullseye":"2.4.62-1~deb11u1","bullseye-security":"2.4.66-1~deb11u1"},"fixed_version":"2.4.46-1","urgency":"not yet assigned"},"forky":{"status":"resolved","repositories":{"forky":"2.4.66-8"},"fixed_version":"2.4.46-1","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"2.4.66-8"},"fixed_version":"2.4.46-1","urgency":"not yet assigned"},"trixie":{"status":"resolved","repositories":{"trixie":"2.4.66-1~deb13u1"},"fixed_version":"2.4.46-1","urgency":"not yet assigned"}}},"CVE-2020-13938":{"description":"Apache HTTP Server versions 2.4.0 to 2.4.46 Unprivileged local users can stop httpd on Windows","scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"2.4.66-1~deb12u1","bookworm-security":"2.4.62-1~deb12u2"},"fixed_version":"0","urgency":"unimportant"},"bullseye":{"status":"resolved","repositories":{"bullseye":"2.4.62-1~deb11u1","bullseye-security":"2.4.66-1~deb11u1"},"fixed_version":"0","urgency":"unimportant"},"forky":{"status":"resolved","repositories":{"forky":"2.4.66-8"},"fixed_version":"0","urgency":"unimportant"},"sid":{"status":"resolved","repositories":{"sid":"2.4.66-8"},"fixed_version":"0","urgency":"unimportant"},"trixie":{"status":"resolved","repositories":{"trixie":"2.4.66-1~deb13u1"},"fixed_version":"0","urgency":"unimportant"}}},"CVE-2020-13950":{"description":"Apache HTTP Server versions 2.4.41 to 2.4.46 mod_proxy_http can be made to crash (NULL pointer dereference) with specially crafted requests using both Content-Length and Transfer-Encoding headers, leading to a Denial of Service","scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"2.4.66-1~deb12u1","bookworm-security":"2.4.62-1~deb12u2"},"fixed_version":"2.4.46-6","urgency":"not yet assigned"},"bullseye":{"status":"resolved","repositories":{"bullseye":"2.4.62-1~deb11u1","bullseye-security":"2.4.66-1~deb11u1"},"fixed_version":"2.4.46-6","urgency":"not yet assigned"},"forky":{"status":"resolved","repositories":{"forky":"2.4.66-8"},"fixed_version":"2.4.46-6","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"2.4.66-8"},"fixed_version":"2.4.46-6","urgency":"not yet assigned"},"trixie":{"status":"resolved","repositories":{"trixie":"2.4.66-1~deb13u1"},"fixed_version":"2.4.46-6","urgency":"not yet assigned"}}},"CVE-2020-1927":{"description":"In Apache HTTP Server 2.4.0 to 2.4.41, redirects configured with mod_rewrite that were intended to be self-referential might be fooled by encoded newlines and redirect instead to an an unexpected URL within the request URL.","scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"2.4.66-1~deb12u1","bookworm-security":"2.4.62-1~deb12u2"},"fixed_version":"2.4.43-1","urgency":"low"},"bullseye":{"status":"resolved","repositories":{"bullseye":"2.4.62-1~deb11u1","bullseye-security":"2.4.66-1~deb11u1"},"fixed_version":"2.4.43-1","urgency":"low"},"forky":{"status":"resolved","repositories":{"forky":"2.4.66-8"},"fixed_version":"2.4.43-1","urgency":"low"},"sid":{"status":"resolved","repositories":{"sid":"2.4.66-8"},"fixed_version":"2.4.43-1","urgency":"low"},"trixie":{"status":"resolved","repositories":{"trixie":"2.4.66-1~deb13u1"},"fixed_version":"2.4.43-1","urgency":"low"}}},"CVE-2020-1934":{"description":"In Apache HTTP Server 2.4.0 to 2.4.41, mod_proxy_ftp may use uninitialized memory when proxying to a malicious FTP server.","scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"2.4.66-1~deb12u1","bookworm-security":"2.4.62-1~deb12u2"},"fixed_version":"2.4.43-1","urgency":"low"},"bullseye":{"status":"resolved","repositories":{"bullseye":"2.4.62-1~deb11u1","bullseye-security":"2.4.66-1~deb11u1"},"fixed_version":"2.4.43-1","urgency":"low"},"forky":{"status":"resolved","repositories":{"forky":"2.4.66-8"},"fixed_version":"2.4.43-1","urgency":"low"},"sid":{"status":"resolved","repositories":{"sid":"2.4.66-8"},"fixed_version":"2.4.43-1","urgency":"low"},"trixie":{"status":"resolved","repositories":{"trixie":"2.4.66-1~deb13u1"},"fixed_version":"2.4.43-1","urgency":"low"}}},"CVE-2020-35452":{"description":"Apache HTTP Server versions 2.4.0 to 2.4.46 A specially crafted Digest nonce can cause a stack overflow in mod_auth_digest. There is no report of this overflow being exploitable, nor the Apache HTTP Server team could create one, though some particular compiler and/or compilation option might make it possible, with limited consequences anyway due to the size (a single byte) and the value (zero byte) of the overflow","scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"2.4.66-1~deb12u1","bookworm-security":"2.4.62-1~deb12u2"},"fixed_version":"2.4.46-6","urgency":"not yet assigned"},"bullseye":{"status":"resolved","repositories":{"bullseye":"2.4.62-1~deb11u1","bullseye-security":"2.4.66-1~deb11u1"},"fixed_version":"2.4.46-6","urgency":"not yet assigned"},"forky":{"status":"resolved","repositories":{"forky":"2.4.66-8"},"fixed_version":"2.4.46-6","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"2.4.66-8"},"fixed_version":"2.4.46-6","urgency":"not yet assigned"},"trixie":{"status":"resolved","repositories":{"trixie":"2.4.66-1~deb13u1"},"fixed_version":"2.4.46-6","urgency":"not yet assigned"}}},"CVE-2020-9490":{"description":"Apache HTTP Server versions 2.4.20 to 2.4.43. A specially crafted value for the 'Cache-Digest' header in a HTTP/2 request would result in a crash when the server actually tries to HTTP/2 PUSH a resource afterwards. Configuring the HTTP/2 feature via \"H2Push off\" will mitigate this vulnerability for unpatched servers.","scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"2.4.66-1~deb12u1","bookworm-security":"2.4.62-1~deb12u2"},"fixed_version":"2.4.46-1","urgency":"not yet assigned"},"bullseye":{"status":"resolved","repositories":{"bullseye":"2.4.62-1~deb11u1","bullseye-security":"2.4.66-1~deb11u1"},"fixed_version":"2.4.46-1","urgency":"not yet assigned"},"forky":{"status":"resolved","repositories":{"forky":"2.4.66-8"},"fixed_version":"2.4.46-1","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"2.4.66-8"},"fixed_version":"2.4.46-1","urgency":"not yet assigned"},"trixie":{"status":"resolved","repositories":{"trixie":"2.4.66-1~deb13u1"},"fixed_version":"2.4.46-1","urgency":"not yet assigned"}}},"CVE-2021-20325":{"description":"Missing fixes for CVE-2021-40438 and CVE-2021-26691 in the versions of httpd, as shipped in Red Hat Enterprise Linux 8.5.0, causes a security regression compared to the versions shipped in Red Hat Enterprise Linux 8.4. A user who installs or updates to Red Hat Enterprise Linux 8.5.0 would be vulnerable to the mentioned CVEs, even if they were properly fixed in Red Hat Enterprise Linux 8.4. CVE-2021-20325 was assigned to that Red Hat specific security regression and it does not affect the upstream versions of httpd.","scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"2.4.66-1~deb12u1","bookworm-security":"2.4.62-1~deb12u2"},"fixed_version":"0","urgency":"unimportant"},"bullseye":{"status":"resolved","repositories":{"bullseye":"2.4.62-1~deb11u1","bullseye-security":"2.4.66-1~deb11u1"},"fixed_version":"0","urgency":"unimportant"},"forky":{"status":"resolved","repositories":{"forky":"2.4.66-8"},"fixed_version":"0","urgency":"unimportant"},"sid":{"status":"resolved","repositories":{"sid":"2.4.66-8"},"fixed_version":"0","urgency":"unimportant"},"trixie":{"status":"resolved","repositories":{"trixie":"2.4.66-1~deb13u1"},"fixed_version":"0","urgency":"unimportant"}}},"CVE-2021-26690":{"description":"Apache HTTP Server versions 2.4.0 to 2.4.46 A specially crafted Cookie header handled by mod_session can cause a NULL pointer dereference and crash, leading to a possible Denial Of Service","scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"2.4.66-1~deb12u1","bookworm-security":"2.4.62-1~deb12u2"},"fixed_version":"2.4.46-6","urgency":"not yet assigned"},"bullseye":{"status":"resolved","repositories":{"bullseye":"2.4.62-1~deb11u1","bullseye-security":"2.4.66-1~deb11u1"},"fixed_version":"2.4.46-6","urgency":"not yet assigned"},"forky":{"status":"resolved","repositories":{"forky":"2.4.66-8"},"fixed_version":"2.4.46-6","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"2.4.66-8"},"fixed_version":"2.4.46-6","urgency":"not yet assigned"},"trixie":{"status":"resolved","repositories":{"trixie":"2.4.66-1~deb13u1"},"fixed_version":"2.4.46-6","urgency":"not yet assigned"}}},"CVE-2021-26691":{"description":"In Apache HTTP Server versions 2.4.0 to 2.4.46 a specially crafted SessionHeader sent by an origin server could cause a heap overflow","scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"2.4.66-1~deb12u1","bookworm-security":"2.4.62-1~deb12u2"},"fixed_version":"2.4.46-6","urgency":"not yet assigned"},"bullseye":{"status":"resolved","repositories":{"bullseye":"2.4.62-1~deb11u1","bullseye-security":"2.4.66-1~deb11u1"},"fixed_version":"2.4.46-6","urgency":"not yet assigned"},"forky":{"status":"resolved","repositories":{"forky":"2.4.66-8"},"fixed_version":"2.4.46-6","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"2.4.66-8"},"fixed_version":"2.4.46-6","urgency":"not yet assigned"},"trixie":{"status":"resolved","repositories":{"trixie":"2.4.66-1~deb13u1"},"fixed_version":"2.4.46-6","urgency":"not yet assigned"}}},"CVE-2021-30641":{"description":"Apache HTTP Server versions 2.4.39 to 2.4.46 Unexpected matching behavior with 'MergeSlashes OFF'","scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"2.4.66-1~deb12u1","bookworm-security":"2.4.62-1~deb12u2"},"fixed_version":"2.4.46-6","urgency":"not yet assigned"},"bullseye":{"status":"resolved","repositories":{"bullseye":"2.4.62-1~deb11u1","bullseye-security":"2.4.66-1~deb11u1"},"fixed_version":"2.4.46-6","urgency":"not yet assigned"},"forky":{"status":"resolved","repositories":{"forky":"2.4.66-8"},"fixed_version":"2.4.46-6","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"2.4.66-8"},"fixed_version":"2.4.46-6","urgency":"not yet assigned"},"trixie":{"status":"resolved","repositories":{"trixie":"2.4.66-1~deb13u1"},"fixed_version":"2.4.46-6","urgency":"not yet assigned"}}},"CVE-2021-31618":{"description":"Apache HTTP Server protocol handler for the HTTP/2 protocol checks received request headers against the size limitations as configured for the server and used for the HTTP/1 protocol as well. On violation of these restrictions and HTTP response is sent to the client with a status code indicating why the request was rejected. This rejection response was not fully initialised in the HTTP/2 protocol handler if the offending header was the very first one received or appeared in a a footer. This led to a NULL pointer dereference on initialised memory, crashing reliably the child process. Since such a triggering HTTP/2 request is easy to craft and submit, this can be exploited to DoS the server. This issue affected mod_http2 1.15.17 and Apache HTTP Server version 2.4.47 only. Apache HTTP Server 2.4.47 was never released.","debianbug":989562,"scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"2.4.66-1~deb12u1","bookworm-security":"2.4.62-1~deb12u2"},"fixed_version":"2.4.46-5","urgency":"not yet assigned"},"bullseye":{"status":"resolved","repositories":{"bullseye":"2.4.62-1~deb11u1","bullseye-security":"2.4.66-1~deb11u1"},"fixed_version":"2.4.46-5","urgency":"not yet assigned"},"forky":{"status":"resolved","repositories":{"forky":"2.4.66-8"},"fixed_version":"2.4.46-5","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"2.4.66-8"},"fixed_version":"2.4.46-5","urgency":"not yet assigned"},"trixie":{"status":"resolved","repositories":{"trixie":"2.4.66-1~deb13u1"},"fixed_version":"2.4.46-5","urgency":"not yet assigned"}}},"CVE-2021-33193":{"description":"A crafted method sent through HTTP/2 will bypass validation and be forwarded by mod_proxy, which can lead to request splitting or cache poisoning. This issue affects Apache HTTP Server 2.4.17 to 2.4.48.","scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"2.4.66-1~deb12u1","bookworm-security":"2.4.62-1~deb12u2"},"fixed_version":"2.4.48-4","urgency":"not yet assigned"},"bullseye":{"status":"resolved","repositories":{"bullseye":"2.4.62-1~deb11u1","bullseye-security":"2.4.66-1~deb11u1"},"fixed_version":"2.4.48-3.1+deb11u1","urgency":"not yet assigned"},"forky":{"status":"resolved","repositories":{"forky":"2.4.66-8"},"fixed_version":"2.4.48-4","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"2.4.66-8"},"fixed_version":"2.4.48-4","urgency":"not yet assigned"},"trixie":{"status":"resolved","repositories":{"trixie":"2.4.66-1~deb13u1"},"fixed_version":"2.4.48-4","urgency":"not yet assigned"}}},"CVE-2021-34798":{"description":"Malformed requests may cause the server to dereference a NULL pointer. This issue affects Apache HTTP Server 2.4.48 and earlier.","scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"2.4.66-1~deb12u1","bookworm-security":"2.4.62-1~deb12u2"},"fixed_version":"2.4.49-1","urgency":"not yet assigned"},"bullseye":{"status":"resolved","repositories":{"bullseye":"2.4.62-1~deb11u1","bullseye-security":"2.4.66-1~deb11u1"},"fixed_version":"2.4.51-1~deb11u1","urgency":"not yet assigned"},"forky":{"status":"resolved","repositories":{"forky":"2.4.66-8"},"fixed_version":"2.4.49-1","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"2.4.66-8"},"fixed_version":"2.4.49-1","urgency":"not yet assigned"},"trixie":{"status":"resolved","repositories":{"trixie":"2.4.66-1~deb13u1"},"fixed_version":"2.4.49-1","urgency":"not yet assigned"}}},"CVE-2021-36160":{"description":"A carefully crafted request uri-path can cause mod_proxy_uwsgi to read above the allocated memory and crash (DoS). This issue affects Apache HTTP Server versions 2.4.30 to 2.4.48 (inclusive).","scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"2.4.66-1~deb12u1","bookworm-security":"2.4.62-1~deb12u2"},"fixed_version":"2.4.49-1","urgency":"not yet assigned"},"bullseye":{"status":"resolved","repositories":{"bullseye":"2.4.62-1~deb11u1","bullseye-security":"2.4.66-1~deb11u1"},"fixed_version":"2.4.51-1~deb11u1","urgency":"not yet assigned"},"forky":{"status":"resolved","repositories":{"forky":"2.4.66-8"},"fixed_version":"2.4.49-1","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"2.4.66-8"},"fixed_version":"2.4.49-1","urgency":"not yet assigned"},"trixie":{"status":"resolved","repositories":{"trixie":"2.4.66-1~deb13u1"},"fixed_version":"2.4.49-1","urgency":"not yet assigned"}}},"CVE-2021-39275":{"description":"ap_escape_quotes() may write beyond the end of a buffer when given malicious input. No included modules pass untrusted data to these functions, but third-party / external modules may. This issue affects Apache HTTP Server 2.4.48 and earlier.","scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"2.4.66-1~deb12u1","bookworm-security":"2.4.62-1~deb12u2"},"fixed_version":"2.4.49-1","urgency":"not yet assigned"},"bullseye":{"status":"resolved","repositories":{"bullseye":"2.4.62-1~deb11u1","bullseye-security":"2.4.66-1~deb11u1"},"fixed_version":"2.4.51-1~deb11u1","urgency":"not yet assigned"},"forky":{"status":"resolved","repositories":{"forky":"2.4.66-8"},"fixed_version":"2.4.49-1","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"2.4.66-8"},"fixed_version":"2.4.49-1","urgency":"not yet assigned"},"trixie":{"status":"resolved","repositories":{"trixie":"2.4.66-1~deb13u1"},"fixed_version":"2.4.49-1","urgency":"not yet assigned"}}},"CVE-2021-40438":{"description":"A crafted request uri-path can cause mod_proxy to forward the request to an origin server choosen by the remote user. This issue affects Apache HTTP Server 2.4.48 and earlier.","scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"2.4.66-1~deb12u1","bookworm-security":"2.4.62-1~deb12u2"},"fixed_version":"2.4.49-1","urgency":"not yet assigned"},"bullseye":{"status":"resolved","repositories":{"bullseye":"2.4.62-1~deb11u1","bullseye-security":"2.4.66-1~deb11u1"},"fixed_version":"2.4.51-1~deb11u1","urgency":"not yet assigned"},"forky":{"status":"resolved","repositories":{"forky":"2.4.66-8"},"fixed_version":"2.4.49-1","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"2.4.66-8"},"fixed_version":"2.4.49-1","urgency":"not yet assigned"},"trixie":{"status":"resolved","repositories":{"trixie":"2.4.66-1~deb13u1"},"fixed_version":"2.4.49-1","urgency":"not yet assigned"}}},"CVE-2021-41524":{"description":"While fuzzing the 2.4.49 httpd, a new null pointer dereference was detected during HTTP/2 request processing, allowing an external source to DoS the server. This requires a specially crafted request. The vulnerability was recently introduced in version 2.4.49. No exploit is known to the project.","scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"2.4.66-1~deb12u1","bookworm-security":"2.4.62-1~deb12u2"},"fixed_version":"2.4.50-1","urgency":"not yet assigned"},"bullseye":{"status":"resolved","repositories":{"bullseye":"2.4.62-1~deb11u1","bullseye-security":"2.4.66-1~deb11u1"},"fixed_version":"0","urgency":"unimportant"},"forky":{"status":"resolved","repositories":{"forky":"2.4.66-8"},"fixed_version":"2.4.50-1","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"2.4.66-8"},"fixed_version":"2.4.50-1","urgency":"not yet assigned"},"trixie":{"status":"resolved","repositories":{"trixie":"2.4.66-1~deb13u1"},"fixed_version":"2.4.50-1","urgency":"not yet assigned"}}},"CVE-2021-41773":{"description":"A flaw was found in a change made to path normalization in Apache HTTP Server 2.4.49. An attacker could use a path traversal attack to map URLs to files outside the directories configured by Alias-like directives. If files outside of these directories are not protected by the usual default configuration \"require all denied\", these requests can succeed. If CGI scripts are also enabled for these aliased pathes, this could allow for remote code execution. This issue is known to be exploited in the wild. This issue only affects Apache 2.4.49 and not earlier versions. The fix in Apache HTTP Server 2.4.50 was found to be incomplete, see CVE-2021-42013.","scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"2.4.66-1~deb12u1","bookworm-security":"2.4.62-1~deb12u2"},"fixed_version":"2.4.50-1","urgency":"not yet assigned"},"bullseye":{"status":"resolved","repositories":{"bullseye":"2.4.62-1~deb11u1","bullseye-security":"2.4.66-1~deb11u1"},"fixed_version":"0","urgency":"unimportant"},"forky":{"status":"resolved","repositories":{"forky":"2.4.66-8"},"fixed_version":"2.4.50-1","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"2.4.66-8"},"fixed_version":"2.4.50-1","urgency":"not yet assigned"},"trixie":{"status":"resolved","repositories":{"trixie":"2.4.66-1~deb13u1"},"fixed_version":"2.4.50-1","urgency":"not yet assigned"}}},"CVE-2021-42013":{"description":"It was found that the fix for CVE-2021-41773 in Apache HTTP Server 2.4.50 was insufficient. An attacker could use a path traversal attack to map URLs to files outside the directories configured by Alias-like directives. If files outside of these directories are not protected by the usual default configuration \"require all denied\", these requests can succeed. If CGI scripts are also enabled for these aliased pathes, this could allow for remote code execution. This issue only affects Apache 2.4.49 and Apache 2.4.50 and not earlier versions.","scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"2.4.66-1~deb12u1","bookworm-security":"2.4.62-1~deb12u2"},"fixed_version":"2.4.51-1","urgency":"not yet assigned"},"bullseye":{"status":"resolved","repositories":{"bullseye":"2.4.62-1~deb11u1","bullseye-security":"2.4.66-1~deb11u1"},"fixed_version":"0","urgency":"unimportant"},"forky":{"status":"resolved","repositories":{"forky":"2.4.66-8"},"fixed_version":"2.4.51-1","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"2.4.66-8"},"fixed_version":"2.4.51-1","urgency":"not yet assigned"},"trixie":{"status":"resolved","repositories":{"trixie":"2.4.66-1~deb13u1"},"fixed_version":"2.4.51-1","urgency":"not yet assigned"}}},"CVE-2021-44224":{"description":"A crafted URI sent to httpd configured as a forward proxy (ProxyRequests on) can cause a crash (NULL pointer dereference) or, for configurations mixing forward and reverse proxy declarations, can allow for requests to be directed to a declared Unix Domain Socket endpoint (Server Side Request Forgery). This issue affects Apache HTTP Server 2.4.7 up to 2.4.51 (included).","scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"2.4.66-1~deb12u1","bookworm-security":"2.4.62-1~deb12u2"},"fixed_version":"2.4.52-1","urgency":"not yet assigned"},"bullseye":{"status":"resolved","repositories":{"bullseye":"2.4.62-1~deb11u1","bullseye-security":"2.4.66-1~deb11u1"},"fixed_version":"2.4.52-1~deb11u2","urgency":"not yet assigned"},"forky":{"status":"resolved","repositories":{"forky":"2.4.66-8"},"fixed_version":"2.4.52-1","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"2.4.66-8"},"fixed_version":"2.4.52-1","urgency":"not yet assigned"},"trixie":{"status":"resolved","repositories":{"trixie":"2.4.66-1~deb13u1"},"fixed_version":"2.4.52-1","urgency":"not yet assigned"}}},"CVE-2021-44790":{"description":"A carefully crafted request body can cause a buffer overflow in the mod_lua multipart parser (r:parsebody() called from Lua scripts). The Apache httpd team is not aware of an exploit for the vulnerabilty though it might be possible to craft one. This issue affects Apache HTTP Server 2.4.51 and earlier.","scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"2.4.66-1~deb12u1","bookworm-security":"2.4.62-1~deb12u2"},"fixed_version":"2.4.52-1","urgency":"not yet assigned"},"bullseye":{"status":"resolved","repositories":{"bullseye":"2.4.62-1~deb11u1","bullseye-security":"2.4.66-1~deb11u1"},"fixed_version":"2.4.52-1~deb11u2","urgency":"not yet assigned"},"forky":{"status":"resolved","repositories":{"forky":"2.4.66-8"},"fixed_version":"2.4.52-1","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"2.4.66-8"},"fixed_version":"2.4.52-1","urgency":"not yet assigned"},"trixie":{"status":"resolved","repositories":{"trixie":"2.4.66-1~deb13u1"},"fixed_version":"2.4.52-1","urgency":"not yet assigned"}}},"CVE-2022-22719":{"description":"A carefully crafted request body can cause a read to a random memory area which could cause the process to crash. This issue affects Apache HTTP Server 2.4.52 and earlier.","scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"2.4.66-1~deb12u1","bookworm-security":"2.4.62-1~deb12u2"},"fixed_version":"2.4.53-1","urgency":"not yet assigned"},"bullseye":{"status":"resolved","repositories":{"bullseye":"2.4.62-1~deb11u1","bullseye-security":"2.4.66-1~deb11u1"},"fixed_version":"2.4.53-1~deb11u1","urgency":"not yet assigned"},"forky":{"status":"resolved","repositories":{"forky":"2.4.66-8"},"fixed_version":"2.4.53-1","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"2.4.66-8"},"fixed_version":"2.4.53-1","urgency":"not yet assigned"},"trixie":{"status":"resolved","repositories":{"trixie":"2.4.66-1~deb13u1"},"fixed_version":"2.4.53-1","urgency":"not yet assigned"}}},"CVE-2022-22720":{"description":"Apache HTTP Server 2.4.52 and earlier fails to close inbound connection when errors are encountered discarding the request body, exposing the server to HTTP Request Smuggling","scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"2.4.66-1~deb12u1","bookworm-security":"2.4.62-1~deb12u2"},"fixed_version":"2.4.53-1","urgency":"not yet assigned"},"bullseye":{"status":"resolved","repositories":{"bullseye":"2.4.62-1~deb11u1","bullseye-security":"2.4.66-1~deb11u1"},"fixed_version":"2.4.53-1~deb11u1","urgency":"not yet assigned"},"forky":{"status":"resolved","repositories":{"forky":"2.4.66-8"},"fixed_version":"2.4.53-1","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"2.4.66-8"},"fixed_version":"2.4.53-1","urgency":"not yet assigned"},"trixie":{"status":"resolved","repositories":{"trixie":"2.4.66-1~deb13u1"},"fixed_version":"2.4.53-1","urgency":"not yet assigned"}}},"CVE-2022-22721":{"description":"If LimitXMLRequestBody is set to allow request bodies larger than 350MB (defaults to 1M) on 32 bit systems an integer overflow happens which later causes out of bounds writes. This issue affects Apache HTTP Server 2.4.52 and earlier.","scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"2.4.66-1~deb12u1","bookworm-security":"2.4.62-1~deb12u2"},"fixed_version":"2.4.53-1","urgency":"not yet assigned"},"bullseye":{"status":"resolved","repositories":{"bullseye":"2.4.62-1~deb11u1","bullseye-security":"2.4.66-1~deb11u1"},"fixed_version":"2.4.53-1~deb11u1","urgency":"not yet assigned"},"forky":{"status":"resolved","repositories":{"forky":"2.4.66-8"},"fixed_version":"2.4.53-1","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"2.4.66-8"},"fixed_version":"2.4.53-1","urgency":"not yet assigned"},"trixie":{"status":"resolved","repositories":{"trixie":"2.4.66-1~deb13u1"},"fixed_version":"2.4.53-1","urgency":"not yet assigned"}}},"CVE-2022-23943":{"description":"Out-of-bounds Write vulnerability in mod_sed of Apache HTTP Server allows an attacker to overwrite heap memory with possibly attacker provided data. This issue affects Apache HTTP Server 2.4 version 2.4.52 and prior versions.","scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"2.4.66-1~deb12u1","bookworm-security":"2.4.62-1~deb12u2"},"fixed_version":"2.4.53-1","urgency":"not yet assigned"},"bullseye":{"status":"resolved","repositories":{"bullseye":"2.4.62-1~deb11u1","bullseye-security":"2.4.66-1~deb11u1"},"fixed_version":"2.4.53-1~deb11u1","urgency":"not yet assigned"},"forky":{"status":"resolved","repositories":{"forky":"2.4.66-8"},"fixed_version":"2.4.53-1","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"2.4.66-8"},"fixed_version":"2.4.53-1","urgency":"not yet assigned"},"trixie":{"status":"resolved","repositories":{"trixie":"2.4.66-1~deb13u1"},"fixed_version":"2.4.53-1","urgency":"not yet assigned"}}},"CVE-2022-26377":{"description":"Inconsistent Interpretation of HTTP Requests ('HTTP Request Smuggling') vulnerability in mod_proxy_ajp of Apache HTTP Server allows an attacker to smuggle requests to the AJP server it forwards requests to. This issue affects Apache HTTP Server Apache HTTP Server 2.4 version 2.4.53 and prior versions.","debianbug":1012513,"scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"2.4.66-1~deb12u1","bookworm-security":"2.4.62-1~deb12u2"},"fixed_version":"2.4.54-1","urgency":"not yet assigned"},"bullseye":{"status":"resolved","repositories":{"bullseye":"2.4.62-1~deb11u1","bullseye-security":"2.4.66-1~deb11u1"},"fixed_version":"2.4.54-1~deb11u1","urgency":"not yet assigned"},"forky":{"status":"resolved","repositories":{"forky":"2.4.66-8"},"fixed_version":"2.4.54-1","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"2.4.66-8"},"fixed_version":"2.4.54-1","urgency":"not yet assigned"},"trixie":{"status":"resolved","repositories":{"trixie":"2.4.66-1~deb13u1"},"fixed_version":"2.4.54-1","urgency":"not yet assigned"}}},"CVE-2022-28330":{"description":"Apache HTTP Server 2.4.53 and earlier on Windows may read beyond bounds when configured to process requests with the mod_isapi module.","scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"2.4.66-1~deb12u1","bookworm-security":"2.4.62-1~deb12u2"},"fixed_version":"0","urgency":"unimportant"},"bullseye":{"status":"resolved","repositories":{"bullseye":"2.4.62-1~deb11u1","bullseye-security":"2.4.66-1~deb11u1"},"fixed_version":"0","urgency":"unimportant"},"forky":{"status":"resolved","repositories":{"forky":"2.4.66-8"},"fixed_version":"0","urgency":"unimportant"},"sid":{"status":"resolved","repositories":{"sid":"2.4.66-8"},"fixed_version":"0","urgency":"unimportant"},"trixie":{"status":"resolved","repositories":{"trixie":"2.4.66-1~deb13u1"},"fixed_version":"0","urgency":"unimportant"}}},"CVE-2022-28614":{"description":"The ap_rwrite() function in Apache HTTP Server 2.4.53 and earlier may read unintended memory if an attacker can cause the server to reflect very large input using ap_rwrite() or ap_rputs(), such as with mod_luas r:puts() function. Modules compiled and distributed separately from Apache HTTP Server that use the 'ap_rputs' function and may pass it a very large (INT_MAX or larger) string must be compiled against current headers to resolve the issue.","debianbug":1012513,"scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"2.4.66-1~deb12u1","bookworm-security":"2.4.62-1~deb12u2"},"fixed_version":"2.4.54-1","urgency":"not yet assigned"},"bullseye":{"status":"resolved","repositories":{"bullseye":"2.4.62-1~deb11u1","bullseye-security":"2.4.66-1~deb11u1"},"fixed_version":"2.4.54-1~deb11u1","urgency":"not yet assigned"},"forky":{"status":"resolved","repositories":{"forky":"2.4.66-8"},"fixed_version":"2.4.54-1","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"2.4.66-8"},"fixed_version":"2.4.54-1","urgency":"not yet assigned"},"trixie":{"status":"resolved","repositories":{"trixie":"2.4.66-1~deb13u1"},"fixed_version":"2.4.54-1","urgency":"not yet assigned"}}},"CVE-2022-28615":{"description":"Apache HTTP Server 2.4.53 and earlier may crash or disclose information due to a read beyond bounds in ap_strcmp_match() when provided with an extremely large input buffer. While no code distributed with the server can be coerced into such a call, third-party modules or lua scripts that use ap_strcmp_match() may hypothetically be affected.","debianbug":1012513,"scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"2.4.66-1~deb12u1","bookworm-security":"2.4.62-1~deb12u2"},"fixed_version":"2.4.54-1","urgency":"not yet assigned"},"bullseye":{"status":"resolved","repositories":{"bullseye":"2.4.62-1~deb11u1","bullseye-security":"2.4.66-1~deb11u1"},"fixed_version":"2.4.54-1~deb11u1","urgency":"not yet assigned"},"forky":{"status":"resolved","repositories":{"forky":"2.4.66-8"},"fixed_version":"2.4.54-1","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"2.4.66-8"},"fixed_version":"2.4.54-1","urgency":"not yet assigned"},"trixie":{"status":"resolved","repositories":{"trixie":"2.4.66-1~deb13u1"},"fixed_version":"2.4.54-1","urgency":"not yet assigned"}}},"CVE-2022-29404":{"description":"In Apache HTTP Server 2.4.53 and earlier, a malicious request to a lua script that calls r:parsebody(0) may cause a denial of service due to no default limit on possible input size.","debianbug":1012513,"scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"2.4.66-1~deb12u1","bookworm-security":"2.4.62-1~deb12u2"},"fixed_version":"2.4.54-1","urgency":"not yet assigned"},"bullseye":{"status":"resolved","repositories":{"bullseye":"2.4.62-1~deb11u1","bullseye-security":"2.4.66-1~deb11u1"},"fixed_version":"2.4.54-1~deb11u1","urgency":"not yet assigned"},"forky":{"status":"resolved","repositories":{"forky":"2.4.66-8"},"fixed_version":"2.4.54-1","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"2.4.66-8"},"fixed_version":"2.4.54-1","urgency":"not yet assigned"},"trixie":{"status":"resolved","repositories":{"trixie":"2.4.66-1~deb13u1"},"fixed_version":"2.4.54-1","urgency":"not yet assigned"}}},"CVE-2022-30522":{"description":"If Apache HTTP Server 2.4.53 is configured to do transformations with mod_sed in contexts where the input to mod_sed may be very large, mod_sed may make excessively large memory allocations and trigger an abort.","debianbug":1012513,"scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"2.4.66-1~deb12u1","bookworm-security":"2.4.62-1~deb12u2"},"fixed_version":"2.4.54-1","urgency":"not yet assigned"},"bullseye":{"status":"resolved","repositories":{"bullseye":"2.4.62-1~deb11u1","bullseye-security":"2.4.66-1~deb11u1"},"fixed_version":"2.4.54-1~deb11u1","urgency":"not yet assigned"},"forky":{"status":"resolved","repositories":{"forky":"2.4.66-8"},"fixed_version":"2.4.54-1","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"2.4.66-8"},"fixed_version":"2.4.54-1","urgency":"not yet assigned"},"trixie":{"status":"resolved","repositories":{"trixie":"2.4.66-1~deb13u1"},"fixed_version":"2.4.54-1","urgency":"not yet assigned"}}},"CVE-2022-30556":{"description":"Apache HTTP Server 2.4.53 and earlier may return lengths to applications calling r:wsread() that point past the end of the storage allocated for the buffer.","debianbug":1012513,"scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"2.4.66-1~deb12u1","bookworm-security":"2.4.62-1~deb12u2"},"fixed_version":"2.4.54-1","urgency":"not yet assigned"},"bullseye":{"status":"resolved","repositories":{"bullseye":"2.4.62-1~deb11u1","bullseye-security":"2.4.66-1~deb11u1"},"fixed_version":"2.4.54-1~deb11u1","urgency":"not yet assigned"},"forky":{"status":"resolved","repositories":{"forky":"2.4.66-8"},"fixed_version":"2.4.54-1","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"2.4.66-8"},"fixed_version":"2.4.54-1","urgency":"not yet assigned"},"trixie":{"status":"resolved","repositories":{"trixie":"2.4.66-1~deb13u1"},"fixed_version":"2.4.54-1","urgency":"not yet assigned"}}},"CVE-2022-31813":{"description":"Apache HTTP Server 2.4.53 and earlier may not send the X-Forwarded-* headers to the origin server based on client side Connection header hop-by-hop mechanism. This may be used to bypass IP based authentication on the origin server/application.","debianbug":1012513,"scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"2.4.66-1~deb12u1","bookworm-security":"2.4.62-1~deb12u2"},"fixed_version":"2.4.54-1","urgency":"not yet assigned"},"bullseye":{"status":"resolved","repositories":{"bullseye":"2.4.62-1~deb11u1","bullseye-security":"2.4.66-1~deb11u1"},"fixed_version":"2.4.54-1~deb11u1","urgency":"not yet assigned"},"forky":{"status":"resolved","repositories":{"forky":"2.4.66-8"},"fixed_version":"2.4.54-1","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"2.4.66-8"},"fixed_version":"2.4.54-1","urgency":"not yet assigned"},"trixie":{"status":"resolved","repositories":{"trixie":"2.4.66-1~deb13u1"},"fixed_version":"2.4.54-1","urgency":"not yet assigned"}}},"CVE-2022-36760":{"description":"Inconsistent Interpretation of HTTP Requests ('HTTP Request Smuggling') vulnerability in mod_proxy_ajp of Apache HTTP Server allows an attacker to smuggle requests to the AJP server it forwards requests to.  This issue affects Apache HTTP Server Apache HTTP Server 2.4 version 2.4.54 and prior versions.","scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"2.4.66-1~deb12u1","bookworm-security":"2.4.62-1~deb12u2"},"fixed_version":"2.4.55-1","urgency":"not yet assigned"},"bullseye":{"status":"resolved","repositories":{"bullseye":"2.4.62-1~deb11u1","bullseye-security":"2.4.66-1~deb11u1"},"fixed_version":"2.4.56-1~deb11u1","urgency":"not yet assigned"},"forky":{"status":"resolved","repositories":{"forky":"2.4.66-8"},"fixed_version":"2.4.55-1","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"2.4.66-8"},"fixed_version":"2.4.55-1","urgency":"not yet assigned"},"trixie":{"status":"resolved","repositories":{"trixie":"2.4.66-1~deb13u1"},"fixed_version":"2.4.55-1","urgency":"not yet assigned"}}},"CVE-2022-37436":{"description":"Prior to Apache HTTP Server 2.4.55, a malicious backend can cause the response headers to be truncated early, resulting in some headers being incorporated into the response body. If the later headers have any security purpose, they will not be interpreted by the client.","scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"2.4.66-1~deb12u1","bookworm-security":"2.4.62-1~deb12u2"},"fixed_version":"2.4.55-1","urgency":"not yet assigned"},"bullseye":{"status":"resolved","repositories":{"bullseye":"2.4.62-1~deb11u1","bullseye-security":"2.4.66-1~deb11u1"},"fixed_version":"2.4.56-1~deb11u1","urgency":"not yet assigned"},"forky":{"status":"resolved","repositories":{"forky":"2.4.66-8"},"fixed_version":"2.4.55-1","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"2.4.66-8"},"fixed_version":"2.4.55-1","urgency":"not yet assigned"},"trixie":{"status":"resolved","repositories":{"trixie":"2.4.66-1~deb13u1"},"fixed_version":"2.4.55-1","urgency":"not yet assigned"}}},"CVE-2023-25690":{"description":"Some mod_proxy configurations on Apache HTTP Server versions 2.4.0 through 2.4.55 allow a HTTP Request Smuggling attack.     Configurations are affected when mod_proxy is enabled along with some form of RewriteRule  or ProxyPassMatch in which a non-specific pattern matches  some portion of the user-supplied request-target (URL) data and is then  re-inserted into the proxied request-target using variable  substitution. For example, something like:     RewriteEngine on RewriteRule \"^/here/(.*)\" \"http://example.com:8080/elsewhere?$1\"; [P] ProxyPassReverse /here/ http://example.com:8080/   Request splitting/smuggling could result in bypass of access controls in the proxy server, proxying unintended URLs to existing origin servers, and cache poisoning. Users are recommended to update to at least version 2.4.56 of Apache HTTP Server.","debianbug":1032476,"scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"2.4.66-1~deb12u1","bookworm-security":"2.4.62-1~deb12u2"},"fixed_version":"2.4.56-1","urgency":"not yet assigned"},"bullseye":{"status":"resolved","repositories":{"bullseye":"2.4.62-1~deb11u1","bullseye-security":"2.4.66-1~deb11u1"},"fixed_version":"2.4.56-1~deb11u1","urgency":"not yet assigned"},"forky":{"status":"resolved","repositories":{"forky":"2.4.66-8"},"fixed_version":"2.4.56-1","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"2.4.66-8"},"fixed_version":"2.4.56-1","urgency":"not yet assigned"},"trixie":{"status":"resolved","repositories":{"trixie":"2.4.66-1~deb13u1"},"fixed_version":"2.4.56-1","urgency":"not yet assigned"}}},"CVE-2023-27522":{"description":"HTTP Response Smuggling vulnerability in Apache HTTP Server via mod_proxy_uwsgi. This issue affects Apache HTTP Server: from 2.4.30 through 2.4.55.  Special characters in the origin response header can truncate/split the response forwarded to the client.","debianbug":1032476,"scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"2.4.66-1~deb12u1","bookworm-security":"2.4.62-1~deb12u2"},"fixed_version":"2.4.56-1","urgency":"not yet assigned"},"bullseye":{"status":"resolved","repositories":{"bullseye":"2.4.62-1~deb11u1","bullseye-security":"2.4.66-1~deb11u1"},"fixed_version":"2.4.56-1~deb11u1","urgency":"not yet assigned"},"forky":{"status":"resolved","repositories":{"forky":"2.4.66-8"},"fixed_version":"2.4.56-1","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"2.4.66-8"},"fixed_version":"2.4.56-1","urgency":"not yet assigned"},"trixie":{"status":"resolved","repositories":{"trixie":"2.4.66-1~deb13u1"},"fixed_version":"2.4.56-1","urgency":"not yet assigned"}}},"CVE-2023-31122":{"description":"Out-of-bounds Read vulnerability in mod_macro of Apache HTTP Server.This issue affects Apache HTTP Server: through 2.4.57.","scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"2.4.66-1~deb12u1","bookworm-security":"2.4.62-1~deb12u2"},"fixed_version":"2.4.59-1~deb12u1","urgency":"not yet assigned"},"bullseye":{"status":"resolved","repositories":{"bullseye":"2.4.62-1~deb11u1","bullseye-security":"2.4.66-1~deb11u1"},"fixed_version":"2.4.59-1~deb11u1","urgency":"not yet assigned"},"forky":{"status":"resolved","repositories":{"forky":"2.4.66-8"},"fixed_version":"2.4.58-1","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"2.4.66-8"},"fixed_version":"2.4.58-1","urgency":"not yet assigned"},"trixie":{"status":"resolved","repositories":{"trixie":"2.4.66-1~deb13u1"},"fixed_version":"2.4.58-1","urgency":"not yet assigned"}}},"CVE-2023-38709":{"description":"Faulty input validation in the core of Apache allows malicious or exploitable backend/content generators to split HTTP responses.  This issue affects Apache HTTP Server: through 2.4.58.","debianbug":1068412,"scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"2.4.66-1~deb12u1","bookworm-security":"2.4.62-1~deb12u2"},"fixed_version":"2.4.59-1~deb12u1","urgency":"not yet assigned"},"bullseye":{"status":"resolved","repositories":{"bullseye":"2.4.62-1~deb11u1","bullseye-security":"2.4.66-1~deb11u1"},"fixed_version":"2.4.59-1~deb11u1","urgency":"not yet assigned"},"forky":{"status":"resolved","repositories":{"forky":"2.4.66-8"},"fixed_version":"2.4.59-1","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"2.4.66-8"},"fixed_version":"2.4.59-1","urgency":"not yet assigned"},"trixie":{"status":"resolved","repositories":{"trixie":"2.4.66-1~deb13u1"},"fixed_version":"2.4.59-1","urgency":"not yet assigned"}}},"CVE-2023-43622":{"description":"An attacker, opening a HTTP/2 connection with an initial window size of 0, was able to block handling of that connection indefinitely in Apache HTTP Server. This could be used to exhaust worker resources in the server, similar to the well known \"slow loris\" attack pattern. This has been fixed in version 2.4.58, so that such connection are terminated properly after the configured connection timeout.  This issue affects Apache HTTP Server: from 2.4.55 through 2.4.57.  Users are recommended to upgrade to version 2.4.58, which fixes the issue.","scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"2.4.66-1~deb12u1","bookworm-security":"2.4.62-1~deb12u2"},"fixed_version":"2.4.59-1~deb12u1","urgency":"not yet assigned"},"bullseye":{"status":"resolved","repositories":{"bullseye":"2.4.62-1~deb11u1","bullseye-security":"2.4.66-1~deb11u1"},"fixed_version":"2.4.59-1~deb11u1","urgency":"not yet assigned"},"forky":{"status":"resolved","repositories":{"forky":"2.4.66-8"},"fixed_version":"2.4.58-1","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"2.4.66-8"},"fixed_version":"2.4.58-1","urgency":"not yet assigned"},"trixie":{"status":"resolved","repositories":{"trixie":"2.4.66-1~deb13u1"},"fixed_version":"2.4.58-1","urgency":"not yet assigned"}}},"CVE-2023-45802":{"description":"When a HTTP/2 stream was reset (RST frame) by a client, there was a time window were the request's memory resources were not reclaimed immediately. Instead, de-allocation was deferred to connection close. A client could send new requests and resets, keeping the connection busy and open and causing the memory footprint to keep on growing. On connection close, all resources were reclaimed, but the process might run out of memory before that.  This was found by the reporter during testing of\u00a0CVE-2023-44487 (HTTP/2 Rapid Reset Exploit) with their own test client. During \"normal\" HTTP/2 use, the probability to hit this bug is very low. The kept memory would not become noticeable before the connection closes or times out.  Users are recommended to upgrade to version 2.4.58, which fixes the issue.","scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"2.4.66-1~deb12u1","bookworm-security":"2.4.62-1~deb12u2"},"fixed_version":"2.4.59-1~deb12u1","urgency":"not yet assigned"},"bullseye":{"status":"resolved","repositories":{"bullseye":"2.4.62-1~deb11u1","bullseye-security":"2.4.66-1~deb11u1"},"fixed_version":"2.4.59-1~deb11u1","urgency":"not yet assigned"},"forky":{"status":"resolved","repositories":{"forky":"2.4.66-8"},"fixed_version":"2.4.58-1","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"2.4.66-8"},"fixed_version":"2.4.58-1","urgency":"not yet assigned"},"trixie":{"status":"resolved","repositories":{"trixie":"2.4.66-1~deb13u1"},"fixed_version":"2.4.58-1","urgency":"not yet assigned"}}},"CVE-2024-24795":{"description":"HTTP Response splitting in multiple modules in Apache HTTP Server allows an attacker that can inject malicious response headers into backend applications to cause an HTTP desynchronization attack.  Users are recommended to upgrade to version 2.4.59, which fixes this issue.","debianbug":1068412,"scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"2.4.66-1~deb12u1","bookworm-security":"2.4.62-1~deb12u2"},"fixed_version":"2.4.59-1~deb12u1","urgency":"not yet assigned"},"bullseye":{"status":"resolved","repositories":{"bullseye":"2.4.62-1~deb11u1","bullseye-security":"2.4.66-1~deb11u1"},"fixed_version":"2.4.59-1~deb11u1","urgency":"not yet assigned"},"forky":{"status":"resolved","repositories":{"forky":"2.4.66-8"},"fixed_version":"2.4.59-1","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"2.4.66-8"},"fixed_version":"2.4.59-1","urgency":"not yet assigned"},"trixie":{"status":"resolved","repositories":{"trixie":"2.4.66-1~deb13u1"},"fixed_version":"2.4.59-1","urgency":"not yet assigned"}}},"CVE-2024-27316":{"description":"HTTP/2 incoming headers exceeding the limit are temporarily buffered in nghttp2 in order to generate an informative HTTP 413 response. If a client does not stop sending headers, this leads to memory exhaustion.","debianbug":1068412,"scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"2.4.66-1~deb12u1","bookworm-security":"2.4.62-1~deb12u2"},"fixed_version":"2.4.59-1~deb12u1","urgency":"not yet assigned"},"bullseye":{"status":"resolved","repositories":{"bullseye":"2.4.62-1~deb11u1","bullseye-security":"2.4.66-1~deb11u1"},"fixed_version":"2.4.59-1~deb11u1","urgency":"not yet assigned"},"forky":{"status":"resolved","repositories":{"forky":"2.4.66-8"},"fixed_version":"2.4.59-1","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"2.4.66-8"},"fixed_version":"2.4.59-1","urgency":"not yet assigned"},"trixie":{"status":"resolved","repositories":{"trixie":"2.4.66-1~deb13u1"},"fixed_version":"2.4.59-1","urgency":"not yet assigned"}}},"CVE-2024-36387":{"description":"Serving WebSocket protocol upgrades over a HTTP/2 connection could result in a Null Pointer dereference, leading to a crash of the server process, degrading performance.","scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"2.4.66-1~deb12u1","bookworm-security":"2.4.62-1~deb12u2"},"fixed_version":"2.4.61-1~deb12u1","urgency":"not yet assigned"},"bullseye":{"status":"resolved","repositories":{"bullseye":"2.4.62-1~deb11u1","bullseye-security":"2.4.66-1~deb11u1"},"fixed_version":"2.4.61-1~deb11u1","urgency":"not yet assigned"},"forky":{"status":"resolved","repositories":{"forky":"2.4.66-8"},"fixed_version":"2.4.60-1","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"2.4.66-8"},"fixed_version":"2.4.60-1","urgency":"not yet assigned"},"trixie":{"status":"resolved","repositories":{"trixie":"2.4.66-1~deb13u1"},"fixed_version":"2.4.60-1","urgency":"not yet assigned"}}},"CVE-2024-38472":{"description":"SSRF in Apache HTTP Server on Windows allows to potentially leak NTLM hashes to a malicious server via SSRF and\u00a0malicious requests or content  Users are recommended to upgrade to version 2.4.60 which fixes this issue.\u00a0 Note: Existing configurations that access UNC paths will have to configure new directive \"UNCList\" to allow access during request processing.","scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"2.4.66-1~deb12u1","bookworm-security":"2.4.62-1~deb12u2"},"fixed_version":"0","urgency":"unimportant"},"bullseye":{"status":"resolved","repositories":{"bullseye":"2.4.62-1~deb11u1","bullseye-security":"2.4.66-1~deb11u1"},"fixed_version":"0","urgency":"unimportant"},"forky":{"status":"resolved","repositories":{"forky":"2.4.66-8"},"fixed_version":"0","urgency":"unimportant"},"sid":{"status":"resolved","repositories":{"sid":"2.4.66-8"},"fixed_version":"0","urgency":"unimportant"},"trixie":{"status":"resolved","repositories":{"trixie":"2.4.66-1~deb13u1"},"fixed_version":"0","urgency":"unimportant"}}},"CVE-2024-38473":{"description":"Encoding problem in mod_proxy in Apache HTTP Server 2.4.59 and earlier allows request URLs with incorrect encoding to be sent to backend services, potentially bypassing authentication via crafted requests. Users are recommended to upgrade to version 2.4.60, which fixes this issue.","scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"2.4.66-1~deb12u1","bookworm-security":"2.4.62-1~deb12u2"},"fixed_version":"2.4.61-1~deb12u1","urgency":"not yet assigned"},"bullseye":{"status":"resolved","repositories":{"bullseye":"2.4.62-1~deb11u1","bullseye-security":"2.4.66-1~deb11u1"},"fixed_version":"2.4.61-1~deb11u1","urgency":"not yet assigned"},"forky":{"status":"resolved","repositories":{"forky":"2.4.66-8"},"fixed_version":"2.4.60-1","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"2.4.66-8"},"fixed_version":"2.4.60-1","urgency":"not yet assigned"},"trixie":{"status":"resolved","repositories":{"trixie":"2.4.66-1~deb13u1"},"fixed_version":"2.4.60-1","urgency":"not yet assigned"}}},"CVE-2024-38474":{"description":"Substitution encoding issue in mod_rewrite in Apache HTTP Server 2.4.59 and earlier allows attacker to execute scripts in directories permitted by the configuration but not directly reachable by any\u00a0URL or source disclosure of scripts meant to only to be executed as CGI.  Users are recommended to upgrade to version 2.4.60, which fixes this issue.  Some RewriteRules that capture and substitute unsafely will now fail unless rewrite flag \"UnsafeAllow3F\" is specified.","scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"2.4.66-1~deb12u1","bookworm-security":"2.4.62-1~deb12u2"},"fixed_version":"2.4.61-1~deb12u1","urgency":"not yet assigned"},"bullseye":{"status":"resolved","repositories":{"bullseye":"2.4.62-1~deb11u1","bullseye-security":"2.4.66-1~deb11u1"},"fixed_version":"2.4.61-1~deb11u1","urgency":"not yet assigned"},"forky":{"status":"resolved","repositories":{"forky":"2.4.66-8"},"fixed_version":"2.4.60-1","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"2.4.66-8"},"fixed_version":"2.4.60-1","urgency":"not yet assigned"},"trixie":{"status":"resolved","repositories":{"trixie":"2.4.66-1~deb13u1"},"fixed_version":"2.4.60-1","urgency":"not yet assigned"}}},"CVE-2024-38475":{"description":"Improper escaping of output in mod_rewrite in Apache HTTP Server 2.4.59 and earlier allows an attacker to map URLs to filesystem locations that are\u00a0permitted to be served by the server but are not intentionally/directly reachable by any URL, resulting in code execution or source code disclosure.   Substitutions in\u00a0server context that use a backreferences or variables as the first segment of the substitution are affected.\u00a0 Some unsafe RewiteRules will be broken by this change and the rewrite flag \"UnsafePrefixStat\" can be used to opt back in once ensuring the substitution is appropriately constrained.","scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"2.4.66-1~deb12u1","bookworm-security":"2.4.62-1~deb12u2"},"fixed_version":"2.4.61-1~deb12u1","urgency":"not yet assigned"},"bullseye":{"status":"resolved","repositories":{"bullseye":"2.4.62-1~deb11u1","bullseye-security":"2.4.66-1~deb11u1"},"fixed_version":"2.4.61-1~deb11u1","urgency":"not yet assigned"},"forky":{"status":"resolved","repositories":{"forky":"2.4.66-8"},"fixed_version":"2.4.60-1","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"2.4.66-8"},"fixed_version":"2.4.60-1","urgency":"not yet assigned"},"trixie":{"status":"resolved","repositories":{"trixie":"2.4.66-1~deb13u1"},"fixed_version":"2.4.60-1","urgency":"not yet assigned"}}},"CVE-2024-38476":{"description":"Vulnerability in core of Apache HTTP Server 2.4.59 and earlier are vulnerably to information disclosure, SSRF or local script execution via\u00a0backend applications whose response headers are malicious or exploitable.  Users are recommended to upgrade to version 2.4.60, which fixes this issue.","scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"2.4.66-1~deb12u1","bookworm-security":"2.4.62-1~deb12u2"},"fixed_version":"2.4.61-1~deb12u1","urgency":"not yet assigned"},"bullseye":{"status":"resolved","repositories":{"bullseye":"2.4.62-1~deb11u1","bullseye-security":"2.4.66-1~deb11u1"},"fixed_version":"2.4.61-1~deb11u1","urgency":"not yet assigned"},"forky":{"status":"resolved","repositories":{"forky":"2.4.66-8"},"fixed_version":"2.4.60-1","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"2.4.66-8"},"fixed_version":"2.4.60-1","urgency":"not yet assigned"},"trixie":{"status":"resolved","repositories":{"trixie":"2.4.66-1~deb13u1"},"fixed_version":"2.4.60-1","urgency":"not yet assigned"}}},"CVE-2024-38477":{"description":"null pointer dereference in mod_proxy in Apache HTTP Server 2.4.59 and earlier allows an attacker to crash the server via a malicious request. Users are recommended to upgrade to version 2.4.60, which fixes this issue.","scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"2.4.66-1~deb12u1","bookworm-security":"2.4.62-1~deb12u2"},"fixed_version":"2.4.61-1~deb12u1","urgency":"not yet assigned"},"bullseye":{"status":"resolved","repositories":{"bullseye":"2.4.62-1~deb11u1","bullseye-security":"2.4.66-1~deb11u1"},"fixed_version":"2.4.61-1~deb11u1","urgency":"not yet assigned"},"forky":{"status":"resolved","repositories":{"forky":"2.4.66-8"},"fixed_version":"2.4.60-1","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"2.4.66-8"},"fixed_version":"2.4.60-1","urgency":"not yet assigned"},"trixie":{"status":"resolved","repositories":{"trixie":"2.4.66-1~deb13u1"},"fixed_version":"2.4.60-1","urgency":"not yet assigned"}}},"CVE-2024-39573":{"description":"Potential SSRF in mod_rewrite in Apache HTTP Server 2.4.59 and earlier allows an attacker to cause unsafe RewriteRules to unexpectedly setup URL's to be handled by mod_proxy. Users are recommended to upgrade to version 2.4.60, which fixes this issue.","scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"2.4.66-1~deb12u1","bookworm-security":"2.4.62-1~deb12u2"},"fixed_version":"2.4.61-1~deb12u1","urgency":"not yet assigned"},"bullseye":{"status":"resolved","repositories":{"bullseye":"2.4.62-1~deb11u1","bullseye-security":"2.4.66-1~deb11u1"},"fixed_version":"2.4.61-1~deb11u1","urgency":"not yet assigned"},"forky":{"status":"resolved","repositories":{"forky":"2.4.66-8"},"fixed_version":"2.4.60-1","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"2.4.66-8"},"fixed_version":"2.4.60-1","urgency":"not yet assigned"},"trixie":{"status":"resolved","repositories":{"trixie":"2.4.66-1~deb13u1"},"fixed_version":"2.4.60-1","urgency":"not yet assigned"}}},"CVE-2024-39884":{"description":"A regression in the core of Apache HTTP Server 2.4.60 ignores some use of the legacy content-type based configuration of handlers.\u00a0 \u00a0\"AddType\" and similar configuration, under some circumstances where files are requested indirectly, result in source code disclosure of local content. For example, PHP scripts may be served instead of interpreted.  Users are recommended to upgrade to version 2.4.61, which fixes this issue.","scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"2.4.66-1~deb12u1","bookworm-security":"2.4.62-1~deb12u2"},"fixed_version":"0","urgency":"unimportant"},"bullseye":{"status":"resolved","repositories":{"bullseye":"2.4.62-1~deb11u1","bullseye-security":"2.4.66-1~deb11u1"},"fixed_version":"2.4.61-1","urgency":"not yet assigned"},"forky":{"status":"resolved","repositories":{"forky":"2.4.66-8"},"fixed_version":"2.4.61-1","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"2.4.66-8"},"fixed_version":"2.4.61-1","urgency":"not yet assigned"},"trixie":{"status":"resolved","repositories":{"trixie":"2.4.66-1~deb13u1"},"fixed_version":"2.4.61-1","urgency":"not yet assigned"}}},"CVE-2024-40725":{"description":"A partial fix for\u00a0 CVE-2024-39884 in the core of Apache HTTP Server 2.4.61 ignores some use of the legacy content-type based configuration of handlers. \"AddType\" and similar configuration, under some circumstances where files are requested indirectly, result in source code disclosure of local content. For example, PHP scripts may be served instead of interpreted.  Users are recommended to upgrade to version 2.4.62, which fixes this issue.","scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"2.4.66-1~deb12u1","bookworm-security":"2.4.62-1~deb12u2"},"fixed_version":"2.4.62-1~deb12u1","urgency":"not yet assigned"},"bullseye":{"status":"resolved","repositories":{"bullseye":"2.4.62-1~deb11u1","bullseye-security":"2.4.66-1~deb11u1"},"fixed_version":"2.4.62-1~deb11u1","urgency":"not yet assigned"},"forky":{"status":"resolved","repositories":{"forky":"2.4.66-8"},"fixed_version":"2.4.62-1","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"2.4.66-8"},"fixed_version":"2.4.62-1","urgency":"not yet assigned"},"trixie":{"status":"resolved","repositories":{"trixie":"2.4.66-1~deb13u1"},"fixed_version":"2.4.62-1","urgency":"not yet assigned"}}},"CVE-2024-40898":{"description":"SSRF in Apache HTTP Server on Windows with mod_rewrite in server/vhost context, allows to potentially leak NTML hashes to a malicious server via SSRF and malicious requests.  Users are recommended to upgrade to version 2.4.62 which fixes this issue.","scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"2.4.66-1~deb12u1","bookworm-security":"2.4.62-1~deb12u2"},"fixed_version":"0","urgency":"unimportant"},"bullseye":{"status":"resolved","repositories":{"bullseye":"2.4.62-1~deb11u1","bullseye-security":"2.4.66-1~deb11u1"},"fixed_version":"0","urgency":"unimportant"},"forky":{"status":"resolved","repositories":{"forky":"2.4.66-8"},"fixed_version":"0","urgency":"unimportant"},"sid":{"status":"resolved","repositories":{"sid":"2.4.66-8"},"fixed_version":"0","urgency":"unimportant"},"trixie":{"status":"resolved","repositories":{"trixie":"2.4.66-1~deb13u1"},"fixed_version":"0","urgency":"unimportant"}}},"CVE-2024-42516":{"description":"HTTP response splitting in the core of Apache HTTP Server allows an attacker who can manipulate the Content-Type response headers of applications hosted or proxied by the server can split the HTTP response.  This vulnerability was described as CVE-2023-38709 but the patch included in Apache HTTP Server 2.4.59 did not address the issue.  Users are recommended to upgrade to version 2.4.64, which fixes this issue.","scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"2.4.66-1~deb12u1","bookworm-security":"2.4.62-1~deb12u2"},"fixed_version":"2.4.65-1~deb12u1","urgency":"not yet assigned"},"bullseye":{"status":"resolved","repositories":{"bullseye":"2.4.62-1~deb11u1","bullseye-security":"2.4.66-1~deb11u1"},"fixed_version":"2.4.65-1~deb11u1","urgency":"not yet assigned"},"forky":{"status":"resolved","repositories":{"forky":"2.4.66-8"},"fixed_version":"2.4.64-1","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"2.4.66-8"},"fixed_version":"2.4.64-1","urgency":"not yet assigned"},"trixie":{"status":"resolved","repositories":{"trixie":"2.4.66-1~deb13u1"},"fixed_version":"2.4.64-1","urgency":"not yet assigned"}}},"CVE-2024-43204":{"description":"SSRF in Apache HTTP Server with mod_proxy loaded allows an attacker to send outbound proxy requests to a URL controlled by the attacker.\u00a0 Requires an unlikely configuration where mod_headers is configured to modify the Content-Type request or response header with a value provided in the HTTP request.  Users are recommended to upgrade to version 2.4.64 which fixes this issue.","scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"2.4.66-1~deb12u1","bookworm-security":"2.4.62-1~deb12u2"},"fixed_version":"2.4.65-1~deb12u1","urgency":"not yet assigned"},"bullseye":{"status":"resolved","repositories":{"bullseye":"2.4.62-1~deb11u1","bullseye-security":"2.4.66-1~deb11u1"},"fixed_version":"2.4.65-1~deb11u1","urgency":"not yet assigned"},"forky":{"status":"resolved","repositories":{"forky":"2.4.66-8"},"fixed_version":"2.4.64-1","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"2.4.66-8"},"fixed_version":"2.4.64-1","urgency":"not yet assigned"},"trixie":{"status":"resolved","repositories":{"trixie":"2.4.66-1~deb13u1"},"fixed_version":"2.4.64-1","urgency":"not yet assigned"}}},"CVE-2024-43394":{"description":"Server-Side Request Forgery (SSRF)\u00a0in Apache HTTP Server on Windows allows to potentially leak NTLM hashes to a malicious server via\u00a0 mod_rewrite or apache expressions that pass unvalidated request input.  This issue affects Apache HTTP Server: from 2.4.0 through 2.4.63.  Note: \u00a0The Apache HTTP Server Project will be setting a higher bar for accepting vulnerability reports regarding SSRF via UNC paths.   The server offers limited protection against administrators directing the server to open UNC paths. Windows servers should limit the hosts they will connect over via SMB based on the nature of NTLM authentication.","scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"2.4.66-1~deb12u1","bookworm-security":"2.4.62-1~deb12u2"},"fixed_version":"0","urgency":"unimportant"},"bullseye":{"status":"resolved","repositories":{"bullseye":"2.4.62-1~deb11u1","bullseye-security":"2.4.66-1~deb11u1"},"fixed_version":"2.4.65-1~deb11u1","urgency":"not yet assigned"},"forky":{"status":"resolved","repositories":{"forky":"2.4.66-8"},"fixed_version":"0","urgency":"unimportant"},"sid":{"status":"resolved","repositories":{"sid":"2.4.66-8"},"fixed_version":"0","urgency":"unimportant"},"trixie":{"status":"resolved","repositories":{"trixie":"2.4.66-1~deb13u1"},"fixed_version":"0","urgency":"unimportant"}}},"CVE-2024-47252":{"description":"Insufficient escaping of user-supplied data in mod_ssl in Apache HTTP Server 2.4.63 and earlier allows an untrusted SSL/TLS client to insert escape characters into log files in some configurations.  In a logging configuration where CustomLog is used with \"%{varname}x\" or \"%{varname}c\" to log variables provided by mod_ssl such as SSL_TLS_SNI, no escaping is performed by either mod_log_config or mod_ssl and unsanitized data provided by the client may appear in log files.","scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"2.4.66-1~deb12u1","bookworm-security":"2.4.62-1~deb12u2"},"fixed_version":"2.4.65-1~deb12u1","urgency":"not yet assigned"},"bullseye":{"status":"resolved","repositories":{"bullseye":"2.4.62-1~deb11u1","bullseye-security":"2.4.66-1~deb11u1"},"fixed_version":"2.4.65-1~deb11u1","urgency":"not yet assigned"},"forky":{"status":"resolved","repositories":{"forky":"2.4.66-8"},"fixed_version":"2.4.64-1","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"2.4.66-8"},"fixed_version":"2.4.64-1","urgency":"not yet assigned"},"trixie":{"status":"resolved","repositories":{"trixie":"2.4.66-1~deb13u1"},"fixed_version":"2.4.64-1","urgency":"not yet assigned"}}},"CVE-2025-23048":{"description":"In some mod_ssl configurations on Apache HTTP Server 2.4.35 through to 2.4.63, an access control bypass by trusted clients is possible using TLS 1.3 session resumption.  Configurations are affected when mod_ssl is configured for multiple virtual hosts, with each restricted to a different set of trusted client certificates (for example with a different SSLCACertificateFile/Path setting). In such a case, a client trusted to access one virtual host may be able to access another virtual host, if SSLStrictSNIVHostCheck is not enabled in either virtual host.","scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"2.4.66-1~deb12u1","bookworm-security":"2.4.62-1~deb12u2"},"fixed_version":"2.4.65-1~deb12u1","urgency":"not yet assigned"},"bullseye":{"status":"resolved","repositories":{"bullseye":"2.4.62-1~deb11u1","bullseye-security":"2.4.66-1~deb11u1"},"fixed_version":"2.4.65-1~deb11u1","urgency":"not yet assigned"},"forky":{"status":"resolved","repositories":{"forky":"2.4.66-8"},"fixed_version":"2.4.64-1","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"2.4.66-8"},"fixed_version":"2.4.64-1","urgency":"not yet assigned"},"trixie":{"status":"resolved","repositories":{"trixie":"2.4.66-1~deb13u1"},"fixed_version":"2.4.64-1","urgency":"not yet assigned"}}},"CVE-2025-49630":{"description":"In certain proxy configurations, a denial of service attack against\u00a0Apache HTTP Server versions 2.4.26 through to 2.4.63 can be triggered by untrusted clients causing an assertion in mod_proxy_http2.  Configurations affected are a reverse proxy is configured for an HTTP/2 backend, with ProxyPreserveHost set to \"on\".","scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"2.4.66-1~deb12u1","bookworm-security":"2.4.62-1~deb12u2"},"fixed_version":"2.4.65-1~deb12u1","urgency":"not yet assigned"},"bullseye":{"status":"resolved","repositories":{"bullseye":"2.4.62-1~deb11u1","bullseye-security":"2.4.66-1~deb11u1"},"fixed_version":"2.4.65-1~deb11u1","urgency":"not yet assigned"},"forky":{"status":"resolved","repositories":{"forky":"2.4.66-8"},"fixed_version":"2.4.64-1","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"2.4.66-8"},"fixed_version":"2.4.64-1","urgency":"not yet assigned"},"trixie":{"status":"resolved","repositories":{"trixie":"2.4.66-1~deb13u1"},"fixed_version":"2.4.64-1","urgency":"not yet assigned"}}},"CVE-2025-49812":{"description":"In some mod_ssl configurations on Apache HTTP Server versions through to 2.4.63, an HTTP desynchronisation attack allows a man-in-the-middle attacker to hijack an HTTP session via a TLS upgrade.  Only configurations using \"SSLEngine optional\" to enable TLS upgrades are affected. Users are recommended to upgrade to version 2.4.64, which removes support for TLS upgrade.","scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"2.4.66-1~deb12u1","bookworm-security":"2.4.62-1~deb12u2"},"fixed_version":"2.4.65-1~deb12u1","urgency":"not yet assigned"},"bullseye":{"status":"resolved","repositories":{"bullseye":"2.4.62-1~deb11u1","bullseye-security":"2.4.66-1~deb11u1"},"fixed_version":"2.4.65-1~deb11u1","urgency":"not yet assigned"},"forky":{"status":"resolved","repositories":{"forky":"2.4.66-8"},"fixed_version":"2.4.64-1","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"2.4.66-8"},"fixed_version":"2.4.64-1","urgency":"not yet assigned"},"trixie":{"status":"resolved","repositories":{"trixie":"2.4.66-1~deb13u1"},"fixed_version":"2.4.64-1","urgency":"not yet assigned"}}},"CVE-2025-53020":{"description":"Late Release of Memory after Effective Lifetime vulnerability in Apache HTTP Server.  This issue affects Apache HTTP Server: from 2.4.17 up to 2.4.63.  Users are recommended to upgrade to version 2.4.64, which fixes the issue.","scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"2.4.66-1~deb12u1","bookworm-security":"2.4.62-1~deb12u2"},"fixed_version":"2.4.65-1~deb12u1","urgency":"not yet assigned"},"bullseye":{"status":"resolved","repositories":{"bullseye":"2.4.62-1~deb11u1","bullseye-security":"2.4.66-1~deb11u1"},"fixed_version":"2.4.65-1~deb11u1","urgency":"not yet assigned"},"forky":{"status":"resolved","repositories":{"forky":"2.4.66-8"},"fixed_version":"2.4.64-1","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"2.4.66-8"},"fixed_version":"2.4.64-1","urgency":"not yet assigned"},"trixie":{"status":"resolved","repositories":{"trixie":"2.4.66-1~deb13u1"},"fixed_version":"2.4.64-1","urgency":"not yet assigned"}}},"CVE-2025-54090":{"description":"A bug in Apache HTTP Server 2.4.64 results in all \"RewriteCond expr ...\" tests evaluating as \"true\".    Users are recommended to upgrade to version 2.4.65, which fixes the issue.","scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"2.4.66-1~deb12u1","bookworm-security":"2.4.62-1~deb12u2"},"fixed_version":"0","urgency":"unimportant"},"bullseye":{"status":"resolved","repositories":{"bullseye":"2.4.62-1~deb11u1","bullseye-security":"2.4.66-1~deb11u1"},"fixed_version":"0","urgency":"unimportant"},"forky":{"status":"resolved","repositories":{"forky":"2.4.66-8"},"fixed_version":"2.4.65-1","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"2.4.66-8"},"fixed_version":"2.4.65-1","urgency":"not yet assigned"},"trixie":{"status":"resolved","repositories":{"trixie":"2.4.66-1~deb13u1"},"fixed_version":"2.4.65-1","urgency":"not yet assigned"}}},"CVE-2025-55753":{"description":"An integer overflow in the case of failed ACME certificate renewal leads, after a number of failures (~30 days in default configurations), to the backoff timer becoming 0. Attempts to renew the certificate then are repeated without delays until it succeeds.  This issue affects Apache HTTP Server: from 2.4.30 before 2.4.66.   Users are recommended to upgrade to version 2.4.66, which fixes the issue.","debianbug":1121926,"scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"2.4.66-1~deb12u1","bookworm-security":"2.4.62-1~deb12u2"},"fixed_version":"2.4.66-1~deb12u1","urgency":"not yet assigned"},"bullseye":{"status":"resolved","repositories":{"bullseye":"2.4.62-1~deb11u1","bullseye-security":"2.4.66-1~deb11u1"},"fixed_version":"2.4.66-1~deb11u1","urgency":"not yet assigned"},"forky":{"status":"resolved","repositories":{"forky":"2.4.66-8"},"fixed_version":"2.4.66-1","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"2.4.66-8"},"fixed_version":"2.4.66-1","urgency":"not yet assigned"},"trixie":{"status":"resolved","repositories":{"trixie":"2.4.66-1~deb13u1"},"fixed_version":"2.4.66-1~deb13u1","urgency":"not yet assigned"}}},"CVE-2025-58098":{"description":"Apache HTTP Server 2.4.65 and earlier with Server Side Includes (SSI) enabled and mod_cgid (but not mod_cgi) passes the shell-escaped query string to #exec cmd=\"...\" directives.  This issue affects Apache HTTP Server before 2.4.66.  Users are recommended to upgrade to version 2.4.66, which fixes the issue.","debianbug":1121926,"scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"2.4.66-1~deb12u1","bookworm-security":"2.4.62-1~deb12u2"},"fixed_version":"2.4.66-1~deb12u1","urgency":"not yet assigned"},"bullseye":{"status":"resolved","repositories":{"bullseye":"2.4.62-1~deb11u1","bullseye-security":"2.4.66-1~deb11u1"},"fixed_version":"2.4.66-1~deb11u1","urgency":"not yet assigned"},"forky":{"status":"resolved","repositories":{"forky":"2.4.66-8"},"fixed_version":"2.4.66-1","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"2.4.66-8"},"fixed_version":"2.4.66-1","urgency":"not yet assigned"},"trixie":{"status":"resolved","repositories":{"trixie":"2.4.66-1~deb13u1"},"fixed_version":"2.4.66-1~deb13u1","urgency":"not yet assigned"}}},"CVE-2025-59775":{"description":"Server-Side Request Forgery (SSRF) vulnerability   \u00a0in Apache HTTP Server on Windows   with AllowEncodedSlashes On\u00a0and MergeSlashes Off\u00a0 allows to potentially leak NTLM  hashes to a malicious server via SSRF and malicious requests or content  Users are recommended to upgrade to version 2.4.66, which fixes the issue.","scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"2.4.66-1~deb12u1","bookworm-security":"2.4.62-1~deb12u2"},"fixed_version":"0","urgency":"unimportant"},"bullseye":{"status":"resolved","repositories":{"bullseye":"2.4.62-1~deb11u1","bullseye-security":"2.4.66-1~deb11u1"},"fixed_version":"0","urgency":"unimportant"},"forky":{"status":"resolved","repositories":{"forky":"2.4.66-8"},"fixed_version":"0","urgency":"unimportant"},"sid":{"status":"resolved","repositories":{"sid":"2.4.66-8"},"fixed_version":"0","urgency":"unimportant"},"trixie":{"status":"resolved","repositories":{"trixie":"2.4.66-1~deb13u1"},"fixed_version":"0","urgency":"unimportant"}}},"CVE-2025-65082":{"description":"Improper Neutralization of Escape, Meta, or Control Sequences vulnerability in Apache HTTP Server through environment variables set via the Apache configuration unexpectedly superseding variables calculated by the server for CGI programs.  This issue affects Apache HTTP Server from 2.4.0 through 2.4.65.  Users are recommended to upgrade to version 2.4.66 which fixes the issue.","debianbug":1121926,"scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"2.4.66-1~deb12u1","bookworm-security":"2.4.62-1~deb12u2"},"fixed_version":"2.4.66-1~deb12u1","urgency":"not yet assigned"},"bullseye":{"status":"resolved","repositories":{"bullseye":"2.4.62-1~deb11u1","bullseye-security":"2.4.66-1~deb11u1"},"fixed_version":"2.4.66-1~deb11u1","urgency":"not yet assigned"},"forky":{"status":"resolved","repositories":{"forky":"2.4.66-8"},"fixed_version":"2.4.66-1","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"2.4.66-8"},"fixed_version":"2.4.66-1","urgency":"not yet assigned"},"trixie":{"status":"resolved","repositories":{"trixie":"2.4.66-1~deb13u1"},"fixed_version":"2.4.66-1~deb13u1","urgency":"not yet assigned"}}},"CVE-2025-66200":{"description":"mod_userdir+suexec bypass via AllowOverride FileInfo vulnerability in Apache HTTP Server. Users with access to use the RequestHeader directive in htaccess can cause some CGI scripts to run under an unexpected userid.  This issue affects Apache HTTP Server: from 2.4.7 through 2.4.65.  Users are recommended to upgrade to version 2.4.66, which fixes the issue.","debianbug":1121926,"scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"2.4.66-1~deb12u1","bookworm-security":"2.4.62-1~deb12u2"},"fixed_version":"2.4.66-1~deb12u1","urgency":"not yet assigned"},"bullseye":{"status":"resolved","repositories":{"bullseye":"2.4.62-1~deb11u1","bullseye-security":"2.4.66-1~deb11u1"},"fixed_version":"2.4.66-1~deb11u1","urgency":"not yet assigned"},"forky":{"status":"resolved","repositories":{"forky":"2.4.66-8"},"fixed_version":"2.4.66-1","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"2.4.66-8"},"fixed_version":"2.4.66-1","urgency":"not yet assigned"},"trixie":{"status":"resolved","repositories":{"trixie":"2.4.66-1~deb13u1"},"fixed_version":"2.4.66-1~deb13u1","urgency":"not yet assigned"}}},"TEMP-0535886-8B62DC":{"debianbug":535886,"releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"2.4.66-1~deb12u1","bookworm-security":"2.4.62-1~deb12u2"},"fixed_version":"2.2.9-1","urgency":"low"},"bullseye":{"status":"resolved","repositories":{"bullseye":"2.4.62-1~deb11u1","bullseye-security":"2.4.66-1~deb11u1"},"fixed_version":"2.2.9-1","urgency":"low"},"forky":{"status":"resolved","repositories":{"forky":"2.4.66-8"},"fixed_version":"2.2.9-1","urgency":"low"},"sid":{"status":"resolved","repositories":{"sid":"2.4.66-8"},"fixed_version":"2.2.9-1","urgency":"low"},"trixie":{"status":"resolved","repositories":{"trixie":"2.4.66-1~deb13u1"},"fixed_version":"2.2.9-1","urgency":"low"}}}},"apachetop":{"CVE-2005-2660":{"description":"apachetop 0.12.5 and earlier, when running in debug mode, allows local users to create or append to arbitrary files via a symlink attack on atop.debug.","scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"0.23.2-1"},"fixed_version":"0.12.5-3","urgency":"not yet assigned"},"bullseye":{"status":"resolved","repositories":{"bullseye":"0.19.7-3"},"fixed_version":"0.12.5-3","urgency":"not yet assigned"},"forky":{"status":"resolved","repositories":{"forky":"0.23.2-4"},"fixed_version":"0.12.5-3","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"0.23.2-4"},"fixed_version":"0.12.5-3","urgency":"not yet assigned"},"trixie":{"status":"resolved","repositories":{"trixie":"0.23.2-3"},"fixed_version":"0.12.5-3","urgency":"not yet assigned"}}}},"apcupsd":{"CVE-2003-0098":{"description":"Unknown vulnerability in apcupsd before 3.8.6, and 3.10.x before 3.10.5, allows remote attackers to gain root privileges, possibly via format strings in a request to a slave server.","scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"3.14.14-3.1"},"fixed_version":"3.8.5-1.2","urgency":"not yet assigned"},"bullseye":{"status":"resolved","repositories":{"bullseye":"3.14.14-3.1"},"fixed_version":"3.8.5-1.2","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"3.14.14-7"},"fixed_version":"3.8.5-1.2","urgency":"not yet assigned"},"trixie":{"status":"resolved","repositories":{"trixie":"3.14.14-5"},"fixed_version":"3.8.5-1.2","urgency":"not yet assigned"}}},"CVE-2003-0099":{"description":"Multiple buffer overflows in apcupsd before 3.8.6, and 3.10.x before 3.10.5, may allow attackers to cause a denial of service or execute arbitrary code, related to usage of the vsprintf function.","scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"3.14.14-3.1"},"fixed_version":"3.8.5-1.2","urgency":"not yet assigned"},"bullseye":{"status":"resolved","repositories":{"bullseye":"3.14.14-3.1"},"fixed_version":"3.8.5-1.2","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"3.14.14-7"},"fixed_version":"3.8.5-1.2","urgency":"not yet assigned"},"trixie":{"status":"resolved","repositories":{"trixie":"3.14.14-5"},"fixed_version":"3.8.5-1.2","urgency":"not yet assigned"}}},"CVE-2017-7884":{"description":"In Adam Kropelin adk0212 APC UPS Daemon through 3.14.14, the default installation of APCUPSD allows a local authenticated, but unprivileged, user to run arbitrary code with elevated privileges by replacing the service executable apcupsd.exe with a malicious executable that will run with SYSTEM privileges at startup. This occurs because of \"RW NT AUTHORITY\\Authenticated Users\" permissions for %SYSTEMDRIVE%\\apcupsd\\bin\\apcupsd.exe.","scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"3.14.14-3.1"},"fixed_version":"0","urgency":"unimportant"},"bullseye":{"status":"resolved","repositories":{"bullseye":"3.14.14-3.1"},"fixed_version":"0","urgency":"unimportant"},"sid":{"status":"resolved","repositories":{"sid":"3.14.14-7"},"fixed_version":"0","urgency":"unimportant"},"trixie":{"status":"resolved","repositories":{"trixie":"3.14.14-5"},"fixed_version":"0","urgency":"unimportant"}}},"CVE-2019-12584":{"description":"Apcupsd 0.3.91_5, as used in pfSense through 2.4.4-RELEASE-p3 and other products, has an XSS issue in apcupsd_status.php.","scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"3.14.14-3.1"},"fixed_version":"0","urgency":"unimportant"},"bullseye":{"status":"resolved","repositories":{"bullseye":"3.14.14-3.1"},"fixed_version":"0","urgency":"unimportant"},"sid":{"status":"resolved","repositories":{"sid":"3.14.14-7"},"fixed_version":"0","urgency":"unimportant"},"trixie":{"status":"resolved","repositories":{"trixie":"3.14.14-5"},"fixed_version":"0","urgency":"unimportant"}}},"CVE-2019-12585":{"description":"Apcupsd 0.3.91_5, as used in pfSense through 2.4.4-RELEASE-p3 and other products, has an Arbitrary Command Execution issue in apcupsd_status.php.","scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"3.14.14-3.1"},"fixed_version":"0","urgency":"unimportant"},"bullseye":{"status":"resolved","repositories":{"bullseye":"3.14.14-3.1"},"fixed_version":"0","urgency":"unimportant"},"sid":{"status":"resolved","repositories":{"sid":"3.14.14-7"},"fixed_version":"0","urgency":"unimportant"},"trixie":{"status":"resolved","repositories":{"trixie":"3.14.14-5"},"fixed_version":"0","urgency":"unimportant"}}}},"apertium":{"CVE-2008-4939":{"description":"apertium 3.0.7 allows local users to overwrite arbitrary files via a symlink attack on (a) /tmp/#####.lex.cc, (b) /tmp/#####.deformat.l, (c) /tmp/#####.reformat.l, (d) /tmp/#####docxorig, (e) /tmp/#####docxsalida.zip, (f) /tmp/#####xlsxembed, (g) /tmp/#####xlsxorig, and (h) /tmp/#####xslxsalida.zip temporary files, related to the (1) apertium-gen-deformat, (2) apertium-gen-reformat, and (3) apertium scripts.","debianbug":496395,"scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"3.8.3-1"},"fixed_version":"3.0.7+1-1.1","urgency":"low"},"bullseye":{"status":"resolved","repositories":{"bullseye":"3.7.1-1"},"fixed_version":"3.0.7+1-1.1","urgency":"low"},"forky":{"status":"resolved","repositories":{"forky":"3.9.12-1"},"fixed_version":"3.0.7+1-1.1","urgency":"low"},"sid":{"status":"resolved","repositories":{"sid":"3.9.12-1"},"fixed_version":"3.0.7+1-1.1","urgency":"low"},"trixie":{"status":"resolved","repositories":{"trixie":"3.9.12-1"},"fixed_version":"3.0.7+1-1.1","urgency":"low"}}}},"apg":{"TEMP-0412618-38583E":{"debianbug":412618,"releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"2.2.3.dfsg.1-5"},"fixed_version":"2.2.3.dfsg.1-2","urgency":"low"},"bullseye":{"status":"resolved","repositories":{"bullseye":"2.2.3.dfsg.1-5"},"fixed_version":"2.2.3.dfsg.1-2","urgency":"low"},"forky":{"status":"resolved","repositories":{"forky":"2.2.3.dfsg.1-8"},"fixed_version":"2.2.3.dfsg.1-2","urgency":"low"},"sid":{"status":"resolved","repositories":{"sid":"2.2.3.dfsg.1-8"},"fixed_version":"2.2.3.dfsg.1-2","urgency":"low"},"trixie":{"status":"resolved","repositories":{"trixie":"2.2.3.dfsg.1-7"},"fixed_version":"2.2.3.dfsg.1-2","urgency":"low"}}}},"apktool":{"CVE-2017-8315":{"description":"Eclipse XML parser for the Eclipse IDE versions 2017.2.5 and earlier was found vulnerable to an XML External Entity attack. An attacker can exploit the vulnerability by implementing malicious code on Androidmanifest.xml.","scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"2.7.0+dfsg-6+deb12u1"},"fixed_version":"2.2.4-1","urgency":"low"},"bullseye":{"status":"resolved","repositories":{"bullseye":"2.5.0+dfsg.1-2"},"fixed_version":"2.2.4-1","urgency":"low"},"forky":{"status":"resolved","repositories":{"forky":"2.7.0+dfsg-7.1"},"fixed_version":"2.2.4-1","urgency":"low"},"sid":{"status":"resolved","repositories":{"sid":"2.7.0+dfsg-7.1"},"fixed_version":"2.2.4-1","urgency":"low"},"trixie":{"status":"resolved","repositories":{"trixie":"2.7.0+dfsg-7"},"fixed_version":"2.2.4-1","urgency":"low"}}},"CVE-2024-21633":{"description":"Apktool is a tool for reverse engineering Android APK files. In versions 2.9.1 and prior, Apktool infers resource files' output path according to their resource names which can be manipulated by attacker to place files at desired location on the system Apktool runs on. Affected environments are those in which an attacker may write/overwrite any file that user has write access, and either user name is known or cwd is under user folder. Commit d348c43b24a9de350ff6e5bd610545a10c1fc712 contains a patch for this issue.","debianbug":1060013,"scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"2.7.0+dfsg-6+deb12u1"},"fixed_version":"2.7.0+dfsg-6+deb12u1","urgency":"not yet assigned"},"bullseye":{"status":"open","repositories":{"bullseye":"2.5.0+dfsg.1-2"},"urgency":"not yet assigned","nodsa":"Minor issue","nodsa_reason":"ignored"},"forky":{"status":"resolved","repositories":{"forky":"2.7.0+dfsg-7.1"},"fixed_version":"2.7.0+dfsg-7","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"2.7.0+dfsg-7.1"},"fixed_version":"2.7.0+dfsg-7","urgency":"not yet assigned"},"trixie":{"status":"resolved","repositories":{"trixie":"2.7.0+dfsg-7"},"fixed_version":"2.7.0+dfsg-7","urgency":"not yet assigned"}}}},"apng2gif":{"CVE-2017-6960":{"description":"An issue was discovered in apng2gif 1.7. There is an integer overflow resulting in a heap-based buffer over-read, related to the load_apng function and the imagesize variable.","debianbug":854367,"scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"1.8-4"},"fixed_version":"1.8-0.1","urgency":"not yet assigned"},"bullseye":{"status":"resolved","repositories":{"bullseye":"1.8-2"},"fixed_version":"1.8-0.1","urgency":"not yet assigned"},"forky":{"status":"resolved","repositories":{"forky":"1.8-5"},"fixed_version":"1.8-0.1","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"1.8-5"},"fixed_version":"1.8-0.1","urgency":"not yet assigned"},"trixie":{"status":"resolved","repositories":{"trixie":"1.8-5"},"fixed_version":"1.8-0.1","urgency":"not yet assigned"}}},"CVE-2017-6961":{"description":"An issue was discovered in apng2gif 1.7. There is improper sanitization of user input causing huge memory allocations, resulting in a crash. This is related to the read_chunk function using the pChunk->size value (within the PNG file) to determine the amount of memory to allocate.","debianbug":854441,"scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"1.8-4"},"fixed_version":"1.8-0.1","urgency":"not yet assigned"},"bullseye":{"status":"resolved","repositories":{"bullseye":"1.8-2"},"fixed_version":"1.8-0.1","urgency":"not yet assigned"},"forky":{"status":"resolved","repositories":{"forky":"1.8-5"},"fixed_version":"1.8-0.1","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"1.8-5"},"fixed_version":"1.8-0.1","urgency":"not yet assigned"},"trixie":{"status":"resolved","repositories":{"trixie":"1.8-5"},"fixed_version":"1.8-0.1","urgency":"not yet assigned"}}},"CVE-2017-6962":{"description":"An issue was discovered in apng2gif 1.7. There is an integer overflow resulting in a heap-based buffer overflow. This is related to the read_chunk function making an unchecked addition of 12.","debianbug":854447,"scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"1.8-4"},"fixed_version":"1.8-0.1","urgency":"not yet assigned"},"bullseye":{"status":"resolved","repositories":{"bullseye":"1.8-2"},"fixed_version":"1.8-0.1","urgency":"not yet assigned"},"forky":{"status":"resolved","repositories":{"forky":"1.8-5"},"fixed_version":"1.8-0.1","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"1.8-5"},"fixed_version":"1.8-0.1","urgency":"not yet assigned"},"trixie":{"status":"resolved","repositories":{"trixie":"1.8-5"},"fixed_version":"1.8-0.1","urgency":"not yet assigned"}}}},"apparmor":{"CVE-2014-1424":{"description":"apparmor_parser in the apparmor package before 2.8.95~2430-0ubuntu5.1 in Ubuntu 14.04 allows attackers to bypass AppArmor policies via unspecified vectors, related to a \"miscompilation flaw.\"","scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"3.0.8-3"},"fixed_version":"0","urgency":"unimportant"},"bullseye":{"status":"resolved","repositories":{"bullseye":"2.13.6-10"},"fixed_version":"0","urgency":"unimportant"},"forky":{"status":"resolved","repositories":{"forky":"4.1.6-3"},"fixed_version":"0","urgency":"unimportant"},"sid":{"status":"resolved","repositories":{"sid":"4.1.6-3"},"fixed_version":"0","urgency":"unimportant"},"trixie":{"status":"resolved","repositories":{"trixie":"4.1.0-1"},"fixed_version":"0","urgency":"unimportant"}}},"CVE-2016-1585":{"description":"In all versions of AppArmor mount rules are accidentally widened when compiled.","debianbug":929990,"scope":"local","releases":{"bookworm":{"status":"open","repositories":{"bookworm":"3.0.8-3"},"urgency":"unimportant"},"bullseye":{"status":"open","repositories":{"bullseye":"2.13.6-10"},"urgency":"unimportant"},"forky":{"status":"resolved","repositories":{"forky":"4.1.6-3"},"fixed_version":"3.0.12-1","urgency":"unimportant"},"sid":{"status":"resolved","repositories":{"sid":"4.1.6-3"},"fixed_version":"3.0.12-1","urgency":"unimportant"},"trixie":{"status":"resolved","repositories":{"trixie":"4.1.0-1"},"fixed_version":"3.0.12-1","urgency":"unimportant"}}},"CVE-2017-6507":{"description":"An issue was discovered in AppArmor before 2.12. Incorrect handling of unknown AppArmor profiles in AppArmor init scripts, upstart jobs, and/or systemd unit files allows an attacker to possibly have increased attack surfaces of processes that were intended to be confined by AppArmor. This is due to the common logic to handle 'restart' operations removing AppArmor profiles that aren't found in the typical filesystem locations, such as /etc/apparmor.d/. Userspace projects that manage their own AppArmor profiles in atypical directories, such as what's done by LXD and Docker, are affected by this flaw in the AppArmor init script logic.","debianbug":858768,"scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"3.0.8-3"},"fixed_version":"2.11.0-3","urgency":"not yet assigned"},"bullseye":{"status":"resolved","repositories":{"bullseye":"2.13.6-10"},"fixed_version":"2.11.0-3","urgency":"not yet assigned"},"forky":{"status":"resolved","repositories":{"forky":"4.1.6-3"},"fixed_version":"2.11.0-3","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"4.1.6-3"},"fixed_version":"2.11.0-3","urgency":"not yet assigned"},"trixie":{"status":"resolved","repositories":{"trixie":"4.1.0-1"},"fixed_version":"2.11.0-3","urgency":"not yet assigned"}}}},"apptainer":{"CVE-2025-65105":{"description":"Apptainer is an open source container platform. In Apptainer versions less than 1.4.5, a container can disable two of the forms of the little used --security option, in particular the forms --security=apparmor:<profile> and --security=selinux:<label> which otherwise put restrictions on operations that containers can do. The --security option has always been mentioned in Apptainer documentation as being a feature for the root user, although these forms do also work for unprivileged users on systems where the corresponding feature is enabled. Apparmor is enabled by default on Debian-based distributions and SElinux is enabled by default on RHEL-based distributions, but on SUSE it depends on the distribution version. This vulnerability is fixed in 1.4.5.","debianbug":1121844,"scope":"local","releases":{"forky":{"status":"resolved","repositories":{"forky":"1.4.5-1"},"fixed_version":"1.4.5-1","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"1.4.5-2"},"fixed_version":"1.4.5-1","urgency":"not yet assigned"}}}},"apr":{"CVE-2009-2412":{"description":"Multiple integer overflows in the Apache Portable Runtime (APR) library and the Apache Portable Utility library (aka APR-util) 0.9.x and 1.3.x allow remote attackers to cause a denial of service (application crash) or possibly execute arbitrary code via vectors that trigger crafted calls to the (1) allocator_alloc or (2) apr_palloc function in memory/unix/apr_pools.c in APR; or crafted calls to the (3) apr_rmm_malloc, (4) apr_rmm_calloc, or (5) apr_rmm_realloc function in misc/apr_rmm.c in APR-util; leading to buffer overflows.  NOTE: some of these details are obtained from third party information.","scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"1.7.2-3+deb12u1"},"fixed_version":"1.3.8-1","urgency":"not yet assigned"},"bullseye":{"status":"resolved","repositories":{"bullseye":"1.7.0-6+deb11u2","bullseye-security":"1.7.0-6+deb11u2"},"fixed_version":"1.3.8-1","urgency":"not yet assigned"},"forky":{"status":"resolved","repositories":{"forky":"1.7.6-3"},"fixed_version":"1.3.8-1","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"1.7.6-3"},"fixed_version":"1.3.8-1","urgency":"not yet assigned"},"trixie":{"status":"resolved","repositories":{"trixie":"1.7.5-1"},"fixed_version":"1.3.8-1","urgency":"not yet assigned"}}},"CVE-2009-2699":{"description":"The Solaris pollset feature in the Event Port backend in poll/unix/port.c in the Apache Portable Runtime (APR) library before 1.3.9, as used in the Apache HTTP Server before 2.2.14 and other products, does not properly handle errors, which allows remote attackers to cause a denial of service (daemon hang) via unspecified HTTP requests, related to the prefork and event MPMs.","scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"1.7.2-3+deb12u1"},"fixed_version":"0","urgency":"unimportant"},"bullseye":{"status":"resolved","repositories":{"bullseye":"1.7.0-6+deb11u2","bullseye-security":"1.7.0-6+deb11u2"},"fixed_version":"0","urgency":"unimportant"},"forky":{"status":"resolved","repositories":{"forky":"1.7.6-3"},"fixed_version":"0","urgency":"unimportant"},"sid":{"status":"resolved","repositories":{"sid":"1.7.6-3"},"fixed_version":"0","urgency":"unimportant"},"trixie":{"status":"resolved","repositories":{"trixie":"1.7.5-1"},"fixed_version":"0","urgency":"unimportant"}}},"CVE-2011-0419":{"description":"Stack consumption vulnerability in the fnmatch implementation in apr_fnmatch.c in the Apache Portable Runtime (APR) library before 1.4.3 and the Apache HTTP Server before 2.2.18, and in fnmatch.c in libc in NetBSD 5.1, OpenBSD 4.8, FreeBSD, Apple Mac OS X 10.6, Oracle Solaris 10, and Android, allows context-dependent attackers to cause a denial of service (CPU and memory consumption) via *? sequences in the first argument, as demonstrated by attacks against mod_autoindex in httpd.","scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"1.7.2-3+deb12u1"},"fixed_version":"1.4.4-1","urgency":"low"},"bullseye":{"status":"resolved","repositories":{"bullseye":"1.7.0-6+deb11u2","bullseye-security":"1.7.0-6+deb11u2"},"fixed_version":"1.4.4-1","urgency":"low"},"forky":{"status":"resolved","repositories":{"forky":"1.7.6-3"},"fixed_version":"1.4.4-1","urgency":"low"},"sid":{"status":"resolved","repositories":{"sid":"1.7.6-3"},"fixed_version":"1.4.4-1","urgency":"low"},"trixie":{"status":"resolved","repositories":{"trixie":"1.7.5-1"},"fixed_version":"1.4.4-1","urgency":"low"}}},"CVE-2011-1928":{"description":"The fnmatch implementation in apr_fnmatch.c in the Apache Portable Runtime (APR) library 1.4.3 and 1.4.4, and the Apache HTTP Server 2.2.18, allows remote attackers to cause a denial of service (infinite loop) via a URI that does not match unspecified types of wildcard patterns, as demonstrated by attacks against mod_autoindex in httpd when a /*/WEB-INF/ configuration pattern is used.  NOTE: this issue exists because of an incorrect fix for CVE-2011-0419.","debianbug":627182,"scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"1.7.2-3+deb12u1"},"fixed_version":"1.4.5-1","urgency":"not yet assigned"},"bullseye":{"status":"resolved","repositories":{"bullseye":"1.7.0-6+deb11u2","bullseye-security":"1.7.0-6+deb11u2"},"fixed_version":"1.4.5-1","urgency":"not yet assigned"},"forky":{"status":"resolved","repositories":{"forky":"1.7.6-3"},"fixed_version":"1.4.5-1","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"1.7.6-3"},"fixed_version":"1.4.5-1","urgency":"not yet assigned"},"trixie":{"status":"resolved","repositories":{"trixie":"1.7.5-1"},"fixed_version":"1.4.5-1","urgency":"not yet assigned"}}},"CVE-2012-0840":{"description":"tables/apr_hash.c in the Apache Portable Runtime (APR) library through 1.4.5 computes hash values without restricting the ability to trigger hash collisions predictably, which allows context-dependent attackers to cause a denial of service (CPU consumption) via crafted input to an application that maintains a hash table.","debianbug":655435,"scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"1.7.2-3+deb12u1"},"fixed_version":"1.4.6-1","urgency":"low"},"bullseye":{"status":"resolved","repositories":{"bullseye":"1.7.0-6+deb11u2","bullseye-security":"1.7.0-6+deb11u2"},"fixed_version":"1.4.6-1","urgency":"low"},"forky":{"status":"resolved","repositories":{"forky":"1.7.6-3"},"fixed_version":"1.4.6-1","urgency":"low"},"sid":{"status":"resolved","repositories":{"sid":"1.7.6-3"},"fixed_version":"1.4.6-1","urgency":"low"},"trixie":{"status":"resolved","repositories":{"trixie":"1.7.5-1"},"fixed_version":"1.4.6-1","urgency":"low"}}},"CVE-2017-12613":{"description":"When apr_time_exp*() or apr_os_exp_time*() functions are invoked with an invalid month field value in Apache Portable Runtime APR 1.6.2 and prior, out of bounds memory may be accessed in converting this value to an apr_time_exp_t value, potentially revealing the contents of a different static heap value or resulting in program termination, and may represent an information disclosure or denial of service vulnerability to applications which call these APR functions with unvalidated external input.","debianbug":879708,"scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"1.7.2-3+deb12u1"},"fixed_version":"1.6.3-1","urgency":"low"},"bullseye":{"status":"resolved","repositories":{"bullseye":"1.7.0-6+deb11u2","bullseye-security":"1.7.0-6+deb11u2"},"fixed_version":"1.6.3-1","urgency":"low"},"forky":{"status":"resolved","repositories":{"forky":"1.7.6-3"},"fixed_version":"1.6.3-1","urgency":"low"},"sid":{"status":"resolved","repositories":{"sid":"1.7.6-3"},"fixed_version":"1.6.3-1","urgency":"low"},"trixie":{"status":"resolved","repositories":{"trixie":"1.7.5-1"},"fixed_version":"1.6.3-1","urgency":"low"}}},"CVE-2021-35940":{"description":"An out-of-bounds array read in the apr_time_exp*() functions was fixed in the Apache Portable Runtime 1.6.3 release (CVE-2017-12613). The fix for this issue was not carried forward to the APR 1.7.x branch, and hence version 1.7.0 regressed compared to 1.6.3 and is vulnerable to the same issue.","debianbug":992789,"scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"1.7.2-3+deb12u1"},"fixed_version":"1.7.0-7","urgency":"not yet assigned"},"bullseye":{"status":"resolved","repositories":{"bullseye":"1.7.0-6+deb11u2","bullseye-security":"1.7.0-6+deb11u2"},"fixed_version":"1.7.0-6+deb11u1","urgency":"not yet assigned"},"forky":{"status":"resolved","repositories":{"forky":"1.7.6-3"},"fixed_version":"1.7.0-7","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"1.7.6-3"},"fixed_version":"1.7.0-7","urgency":"not yet assigned"},"trixie":{"status":"resolved","repositories":{"trixie":"1.7.5-1"},"fixed_version":"1.7.0-7","urgency":"not yet assigned"}}},"CVE-2022-24963":{"description":"Integer Overflow or Wraparound vulnerability in apr_encode functions of Apache Portable Runtime (APR) allows an attacker to write beyond bounds of a buffer. This issue affects Apache Portable Runtime (APR) version 1.7.0.","scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"1.7.2-3+deb12u1"},"fixed_version":"1.7.2-1","urgency":"not yet assigned"},"bullseye":{"status":"resolved","repositories":{"bullseye":"1.7.0-6+deb11u2","bullseye-security":"1.7.0-6+deb11u2"},"fixed_version":"1.7.0-6+deb11u2","urgency":"not yet assigned"},"forky":{"status":"resolved","repositories":{"forky":"1.7.6-3"},"fixed_version":"1.7.2-1","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"1.7.6-3"},"fixed_version":"1.7.2-1","urgency":"not yet assigned"},"trixie":{"status":"resolved","repositories":{"trixie":"1.7.5-1"},"fixed_version":"1.7.2-1","urgency":"not yet assigned"}}},"CVE-2022-28331":{"description":"On Windows, Apache Portable Runtime 1.7.0 and earlier may write beyond the end of a stack based buffer in apr_socket_sendv(). This is a result of integer overflow.","scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"1.7.2-3+deb12u1"},"fixed_version":"0","urgency":"unimportant"},"bullseye":{"status":"resolved","repositories":{"bullseye":"1.7.0-6+deb11u2","bullseye-security":"1.7.0-6+deb11u2"},"fixed_version":"0","urgency":"unimportant"},"forky":{"status":"resolved","repositories":{"forky":"1.7.6-3"},"fixed_version":"0","urgency":"unimportant"},"sid":{"status":"resolved","repositories":{"sid":"1.7.6-3"},"fixed_version":"0","urgency":"unimportant"},"trixie":{"status":"resolved","repositories":{"trixie":"1.7.5-1"},"fixed_version":"0","urgency":"unimportant"}}},"CVE-2023-49582":{"description":"Lax permissions set by the Apache Portable Runtime library on Unix platforms would allow local users read access to named shared memory segments, potentially revealing sensitive application data.   This issue does not affect non-Unix platforms, or builds with\u00a0APR_USE_SHMEM_SHMGET=1 (apr.h)  Users are recommended to upgrade to APR version 1.7.5, which fixes this issue.","debianbug":1080375,"scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"1.7.2-3+deb12u1"},"fixed_version":"1.7.2-3+deb12u1","urgency":"not yet assigned"},"bullseye":{"status":"open","repositories":{"bullseye":"1.7.0-6+deb11u2","bullseye-security":"1.7.0-6+deb11u2"},"urgency":"not yet assigned","nodsa":"binary packages not affected due to APR_USE_SHMEM_SHMGET=1","nodsa_reason":"ignored"},"forky":{"status":"resolved","repositories":{"forky":"1.7.6-3"},"fixed_version":"1.7.5-1","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"1.7.6-3"},"fixed_version":"1.7.5-1","urgency":"not yet assigned"},"trixie":{"status":"resolved","repositories":{"trixie":"1.7.5-1"},"fixed_version":"1.7.5-1","urgency":"not yet assigned"}}}},"apr-util":{"CVE-2009-0023":{"description":"The apr_strmatch_precompile function in strmatch/apr_strmatch.c in Apache APR-util before 1.3.5 allows remote attackers to cause a denial of service (daemon crash) via crafted input involving (1) a .htaccess file used with the Apache HTTP Server, (2) the SVNMasterURI directive in the mod_dav_svn module in the Apache HTTP Server, (3) the mod_apreq2 module for the Apache HTTP Server, or (4) an application that uses the libapreq2 library, which triggers a heap-based buffer underflow.","scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"1.6.3-1"},"fixed_version":"1.3.7+dfsg-1","urgency":"not yet assigned"},"bullseye":{"status":"resolved","repositories":{"bullseye":"1.6.1-5+deb11u1","bullseye-security":"1.6.1-5+deb11u1"},"fixed_version":"1.3.7+dfsg-1","urgency":"not yet assigned"},"forky":{"status":"resolved","repositories":{"forky":"1.6.3-4"},"fixed_version":"1.3.7+dfsg-1","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"1.6.3-4"},"fixed_version":"1.3.7+dfsg-1","urgency":"not yet assigned"},"trixie":{"status":"resolved","repositories":{"trixie":"1.6.3-3"},"fixed_version":"1.3.7+dfsg-1","urgency":"not yet assigned"}}},"CVE-2009-1955":{"description":"The expat XML parser in the apr_xml_* interface in xml/apr_xml.c in Apache APR-util before 1.3.7, as used in the mod_dav and mod_dav_svn modules in the Apache HTTP Server, allows remote attackers to cause a denial of service (memory consumption) via a crafted XML document containing a large number of nested entity references, as demonstrated by a PROPFIND request, a similar issue to CVE-2003-1564.","scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"1.6.3-1"},"fixed_version":"1.3.7+dfsg-1","urgency":"medium"},"bullseye":{"status":"resolved","repositories":{"bullseye":"1.6.1-5+deb11u1","bullseye-security":"1.6.1-5+deb11u1"},"fixed_version":"1.3.7+dfsg-1","urgency":"medium"},"forky":{"status":"resolved","repositories":{"forky":"1.6.3-4"},"fixed_version":"1.3.7+dfsg-1","urgency":"medium"},"sid":{"status":"resolved","repositories":{"sid":"1.6.3-4"},"fixed_version":"1.3.7+dfsg-1","urgency":"medium"},"trixie":{"status":"resolved","repositories":{"trixie":"1.6.3-3"},"fixed_version":"1.3.7+dfsg-1","urgency":"medium"}}},"CVE-2009-1956":{"description":"Off-by-one error in the apr_brigade_vprintf function in Apache APR-util before 1.3.5 on big-endian platforms allows remote attackers to obtain sensitive information or cause a denial of service (application crash) via crafted input.","scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"1.6.3-1"},"fixed_version":"1.3.7+dfsg-1","urgency":"low"},"bullseye":{"status":"resolved","repositories":{"bullseye":"1.6.1-5+deb11u1","bullseye-security":"1.6.1-5+deb11u1"},"fixed_version":"1.3.7+dfsg-1","urgency":"low"},"forky":{"status":"resolved","repositories":{"forky":"1.6.3-4"},"fixed_version":"1.3.7+dfsg-1","urgency":"low"},"sid":{"status":"resolved","repositories":{"sid":"1.6.3-4"},"fixed_version":"1.3.7+dfsg-1","urgency":"low"},"trixie":{"status":"resolved","repositories":{"trixie":"1.6.3-3"},"fixed_version":"1.3.7+dfsg-1","urgency":"low"}}},"CVE-2009-2412":{"description":"Multiple integer overflows in the Apache Portable Runtime (APR) library and the Apache Portable Utility library (aka APR-util) 0.9.x and 1.3.x allow remote attackers to cause a denial of service (application crash) or possibly execute arbitrary code via vectors that trigger crafted calls to the (1) allocator_alloc or (2) apr_palloc function in memory/unix/apr_pools.c in APR; or crafted calls to the (3) apr_rmm_malloc, (4) apr_rmm_calloc, or (5) apr_rmm_realloc function in misc/apr_rmm.c in APR-util; leading to buffer overflows.  NOTE: some of these details are obtained from third party information.","scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"1.6.3-1"},"fixed_version":"1.3.9+dfsg-1","urgency":"not yet assigned"},"bullseye":{"status":"resolved","repositories":{"bullseye":"1.6.1-5+deb11u1","bullseye-security":"1.6.1-5+deb11u1"},"fixed_version":"1.3.9+dfsg-1","urgency":"not yet assigned"},"forky":{"status":"resolved","repositories":{"forky":"1.6.3-4"},"fixed_version":"1.3.9+dfsg-1","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"1.6.3-4"},"fixed_version":"1.3.9+dfsg-1","urgency":"not yet assigned"},"trixie":{"status":"resolved","repositories":{"trixie":"1.6.3-3"},"fixed_version":"1.3.9+dfsg-1","urgency":"not yet assigned"}}},"CVE-2010-1623":{"description":"Memory leak in the apr_brigade_split_line function in buckets/apr_brigade.c in the Apache Portable Runtime Utility library (aka APR-util) before 1.3.10, as used in the mod_reqtimeout module in the Apache HTTP Server and other software, allows remote attackers to cause a denial of service (memory consumption) via unspecified vectors related to the destruction of an APR bucket.","scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"1.6.3-1"},"fixed_version":"1.3.9+dfsg-4","urgency":"medium"},"bullseye":{"status":"resolved","repositories":{"bullseye":"1.6.1-5+deb11u1","bullseye-security":"1.6.1-5+deb11u1"},"fixed_version":"1.3.9+dfsg-4","urgency":"medium"},"forky":{"status":"resolved","repositories":{"forky":"1.6.3-4"},"fixed_version":"1.3.9+dfsg-4","urgency":"medium"},"sid":{"status":"resolved","repositories":{"sid":"1.6.3-4"},"fixed_version":"1.3.9+dfsg-4","urgency":"medium"},"trixie":{"status":"resolved","repositories":{"trixie":"1.6.3-3"},"fixed_version":"1.3.9+dfsg-4","urgency":"medium"}}},"CVE-2016-6312":{"description":"The mod_dontdothat component of the mod_dav_svn Apache module in Subversion as packaged in Red Hat Enterprise Linux 5.11 does not properly detect recursion during entity expansion, which allows remote authenticated users with access to the webdav repository to cause a denial of service (memory consumption and httpd crash).  NOTE: Exists as a regression to CVE-2009-1955.","scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"1.6.3-1"},"fixed_version":"0","urgency":"unimportant"},"bullseye":{"status":"resolved","repositories":{"bullseye":"1.6.1-5+deb11u1","bullseye-security":"1.6.1-5+deb11u1"},"fixed_version":"0","urgency":"unimportant"},"forky":{"status":"resolved","repositories":{"forky":"1.6.3-4"},"fixed_version":"0","urgency":"unimportant"},"sid":{"status":"resolved","repositories":{"sid":"1.6.3-4"},"fixed_version":"0","urgency":"unimportant"},"trixie":{"status":"resolved","repositories":{"trixie":"1.6.3-3"},"fixed_version":"0","urgency":"unimportant"}}},"CVE-2017-12618":{"description":"Apache Portable Runtime Utility (APR-util) 1.6.0 and prior fail to validate the integrity of SDBM database files used by apr_sdbm*() functions, resulting in a possible out of bound read access. A local user with write access to the database can make a program or process using these functions crash, and cause a denial of service.","debianbug":879996,"scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"1.6.3-1"},"fixed_version":"1.6.1-1","urgency":"low"},"bullseye":{"status":"resolved","repositories":{"bullseye":"1.6.1-5+deb11u1","bullseye-security":"1.6.1-5+deb11u1"},"fixed_version":"1.6.1-1","urgency":"low"},"forky":{"status":"resolved","repositories":{"forky":"1.6.3-4"},"fixed_version":"1.6.1-1","urgency":"low"},"sid":{"status":"resolved","repositories":{"sid":"1.6.3-4"},"fixed_version":"1.6.1-1","urgency":"low"},"trixie":{"status":"resolved","repositories":{"trixie":"1.6.3-3"},"fixed_version":"1.6.1-1","urgency":"low"}}},"CVE-2022-25147":{"description":"Integer Overflow or Wraparound vulnerability in apr_base64 functions of Apache Portable Runtime Utility (APR-util) allows an attacker to write beyond bounds of a buffer.     This issue affects Apache Portable Runtime Utility (APR-util) 1.6.1 and prior versions.","scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"1.6.3-1"},"fixed_version":"1.6.3-1","urgency":"not yet assigned"},"bullseye":{"status":"resolved","repositories":{"bullseye":"1.6.1-5+deb11u1","bullseye-security":"1.6.1-5+deb11u1"},"fixed_version":"1.6.1-5+deb11u1","urgency":"not yet assigned"},"forky":{"status":"resolved","repositories":{"forky":"1.6.3-4"},"fixed_version":"1.6.3-1","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"1.6.3-4"},"fixed_version":"1.6.3-1","urgency":"not yet assigned"},"trixie":{"status":"resolved","repositories":{"trixie":"1.6.3-3"},"fixed_version":"1.6.3-1","urgency":"not yet assigned"}}}},"apt":{"CVE-2009-1300":{"description":"apt 0.7.20 does not check when the date command returns an \"invalid date\" error, which can prevent apt from loading security updates in time zones for which DST occurs at midnight.","debianbug":523213,"scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"2.6.1"},"fixed_version":"0.7.21","urgency":"not yet assigned"},"bullseye":{"status":"resolved","repositories":{"bullseye":"2.2.4"},"fixed_version":"0.7.21","urgency":"not yet assigned"},"forky":{"status":"resolved","repositories":{"forky":"3.1.16"},"fixed_version":"0.7.21","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"3.1.16"},"fixed_version":"0.7.21","urgency":"not yet assigned"},"trixie":{"status":"resolved","repositories":{"trixie":"3.0.3"},"fixed_version":"0.7.21","urgency":"not yet assigned"}}},"CVE-2009-1358":{"description":"apt-get in apt before 0.7.21 does not check for the correct error code from gpgv, which causes apt to treat a repository as valid even when it has been signed with a key that has been revoked or expired, which might allow remote attackers to trick apt into installing malicious repositories.","debianbug":433091,"scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"2.6.1"},"fixed_version":"0.7.21","urgency":"not yet assigned"},"bullseye":{"status":"resolved","repositories":{"bullseye":"2.2.4"},"fixed_version":"0.7.21","urgency":"not yet assigned"},"forky":{"status":"resolved","repositories":{"forky":"3.1.16"},"fixed_version":"0.7.21","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"3.1.16"},"fixed_version":"0.7.21","urgency":"not yet assigned"},"trixie":{"status":"resolved","repositories":{"trixie":"3.0.3"},"fixed_version":"0.7.21","urgency":"not yet assigned"}}},"CVE-2011-1829":{"description":"APT before 0.8.15.2 does not properly validate inline GPG signatures, which allows man-in-the-middle attackers to install modified packages via vectors involving lack of an initial clearsigned message.","scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"2.6.1"},"fixed_version":"0.8.15.2","urgency":"not yet assigned"},"bullseye":{"status":"resolved","repositories":{"bullseye":"2.2.4"},"fixed_version":"0.8.15.2","urgency":"not yet assigned"},"forky":{"status":"resolved","repositories":{"forky":"3.1.16"},"fixed_version":"0.8.15.2","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"3.1.16"},"fixed_version":"0.8.15.2","urgency":"not yet assigned"},"trixie":{"status":"resolved","repositories":{"trixie":"3.0.3"},"fixed_version":"0.8.15.2","urgency":"not yet assigned"}}},"CVE-2011-3374":{"description":"It was found that apt-key in apt, all versions, do not correctly validate gpg keys with the master keyring, leading to a potential man-in-the-middle attack.","debianbug":642480,"scope":"local","releases":{"bookworm":{"status":"open","repositories":{"bookworm":"2.6.1"},"urgency":"unimportant"},"bullseye":{"status":"open","repositories":{"bullseye":"2.2.4"},"urgency":"unimportant"},"forky":{"status":"open","repositories":{"forky":"3.1.16"},"urgency":"unimportant"},"sid":{"status":"open","repositories":{"sid":"3.1.16"},"urgency":"unimportant"},"trixie":{"status":"open","repositories":{"trixie":"3.0.3"},"urgency":"unimportant"}}},"CVE-2011-3634":{"description":"methods/https.cc in apt before 0.8.11 accepts connections when the certificate host name fails validation and Verify-Host is enabled, which allows man-in-the-middle attackers to obtain repository credentials via unspecified vectors.","scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"2.6.1"},"fixed_version":"0.8.11","urgency":"low"},"bullseye":{"status":"resolved","repositories":{"bullseye":"2.2.4"},"fixed_version":"0.8.11","urgency":"low"},"forky":{"status":"resolved","repositories":{"forky":"3.1.16"},"fixed_version":"0.8.11","urgency":"low"},"sid":{"status":"resolved","repositories":{"sid":"3.1.16"},"fixed_version":"0.8.11","urgency":"low"},"trixie":{"status":"resolved","repositories":{"trixie":"3.0.3"},"fixed_version":"0.8.11","urgency":"low"}}},"CVE-2012-0214":{"description":"The pkgAcqMetaClearSig::Failed method in apt-pkg/acquire-item.cc in Advanced Package Tool (APT) 0.8.11 through 0.8.15.10 and 0.8.16 before 0.8.16~exp13, when updating from repositories that use InRelease files, allows man-in-the-middle attackers to install arbitrary packages by preventing a user from downloading the new InRelease file, which leaves the original InRelease file active and makes it more difficult to detect that the Packages file is modified and unsigned.","scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"2.6.1"},"fixed_version":"0.8.15.10","urgency":"not yet assigned"},"bullseye":{"status":"resolved","repositories":{"bullseye":"2.2.4"},"fixed_version":"0.8.15.10","urgency":"not yet assigned"},"forky":{"status":"resolved","repositories":{"forky":"3.1.16"},"fixed_version":"0.8.15.10","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"3.1.16"},"fixed_version":"0.8.15.10","urgency":"not yet assigned"},"trixie":{"status":"resolved","repositories":{"trixie":"3.0.3"},"fixed_version":"0.8.15.10","urgency":"not yet assigned"}}},"CVE-2012-0954":{"description":"APT 0.7.x before 0.7.25 and 0.8.x before 0.8.16, when using the apt-key net-update to import keyrings, relies on GnuPG argument order and does not check GPG subkeys, which might allow remote attackers to install altered packages via a man-in-the-middle (MITM) attack.  NOTE: this vulnerability exists because of an incomplete fix for CVE-2012-3587.","scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"2.6.1"},"fixed_version":"0.7.25","urgency":"unimportant"},"bullseye":{"status":"resolved","repositories":{"bullseye":"2.2.4"},"fixed_version":"0.7.25","urgency":"unimportant"},"forky":{"status":"resolved","repositories":{"forky":"3.1.16"},"fixed_version":"0.7.25","urgency":"unimportant"},"sid":{"status":"resolved","repositories":{"sid":"3.1.16"},"fixed_version":"0.7.25","urgency":"unimportant"},"trixie":{"status":"resolved","repositories":{"trixie":"3.0.3"},"fixed_version":"0.7.25","urgency":"unimportant"}}},"CVE-2012-0961":{"description":"Apt 0.8.16~exp5ubuntu13.x before 0.8.16~exp5ubuntu13.6, 0.8.16~exp12ubuntu10.x before 0.8.16~exp12ubuntu10.7, and 0.9.7.5ubuntu5.x before 0.9.7.5ubuntu5.2, as used in Ubuntu, uses world-readable permissions for /var/log/apt/term.log, which allows local users to obtain sensitive shell information by reading the log file.","debianbug":695832,"scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"2.6.1"},"fixed_version":"0.9.7.7","urgency":"not yet assigned"},"bullseye":{"status":"resolved","repositories":{"bullseye":"2.2.4"},"fixed_version":"0.9.7.7","urgency":"not yet assigned"},"forky":{"status":"resolved","repositories":{"forky":"3.1.16"},"fixed_version":"0.9.7.7","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"3.1.16"},"fixed_version":"0.9.7.7","urgency":"not yet assigned"},"trixie":{"status":"resolved","repositories":{"trixie":"3.0.3"},"fixed_version":"0.9.7.7","urgency":"not yet assigned"}}},"CVE-2012-3587":{"description":"APT 0.7.x before 0.7.25 and 0.8.x before 0.8.16, when using the apt-key net-update to import keyrings, relies on GnuPG argument order and does not check GPG subkeys, which might allow remote attackers to install Trojan horse packages via a man-in-the-middle (MITM) attack.","scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"2.6.1"},"fixed_version":"0.7.25","urgency":"unimportant"},"bullseye":{"status":"resolved","repositories":{"bullseye":"2.2.4"},"fixed_version":"0.7.25","urgency":"unimportant"},"forky":{"status":"resolved","repositories":{"forky":"3.1.16"},"fixed_version":"0.7.25","urgency":"unimportant"},"sid":{"status":"resolved","repositories":{"sid":"3.1.16"},"fixed_version":"0.7.25","urgency":"unimportant"},"trixie":{"status":"resolved","repositories":{"trixie":"3.0.3"},"fixed_version":"0.7.25","urgency":"unimportant"}}},"CVE-2013-1051":{"description":"apt 0.8.16, 0.9.7, and possibly other versions does not properly handle InRelease files, which allows man-in-the-middle attackers to modify packages before installation via unknown vectors, possibly related to integrity checking and the use of third-party repositories.","scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"2.6.1"},"fixed_version":"0.9.7.8","urgency":"not yet assigned"},"bullseye":{"status":"resolved","repositories":{"bullseye":"2.2.4"},"fixed_version":"0.9.7.8","urgency":"not yet assigned"},"forky":{"status":"resolved","repositories":{"forky":"3.1.16"},"fixed_version":"0.9.7.8","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"3.1.16"},"fixed_version":"0.9.7.8","urgency":"not yet assigned"},"trixie":{"status":"resolved","repositories":{"trixie":"3.0.3"},"fixed_version":"0.9.7.8","urgency":"not yet assigned"}}},"CVE-2014-0478":{"description":"APT before 1.0.4 does not properly validate source packages, which allows man-in-the-middle attackers to download and install Trojan horse packages by removing the Release signature.","debianbug":749795,"scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"2.6.1"},"fixed_version":"1.0.4","urgency":"not yet assigned"},"bullseye":{"status":"resolved","repositories":{"bullseye":"2.2.4"},"fixed_version":"1.0.4","urgency":"not yet assigned"},"forky":{"status":"resolved","repositories":{"forky":"3.1.16"},"fixed_version":"1.0.4","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"3.1.16"},"fixed_version":"1.0.4","urgency":"not yet assigned"},"trixie":{"status":"resolved","repositories":{"trixie":"3.0.3"},"fixed_version":"1.0.4","urgency":"not yet assigned"}}},"CVE-2014-0487":{"description":"APT before 1.0.9 does not verify downloaded files if they have been modified as indicated using the If-Modified-Since header, which has unspecified impact and attack vectors.","scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"2.6.1"},"fixed_version":"1.0.9","urgency":"not yet assigned"},"bullseye":{"status":"resolved","repositories":{"bullseye":"2.2.4"},"fixed_version":"1.0.9","urgency":"not yet assigned"},"forky":{"status":"resolved","repositories":{"forky":"3.1.16"},"fixed_version":"1.0.9","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"3.1.16"},"fixed_version":"1.0.9","urgency":"not yet assigned"},"trixie":{"status":"resolved","repositories":{"trixie":"3.0.3"},"fixed_version":"1.0.9","urgency":"not yet assigned"}}},"CVE-2014-0488":{"description":"APT before 1.0.9 does not \"invalidate repository data\" when moving from an unauthenticated to authenticated state, which allows remote attackers to have unspecified impact via crafted repository data.","scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"2.6.1"},"fixed_version":"1.0.9","urgency":"not yet assigned"},"bullseye":{"status":"resolved","repositories":{"bullseye":"2.2.4"},"fixed_version":"1.0.9","urgency":"not yet assigned"},"forky":{"status":"resolved","repositories":{"forky":"3.1.16"},"fixed_version":"1.0.9","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"3.1.16"},"fixed_version":"1.0.9","urgency":"not yet assigned"},"trixie":{"status":"resolved","repositories":{"trixie":"3.0.3"},"fixed_version":"1.0.9","urgency":"not yet assigned"}}},"CVE-2014-0489":{"description":"APT before 1.0.9, when the Acquire::GzipIndexes option is enabled, does not validate checksums, which allows remote attackers to execute arbitrary code via a crafted package.","scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"2.6.1"},"fixed_version":"1.0.9","urgency":"not yet assigned"},"bullseye":{"status":"resolved","repositories":{"bullseye":"2.2.4"},"fixed_version":"1.0.9","urgency":"not yet assigned"},"forky":{"status":"resolved","repositories":{"forky":"3.1.16"},"fixed_version":"1.0.9","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"3.1.16"},"fixed_version":"1.0.9","urgency":"not yet assigned"},"trixie":{"status":"resolved","repositories":{"trixie":"3.0.3"},"fixed_version":"1.0.9","urgency":"not yet assigned"}}},"CVE-2014-0490":{"description":"The apt-get download command in APT before 1.0.9 does not properly validate signatures for packages, which allows remote attackers to execute arbitrary code via a crafted package.","scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"2.6.1"},"fixed_version":"0.9.12","urgency":"not yet assigned"},"bullseye":{"status":"resolved","repositories":{"bullseye":"2.2.4"},"fixed_version":"0.9.12","urgency":"not yet assigned"},"forky":{"status":"resolved","repositories":{"forky":"3.1.16"},"fixed_version":"0.9.12","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"3.1.16"},"fixed_version":"0.9.12","urgency":"not yet assigned"},"trixie":{"status":"resolved","repositories":{"trixie":"3.0.3"},"fixed_version":"0.9.12","urgency":"not yet assigned"}}},"CVE-2014-6273":{"description":"Buffer overflow in the HTTP transport code in apt-get in APT 1.0.1 and earlier allows man-in-the-middle attackers to cause a denial of service (crash) or possibly execute arbitrary code via a crafted URL.","scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"2.6.1"},"fixed_version":"1.0.3","urgency":"not yet assigned"},"bullseye":{"status":"resolved","repositories":{"bullseye":"2.2.4"},"fixed_version":"1.0.3","urgency":"not yet assigned"},"forky":{"status":"resolved","repositories":{"forky":"3.1.16"},"fixed_version":"1.0.3","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"3.1.16"},"fixed_version":"1.0.3","urgency":"not yet assigned"},"trixie":{"status":"resolved","repositories":{"trixie":"3.0.3"},"fixed_version":"1.0.3","urgency":"not yet assigned"}}},"CVE-2014-7206":{"description":"The changelog command in Apt before 1.0.9.2 allows local users to write to arbitrary files via a symlink attack on the changelog file.","debianbug":763780,"scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"2.6.1"},"fixed_version":"1.0.9.2","urgency":"not yet assigned"},"bullseye":{"status":"resolved","repositories":{"bullseye":"2.2.4"},"fixed_version":"1.0.9.2","urgency":"not yet assigned"},"forky":{"status":"resolved","repositories":{"forky":"3.1.16"},"fixed_version":"1.0.9.2","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"3.1.16"},"fixed_version":"1.0.9.2","urgency":"not yet assigned"},"trixie":{"status":"resolved","repositories":{"trixie":"3.0.3"},"fixed_version":"1.0.9.2","urgency":"not yet assigned"}}},"CVE-2016-1252":{"description":"The apt package in Debian jessie before 1.0.9.8.4, in Debian unstable before 1.4~beta2, in Ubuntu 14.04 LTS before 1.0.1ubuntu2.17, in Ubuntu 16.04 LTS before 1.2.15ubuntu0.2, and in Ubuntu 16.10 before 1.3.2ubuntu0.1 allows man-in-the-middle attackers to bypass a repository-signing protection mechanism by leveraging improper error handling when validating InRelease file signatures.","scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"2.6.1"},"fixed_version":"1.4~beta2","urgency":"not yet assigned"},"bullseye":{"status":"resolved","repositories":{"bullseye":"2.2.4"},"fixed_version":"1.4~beta2","urgency":"not yet assigned"},"forky":{"status":"resolved","repositories":{"forky":"3.1.16"},"fixed_version":"1.4~beta2","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"3.1.16"},"fixed_version":"1.4~beta2","urgency":"not yet assigned"},"trixie":{"status":"resolved","repositories":{"trixie":"3.0.3"},"fixed_version":"1.4~beta2","urgency":"not yet assigned"}}},"CVE-2018-0501":{"description":"The mirror:// method implementation in Advanced Package Tool (APT) 1.6.x before 1.6.4 and 1.7.x before 1.7.0~alpha3 mishandles gpg signature verification for the InRelease file of a fallback mirror, aka mirrorfail.","scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"2.6.1"},"fixed_version":"1.6.4","urgency":"not yet assigned"},"bullseye":{"status":"resolved","repositories":{"bullseye":"2.2.4"},"fixed_version":"1.6.4","urgency":"not yet assigned"},"forky":{"status":"resolved","repositories":{"forky":"3.1.16"},"fixed_version":"1.6.4","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"3.1.16"},"fixed_version":"1.6.4","urgency":"not yet assigned"},"trixie":{"status":"resolved","repositories":{"trixie":"3.0.3"},"fixed_version":"1.6.4","urgency":"not yet assigned"}}},"CVE-2019-3462":{"description":"Incorrect sanitation of the 302 redirect field in HTTP transport method of apt versions 1.4.8 and earlier can lead to content injection by a MITM attacker, potentially leading to remote code execution on the target machine.","scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"2.6.1"},"fixed_version":"1.8.0~alpha3.1","urgency":"not yet assigned"},"bullseye":{"status":"resolved","repositories":{"bullseye":"2.2.4"},"fixed_version":"1.8.0~alpha3.1","urgency":"not yet assigned"},"forky":{"status":"resolved","repositories":{"forky":"3.1.16"},"fixed_version":"1.8.0~alpha3.1","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"3.1.16"},"fixed_version":"1.8.0~alpha3.1","urgency":"not yet assigned"},"trixie":{"status":"resolved","repositories":{"trixie":"3.0.3"},"fixed_version":"1.8.0~alpha3.1","urgency":"not yet assigned"}}},"CVE-2020-27350":{"description":"APT had several integer overflows and underflows while parsing .deb packages, aka GHSL-2020-168 GHSL-2020-169, in files apt-pkg/contrib/extracttar.cc, apt-pkg/deb/debfile.cc, and apt-pkg/contrib/arfile.cc. This issue affects: apt 1.2.32ubuntu0 versions prior to 1.2.32ubuntu0.2; 1.6.12ubuntu0 versions prior to 1.6.12ubuntu0.2; 2.0.2ubuntu0 versions prior to 2.0.2ubuntu0.2; 2.1.10ubuntu0 versions prior to 2.1.10ubuntu0.1;","scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"2.6.1"},"fixed_version":"2.1.13","urgency":"not yet assigned"},"bullseye":{"status":"resolved","repositories":{"bullseye":"2.2.4"},"fixed_version":"2.1.13","urgency":"not yet assigned"},"forky":{"status":"resolved","repositories":{"forky":"3.1.16"},"fixed_version":"2.1.13","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"3.1.16"},"fixed_version":"2.1.13","urgency":"not yet assigned"},"trixie":{"status":"resolved","repositories":{"trixie":"3.0.3"},"fixed_version":"2.1.13","urgency":"not yet assigned"}}},"CVE-2020-3810":{"description":"Missing input validation in the ar/tar implementations of APT before version 2.1.2 could result in denial of service when processing specially crafted deb files.","scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"2.6.1"},"fixed_version":"2.1.2","urgency":"not yet assigned"},"bullseye":{"status":"resolved","repositories":{"bullseye":"2.2.4"},"fixed_version":"2.1.2","urgency":"not yet assigned"},"forky":{"status":"resolved","repositories":{"forky":"3.1.16"},"fixed_version":"2.1.2","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"3.1.16"},"fixed_version":"2.1.2","urgency":"not yet assigned"},"trixie":{"status":"resolved","repositories":{"trixie":"3.0.3"},"fixed_version":"2.1.2","urgency":"not yet assigned"}}}},"apt-cacher":{"CVE-2005-1854":{"description":"Unknown vulnerability in apt-cacher in Debian 3.1, related to \"missing input sanitising,\" allows remote attackers to execute arbitrary commands on the caching server.","scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"1.7.29"},"fixed_version":"0.9.10","urgency":"high"},"bullseye":{"status":"resolved","repositories":{"bullseye":"1.7.22"},"fixed_version":"0.9.10","urgency":"high"},"forky":{"status":"resolved","repositories":{"forky":"1.7.32"},"fixed_version":"0.9.10","urgency":"high"},"sid":{"status":"resolved","repositories":{"sid":"1.7.32"},"fixed_version":"0.9.10","urgency":"high"},"trixie":{"status":"resolved","repositories":{"trixie":"1.7.31"},"fixed_version":"0.9.10","urgency":"high"}}},"CVE-2017-7443":{"description":"apt-cacher before 1.7.15 and apt-cacher-ng before 3.4 allow HTTP response splitting via encoded newline characters, related to lack of blocking for the %0[ad] regular expression.","debianbug":858739,"scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"1.7.29"},"fixed_version":"1.7.15","urgency":"not yet assigned"},"bullseye":{"status":"resolved","repositories":{"bullseye":"1.7.22"},"fixed_version":"1.7.15","urgency":"not yet assigned"},"forky":{"status":"resolved","repositories":{"forky":"1.7.32"},"fixed_version":"1.7.15","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"1.7.32"},"fixed_version":"1.7.15","urgency":"not yet assigned"},"trixie":{"status":"resolved","repositories":{"trixie":"1.7.31"},"fixed_version":"1.7.15","urgency":"not yet assigned"}}},"TEMP-0000000-62D57E":{"releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"1.7.29"},"fixed_version":"1.6.1","urgency":"not yet assigned"},"bullseye":{"status":"resolved","repositories":{"bullseye":"1.7.22"},"fixed_version":"1.6.1","urgency":"not yet assigned"},"forky":{"status":"resolved","repositories":{"forky":"1.7.32"},"fixed_version":"1.6.1","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"1.7.32"},"fixed_version":"1.6.1","urgency":"not yet assigned"},"trixie":{"status":"resolved","repositories":{"trixie":"1.7.31"},"fixed_version":"1.6.1","urgency":"not yet assigned"}}}},"apt-cacher-ng":{"CVE-2014-4510":{"description":"Cross-site scripting (XSS) vulnerability in job.cc in apt-cacher-ng 0.7.26 allows remote attackers to inject arbitrary web script or HTML via a crafted URL.","scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"3.7.4-1"},"fixed_version":"0.7.26-2","urgency":"not yet assigned"},"bullseye":{"status":"resolved","repositories":{"bullseye":"3.6.4-1"},"fixed_version":"0.7.26-2","urgency":"not yet assigned"},"forky":{"status":"resolved","repositories":{"forky":"3.7.5-1.1"},"fixed_version":"0.7.26-2","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"3.7.5-1.1"},"fixed_version":"0.7.26-2","urgency":"not yet assigned"},"trixie":{"status":"resolved","repositories":{"trixie":"3.7.5-1"},"fixed_version":"0.7.26-2","urgency":"not yet assigned"}}},"CVE-2017-7443":{"description":"apt-cacher before 1.7.15 and apt-cacher-ng before 3.4 allow HTTP response splitting via encoded newline characters, related to lack of blocking for the %0[ad] regular expression.","debianbug":858833,"scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"3.7.4-1"},"fixed_version":"3-1","urgency":"not yet assigned"},"bullseye":{"status":"resolved","repositories":{"bullseye":"3.6.4-1"},"fixed_version":"3-1","urgency":"not yet assigned"},"forky":{"status":"resolved","repositories":{"forky":"3.7.5-1.1"},"fixed_version":"3-1","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"3.7.5-1.1"},"fixed_version":"3-1","urgency":"not yet assigned"},"trixie":{"status":"resolved","repositories":{"trixie":"3.7.5-1"},"fixed_version":"3-1","urgency":"not yet assigned"}}},"CVE-2019-18899":{"description":"The apt-cacher-ng package of openSUSE Leap 15.1 runs operations in user owned directory /run/apt-cacher-ng with root privileges. This can allow local attackers to influence the outcome of these operations. This issue affects: openSUSE Leap 15.1 apt-cacher-ng versions prior to 3.1-lp151.3.3.1.","scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"3.7.4-1"},"fixed_version":"0","urgency":"unimportant"},"bullseye":{"status":"resolved","repositories":{"bullseye":"3.6.4-1"},"fixed_version":"0","urgency":"unimportant"},"forky":{"status":"resolved","repositories":{"forky":"3.7.5-1.1"},"fixed_version":"0","urgency":"unimportant"},"sid":{"status":"resolved","repositories":{"sid":"3.7.5-1.1"},"fixed_version":"0","urgency":"unimportant"},"trixie":{"status":"resolved","repositories":{"trixie":"3.7.5-1"},"fixed_version":"0","urgency":"unimportant"}}},"CVE-2020-5202":{"description":"apt-cacher-ng through 3.3 allows local users to obtain sensitive information by hijacking the hardcoded TCP port. The /usr/lib/apt-cacher-ng/acngtool program attempts to connect to apt-cacher-ng via TCP on localhost port 3142, even if the explicit SocketPath=/var/run/apt-cacher-ng/socket command-line option is passed. The cron job /etc/cron.daily/apt-cacher-ng (which is active by default) attempts this periodically. Because 3142 is an unprivileged port, any local user can try to bind to this port and will receive requests from acngtool. There can be sensitive data in these requests, e.g., if AdminAuth is enabled in /etc/apt-cacher-ng/security.conf. This sensitive data can leak to unprivileged local users that manage to bind to this port before the apt-cacher-ng daemon can.","scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"3.7.4-1"},"fixed_version":"3.3.1-1","urgency":"not yet assigned"},"bullseye":{"status":"resolved","repositories":{"bullseye":"3.6.4-1"},"fixed_version":"3.3.1-1","urgency":"not yet assigned"},"forky":{"status":"resolved","repositories":{"forky":"3.7.5-1.1"},"fixed_version":"3.3.1-1","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"3.7.5-1.1"},"fixed_version":"3.3.1-1","urgency":"not yet assigned"},"trixie":{"status":"resolved","repositories":{"trixie":"3.7.5-1"},"fixed_version":"3.3.1-1","urgency":"not yet assigned"}}},"CVE-2025-11146":{"description":"Reflected Cross-site scripting (XSS) in Apt-Cacher-NG v3.2.1. The vulnerability allows an attacker to execute malicious scripts (XSS) in the web management application. The vulnerability is caused by improper handling of GET inputs included in the URL in \u201c/acng-report.html\u201d.","scope":"local","releases":{"bookworm":{"status":"open","repositories":{"bookworm":"3.7.4-1"},"urgency":"not yet assigned","nodsa":"Minor issue","nodsa_reason":""},"bullseye":{"status":"open","repositories":{"bullseye":"3.6.4-1"},"urgency":"not yet assigned","nodsa":"Minor issue","nodsa_reason":"postponed"},"forky":{"status":"resolved","repositories":{"forky":"3.7.5-1.1"},"fixed_version":"3.7.5-1","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"3.7.5-1.1"},"fixed_version":"3.7.5-1","urgency":"not yet assigned"},"trixie":{"status":"resolved","repositories":{"trixie":"3.7.5-1"},"fixed_version":"3.7.5-1","urgency":"not yet assigned"}}},"CVE-2025-11147":{"description":"Reflected cross-site scripting (XSS) in Apt-Cacher-NG v3.2.1. The vulnerability allows malicious scripts (XSS) to be executed in \u201c/html/<filename>.html\u201d.","scope":"local","releases":{"bookworm":{"status":"undetermined","repositories":{"bookworm":"3.7.4-1"},"urgency":"not yet assigned"},"bullseye":{"status":"undetermined","repositories":{"bullseye":"3.6.4-1"},"urgency":"not yet assigned"},"forky":{"status":"undetermined","repositories":{"forky":"3.7.5-1.1"},"urgency":"not yet assigned"},"sid":{"status":"undetermined","repositories":{"sid":"3.7.5-1.1"},"urgency":"not yet assigned"},"trixie":{"status":"undetermined","repositories":{"trixie":"3.7.5-1"},"urgency":"not yet assigned"}}}},"apt-listbugs":{"CVE-2013-6049":{"description":"apt-listbugs before 0.1.10 creates temporary files insecurely, which allows attackers to have unspecified impact via unknown vectors.","scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"0.1.40"},"fixed_version":"0.1.10","urgency":"low"},"bullseye":{"status":"resolved","repositories":{"bullseye":"0.1.35"},"fixed_version":"0.1.10","urgency":"low"},"forky":{"status":"resolved","repositories":{"forky":"0.1.47"},"fixed_version":"0.1.10","urgency":"low"},"sid":{"status":"resolved","repositories":{"sid":"0.1.47"},"fixed_version":"0.1.10","urgency":"low"},"trixie":{"status":"resolved","repositories":{"trixie":"0.1.47"},"fixed_version":"0.1.10","urgency":"low"}}}},"apt-listchanges":{"CVE-2008-0302":{"description":"Untrusted search path vulnerability in apt-listchanges.py in apt-listchanges before 2.82 allows local users to execute arbitrary code via a malicious apt-listchanges program in the current working directory.","scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"3.24"},"fixed_version":"2.82","urgency":"medium"},"bullseye":{"status":"resolved","repositories":{"bullseye":"3.24"},"fixed_version":"2.82","urgency":"medium"},"forky":{"status":"resolved","repositories":{"forky":"4.8+nmu1"},"fixed_version":"2.82","urgency":"medium"},"sid":{"status":"resolved","repositories":{"sid":"4.8+nmu1"},"fixed_version":"2.82","urgency":"medium"},"trixie":{"status":"resolved","repositories":{"trixie":"4.8"},"fixed_version":"2.82","urgency":"medium"}}}},"apt-setup":{"CVE-2005-2214":{"description":"apt-setup in Debian GNU/Linux installs the apt.conf file with insecure permissions, which allows local users to obtain sensitive information such as passwords.","debianbug":305142,"scope":"local","releases":{"bookworm":{"status":"open","repositories":{"bookworm":"1:0.182"},"urgency":"unimportant"},"bullseye":{"status":"open","repositories":{"bullseye":"1:0.166"},"urgency":"unimportant"},"forky":{"status":"open","repositories":{"forky":"1:0.199"},"urgency":"unimportant"},"sid":{"status":"open","repositories":{"sid":"1:0.199"},"urgency":"unimportant"},"trixie":{"status":"open","repositories":{"trixie":"1:0.198"},"urgency":"unimportant"}}}},"apt-xapian-index":{"CVE-2013-1064":{"description":"apt-xapian-index before 0.45ubuntu2.1, 0.44ubuntu7.1, and 0.44ubuntu5.1 does not properly use D-Bus for communication with a polkit authority, which allows local users to bypass intended access restrictions by leveraging a PolkitUnixProcess PolkitSubject race condition via a (1) setuid process or (2) pkexec process, a related issue to CVE-2013-4288.","debianbug":724837,"scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"0.53"},"fixed_version":"0.47","urgency":"low"},"bullseye":{"status":"resolved","repositories":{"bullseye":"0.52"},"fixed_version":"0.47","urgency":"low"},"forky":{"status":"resolved","repositories":{"forky":"0.58"},"fixed_version":"0.47","urgency":"low"},"sid":{"status":"resolved","repositories":{"sid":"0.59"},"fixed_version":"0.47","urgency":"low"}}}},"aptitude":{"TEMP-0612034-33CBAD":{"debianbug":612034,"releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"0.8.13-5"},"fixed_version":"0.6.3-4","urgency":"low"},"bullseye":{"status":"resolved","repositories":{"bullseye":"0.8.13-3"},"fixed_version":"0.6.3-4","urgency":"low"},"forky":{"status":"resolved","repositories":{"forky":"0.8.13-8"},"fixed_version":"0.6.3-4","urgency":"low"},"sid":{"status":"resolved","repositories":{"sid":"0.8.13-8"},"fixed_version":"0.6.3-4","urgency":"low"},"trixie":{"status":"resolved","repositories":{"trixie":"0.8.13-7"},"fixed_version":"0.6.3-4","urgency":"low"}}}},"arb":{"CVE-2008-4941":{"description":"arb-common 0.0.20071207.1 allows local users to overwrite arbitrary files via a symlink attack on (a) /tmp/arb_fdnaml_*, (b) /tmp/arb_pids_*, (c) /tmp/arbdsmz.html, and (d) /tmp/arbdsmz.htm temporary files, related to the (1) arb_fastdnaml and (2) dszmconnect.pl scripts.","debianbug":496396,"scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"6.0.6-5"},"fixed_version":"0.0.20071207.1-5","urgency":"low"},"bullseye":{"status":"resolved","repositories":{"bullseye":"6.0.6-4"},"fixed_version":"0.0.20071207.1-5","urgency":"low"},"sid":{"status":"resolved","repositories":{"sid":"6.0.6-8"},"fixed_version":"0.0.20071207.1-5","urgency":"low"},"trixie":{"status":"resolved","repositories":{"trixie":"6.0.6-8"},"fixed_version":"0.0.20071207.1-5","urgency":"low"}}},"CVE-2008-5378":{"description":"arb-kill in arb 0.0.20071207.1 allows local users to overwrite arbitrary files via a symlink attack on a /tmp/arb_pids_*_* temporary file.","debianbug":508942,"scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"6.0.6-5"},"fixed_version":"0.0.20071207.1-6","urgency":"low"},"bullseye":{"status":"resolved","repositories":{"bullseye":"6.0.6-4"},"fixed_version":"0.0.20071207.1-6","urgency":"low"},"sid":{"status":"resolved","repositories":{"sid":"6.0.6-8"},"fixed_version":"0.0.20071207.1-6","urgency":"low"},"trixie":{"status":"resolved","repositories":{"trixie":"6.0.6-8"},"fixed_version":"0.0.20071207.1-6","urgency":"low"}}}},"arc":{"CVE-2005-2945":{"description":"arc 5.21j and earlier create temporary files with world-readable permissions, which allows local users to read sensitive information from files created by (1) arc (arc.c) or (2) marc (marc.c).","debianbug":329053,"scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"5.21q-12"},"fixed_version":"5.21m-1","urgency":"low"},"bullseye":{"status":"resolved","repositories":{"bullseye":"5.21q-8"},"fixed_version":"5.21m-1","urgency":"low"},"forky":{"status":"resolved","repositories":{"forky":"5.21q-16"},"fixed_version":"5.21m-1","urgency":"low"},"sid":{"status":"resolved","repositories":{"sid":"5.21q-16"},"fixed_version":"5.21m-1","urgency":"low"},"trixie":{"status":"resolved","repositories":{"trixie":"5.21q-15"},"fixed_version":"5.21m-1","urgency":"low"}}},"CVE-2005-2992":{"description":"arc 5.21j and earlier allows local users to overwrite arbitrary files via a symlink attack on temporary files, a different type of vulnerability than CVE-2005-2945.","scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"5.21q-12"},"fixed_version":"5.21m-1","urgency":"low"},"bullseye":{"status":"resolved","repositories":{"bullseye":"5.21q-8"},"fixed_version":"5.21m-1","urgency":"low"},"forky":{"status":"resolved","repositories":{"forky":"5.21q-16"},"fixed_version":"5.21m-1","urgency":"low"},"sid":{"status":"resolved","repositories":{"sid":"5.21q-16"},"fixed_version":"5.21m-1","urgency":"low"},"trixie":{"status":"resolved","repositories":{"trixie":"5.21q-15"},"fixed_version":"5.21m-1","urgency":"low"}}},"CVE-2015-9275":{"description":"ARC 5.21q allows directory traversal via a full pathname in an archive file.","debianbug":774527,"scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"5.21q-12"},"fixed_version":"5.21q-6","urgency":"low"},"bullseye":{"status":"resolved","repositories":{"bullseye":"5.21q-8"},"fixed_version":"5.21q-6","urgency":"low"},"forky":{"status":"resolved","repositories":{"forky":"5.21q-16"},"fixed_version":"5.21q-6","urgency":"low"},"sid":{"status":"resolved","repositories":{"sid":"5.21q-16"},"fixed_version":"5.21q-6","urgency":"low"},"trixie":{"status":"resolved","repositories":{"trixie":"5.21q-15"},"fixed_version":"5.21q-6","urgency":"low"}}}},"archmage":{"CVE-2015-1589":{"description":"Directory traversal vulnerability in arCHMage 0.2.4 allows remote attackers to write to arbitrary files via a .. (dot dot) in a CHM file.","debianbug":776164,"scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"1:0.4.2.1-2"},"fixed_version":"1:0.2.4-4","urgency":"not yet assigned"},"bullseye":{"status":"resolved","repositories":{"bullseye":"1:0.4.2.1-1"},"fixed_version":"1:0.2.4-4","urgency":"not yet assigned"},"forky":{"status":"resolved","repositories":{"forky":"1:0.4.2.1-5"},"fixed_version":"1:0.2.4-4","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"1:0.4.2.1-5"},"fixed_version":"1:0.2.4-4","urgency":"not yet assigned"},"trixie":{"status":"resolved","repositories":{"trixie":"1:0.4.2.1-3"},"fixed_version":"1:0.2.4-4","urgency":"not yet assigned"}}}},"archvsync":{"CVE-2017-8805":{"description":"Debian ftpsync before 20171017 does not use the rsync --safe-links option, which allows remote attackers to conduct directory traversal attacks via a crafted upstream mirror.","scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"20180513+nmu1"},"fixed_version":"20171017","urgency":"not yet assigned"},"bullseye":{"status":"resolved","repositories":{"bullseye":"20180513+nmu1"},"fixed_version":"20171017","urgency":"not yet assigned"},"forky":{"status":"resolved","repositories":{"forky":"20180513+nmu1"},"fixed_version":"20171017","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"20180513+nmu1"},"fixed_version":"20171017","urgency":"not yet assigned"},"trixie":{"status":"resolved","repositories":{"trixie":"20180513+nmu1"},"fixed_version":"20171017","urgency":"not yet assigned"}}}},"ardour":{"CVE-2007-4974":{"description":"Heap-based buffer overflow in the flac_buffer_copy function in libsndfile 1.0.17 and earlier might allow remote attackers to execute arbitrary code via a FLAC file with crafted PCM data containing a block with a size that exceeds the previous block size.","debianbug":445889,"scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"1:7.3.0+ds0-1"},"fixed_version":"1:2.1-1.1","urgency":"medium"},"bullseye":{"status":"resolved","repositories":{"bullseye":"1:6.5.0+ds0-1"},"fixed_version":"1:2.1-1.1","urgency":"medium"},"forky":{"status":"resolved","repositories":{"forky":"1:9.2.0+ds-1"},"fixed_version":"1:2.1-1.1","urgency":"medium"},"sid":{"status":"resolved","repositories":{"sid":"1:9.2.0+ds-1"},"fixed_version":"1:2.1-1.1","urgency":"medium"},"trixie":{"status":"resolved","repositories":{"trixie":"1:8.12.0+ds-1"},"fixed_version":"1:2.1-1.1","urgency":"medium"}}},"CVE-2010-3349":{"description":"Ardour 2.8.11 places a zero-length directory name in the LD_LIBRARY_PATH, which allows local users to gain privileges via a Trojan horse shared library in the current working directory.","debianbug":598282,"scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"1:7.3.0+ds0-1"},"fixed_version":"1:2.8.11-2","urgency":"low"},"bullseye":{"status":"resolved","repositories":{"bullseye":"1:6.5.0+ds0-1"},"fixed_version":"1:2.8.11-2","urgency":"low"},"forky":{"status":"resolved","repositories":{"forky":"1:9.2.0+ds-1"},"fixed_version":"1:2.8.11-2","urgency":"low"},"sid":{"status":"resolved","repositories":{"sid":"1:9.2.0+ds-1"},"fixed_version":"1:2.8.11-2","urgency":"low"},"trixie":{"status":"resolved","repositories":{"trixie":"1:8.12.0+ds-1"},"fixed_version":"1:2.8.11-2","urgency":"low"}}},"CVE-2020-22617":{"description":"Ardour v5.12 contains a use-after-free vulnerability in the component ardour/libs/pbd/xml++.cc when using xmlFreeDoc and xmlXPathFreeContext.","scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"1:7.3.0+ds0-1"},"fixed_version":"1:6.0.0~ds0-1","urgency":"not yet assigned"},"bullseye":{"status":"resolved","repositories":{"bullseye":"1:6.5.0+ds0-1"},"fixed_version":"1:6.0.0~ds0-1","urgency":"not yet assigned"},"forky":{"status":"resolved","repositories":{"forky":"1:9.2.0+ds-1"},"fixed_version":"1:6.0.0~ds0-1","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"1:9.2.0+ds-1"},"fixed_version":"1:6.0.0~ds0-1","urgency":"not yet assigned"},"trixie":{"status":"resolved","repositories":{"trixie":"1:8.12.0+ds-1"},"fixed_version":"1:6.0.0~ds0-1","urgency":"not yet assigned"}}}},"arduino-core-avr":{"CVE-2025-69209":{"description":"ArduinoCore-avr contains the source code and configuration files of the Arduino AVR Boards platform. A vulnerability in versions prior to 1.8.7 allows an attacker to trigger a stack-based buffer overflow when converting floating-point values to strings with high precision. By passing very large `decimalPlaces` values to the affected String constructors or concat methods, the `dtostrf` function writes beyond fixed-size stack buffers, causing memory corruption and denial of service. Under specific conditions, this could enable arbitrary code execution on AVR-based Arduino boards.  ### Patches  - The Fix is included starting from the `1.8.7` release available from the following link [ArduinoCore-avr v1.8.7](https://github.com/arduino/ArduinoCore-avr)  - The Fixing Commit is available at the following link [1a6a417f89c8901dad646efce74ae9d3ddebfd59](https://github.com/arduino/ArduinoCore-avr/pull/613/commits/1a6a417f89c8901dad646efce74ae9d3ddebfd59)  ### References  - [ASEC-26-001 ArduinoCore-avr vXXXX Resolves Buffer Overflow Vulnerability](https://support.arduino.cc/hc/en-us/articles/XXXXX)  ### Credits  - Maxime Rossi Bellom and Ramtine Tofighi Shirazi from SecMate (https://secmate.dev/)","debianbug":1126285,"scope":"local","releases":{"bookworm":{"status":"open","repositories":{"bookworm":"1.8.6+dfsg-1"},"urgency":"not yet assigned","nodsa":"Minor issue","nodsa_reason":""},"bullseye":{"status":"open","repositories":{"bullseye":"1.8.3+dfsg1-1"},"urgency":"not yet assigned","nodsa":"Minor issue","nodsa_reason":"postponed"},"forky":{"status":"resolved","repositories":{"forky":"1.8.7+dfsg-1"},"fixed_version":"1.8.7+dfsg-1","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"1.8.7+dfsg-1"},"fixed_version":"1.8.7+dfsg-1","urgency":"not yet assigned"},"trixie":{"status":"open","repositories":{"trixie":"1.8.6+dfsg-2"},"urgency":"not yet assigned","nodsa":"Minor issue","nodsa_reason":""}}}},"argyll":{"CVE-2009-0583":{"description":"Multiple integer overflows in icc.c in the International Color Consortium (ICC) Format library (aka icclib), as used in Ghostscript 8.64 and earlier and Argyll Color Management System (CMS) 1.0.3 and earlier, allow context-dependent attackers to cause a denial of service (heap-based buffer overflow and application crash) or possibly execute arbitrary code by using a device file for a translation request that operates on a crafted image file and targets a certain \"native color space,\" related to an ICC profile in a (1) PostScript or (2) PDF file with embedded images.","debianbug":522448,"scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"2.3.1+repack-1.1"},"fixed_version":"1.0.3-2","urgency":"not yet assigned"},"bullseye":{"status":"resolved","repositories":{"bullseye":"2.0.1+repack-1.1"},"fixed_version":"1.0.3-2","urgency":"not yet assigned"},"forky":{"status":"resolved","repositories":{"forky":"3.3.0+repack-1.1"},"fixed_version":"1.0.3-2","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"3.3.0+repack-1.1"},"fixed_version":"1.0.3-2","urgency":"not yet assigned"},"trixie":{"status":"resolved","repositories":{"trixie":"3.3.0+repack-1"},"fixed_version":"1.0.3-2","urgency":"not yet assigned"}}},"CVE-2009-0584":{"description":"icc.c in the International Color Consortium (ICC) Format library (aka icclib), as used in Ghostscript 8.64 and earlier and Argyll Color Management System (CMS) 1.0.3 and earlier, allows context-dependent attackers to cause a denial of service (application crash) or possibly execute arbitrary code by using a device file for processing a crafted image file associated with large integer values for certain sizes, related to an ICC profile in a (1) PostScript or (2) PDF file with embedded images.","debianbug":522448,"scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"2.3.1+repack-1.1"},"fixed_version":"1.0.3-2","urgency":"not yet assigned"},"bullseye":{"status":"resolved","repositories":{"bullseye":"2.0.1+repack-1.1"},"fixed_version":"1.0.3-2","urgency":"not yet assigned"},"forky":{"status":"resolved","repositories":{"forky":"3.3.0+repack-1.1"},"fixed_version":"1.0.3-2","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"3.3.0+repack-1.1"},"fixed_version":"1.0.3-2","urgency":"not yet assigned"},"trixie":{"status":"resolved","repositories":{"trixie":"3.3.0+repack-1"},"fixed_version":"1.0.3-2","urgency":"not yet assigned"}}},"CVE-2009-0792":{"description":"Multiple integer overflows in icc.c in the International Color Consortium (ICC) Format library (aka icclib), as used in Ghostscript 8.64 and earlier and Argyll Color Management System (CMS) 1.0.3 and earlier, allow context-dependent attackers to cause a denial of service (heap-based buffer overflow and application crash) or possibly execute arbitrary code by using a device file for a translation request that operates on a crafted image file and targets a certain \"native color space,\" related to an ICC profile in a (1) PostScript or (2) PDF file with embedded images.  NOTE: this issue exists because of an incomplete fix for CVE-2009-0583.","debianbug":523472,"scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"2.3.1+repack-1.1"},"fixed_version":"1.0.3-3","urgency":"medium"},"bullseye":{"status":"resolved","repositories":{"bullseye":"2.0.1+repack-1.1"},"fixed_version":"1.0.3-3","urgency":"medium"},"forky":{"status":"resolved","repositories":{"forky":"3.3.0+repack-1.1"},"fixed_version":"1.0.3-3","urgency":"medium"},"sid":{"status":"resolved","repositories":{"sid":"3.3.0+repack-1.1"},"fixed_version":"1.0.3-3","urgency":"medium"},"trixie":{"status":"resolved","repositories":{"trixie":"3.3.0+repack-1"},"fixed_version":"1.0.3-3","urgency":"medium"}}},"CVE-2012-1616":{"description":"Use-after-free vulnerability in icclib before 2.13, as used by Argyll CMS before 1.4 and possibly other programs, allows remote attackers to cause a denial of service (crash) or execute arbitrary code via a crafted ICC profile file.","scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"2.3.1+repack-1.1"},"fixed_version":"1.4.0-1","urgency":"not yet assigned"},"bullseye":{"status":"resolved","repositories":{"bullseye":"2.0.1+repack-1.1"},"fixed_version":"1.4.0-1","urgency":"not yet assigned"},"forky":{"status":"resolved","repositories":{"forky":"3.3.0+repack-1.1"},"fixed_version":"1.4.0-1","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"3.3.0+repack-1.1"},"fixed_version":"1.4.0-1","urgency":"not yet assigned"},"trixie":{"status":"resolved","repositories":{"trixie":"3.3.0+repack-1"},"fixed_version":"1.4.0-1","urgency":"not yet assigned"}}},"CVE-2012-4405":{"description":"Multiple integer underflows in the icmLut_allocate function in International Color Consortium (ICC) Format library (icclib), as used in Ghostscript 9.06 and Argyll Color Management System, allow remote attackers to cause a denial of service (crash) and possibly execute arbitrary code via a crafted (1) PostScript or (2) PDF file with embedded images, which triggers a heap-based buffer overflow.  NOTE: this issue is also described as an array index error.","debianbug":687275,"scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"2.3.1+repack-1.1"},"fixed_version":"1.4.0-7","urgency":"not yet assigned"},"bullseye":{"status":"resolved","repositories":{"bullseye":"2.0.1+repack-1.1"},"fixed_version":"1.4.0-7","urgency":"not yet assigned"},"forky":{"status":"resolved","repositories":{"forky":"3.3.0+repack-1.1"},"fixed_version":"1.4.0-7","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"3.3.0+repack-1.1"},"fixed_version":"1.4.0-7","urgency":"not yet assigned"},"trixie":{"status":"resolved","repositories":{"trixie":"3.3.0+repack-1"},"fixed_version":"1.4.0-7","urgency":"not yet assigned"}}},"TEMP-0000000-425714":{"releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"2.3.1+repack-1.1"},"fixed_version":"0","urgency":"unimportant"},"bullseye":{"status":"resolved","repositories":{"bullseye":"2.0.1+repack-1.1"},"fixed_version":"0","urgency":"unimportant"},"forky":{"status":"resolved","repositories":{"forky":"3.3.0+repack-1.1"},"fixed_version":"0","urgency":"unimportant"},"sid":{"status":"resolved","repositories":{"sid":"3.3.0+repack-1.1"},"fixed_version":"0","urgency":"unimportant"},"trixie":{"status":"resolved","repositories":{"trixie":"3.3.0+repack-1"},"fixed_version":"0","urgency":"unimportant"}}}},"aria2":{"CVE-2009-3575":{"description":"Buffer overflow in DHTRoutingTableDeserializer.cc in aria2 0.15.3, 1.2.0, and other versions allows remote attackers to cause a denial of service (crash) and possibly execute arbitrary code via unknown vectors.","debianbug":551070,"scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"1.36.0-1"},"fixed_version":"1.2.0-1","urgency":"low"},"bullseye":{"status":"resolved","repositories":{"bullseye":"1.35.0-3"},"fixed_version":"1.2.0-1","urgency":"low"},"forky":{"status":"resolved","repositories":{"forky":"1.37.0+debian-4"},"fixed_version":"1.2.0-1","urgency":"low"},"sid":{"status":"resolved","repositories":{"sid":"1.37.0+debian-4"},"fixed_version":"1.2.0-1","urgency":"low"},"trixie":{"status":"resolved","repositories":{"trixie":"1.37.0+debian-3"},"fixed_version":"1.2.0-1","urgency":"low"}}},"CVE-2009-3617":{"description":"Format string vulnerability in the AbstractCommand::onAbort function in src/AbstractCommand.cc in aria2 before 1.6.2, when logging is enabled, allows remote attackers to execute arbitrary code or cause a denial of service (application crash) via format string specifiers in a download URI.  NOTE: some of these details are obtained from third party information.","scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"1.36.0-1"},"fixed_version":"1.6.2-1","urgency":"low"},"bullseye":{"status":"resolved","repositories":{"bullseye":"1.35.0-3"},"fixed_version":"1.6.2-1","urgency":"low"},"forky":{"status":"resolved","repositories":{"forky":"1.37.0+debian-4"},"fixed_version":"1.6.2-1","urgency":"low"},"sid":{"status":"resolved","repositories":{"sid":"1.37.0+debian-4"},"fixed_version":"1.6.2-1","urgency":"low"},"trixie":{"status":"resolved","repositories":{"trixie":"1.37.0+debian-3"},"fixed_version":"1.6.2-1","urgency":"low"}}},"CVE-2010-1512":{"description":"Directory traversal vulnerability in aria2 before 1.9.3 allows remote attackers to create arbitrary files via directory traversal sequences in the name attribute of a file element in a metalink file.","scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"1.36.0-1"},"fixed_version":"1.9.3-1","urgency":"not yet assigned"},"bullseye":{"status":"resolved","repositories":{"bullseye":"1.35.0-3"},"fixed_version":"1.9.3-1","urgency":"not yet assigned"},"forky":{"status":"resolved","repositories":{"forky":"1.37.0+debian-4"},"fixed_version":"1.9.3-1","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"1.37.0+debian-4"},"fixed_version":"1.9.3-1","urgency":"not yet assigned"},"trixie":{"status":"resolved","repositories":{"trixie":"1.37.0+debian-3"},"fixed_version":"1.9.3-1","urgency":"not yet assigned"}}},"CVE-2019-3500":{"description":"aria2c in aria2 1.33.1, when --log is used, can store an HTTP Basic Authentication username and password in a file, which might allow local users to obtain sensitive information by reading this file.","debianbug":918058,"scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"1.36.0-1"},"fixed_version":"1.34.0-4","urgency":"low"},"bullseye":{"status":"resolved","repositories":{"bullseye":"1.35.0-3"},"fixed_version":"1.34.0-4","urgency":"low"},"forky":{"status":"resolved","repositories":{"forky":"1.37.0+debian-4"},"fixed_version":"1.34.0-4","urgency":"low"},"sid":{"status":"resolved","repositories":{"sid":"1.37.0+debian-4"},"fixed_version":"1.34.0-4","urgency":"low"},"trixie":{"status":"resolved","repositories":{"trixie":"1.37.0+debian-3"},"fixed_version":"1.34.0-4","urgency":"low"}}}},"arj":{"CVE-2004-0947":{"description":"Buffer overflow in unarj before 2.63a-r2 allows remote attackers to execute arbitrary code via an arj archive that contains long filenames.","scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"3.10.22-26"},"fixed_version":"0","urgency":"unimportant"},"bullseye":{"status":"resolved","repositories":{"bullseye":"3.10.22-24"},"fixed_version":"0","urgency":"unimportant"},"forky":{"status":"resolved","repositories":{"forky":"3.10.22-29"},"fixed_version":"0","urgency":"unimportant"},"sid":{"status":"resolved","repositories":{"sid":"3.10.22-29"},"fixed_version":"0","urgency":"unimportant"},"trixie":{"status":"resolved","repositories":{"trixie":"3.10.22-28"},"fixed_version":"0","urgency":"unimportant"}}},"CVE-2004-1027":{"description":"Directory traversal vulnerability in the -x (extract) command line option in unarj allows remote attackers to overwrite arbitrary files via an arj archive with filenames that contain .. (dot dot) sequences.","scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"3.10.22-26"},"fixed_version":"0","urgency":"unimportant"},"bullseye":{"status":"resolved","repositories":{"bullseye":"3.10.22-24"},"fixed_version":"0","urgency":"unimportant"},"forky":{"status":"resolved","repositories":{"forky":"3.10.22-29"},"fixed_version":"0","urgency":"unimportant"},"sid":{"status":"resolved","repositories":{"sid":"3.10.22-29"},"fixed_version":"0","urgency":"unimportant"},"trixie":{"status":"resolved","repositories":{"trixie":"3.10.22-28"},"fixed_version":"0","urgency":"unimportant"}}},"CVE-2015-0556":{"description":"Open-source ARJ archiver 3.10.22 allows remote attackers to conduct directory traversal attacks via a symlink attack in an ARJ archive.","debianbug":774434,"scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"3.10.22-26"},"fixed_version":"3.10.22-13","urgency":"low"},"bullseye":{"status":"resolved","repositories":{"bullseye":"3.10.22-24"},"fixed_version":"3.10.22-13","urgency":"low"},"forky":{"status":"resolved","repositories":{"forky":"3.10.22-29"},"fixed_version":"3.10.22-13","urgency":"low"},"sid":{"status":"resolved","repositories":{"sid":"3.10.22-29"},"fixed_version":"3.10.22-13","urgency":"low"},"trixie":{"status":"resolved","repositories":{"trixie":"3.10.22-28"},"fixed_version":"3.10.22-13","urgency":"low"}}},"CVE-2015-0557":{"description":"Open-source ARJ archiver 3.10.22 does not properly remove leading slashes from paths, which allows remote attackers to conduct absolute path traversal attacks and write to arbitrary files via multiple leading slashes in a path in an ARJ archive.","debianbug":774435,"scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"3.10.22-26"},"fixed_version":"3.10.22-13","urgency":"low"},"bullseye":{"status":"resolved","repositories":{"bullseye":"3.10.22-24"},"fixed_version":"3.10.22-13","urgency":"low"},"forky":{"status":"resolved","repositories":{"forky":"3.10.22-29"},"fixed_version":"3.10.22-13","urgency":"low"},"sid":{"status":"resolved","repositories":{"sid":"3.10.22-29"},"fixed_version":"3.10.22-13","urgency":"low"},"trixie":{"status":"resolved","repositories":{"trixie":"3.10.22-28"},"fixed_version":"3.10.22-13","urgency":"low"}}},"CVE-2015-2782":{"description":"Buffer overflow in Open-source ARJ archiver 3.10.22 allows remote attackers to cause a denial of service (crash) or possibly execute arbitrary code via a crafted ARJ archive.","debianbug":774015,"scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"3.10.22-26"},"fixed_version":"3.10.22-13","urgency":"not yet assigned"},"bullseye":{"status":"resolved","repositories":{"bullseye":"3.10.22-24"},"fixed_version":"3.10.22-13","urgency":"not yet assigned"},"forky":{"status":"resolved","repositories":{"forky":"3.10.22-29"},"fixed_version":"3.10.22-13","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"3.10.22-29"},"fixed_version":"3.10.22-13","urgency":"not yet assigned"},"trixie":{"status":"resolved","repositories":{"trixie":"3.10.22-28"},"fixed_version":"3.10.22-13","urgency":"not yet assigned"}}}},"ark":{"CVE-2017-5330":{"description":"ark before 16.12.1 might allow remote attackers to execute arbitrary code via an executable in an archive, related to associated applications.","debianbug":850874,"scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"4:22.12.3-1+deb12u1","bookworm-security":"4:22.12.3-1+deb12u1"},"fixed_version":"4:16.08.3-2","urgency":"not yet assigned"},"bullseye":{"status":"resolved","repositories":{"bullseye":"4:20.12.2-1","bullseye-security":"4:20.12.2-1+deb11u1"},"fixed_version":"4:16.08.3-2","urgency":"not yet assigned"},"forky":{"status":"resolved","repositories":{"forky":"4:25.12.1-1"},"fixed_version":"4:16.08.3-2","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"4:25.12.3-1"},"fixed_version":"4:16.08.3-2","urgency":"not yet assigned"},"trixie":{"status":"resolved","repositories":{"trixie":"4:25.04.3-1"},"fixed_version":"4:16.08.3-2","urgency":"not yet assigned"}}},"CVE-2020-16116":{"description":"In kerfuffle/jobs.cpp in KDE Ark before 20.08.0, a crafted archive can install files outside the extraction directory via ../ directory traversal.","scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"4:22.12.3-1+deb12u1","bookworm-security":"4:22.12.3-1+deb12u1"},"fixed_version":"4:20.04.3-1","urgency":"not yet assigned"},"bullseye":{"status":"resolved","repositories":{"bullseye":"4:20.12.2-1","bullseye-security":"4:20.12.2-1+deb11u1"},"fixed_version":"4:20.04.3-1","urgency":"not yet assigned"},"forky":{"status":"resolved","repositories":{"forky":"4:25.12.1-1"},"fixed_version":"4:20.04.3-1","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"4:25.12.3-1"},"fixed_version":"4:20.04.3-1","urgency":"not yet assigned"},"trixie":{"status":"resolved","repositories":{"trixie":"4:25.04.3-1"},"fixed_version":"4:20.04.3-1","urgency":"not yet assigned"}}},"CVE-2020-24654":{"description":"In KDE Ark before 20.08.1, a crafted TAR archive with symlinks can install files outside the extraction directory, as demonstrated by a write operation to a user's home directory.","debianbug":969437,"scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"4:22.12.3-1+deb12u1","bookworm-security":"4:22.12.3-1+deb12u1"},"fixed_version":"4:20.08.1-1","urgency":"not yet assigned"},"bullseye":{"status":"resolved","repositories":{"bullseye":"4:20.12.2-1","bullseye-security":"4:20.12.2-1+deb11u1"},"fixed_version":"4:20.08.1-1","urgency":"not yet assigned"},"forky":{"status":"resolved","repositories":{"forky":"4:25.12.1-1"},"fixed_version":"4:20.08.1-1","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"4:25.12.3-1"},"fixed_version":"4:20.08.1-1","urgency":"not yet assigned"},"trixie":{"status":"resolved","repositories":{"trixie":"4:25.04.3-1"},"fixed_version":"4:20.08.1-1","urgency":"not yet assigned"}}},"CVE-2024-57966":{"description":"libarchiveplugin.cpp in KDE ark before 24.12.0 can extract to an absolute path from an archive.","debianbug":1106104,"scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"4:22.12.3-1+deb12u1","bookworm-security":"4:22.12.3-1+deb12u1"},"fixed_version":"4:22.12.3-1+deb12u1","urgency":"not yet assigned"},"bullseye":{"status":"resolved","repositories":{"bullseye":"4:20.12.2-1","bullseye-security":"4:20.12.2-1+deb11u1"},"fixed_version":"4:20.12.2-1+deb11u1","urgency":"not yet assigned"},"forky":{"status":"resolved","repositories":{"forky":"4:25.12.1-1"},"fixed_version":"4:24.12.0-1","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"4:25.12.3-1"},"fixed_version":"4:24.12.0-1","urgency":"not yet assigned"},"trixie":{"status":"resolved","repositories":{"trixie":"4:25.04.3-1"},"fixed_version":"4:24.12.0-1","urgency":"not yet assigned"}}}},"arm-trusted-firmware":{"CVE-2022-47630":{"description":"Trusted Firmware-A through 2.8 has an out-of-bounds read in the X.509 parser for parsing boot certificates. This affects downstream use of get_ext and auth_nvctr. Attackers might be able to trigger dangerous read side effects or obtain sensitive information about microarchitectural state.","scope":"local","releases":{"bookworm":{"status":"open","repositories":{"bookworm":"2.8.0+dfsg-1"},"urgency":"unimportant"},"bullseye":{"status":"open","repositories":{"bullseye":"2.4+dfsg-2"},"urgency":"unimportant"},"forky":{"status":"resolved","repositories":{"forky":"2.12.1+dfsg-1"},"fixed_version":"2.9.0+dfsg-3","urgency":"unimportant"},"sid":{"status":"resolved","repositories":{"sid":"2.12.1+dfsg-1"},"fixed_version":"2.9.0+dfsg-3","urgency":"unimportant"},"trixie":{"status":"resolved","repositories":{"trixie":"2.12.1+dfsg-1"},"fixed_version":"2.9.0+dfsg-3","urgency":"unimportant"}}},"CVE-2023-49100":{"description":"Trusted Firmware-A (TF-A) before 2.10 has a potential read out-of-bounds in the SDEI service. The input parameter passed in register x1 is not validated well enough in the function sdei_interrupt_bind. The parameter is passed to a call to plat_ic_get_interrupt_type. It can be any arbitrary value passing checks in the function plat_ic_is_sgi. A compromised Normal World (Linux kernel) can enable a root-privileged attacker to issue arbitrary SMC calls. Using this primitive, he can control the content of registers x0 through x6, which are used to send parameters to TF-A. Out-of-bounds addresses can be read in the context of TF-A (EL3). Because the read value is never returned to non-secure memory or in registers, no leak is possible. An attacker can still crash TF-A, however.","scope":"local","releases":{"bookworm":{"status":"open","repositories":{"bookworm":"2.8.0+dfsg-1"},"urgency":"not yet assigned","nodsa":"Minor issue","nodsa_reason":""},"bullseye":{"status":"open","repositories":{"bullseye":"2.4+dfsg-2"},"urgency":"not yet assigned","nodsa":"Minor issue","nodsa_reason":""},"forky":{"status":"resolved","repositories":{"forky":"2.12.1+dfsg-1"},"fixed_version":"2.10.0+dfsg-1","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"2.12.1+dfsg-1"},"fixed_version":"2.10.0+dfsg-1","urgency":"not yet assigned"},"trixie":{"status":"resolved","repositories":{"trixie":"2.12.1+dfsg-1"},"fixed_version":"2.10.0+dfsg-1","urgency":"not yet assigned"}}},"CVE-2023-51712":{"description":"An issue was discovered in Trusted Firmware-M through 2.0.0. The lack of argument verification in the logging subsystem allows attackers to read sensitive data via the login function.","scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"2.8.0+dfsg-1"},"fixed_version":"0","urgency":"unimportant"},"bullseye":{"status":"resolved","repositories":{"bullseye":"2.4+dfsg-2"},"fixed_version":"0","urgency":"unimportant"},"forky":{"status":"resolved","repositories":{"forky":"2.12.1+dfsg-1"},"fixed_version":"0","urgency":"unimportant"},"sid":{"status":"resolved","repositories":{"sid":"2.12.1+dfsg-1"},"fixed_version":"0","urgency":"unimportant"},"trixie":{"status":"resolved","repositories":{"trixie":"2.12.1+dfsg-1"},"fixed_version":"0","urgency":"unimportant"}}},"CVE-2024-45746":{"description":"An issue was discovered in Trusted Firmware-M through 2.1.0. User provided (and controlled) mailbox messages contain a pointer to a list of input arguments (in_vec) and output arguments (out_vec). These list pointers are never validated. Each argument list contains a buffer pointer and a buffer length field. After a PSA call, the length of the output arguments behind the unchecked pointer is updated in mailbox_direct_reply, regardless of the call result. This allows an attacker to write anywhere in the secure firmware, which can be used to take over the control flow, leading to remote code execution (RCE).","scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"2.8.0+dfsg-1"},"fixed_version":"0","urgency":"unimportant"},"bullseye":{"status":"resolved","repositories":{"bullseye":"2.4+dfsg-2"},"fixed_version":"0","urgency":"unimportant"},"forky":{"status":"resolved","repositories":{"forky":"2.12.1+dfsg-1"},"fixed_version":"0","urgency":"unimportant"},"sid":{"status":"resolved","repositories":{"sid":"2.12.1+dfsg-1"},"fixed_version":"0","urgency":"unimportant"},"trixie":{"status":"resolved","repositories":{"trixie":"2.12.1+dfsg-1"},"fixed_version":"0","urgency":"unimportant"}}},"CVE-2024-5660":{"description":"Use of Hardware Page Aggregation (HPA) and Stage-1 and/or Stage-2 translation on Cortex-A77, Cortex-A78, Cortex-A78C, Cortex-A78AE, Cortex-A710, Cortex-X1, Cortex-X1C, Cortex-X2, Cortex-X3, Cortex-X4, Cortex-X925, Neoverse V1, Neoverse V2, Neoverse V3, Neoverse V3AE, Neoverse N2 may permit bypass of Stage-2 translation and/or GPT protection.","scope":"local","releases":{"bookworm":{"status":"open","repositories":{"bookworm":"2.8.0+dfsg-1"},"urgency":"not yet assigned","nodsa":"Minor issue","nodsa_reason":""},"bullseye":{"status":"open","repositories":{"bullseye":"2.4+dfsg-2"},"urgency":"not yet assigned","nodsa":"Minor issue, follow bookworm","nodsa_reason":"postponed"},"forky":{"status":"resolved","repositories":{"forky":"2.12.1+dfsg-1"},"fixed_version":"2.12.1+dfsg-1","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"2.12.1+dfsg-1"},"fixed_version":"2.12.1+dfsg-1","urgency":"not yet assigned"},"trixie":{"status":"resolved","repositories":{"trixie":"2.12.1+dfsg-1"},"fixed_version":"2.12.1+dfsg-1","urgency":"not yet assigned"}}},"CVE-2024-6285":{"description":"Integer Underflow (Wrap or Wraparound) vulnerability in Renesas arm-trusted-firmware. An integer underflow in image range check calculations could lead to bypassing address restrictions and loading of images to unallowed addresses.","debianbug":1074431,"scope":"local","releases":{"bookworm":{"status":"open","repositories":{"bookworm":"2.8.0+dfsg-1"},"urgency":"unimportant"},"bullseye":{"status":"open","repositories":{"bullseye":"2.4+dfsg-2"},"urgency":"unimportant"},"forky":{"status":"open","repositories":{"forky":"2.12.1+dfsg-1"},"urgency":"unimportant"},"sid":{"status":"open","repositories":{"sid":"2.12.1+dfsg-1"},"urgency":"unimportant"},"trixie":{"status":"open","repositories":{"trixie":"2.12.1+dfsg-1"},"urgency":"unimportant"}}},"CVE-2024-6287":{"description":"Incorrect Calculation vulnerability in Renesas arm-trusted-firmware allows Local Execution of Code.   When checking whether a new image invades/overlaps with a previously loaded image the code neglects to consider a few cases. that could An attacker to bypass memory range restriction and overwrite an already loaded image partly or completely, which could result in code execution and bypass of secure boot.","debianbug":1074431,"scope":"local","releases":{"bookworm":{"status":"open","repositories":{"bookworm":"2.8.0+dfsg-1"},"urgency":"unimportant"},"bullseye":{"status":"open","repositories":{"bullseye":"2.4+dfsg-2"},"urgency":"unimportant"},"forky":{"status":"open","repositories":{"forky":"2.12.1+dfsg-1"},"urgency":"unimportant"},"sid":{"status":"open","repositories":{"sid":"2.12.1+dfsg-1"},"urgency":"unimportant"},"trixie":{"status":"open","repositories":{"trixie":"2.12.1+dfsg-1"},"urgency":"unimportant"}}},"CVE-2024-6563":{"description":"Buffer Copy without Checking Size of Input ('Classic Buffer Overflow') vulnerability in Renesas arm-trusted-firmware allows Local Execution of Code. This vulnerability is associated with program files  https://github.Com/renesas-rcar/arm-trusted-firmware/blob/rcar_gen3_v2.5/drivers/renesas/common/io/i... https://github.Com/renesas-rcar/arm-trusted-firmware/blob/rcar_gen3_v2.5/drivers/renesas/common/io/io_rcar.C .     In line 313 \"addr_loaded_cnt\" is checked not to be \"CHECK_IMAGE_AREA_CNT\" (5) or larger, this check does not halt the function. Immediately after (line 317) there will be an overflow in the buffer and the value of \"dst\" will be written to the area immediately after the buffer, which is \"addr_loaded_cnt\". This will allow an attacker to freely control the value of \"addr_loaded_cnt\" and thus control the destination of the write immediately after (line 318). The write in line 318 will then be fully controlled by said attacker, with whichever address and whichever value (\"len\") they desire.","debianbug":1076042,"scope":"local","releases":{"bookworm":{"status":"open","repositories":{"bookworm":"2.8.0+dfsg-1"},"urgency":"not yet assigned","nodsa":"Minor issue","nodsa_reason":""},"bullseye":{"status":"open","repositories":{"bullseye":"2.4+dfsg-2"},"urgency":"not yet assigned","nodsa":"Minor issue","nodsa_reason":""},"forky":{"status":"resolved","repositories":{"forky":"2.12.1+dfsg-1"},"fixed_version":"2.12.0+dfsg-2","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"2.12.1+dfsg-1"},"fixed_version":"2.12.0+dfsg-2","urgency":"not yet assigned"},"trixie":{"status":"resolved","repositories":{"trixie":"2.12.1+dfsg-1"},"fixed_version":"2.12.0+dfsg-2","urgency":"not yet assigned"}}},"CVE-2024-6564":{"description":"Buffer overflow in \"rcar_dev_init\"  due to using due to using untrusted data (rcar_image_number) as a loop counter before verifying it against RCAR_MAX_BL3X_IMAGE. This could lead to a full bypass of secure boot.","debianbug":1076042,"scope":"local","releases":{"bookworm":{"status":"open","repositories":{"bookworm":"2.8.0+dfsg-1"},"urgency":"not yet assigned","nodsa":"Minor issue","nodsa_reason":""},"bullseye":{"status":"open","repositories":{"bullseye":"2.4+dfsg-2"},"urgency":"not yet assigned","nodsa":"Minor issue","nodsa_reason":""},"forky":{"status":"resolved","repositories":{"forky":"2.12.1+dfsg-1"},"fixed_version":"2.12.0+dfsg-2","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"2.12.1+dfsg-1"},"fixed_version":"2.12.0+dfsg-2","urgency":"not yet assigned"},"trixie":{"status":"resolved","repositories":{"trixie":"2.12.1+dfsg-1"},"fixed_version":"2.12.0+dfsg-2","urgency":"not yet assigned"}}},"CVE-2024-7881":{"description":"An unprivileged context can trigger a data memory-dependent prefetch engine to fetch the contents of a privileged location and consume those contents as an address that is also dereferenced.","scope":"local","releases":{"bookworm":{"status":"open","repositories":{"bookworm":"2.8.0+dfsg-1"},"urgency":"not yet assigned","nodsa":"Minor issue","nodsa_reason":""},"bullseye":{"status":"open","repositories":{"bullseye":"2.4+dfsg-2"},"urgency":"not yet assigned","nodsa":"Minor issue, follow bookworm","nodsa_reason":"postponed"},"forky":{"status":"resolved","repositories":{"forky":"2.12.1+dfsg-1"},"fixed_version":"2.12.1+dfsg-1","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"2.12.1+dfsg-1"},"fixed_version":"2.12.1+dfsg-1","urgency":"not yet assigned"},"trixie":{"status":"resolved","repositories":{"trixie":"2.12.1+dfsg-1"},"fixed_version":"2.12.1+dfsg-1","urgency":"not yet assigned"}}},"CVE-2025-53022":{"description":"TrustedFirmware-M (aka Trusted Firmware for M profile Arm CPUs) before 2.1.3 and 2.2.x before 2.2.1 lacks length validation during a firmware upgrade. While processing a new image, the Firmware Upgrade (FWU) module does not validate the length field of the Type-Length-Value (TLV) structure for dependent components against the maximum allowed size. If the length specified in the TLV exceeds the size of the buffer allocated on the stack, the FWU module will overwrite the buffer (and potentially other stack data) with the TLV's value content. An attacker could exploit this by crafting a malicious TLV entry in the unprotected section of the MCUBoot upgrade image. By setting the length field to exceed the expected structure size, the attacker can manipulate the stack memory of the system during the upgrade process.","scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"2.8.0+dfsg-1"},"fixed_version":"0","urgency":"unimportant"},"bullseye":{"status":"resolved","repositories":{"bullseye":"2.4+dfsg-2"},"fixed_version":"0","urgency":"unimportant"},"forky":{"status":"resolved","repositories":{"forky":"2.12.1+dfsg-1"},"fixed_version":"0","urgency":"unimportant"},"sid":{"status":"resolved","repositories":{"sid":"2.12.1+dfsg-1"},"fixed_version":"0","urgency":"unimportant"},"trixie":{"status":"resolved","repositories":{"trixie":"2.12.1+dfsg-1"},"fixed_version":"0","urgency":"unimportant"}}}},"armagetronad":{"TEMP-0780178-BE09AB":{"debianbug":780178,"releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"0.2.9.1.0-3"},"fixed_version":"0.2.8.3.2-4","urgency":"not yet assigned"},"bullseye":{"status":"resolved","repositories":{"bullseye":"0.2.9.1.0-2"},"fixed_version":"0.2.8.3.2-4","urgency":"not yet assigned"},"forky":{"status":"resolved","repositories":{"forky":"0.2.9.1.1-1"},"fixed_version":"0.2.8.3.2-4","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"0.2.9.1.1-1"},"fixed_version":"0.2.8.3.2-4","urgency":"not yet assigned"},"trixie":{"status":"resolved","repositories":{"trixie":"0.2.9.1.1-1"},"fixed_version":"0.2.8.3.2-4","urgency":"not yet assigned"}}}},"arpwatch":{"CVE-2012-2653":{"description":"arpwatch 2.1a15, as used by Red Hat, Debian, Fedora, and possibly others, does not properly drop supplementary groups, which might allow attackers to gain root privileges by leveraging other vulnerabilities in the daemon.","debianbug":674715,"scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"2.1a15-8"},"fixed_version":"2.1a15-1.2","urgency":"not yet assigned"},"bullseye":{"status":"resolved","repositories":{"bullseye":"2.1a15-8"},"fixed_version":"2.1a15-1.2","urgency":"not yet assigned"},"forky":{"status":"resolved","repositories":{"forky":"2.1a15-9"},"fixed_version":"2.1a15-1.2","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"2.1a15-9"},"fixed_version":"2.1a15-1.2","urgency":"not yet assigned"},"trixie":{"status":"resolved","repositories":{"trixie":"2.1a15-9"},"fixed_version":"2.1a15-1.2","urgency":"not yet assigned"}}},"CVE-2021-25321":{"description":"A UNIX Symbolic Link (Symlink) Following vulnerability in arpwatch of SUSE Linux Enterprise Server 11-SP4-LTSS, SUSE Manager Server 4.0, SUSE OpenStack Cloud Crowbar 9; openSUSE Factory, Leap 15.2 allows local attackers with control of the runtime user to run arpwatch as to escalate to root upon the next restart of arpwatch. This issue affects: SUSE Linux Enterprise Server 11-SP4-LTSS arpwatch versions prior to 2.1a15. SUSE Manager Server 4.0 arpwatch versions prior to 2.1a15. SUSE OpenStack Cloud Crowbar 9 arpwatch versions prior to 2.1a15. openSUSE Factory arpwatch version 2.1a15-169.5 and prior versions. openSUSE Leap 15.2 arpwatch version 2.1a15-lp152.5.5 and prior versions.","scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"2.1a15-8"},"fixed_version":"0","urgency":"unimportant"},"bullseye":{"status":"resolved","repositories":{"bullseye":"2.1a15-8"},"fixed_version":"0","urgency":"unimportant"},"forky":{"status":"resolved","repositories":{"forky":"2.1a15-9"},"fixed_version":"0","urgency":"unimportant"},"sid":{"status":"resolved","repositories":{"sid":"2.1a15-9"},"fixed_version":"0","urgency":"unimportant"},"trixie":{"status":"resolved","repositories":{"trixie":"2.1a15-9"},"fixed_version":"0","urgency":"unimportant"}}}},"as31":{"CVE-2012-0808":{"description":"as31 2.3.1-4 does not seed the random number generator and generates predictable temporary file names, which makes it easier for local users to create or truncate files via a symlink attack.","debianbug":655496,"scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"2.3.1-9"},"fixed_version":"2.3.1-5","urgency":"not yet assigned"},"bullseye":{"status":"resolved","repositories":{"bullseye":"2.3.1-7"},"fixed_version":"2.3.1-5","urgency":"not yet assigned"},"forky":{"status":"resolved","repositories":{"forky":"2.3.1-12"},"fixed_version":"2.3.1-5","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"2.3.1-12"},"fixed_version":"2.3.1-5","urgency":"not yet assigned"},"trixie":{"status":"resolved","repositories":{"trixie":"2.3.1-12"},"fixed_version":"2.3.1-5","urgency":"not yet assigned"}}}},"asciidoctor":{"CVE-2018-18385":{"description":"Asciidoctor in versions < 1.5.8 allows remote attackers to cause a denial of service (infinite loop). The loop was caused by the fact that Parser.next_block was not exhausting all the lines in the reader as the while loop expected it would. This was happening because the regular expression that detects any list was not agreeing with the regular expression that detects a specific list type. So the line kept getting pushed back onto the reader, hence causing the loop.","debianbug":913892,"scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"2.0.18-2"},"fixed_version":"1.5.8-1","urgency":"low"},"bullseye":{"status":"resolved","repositories":{"bullseye":"2.0.12-2"},"fixed_version":"1.5.8-1","urgency":"low"},"forky":{"status":"resolved","repositories":{"forky":"2.0.26-2"},"fixed_version":"1.5.8-1","urgency":"low"},"sid":{"status":"resolved","repositories":{"sid":"2.0.26-2"},"fixed_version":"1.5.8-1","urgency":"low"},"trixie":{"status":"resolved","repositories":{"trixie":"2.0.23-1"},"fixed_version":"1.5.8-1","urgency":"low"}}}},"asciijump":{"TEMP-0269186-FFE79F":{"debianbug":269186,"releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"1.0.2~beta-10"},"fixed_version":"0.0.6-1.2","urgency":"not yet assigned"},"bullseye":{"status":"resolved","repositories":{"bullseye":"1.0.2~beta-10"},"fixed_version":"0.0.6-1.2","urgency":"not yet assigned"},"forky":{"status":"resolved","repositories":{"forky":"1.0.2~beta-12"},"fixed_version":"0.0.6-1.2","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"1.0.2~beta-12"},"fixed_version":"0.0.6-1.2","urgency":"not yet assigned"},"trixie":{"status":"resolved","repositories":{"trixie":"1.0.2~beta-11"},"fixed_version":"0.0.6-1.2","urgency":"not yet assigned"}}}},"asio":{"CVE-2019-25219":{"description":"Asio C++ Library before 1.13.0 lacks a fallback error code in the case of SSL_ERROR_SYSCALL with no associated error information from the SSL library being used.","scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"1:1.22.1-1"},"fixed_version":"1:1.18.1-1","urgency":"not yet assigned"},"bullseye":{"status":"resolved","repositories":{"bullseye":"1:1.18.1-1"},"fixed_version":"1:1.18.1-1","urgency":"not yet assigned"},"forky":{"status":"resolved","repositories":{"forky":"1:1.30.2-1"},"fixed_version":"1:1.18.1-1","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"1:1.30.2-1"},"fixed_version":"1:1.18.1-1","urgency":"not yet assigned"},"trixie":{"status":"resolved","repositories":{"trixie":"1:1.30.2-1"},"fixed_version":"1:1.18.1-1","urgency":"not yet assigned"}}}},"asn1c":{"CVE-2004-2644":{"description":"Unspecified vulnerability in ASN.1 Compiler (asn1c) before 0.9.7 has unknown impact and attack vectors when processing \"ANY\" type tags.","scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"0.9.28+dfsg-5"},"fixed_version":"0","urgency":"unimportant"},"bullseye":{"status":"resolved","repositories":{"bullseye":"0.9.28+dfsg-3"},"fixed_version":"0","urgency":"unimportant"},"forky":{"status":"resolved","repositories":{"forky":"0.9.28+dfsg-6"},"fixed_version":"0","urgency":"unimportant"},"sid":{"status":"resolved","repositories":{"sid":"0.9.28+dfsg-6"},"fixed_version":"0","urgency":"unimportant"},"trixie":{"status":"resolved","repositories":{"trixie":"0.9.28+dfsg-5"},"fixed_version":"0","urgency":"unimportant"}}},"CVE-2004-2645":{"description":"Unspecified vulnerability in ASN.1 Compiler (asn1c) before 0.9.7 has unknown impact and attack vectors when processing \"CHOICE\" types with \"indefinite length structures.\"","scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"0.9.28+dfsg-5"},"fixed_version":"0","urgency":"unimportant"},"bullseye":{"status":"resolved","repositories":{"bullseye":"0.9.28+dfsg-3"},"fixed_version":"0","urgency":"unimportant"},"forky":{"status":"resolved","repositories":{"forky":"0.9.28+dfsg-6"},"fixed_version":"0","urgency":"unimportant"},"sid":{"status":"resolved","repositories":{"sid":"0.9.28+dfsg-6"},"fixed_version":"0","urgency":"unimportant"},"trixie":{"status":"resolved","repositories":{"trixie":"0.9.28+dfsg-5"},"fixed_version":"0","urgency":"unimportant"}}},"CVE-2017-12966":{"description":"The asn1f_lookup_symbol_impl function in asn1fix_retrieve.c in libasn1fix.a in asn1c 0.9.28 allows remote attackers to cause a denial of service (segmentation fault) via a crafted .asn1 file.","scope":"local","releases":{"bookworm":{"status":"open","repositories":{"bookworm":"0.9.28+dfsg-5"},"urgency":"unimportant"},"bullseye":{"status":"open","repositories":{"bullseye":"0.9.28+dfsg-3"},"urgency":"unimportant"},"forky":{"status":"open","repositories":{"forky":"0.9.28+dfsg-6"},"urgency":"unimportant"},"sid":{"status":"open","repositories":{"sid":"0.9.28+dfsg-6"},"urgency":"unimportant"},"trixie":{"status":"open","repositories":{"trixie":"0.9.28+dfsg-5"},"urgency":"unimportant"}}},"CVE-2020-23910":{"description":"Stack-based buffer overflow vulnerability in asn1c through v0.9.28 via function genhash_get in genhash.c.","scope":"local","releases":{"bookworm":{"status":"open","repositories":{"bookworm":"0.9.28+dfsg-5"},"urgency":"unimportant"},"bullseye":{"status":"open","repositories":{"bullseye":"0.9.28+dfsg-3"},"urgency":"unimportant"},"forky":{"status":"open","repositories":{"forky":"0.9.28+dfsg-6"},"urgency":"unimportant"},"sid":{"status":"open","repositories":{"sid":"0.9.28+dfsg-6"},"urgency":"unimportant"},"trixie":{"status":"open","repositories":{"trixie":"0.9.28+dfsg-5"},"urgency":"unimportant"}}},"CVE-2020-23911":{"description":"An issue was discovered in asn1c through v0.9.28. A NULL pointer dereference exists in the function _default_error_logger() located in asn1fix.c. It allows an attacker to cause Denial of Service.","scope":"local","releases":{"bookworm":{"status":"open","repositories":{"bookworm":"0.9.28+dfsg-5"},"urgency":"unimportant"},"bullseye":{"status":"open","repositories":{"bullseye":"0.9.28+dfsg-3"},"urgency":"unimportant"},"forky":{"status":"open","repositories":{"forky":"0.9.28+dfsg-6"},"urgency":"unimportant"},"sid":{"status":"open","repositories":{"sid":"0.9.28+dfsg-6"},"urgency":"unimportant"},"trixie":{"status":"open","repositories":{"trixie":"0.9.28+dfsg-5"},"urgency":"unimportant"}}}},"aspell":{"CVE-2004-0548":{"description":"Multiple stack-based buffer overflows in the word-list-compress functionality in compress.c for Aspell allow local users to execute arbitrary code via a long entry in the wordlist that is not properly handled when using the (1) \"c\" compress option or (2) \"d\" decompress option.","scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"0.60.8-4"},"fixed_version":"0.50.5-3","urgency":"not yet assigned"},"bullseye":{"status":"resolved","repositories":{"bullseye":"0.60.8-3"},"fixed_version":"0.50.5-3","urgency":"not yet assigned"},"forky":{"status":"resolved","repositories":{"forky":"0.60.8.2-3"},"fixed_version":"0.50.5-3","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"0.60.8.2-3"},"fixed_version":"0.50.5-3","urgency":"not yet assigned"},"trixie":{"status":"resolved","repositories":{"trixie":"0.60.8.1-4"},"fixed_version":"0.50.5-3","urgency":"not yet assigned"}}},"CVE-2019-17544":{"description":"libaspell.a in GNU Aspell before 0.60.8 has a stack-based buffer over-read in acommon::unescape in common/getdata.cpp via an isolated \\ character.","scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"0.60.8-4"},"fixed_version":"0.60.8-1","urgency":"low"},"bullseye":{"status":"resolved","repositories":{"bullseye":"0.60.8-3"},"fixed_version":"0.60.8-1","urgency":"low"},"forky":{"status":"resolved","repositories":{"forky":"0.60.8.2-3"},"fixed_version":"0.60.8-1","urgency":"low"},"sid":{"status":"resolved","repositories":{"sid":"0.60.8.2-3"},"fixed_version":"0.60.8-1","urgency":"low"},"trixie":{"status":"resolved","repositories":{"trixie":"0.60.8.1-4"},"fixed_version":"0.60.8-1","urgency":"low"}}},"CVE-2019-20433":{"description":"libaspell.a in GNU Aspell before 0.60.8 has a buffer over-read for a string ending with a single '\\0' byte, if the encoding is set to ucs-2 or ucs-4 outside of the application, as demonstrated by the ASPELL_CONF environment variable.","debianbug":935128,"scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"0.60.8-4"},"fixed_version":"0.60.7-3","urgency":"not yet assigned"},"bullseye":{"status":"resolved","repositories":{"bullseye":"0.60.8-3"},"fixed_version":"0.60.7-3","urgency":"not yet assigned"},"forky":{"status":"resolved","repositories":{"forky":"0.60.8.2-3"},"fixed_version":"0.60.7-3","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"0.60.8.2-3"},"fixed_version":"0.60.7-3","urgency":"not yet assigned"},"trixie":{"status":"resolved","repositories":{"trixie":"0.60.8.1-4"},"fixed_version":"0.60.7-3","urgency":"not yet assigned"}}},"CVE-2019-25051":{"description":"objstack in GNU Aspell 0.60.8 has a heap-based buffer overflow in acommon::ObjStack::dup_top (called from acommon::StringMap::add and acommon::Config::lookup_list).","debianbug":991307,"scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"0.60.8-4"},"fixed_version":"0.60.8-3","urgency":"not yet assigned"},"bullseye":{"status":"resolved","repositories":{"bullseye":"0.60.8-3"},"fixed_version":"0.60.8-3","urgency":"not yet assigned"},"forky":{"status":"resolved","repositories":{"forky":"0.60.8.2-3"},"fixed_version":"0.60.8-3","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"0.60.8.2-3"},"fixed_version":"0.60.8-3","urgency":"not yet assigned"},"trixie":{"status":"resolved","repositories":{"trixie":"0.60.8.1-4"},"fixed_version":"0.60.8-3","urgency":"not yet assigned"}}}},"assertj-core":{"CVE-2026-24400":{"description":"AssertJ provides Fluent testing assertions for Java and the Java Virtual Machine (JVM). Starting in version 1.4.0 and prior to version 3.27.7, an XML External Entity (XXE) vulnerability exists in `org.assertj.core.util.xml.XmlStringPrettyFormatter`: the `toXmlDocument(String)` method initializes `DocumentBuilderFactory` with default settings, without disabling DTDs or external entities. This formatter is used by the `isXmlEqualTo(CharSequence)` assertion for `CharSequence` values. An application is vulnerable only when it uses untrusted XML input with either `isXmlEqualTo(CharSequence)` from `org.assertj.core.api.AbstractCharSequenceAssert` or `xmlPrettyFormat(String)` from `org.assertj.core.util.xml.XmlStringPrettyFormatter`. If untrusted XML input is processed by tone of these methods, an attacker couldnread arbitrary local files via `file://` URIs (e.g., `/etc/passwd`, application configuration files); perform Server-Side Request Forgery (SSRF) via HTTP/HTTPS URIs, and/or cause Denial of Service via \"Billion Laughs\" entity expansion attacks. `isXmlEqualTo(CharSequence)` has been deprecated in favor of XMLUnit in version 3.18.0 and will be removed in version 4.0. Users of affected versions should, in order of preference: replace `isXmlEqualTo(CharSequence)` with XMLUnit, upgrade to version 3.27.7, or avoid using `isXmlEqualTo(CharSequence)` or `XmlStringPrettyFormatter` with untrusted input. `XmlStringPrettyFormatter` has historically been considered a utility for `isXmlEqualTo(CharSequence)` rather than a feature for AssertJ users, so it is deprecated in version 3.27.7 and removed in version 4.0, with no replacement.","debianbug":1127938,"scope":"local","releases":{"bookworm":{"status":"open","repositories":{"bookworm":"3.14.0-2"},"urgency":"not yet assigned","nodsa":"Minor issue","nodsa_reason":""},"bullseye":{"status":"open","repositories":{"bullseye":"2.3.0-4"},"urgency":"not yet assigned","nodsa":"Minor issue","nodsa_reason":"postponed"},"forky":{"status":"open","repositories":{"forky":"3.26.3-2"},"urgency":"not yet assigned"},"sid":{"status":"open","repositories":{"sid":"3.26.3-2"},"urgency":"not yet assigned"},"trixie":{"status":"open","repositories":{"trixie":"3.26.3-2"},"urgency":"not yet assigned","nodsa":"Minor issue","nodsa_reason":""}}}},"assimp":{"CVE-2021-45948":{"description":"Open Asset Import Library (aka assimp) 5.1.0 and 5.1.1 has a heap-based buffer overflow in _m3d_safestr (called from m3d_load and Assimp::M3DWrapper::M3DWrapper).","scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"5.2.5~ds0-1"},"fixed_version":"5.1.1~ds0-1","urgency":"not yet assigned"},"bullseye":{"status":"resolved","repositories":{"bullseye":"5.0.1~ds0-2"},"fixed_version":"0","urgency":"unimportant"},"forky":{"status":"resolved","repositories":{"forky":"6.0.4+ds-1"},"fixed_version":"5.1.1~ds0-1","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"6.0.4+ds-1"},"fixed_version":"5.1.1~ds0-1","urgency":"not yet assigned"},"trixie":{"status":"resolved","repositories":{"trixie":"5.4.3+ds-2"},"fixed_version":"5.1.1~ds0-1","urgency":"not yet assigned"}}},"CVE-2022-38528":{"description":"Open Asset Import Library (assimp) commit 3c253ca was discovered to contain a segmentation violation via the component Assimp::XFileImporter::CreateMeshes.","debianbug":1021018,"scope":"local","releases":{"bookworm":{"status":"open","repositories":{"bookworm":"5.2.5~ds0-1"},"urgency":"not yet assigned","nodsa":"Minor issue, revisit when fixed upstream","nodsa_reason":"postponed"},"bullseye":{"status":"open","repositories":{"bullseye":"5.0.1~ds0-2"},"urgency":"not yet assigned","nodsa":"Minor issue","nodsa_reason":""},"forky":{"status":"open","repositories":{"forky":"6.0.4+ds-1"},"urgency":"not yet assigned"},"sid":{"status":"open","repositories":{"sid":"6.0.4+ds-1"},"urgency":"not yet assigned"},"trixie":{"status":"open","repositories":{"trixie":"5.4.3+ds-2"},"urgency":"not yet assigned","nodsa":"Minor issue, revisit when fixed upstream","nodsa_reason":"postponed"}}},"CVE-2022-45748":{"description":"An issue was discovered with assimp 5.1.4, a use after free occurred in function ColladaParser::ExtractDataObjectFromChannel in file /code/AssetLib/Collada/ColladaParser.cpp.","debianbug":1029833,"scope":"local","releases":{"bookworm":{"status":"open","repositories":{"bookworm":"5.2.5~ds0-1"},"urgency":"not yet assigned","nodsa":"Minor issue","nodsa_reason":"ignored"},"bullseye":{"status":"open","repositories":{"bullseye":"5.0.1~ds0-2"},"urgency":"not yet assigned","nodsa":"Minor issue","nodsa_reason":""},"forky":{"status":"resolved","repositories":{"forky":"6.0.4+ds-1"},"fixed_version":"5.3.1+ds-2","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"6.0.4+ds-1"},"fixed_version":"5.3.1+ds-2","urgency":"not yet assigned"},"trixie":{"status":"resolved","repositories":{"trixie":"5.4.3+ds-2"},"fixed_version":"5.3.1+ds-2","urgency":"not yet assigned"}}},"CVE-2024-40724":{"description":"Heap-based buffer overflow vulnerability in Assimp versions prior to 5.4.2 allows a local attacker to execute arbitrary code by inputting a specially crafted file into the product.","scope":"local","releases":{"bookworm":{"status":"open","repositories":{"bookworm":"5.2.5~ds0-1"},"urgency":"not yet assigned","nodsa":"Minor issue","nodsa_reason":"ignored"},"bullseye":{"status":"open","repositories":{"bullseye":"5.0.1~ds0-2"},"urgency":"not yet assigned","nodsa":"Minor issue","nodsa_reason":""},"forky":{"status":"resolved","repositories":{"forky":"6.0.4+ds-1"},"fixed_version":"5.4.2+ds-1","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"6.0.4+ds-1"},"fixed_version":"5.4.2+ds-1","urgency":"not yet assigned"},"trixie":{"status":"resolved","repositories":{"trixie":"5.4.3+ds-2"},"fixed_version":"5.4.2+ds-1","urgency":"not yet assigned"}}},"CVE-2024-45679":{"description":"Heap-based buffer overflow vulnerability in Assimp versions prior to 5.4.3 allows a local attacker to execute arbitrary code by importing a specially crafted file into the product.","scope":"local","releases":{"bookworm":{"status":"open","repositories":{"bookworm":"5.2.5~ds0-1"},"urgency":"not yet assigned","nodsa":"Minor issue","nodsa_reason":"ignored"},"bullseye":{"status":"open","repositories":{"bullseye":"5.0.1~ds0-2"},"urgency":"not yet assigned","nodsa":"Minor issue","nodsa_reason":"postponed"},"forky":{"status":"resolved","repositories":{"forky":"6.0.4+ds-1"},"fixed_version":"5.4.0+ds-1","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"6.0.4+ds-1"},"fixed_version":"5.4.0+ds-1","urgency":"not yet assigned"},"trixie":{"status":"resolved","repositories":{"trixie":"5.4.3+ds-2"},"fixed_version":"5.4.0+ds-1","urgency":"not yet assigned"}}},"CVE-2024-46632":{"description":"Assimp v5.4.3 is vulnerable to Buffer Overflow via the MD5Importer::LoadMD5MeshFile function.","debianbug":1082857,"scope":"local","releases":{"bookworm":{"status":"open","repositories":{"bookworm":"5.2.5~ds0-1"},"urgency":"not yet assigned","nodsa":"Minor issue, revisit when fixed upstream","nodsa_reason":"postponed"},"bullseye":{"status":"open","repositories":{"bullseye":"5.0.1~ds0-2"},"urgency":"not yet assigned","nodsa":"Minor issue","nodsa_reason":"postponed"},"forky":{"status":"open","repositories":{"forky":"6.0.4+ds-1"},"urgency":"not yet assigned"},"sid":{"status":"open","repositories":{"sid":"6.0.4+ds-1"},"urgency":"not yet assigned"},"trixie":{"status":"open","repositories":{"trixie":"5.4.3+ds-2"},"urgency":"not yet assigned","nodsa":"Minor issue, revisit when fixed upstream","nodsa_reason":"postponed"}}},"CVE-2024-48423":{"description":"An issue in assimp v.5.4.3 allows a local attacker to execute arbitrary code via the CallbackToLogRedirector function within the Assimp library.","debianbug":1086046,"scope":"local","releases":{"bookworm":{"status":"open","repositories":{"bookworm":"5.2.5~ds0-1"},"urgency":"not yet assigned","nodsa":"Minor issue, revisit when fixed upstream","nodsa_reason":"postponed"},"bullseye":{"status":"open","repositories":{"bullseye":"5.0.1~ds0-2"},"urgency":"not yet assigned","nodsa":"Minor issue, revisit when fixed upstream","nodsa_reason":"postponed"},"forky":{"status":"resolved","repositories":{"forky":"6.0.4+ds-1"},"fixed_version":"6.0.2+ds-1","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"6.0.4+ds-1"},"fixed_version":"6.0.2+ds-1","urgency":"not yet assigned"},"trixie":{"status":"open","repositories":{"trixie":"5.4.3+ds-2"},"urgency":"not yet assigned","nodsa":"Minor issue, revisit when fixed upstream","nodsa_reason":"postponed"}}},"CVE-2024-48424":{"description":"A heap-buffer-overflow vulnerability has been identified in the OpenDDLParser::parseStructure function within the Assimp library, specifically during the processing of OpenGEX files.","debianbug":1086045,"scope":"local","releases":{"bookworm":{"status":"open","repositories":{"bookworm":"5.2.5~ds0-1"},"urgency":"not yet assigned","nodsa":"Minor issue, revisit when fixed upstream","nodsa_reason":"postponed"},"bullseye":{"status":"open","repositories":{"bullseye":"5.0.1~ds0-2"},"urgency":"not yet assigned","nodsa":"Minor issue, revisit when fixed upstream","nodsa_reason":"postponed"},"forky":{"status":"resolved","repositories":{"forky":"6.0.4+ds-1"},"fixed_version":"6.0.2+ds-1","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"6.0.4+ds-1"},"fixed_version":"6.0.2+ds-1","urgency":"not yet assigned"},"trixie":{"status":"open","repositories":{"trixie":"5.4.3+ds-2"},"urgency":"not yet assigned","nodsa":"Minor issue, revisit when fixed upstream","nodsa_reason":"postponed"}}},"CVE-2024-48425":{"description":"A segmentation fault (SEGV) was detected in the Assimp::SplitLargeMeshesProcess_Triangle::UpdateNode function within the Assimp library during fuzz testing using AddressSanitizer. The crash occurs due to a read access violation at address 0x000000000460, which points to the zero page, indicating a null or invalid pointer dereference.","debianbug":1086044,"scope":"local","releases":{"bookworm":{"status":"open","repositories":{"bookworm":"5.2.5~ds0-1"},"urgency":"not yet assigned","nodsa":"Minor issue, revisit when fixed upstream","nodsa_reason":"postponed"},"bullseye":{"status":"open","repositories":{"bullseye":"5.0.1~ds0-2"},"urgency":"not yet assigned","nodsa":"Minor issue, revisit when fixed upstream","nodsa_reason":"postponed"},"forky":{"status":"resolved","repositories":{"forky":"6.0.4+ds-1"},"fixed_version":"6.0.2+ds-1","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"6.0.4+ds-1"},"fixed_version":"6.0.2+ds-1","urgency":"not yet assigned"},"trixie":{"status":"open","repositories":{"trixie":"5.4.3+ds-2"},"urgency":"not yet assigned","nodsa":"Minor issue, revisit when fixed upstream","nodsa_reason":"postponed"}}},"CVE-2024-48426":{"description":"A segmentation fault (SEGV) was detected in the SortByPTypeProcess::Execute function in the Assimp library during fuzz testing with AddressSanitizer. The crash occurred due to a read access to an invalid memory address (0x1000c9714971).","debianbug":1086043,"scope":"local","releases":{"bookworm":{"status":"open","repositories":{"bookworm":"5.2.5~ds0-1"},"urgency":"not yet assigned","nodsa":"Minor issue, revisit when fixed upstream","nodsa_reason":"postponed"},"bullseye":{"status":"open","repositories":{"bullseye":"5.0.1~ds0-2"},"urgency":"not yet assigned","nodsa":"Minor issue, revisit when fixed upstream","nodsa_reason":"postponed"},"forky":{"status":"open","repositories":{"forky":"6.0.4+ds-1"},"urgency":"not yet assigned"},"sid":{"status":"open","repositories":{"sid":"6.0.4+ds-1"},"urgency":"not yet assigned"},"trixie":{"status":"open","repositories":{"trixie":"5.4.3+ds-2"},"urgency":"not yet assigned","nodsa":"Minor issue, revisit when fixed upstream","nodsa_reason":"postponed"}}},"CVE-2024-53425":{"description":"A heap-buffer-overflow vulnerability was discovered in the SkipSpacesAndLineEnd function in Assimp v5.4.3. This issue occurs when processing certain malformed MD5 model files, leading to an out-of-bounds read and potential application crash.","debianbug":1088187,"scope":"local","releases":{"bookworm":{"status":"open","repositories":{"bookworm":"5.2.5~ds0-1"},"urgency":"not yet assigned","nodsa":"Minor issue, revisit when fixed upstream","nodsa_reason":"postponed"},"bullseye":{"status":"open","repositories":{"bullseye":"5.0.1~ds0-2"},"urgency":"not yet assigned","nodsa":"Minor issue, revisit when fixed upstream","nodsa_reason":"postponed"},"forky":{"status":"resolved","repositories":{"forky":"6.0.4+ds-1"},"fixed_version":"6.0.2+ds-1","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"6.0.4+ds-1"},"fixed_version":"6.0.2+ds-1","urgency":"not yet assigned"},"trixie":{"status":"open","repositories":{"trixie":"5.4.3+ds-2"},"urgency":"not yet assigned","nodsa":"Minor issue, revisit when fixed upstream","nodsa_reason":"postponed"}}},"CVE-2025-11274":{"description":"A vulnerability was determined in Open Asset Import Library Assimp 6.0.2. Affected is the function Q3DImporter::InternReadFile of the file assimp/code/AssetLib/Q3D/Q3DLoader.cpp. This manipulation causes allocation of resources. The attack is restricted to local execution. The exploit has been publicly disclosed and may be utilized.","debianbug":1117691,"scope":"local","releases":{"bookworm":{"status":"open","repositories":{"bookworm":"5.2.5~ds0-1"},"urgency":"not yet assigned","nodsa":"Minor issue, revisit when/if fixed upstream","nodsa_reason":"postponed"},"bullseye":{"status":"open","repositories":{"bullseye":"5.0.1~ds0-2"},"urgency":"not yet assigned","nodsa":"Minor issue; can be fixed in next update","nodsa_reason":"postponed"},"forky":{"status":"open","repositories":{"forky":"6.0.4+ds-1"},"urgency":"not yet assigned"},"sid":{"status":"open","repositories":{"sid":"6.0.4+ds-1"},"urgency":"not yet assigned"},"trixie":{"status":"open","repositories":{"trixie":"5.4.3+ds-2"},"urgency":"not yet assigned","nodsa":"Minor issue, revisit when/if fixed upstream","nodsa_reason":"postponed"}}},"CVE-2025-11275":{"description":"A vulnerability was identified in Open Asset Import Library Assimp 6.0.2. Affected by this vulnerability is the function ODDLParser::getNextSeparator in the library assimp/contrib/openddlparser/include/openddlparser/OpenDDLParserUtils.h. Such manipulation leads to heap-based buffer overflow. The attack must be carried out locally. The exploit is publicly available and might be used.","debianbug":1117689,"scope":"local","releases":{"bookworm":{"status":"open","repositories":{"bookworm":"5.2.5~ds0-1"},"urgency":"not yet assigned","nodsa":"Minor issue, revisit when/if fixed upstream","nodsa_reason":"postponed"},"bullseye":{"status":"open","repositories":{"bullseye":"5.0.1~ds0-2"},"urgency":"not yet assigned","nodsa":"Minor issue; can be fixed in next update","nodsa_reason":"postponed"},"forky":{"status":"open","repositories":{"forky":"6.0.4+ds-1"},"urgency":"not yet assigned"},"sid":{"status":"open","repositories":{"sid":"6.0.4+ds-1"},"urgency":"not yet assigned"},"trixie":{"status":"open","repositories":{"trixie":"5.4.3+ds-2"},"urgency":"not yet assigned","nodsa":"Minor issue, revisit when/if fixed upstream","nodsa_reason":"postponed"}}},"CVE-2025-11277":{"description":"A weakness has been identified in Open Asset Import Library Assimp 6.0.2. This affects the function Q3DImporter::InternReadFile of the file assimp/code/AssetLib/Q3D/Q3DLoader.cpp. Executing a manipulation can lead to heap-based buffer overflow. The attack needs to be launched locally. The exploit has been made available to the public and could be used for attacks.","debianbug":1117693,"scope":"local","releases":{"bookworm":{"status":"open","repositories":{"bookworm":"5.2.5~ds0-1"},"urgency":"not yet assigned","nodsa":"Minor issue","nodsa_reason":""},"bullseye":{"status":"open","repositories":{"bullseye":"5.0.1~ds0-2"},"urgency":"not yet assigned","nodsa":"Minor issue; can be fixed in next update","nodsa_reason":"postponed"},"forky":{"status":"resolved","repositories":{"forky":"6.0.4+ds-1"},"fixed_version":"6.0.3+ds-1","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"6.0.4+ds-1"},"fixed_version":"6.0.3+ds-1","urgency":"not yet assigned"},"trixie":{"status":"open","repositories":{"trixie":"5.4.3+ds-2"},"urgency":"not yet assigned","nodsa":"Minor issue","nodsa_reason":""}}},"CVE-2025-15538":{"description":"A security vulnerability has been detected in Open Asset Import Library Assimp up to 6.0.2. Affected by this vulnerability is the function Assimp::LWOImporter::FindUVChannels of the file /src/assimp/code/AssetLib/LWO/LWOMaterial.cpp. Such manipulation leads to use after free. The attack needs to be performed locally. The exploit has been disclosed publicly and may be used. This and similar defects are tracked and handled via issue #6128.","debianbug":1126072,"scope":"local","releases":{"bookworm":{"status":"open","repositories":{"bookworm":"5.2.5~ds0-1"},"urgency":"not yet assigned","nodsa":"Minor issue, revisit when/if fixed upstream","nodsa_reason":"postponed"},"bullseye":{"status":"open","repositories":{"bullseye":"5.0.1~ds0-2"},"urgency":"not yet assigned","nodsa":"Minor issue, revisit when/if fixed upstream","nodsa_reason":"postponed"},"forky":{"status":"open","repositories":{"forky":"6.0.4+ds-1"},"urgency":"not yet assigned"},"sid":{"status":"open","repositories":{"sid":"6.0.4+ds-1"},"urgency":"not yet assigned"},"trixie":{"status":"open","repositories":{"trixie":"5.4.3+ds-2"},"urgency":"not yet assigned","nodsa":"Minor issue, revisit when/if fixed upstream","nodsa_reason":"postponed"}}},"CVE-2025-2151":{"description":"A vulnerability classified as critical was found in Open Asset Import Library Assimp 5.4.3. This vulnerability affects the function Assimp::GetNextLine in the library ParsingUtils.h of the component File Handler. The manipulation leads to stack-based buffer overflow. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used.","debianbug":1100439,"scope":"local","releases":{"bookworm":{"status":"open","repositories":{"bookworm":"5.2.5~ds0-1"},"urgency":"not yet assigned","nodsa":"Minor issue, revisit when fixed upstream","nodsa_reason":"postponed"},"bullseye":{"status":"open","repositories":{"bullseye":"5.0.1~ds0-2"},"urgency":"not yet assigned","nodsa":"Minor issue","nodsa_reason":"postponed"},"forky":{"status":"resolved","repositories":{"forky":"6.0.4+ds-1"},"fixed_version":"6.0.2+ds-1","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"6.0.4+ds-1"},"fixed_version":"6.0.2+ds-1","urgency":"not yet assigned"},"trixie":{"status":"open","repositories":{"trixie":"5.4.3+ds-2"},"urgency":"not yet assigned","nodsa":"Minor issue, revisit when fixed upstream","nodsa_reason":"postponed"}}},"CVE-2025-2152":{"description":"A vulnerability, which was classified as critical, has been found in Open Asset Import Library Assimp 5.4.3. This issue affects the function Assimp::BaseImporter::ConvertToUTF8 of the file BaseImporter.cpp of the component File Handler. The manipulation leads to heap-based buffer overflow. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used.","debianbug":1100438,"scope":"local","releases":{"bookworm":{"status":"open","repositories":{"bookworm":"5.2.5~ds0-1"},"urgency":"not yet assigned","nodsa":"Minor issue, revisit when fixed upstream","nodsa_reason":"postponed"},"bullseye":{"status":"open","repositories":{"bullseye":"5.0.1~ds0-2"},"urgency":"not yet assigned","nodsa":"Minor issue","nodsa_reason":"postponed"},"forky":{"status":"resolved","repositories":{"forky":"6.0.4+ds-1"},"fixed_version":"6.0.2+ds-1","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"6.0.4+ds-1"},"fixed_version":"6.0.2+ds-1","urgency":"not yet assigned"},"trixie":{"status":"open","repositories":{"trixie":"5.4.3+ds-2"},"urgency":"not yet assigned","nodsa":"Minor issue, revisit when fixed upstream","nodsa_reason":"postponed"}}},"CVE-2025-2591":{"description":"A vulnerability classified as problematic was found in Open Asset Import Library Assimp 5.4.3. This vulnerability affects the function MDLImporter::InternReadFile_Quake1 of the file code/AssetLib/MDL/MDLLoader.cpp. The manipulation of the argument skinwidth/skinheight leads to divide by zero. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used. The patch is identified as ab66a1674fcfac87aaba4c8b900b315ebc3e7dbd. It is recommended to apply a patch to fix this issue.","debianbug":1102221,"scope":"local","releases":{"bookworm":{"status":"open","repositories":{"bookworm":"5.2.5~ds0-1"},"urgency":"not yet assigned","nodsa":"Minor issue, revisit when fixed upstream","nodsa_reason":"postponed"},"bullseye":{"status":"open","repositories":{"bullseye":"5.0.1~ds0-2"},"urgency":"not yet assigned","nodsa":"Minor issue","nodsa_reason":"postponed"},"forky":{"status":"resolved","repositories":{"forky":"6.0.4+ds-1"},"fixed_version":"6.0.2+ds-1","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"6.0.4+ds-1"},"fixed_version":"6.0.2+ds-1","urgency":"not yet assigned"},"trixie":{"status":"open","repositories":{"trixie":"5.4.3+ds-2"},"urgency":"not yet assigned","nodsa":"Minor issue, revisit when fixed upstream","nodsa_reason":"postponed"}}},"CVE-2025-2592":{"description":"A vulnerability, which was classified as critical, has been found in Open Asset Import Library Assimp 5.4.3. This issue affects the function CSMImporter::InternReadFile of the file code/AssetLib/CSM/CSMLoader.cpp. The manipulation leads to heap-based buffer overflow. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used. The patch is named 2690e354da0c681db000cfd892a55226788f2743. It is recommended to apply a patch to fix this issue.","debianbug":1102222,"scope":"local","releases":{"bookworm":{"status":"open","repositories":{"bookworm":"5.2.5~ds0-1"},"urgency":"not yet assigned","nodsa":"Minor issue, revisit when fixed upstream","nodsa_reason":"postponed"},"bullseye":{"status":"open","repositories":{"bullseye":"5.0.1~ds0-2"},"urgency":"not yet assigned","nodsa":"Minor issue","nodsa_reason":"postponed"},"forky":{"status":"resolved","repositories":{"forky":"6.0.4+ds-1"},"fixed_version":"6.0.2+ds-1","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"6.0.4+ds-1"},"fixed_version":"6.0.2+ds-1","urgency":"not yet assigned"},"trixie":{"status":"open","repositories":{"trixie":"5.4.3+ds-2"},"urgency":"not yet assigned","nodsa":"Minor issue, revisit when fixed upstream","nodsa_reason":"postponed"}}},"CVE-2025-2750":{"description":"A vulnerability, which was classified as critical, was found in Open Asset Import Library Assimp 5.4.3. This affects the function Assimp::CSMImporter::InternReadFile of the file code/AssetLib/CSM/CSMLoader.cpp of the component CSM File Handler. The manipulation leads to out-of-bounds write. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used.","debianbug":1101496,"scope":"local","releases":{"bookworm":{"status":"open","repositories":{"bookworm":"5.2.5~ds0-1"},"urgency":"not yet assigned","nodsa":"Minor issue, revisit when/if fixed upstream","nodsa_reason":"postponed"},"bullseye":{"status":"open","repositories":{"bullseye":"5.0.1~ds0-2"},"urgency":"not yet assigned","nodsa":"Minor issue","nodsa_reason":"postponed"},"forky":{"status":"resolved","repositories":{"forky":"6.0.4+ds-1"},"fixed_version":"6.0.2+ds-1","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"6.0.4+ds-1"},"fixed_version":"6.0.2+ds-1","urgency":"not yet assigned"},"trixie":{"status":"open","repositories":{"trixie":"5.4.3+ds-2"},"urgency":"not yet assigned","nodsa":"Minor issue, revisit when/if fixed upstream","nodsa_reason":"postponed"}}},"CVE-2025-2751":{"description":"A vulnerability has been found in Open Asset Import Library Assimp 5.4.3 and classified as problematic. This vulnerability affects the function Assimp::CSMImporter::InternReadFile of the file code/AssetLib/CSM/CSMLoader.cpp of the component CSM File Handler. The manipulation of the argument na leads to out-of-bounds read. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used.","debianbug":1101495,"scope":"local","releases":{"bookworm":{"status":"open","repositories":{"bookworm":"5.2.5~ds0-1"},"urgency":"not yet assigned","nodsa":"Minor issue, revisit when/if fixed upstream","nodsa_reason":"postponed"},"bullseye":{"status":"open","repositories":{"bullseye":"5.0.1~ds0-2"},"urgency":"not yet assigned","nodsa":"Minor issue","nodsa_reason":"postponed"},"forky":{"status":"resolved","repositories":{"forky":"6.0.4+ds-1"},"fixed_version":"6.0.2+ds-1","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"6.0.4+ds-1"},"fixed_version":"6.0.2+ds-1","urgency":"not yet assigned"},"trixie":{"status":"open","repositories":{"trixie":"5.4.3+ds-2"},"urgency":"not yet assigned","nodsa":"Minor issue, revisit when/if fixed upstream","nodsa_reason":"postponed"}}},"CVE-2025-2752":{"description":"A vulnerability was found in Open Asset Import Library Assimp 5.4.3 and classified as problematic. This issue affects the function fast_atoreal_move in the library include/assimp/fast_atof.h of the component CSM File Handler. The manipulation leads to out-of-bounds read. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used.","debianbug":1101494,"scope":"local","releases":{"bookworm":{"status":"open","repositories":{"bookworm":"5.2.5~ds0-1"},"urgency":"not yet assigned","nodsa":"Minor issue, revisit when/if fixed upstream","nodsa_reason":"postponed"},"bullseye":{"status":"open","repositories":{"bullseye":"5.0.1~ds0-2"},"urgency":"not yet assigned","nodsa":"Minor issue","nodsa_reason":"postponed"},"forky":{"status":"open","repositories":{"forky":"6.0.4+ds-1"},"urgency":"not yet assigned"},"sid":{"status":"open","repositories":{"sid":"6.0.4+ds-1"},"urgency":"not yet assigned"},"trixie":{"status":"open","repositories":{"trixie":"5.4.3+ds-2"},"urgency":"not yet assigned","nodsa":"Minor issue, revisit when/if fixed upstream","nodsa_reason":"postponed"}}},"CVE-2025-2753":{"description":"A vulnerability was found in Open Asset Import Library Assimp 5.4.3. It has been classified as critical. Affected is the function SceneCombiner::MergeScenes of the file code/AssetLib/LWS/LWSLoader.cpp of the component LWS File Handler. The manipulation leads to out-of-bounds read. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used.","debianbug":1102224,"scope":"local","releases":{"bookworm":{"status":"open","repositories":{"bookworm":"5.2.5~ds0-1"},"urgency":"not yet assigned","nodsa":"Minor issue, revisit when/if fixed upstream","nodsa_reason":"postponed"},"bullseye":{"status":"open","repositories":{"bullseye":"5.0.1~ds0-2"},"urgency":"not yet assigned","nodsa":"Minor issue","nodsa_reason":"postponed"},"forky":{"status":"open","repositories":{"forky":"6.0.4+ds-1"},"urgency":"not yet assigned"},"sid":{"status":"open","repositories":{"sid":"6.0.4+ds-1"},"urgency":"not yet assigned"},"trixie":{"status":"open","repositories":{"trixie":"5.4.3+ds-2"},"urgency":"not yet assigned","nodsa":"Minor issue, revisit when/if fixed upstream","nodsa_reason":"postponed"}}},"CVE-2025-2754":{"description":"A vulnerability was found in Open Asset Import Library Assimp 5.4.3. It has been declared as critical. Affected by this vulnerability is the function Assimp::AC3DImporter::ConvertObjectSection of the file code/AssetLib/AC/ACLoader.cpp of the component AC3D File Handler. The manipulation of the argument it leads to heap-based buffer overflow. The attack can be launched remotely. The exploit has been disclosed to the public and may be used.","debianbug":1102225,"scope":"local","releases":{"bookworm":{"status":"open","repositories":{"bookworm":"5.2.5~ds0-1"},"urgency":"not yet assigned","nodsa":"Minor issue, revisit when/if fixed upstream","nodsa_reason":"postponed"},"bullseye":{"status":"open","repositories":{"bullseye":"5.0.1~ds0-2"},"urgency":"not yet assigned","nodsa":"Minor issue","nodsa_reason":"postponed"},"forky":{"status":"open","repositories":{"forky":"6.0.4+ds-1"},"urgency":"not yet assigned"},"sid":{"status":"open","repositories":{"sid":"6.0.4+ds-1"},"urgency":"not yet assigned"},"trixie":{"status":"open","repositories":{"trixie":"5.4.3+ds-2"},"urgency":"not yet assigned","nodsa":"Minor issue, revisit when/if fixed upstream","nodsa_reason":"postponed"}}},"CVE-2025-2755":{"description":"A vulnerability was found in Open Asset Import Library Assimp 5.4.3. It has been rated as critical. Affected by this issue is the function Assimp::AC3DImporter::ConvertObjectSection of the file code/AssetLib/AC/ACLoader.cpp of the component AC3D File Handler. The manipulation of the argument src.entries leads to out-of-bounds read. The attack may be launched remotely. The exploit has been disclosed to the public and may be used.","debianbug":1102226,"scope":"local","releases":{"bookworm":{"status":"open","repositories":{"bookworm":"5.2.5~ds0-1"},"urgency":"not yet assigned","nodsa":"Minor issue, revisit when/if fixed upstream","nodsa_reason":"postponed"},"bullseye":{"status":"open","repositories":{"bullseye":"5.0.1~ds0-2"},"urgency":"not yet assigned","nodsa":"Minor issue","nodsa_reason":"postponed"},"forky":{"status":"open","repositories":{"forky":"6.0.4+ds-1"},"urgency":"not yet assigned"},"sid":{"status":"open","repositories":{"sid":"6.0.4+ds-1"},"urgency":"not yet assigned"},"trixie":{"status":"open","repositories":{"trixie":"5.4.3+ds-2"},"urgency":"not yet assigned","nodsa":"Minor issue, revisit when/if fixed upstream","nodsa_reason":"postponed"}}},"CVE-2025-2756":{"description":"A vulnerability classified as critical has been found in Open Asset Import Library Assimp 5.4.3. This affects the function Assimp::AC3DImporter::ConvertObjectSection of the file code/AssetLib/AC/ACLoader.cpp of the component AC3D File Handler. The manipulation of the argument tmp leads to heap-based buffer overflow. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used.","debianbug":1102227,"scope":"local","releases":{"bookworm":{"status":"open","repositories":{"bookworm":"5.2.5~ds0-1"},"urgency":"not yet assigned","nodsa":"Minor issue, revisit when/if fixed upstream","nodsa_reason":"postponed"},"bullseye":{"status":"open","repositories":{"bullseye":"5.0.1~ds0-2"},"urgency":"not yet assigned","nodsa":"Minor issue","nodsa_reason":"postponed"},"forky":{"status":"open","repositories":{"forky":"6.0.4+ds-1"},"urgency":"not yet assigned"},"sid":{"status":"open","repositories":{"sid":"6.0.4+ds-1"},"urgency":"not yet assigned"},"trixie":{"status":"open","repositories":{"trixie":"5.4.3+ds-2"},"urgency":"not yet assigned","nodsa":"Minor issue, revisit when/if fixed upstream","nodsa_reason":"postponed"}}},"CVE-2025-2757":{"description":"A vulnerability classified as critical was found in Open Asset Import Library Assimp 5.4.3. This vulnerability affects the function AI_MD5_PARSE_STRING_IN_QUOTATION of the file code/AssetLib/MD5/MD5Parser.cpp of the component MD5 File Handler. The manipulation of the argument data leads to heap-based buffer overflow. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used.","debianbug":1102228,"scope":"local","releases":{"bookworm":{"status":"open","repositories":{"bookworm":"5.2.5~ds0-1"},"urgency":"not yet assigned","nodsa":"Minor issue, revisit when/if fixed upstream","nodsa_reason":"postponed"},"bullseye":{"status":"open","repositories":{"bullseye":"5.0.1~ds0-2"},"urgency":"not yet assigned","nodsa":"Minor issue","nodsa_reason":"postponed"},"forky":{"status":"resolved","repositories":{"forky":"6.0.4+ds-1"},"fixed_version":"6.0.2+ds-1","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"6.0.4+ds-1"},"fixed_version":"6.0.2+ds-1","urgency":"not yet assigned"},"trixie":{"status":"open","repositories":{"trixie":"5.4.3+ds-2"},"urgency":"not yet assigned","nodsa":"Minor issue, revisit when/if fixed upstream","nodsa_reason":"postponed"}}},"CVE-2025-3015":{"description":"A vulnerability classified as critical has been found in Open Asset Import Library Assimp 5.4.3. This affects the function Assimp::ASEImporter::BuildUniqueRepresentation of the file code/AssetLib/ASE/ASELoader.cpp of the component ASE File Handler. The manipulation of the argument mIndices leads to out-of-bounds read. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used. Upgrading to version 6.0 is able to address this issue. The patch is named 7c705fde418d68cca4e8eff56be01b2617b0d6fe. It is recommended to apply a patch to fix this issue.","debianbug":1102234,"scope":"local","releases":{"bookworm":{"status":"open","repositories":{"bookworm":"5.2.5~ds0-1"},"urgency":"not yet assigned","nodsa":"Minor issue, revisit when/if fixed upstream","nodsa_reason":"postponed"},"bullseye":{"status":"open","repositories":{"bullseye":"5.0.1~ds0-2"},"urgency":"not yet assigned","nodsa":"Minor issue, OOB read","nodsa_reason":"postponed"},"forky":{"status":"resolved","repositories":{"forky":"6.0.4+ds-1"},"fixed_version":"6.0.2+ds-1","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"6.0.4+ds-1"},"fixed_version":"6.0.2+ds-1","urgency":"not yet assigned"},"trixie":{"status":"open","repositories":{"trixie":"5.4.3+ds-2"},"urgency":"not yet assigned","nodsa":"Minor issue, revisit when/if fixed upstream","nodsa_reason":"postponed"}}},"CVE-2025-3016":{"description":"A vulnerability classified as problematic was found in Open Asset Import Library Assimp 5.4.3. This vulnerability affects the function Assimp::MDLImporter::ParseTextureColorData of the file code/AssetLib/MDL/MDLMaterialLoader.cpp of the component MDL File Handler. The manipulation of the argument mWidth/mHeight leads to resource consumption. The attack can be initiated remotely. Upgrading to version 6.0 is able to address this issue. The name of the patch is 5d2a7482312db2e866439a8c05a07ce1e718bed1. It is recommended to apply a patch to fix this issue.","debianbug":1102235,"scope":"local","releases":{"bookworm":{"status":"open","repositories":{"bookworm":"5.2.5~ds0-1"},"urgency":"not yet assigned","nodsa":"Minor issue, revisit when/if fixed upstream","nodsa_reason":"postponed"},"bullseye":{"status":"open","repositories":{"bullseye":"5.0.1~ds0-2"},"urgency":"not yet assigned","nodsa":"Minor issue, OOM DoS","nodsa_reason":"postponed"},"forky":{"status":"resolved","repositories":{"forky":"6.0.4+ds-1"},"fixed_version":"6.0.2+ds-1","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"6.0.4+ds-1"},"fixed_version":"6.0.2+ds-1","urgency":"not yet assigned"},"trixie":{"status":"open","repositories":{"trixie":"5.4.3+ds-2"},"urgency":"not yet assigned","nodsa":"Minor issue, revisit when/if fixed upstream","nodsa_reason":"postponed"}}},"CVE-2025-3158":{"description":"A vulnerability, which was classified as critical, has been found in Open Asset Import Library Assimp 5.4.3. Affected by this issue is the function Assimp::LWO::AnimResolver::UpdateAnimRangeSetup of the file code/AssetLib/LWO/LWOAnimation.cpp of the component LWO File Handler. The manipulation leads to heap-based buffer overflow. It is possible to launch the attack on the local host. The exploit has been disclosed to the public and may be used.","debianbug":1102204,"scope":"local","releases":{"bookworm":{"status":"open","repositories":{"bookworm":"5.2.5~ds0-1"},"urgency":"not yet assigned","nodsa":"Minor issue, revisit when/if fixed upstream","nodsa_reason":"postponed"},"bullseye":{"status":"open","repositories":{"bullseye":"5.0.1~ds0-2"},"urgency":"not yet assigned","nodsa":"Minor issue, OOB read","nodsa_reason":"postponed"},"forky":{"status":"resolved","repositories":{"forky":"6.0.4+ds-1"},"fixed_version":"6.0.2+ds-1","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"6.0.4+ds-1"},"fixed_version":"6.0.2+ds-1","urgency":"not yet assigned"},"trixie":{"status":"open","repositories":{"trixie":"5.4.3+ds-2"},"urgency":"not yet assigned","nodsa":"Minor issue, revisit when/if fixed upstream","nodsa_reason":"postponed"}}},"CVE-2025-3159":{"description":"A vulnerability, which was classified as critical, was found in Open Asset Import Library Assimp 5.4.3. This affects the function Assimp::ASE::Parser::ParseLV4MeshBonesVertices of the file code/AssetLib/ASE/ASEParser.cpp of the component ASE File Handler. The manipulation leads to heap-based buffer overflow. The attack needs to be approached locally. The exploit has been disclosed to the public and may be used. The identifier of the patch is e8a6286542924e628e02749c4f5ac4f91fdae71b. It is recommended to apply a patch to fix this issue.","debianbug":1102205,"scope":"local","releases":{"bookworm":{"status":"open","repositories":{"bookworm":"5.2.5~ds0-1"},"urgency":"not yet assigned","nodsa":"Minor issue","nodsa_reason":""},"bullseye":{"status":"open","repositories":{"bullseye":"5.0.1~ds0-2"},"urgency":"not yet assigned","nodsa":"Minor issue, OOB read","nodsa_reason":"postponed"},"forky":{"status":"resolved","repositories":{"forky":"6.0.4+ds-1"},"fixed_version":"6.0.2+ds-1","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"6.0.4+ds-1"},"fixed_version":"6.0.2+ds-1","urgency":"not yet assigned"},"trixie":{"status":"open","repositories":{"trixie":"5.4.3+ds-2"},"urgency":"not yet assigned","nodsa":"Minor issue","nodsa_reason":""}}},"CVE-2025-3160":{"description":"A vulnerability has been found in Open Asset Import Library Assimp 5.4.3 and classified as problematic. This vulnerability affects the function Assimp::SceneCombiner::AddNodeHashes of the file code/Common/SceneCombiner.cpp of the component File Handler. The manipulation leads to out-of-bounds read. An attack has to be approached locally. The exploit has been disclosed to the public and may be used. The patch is identified as a0993658f40d8e13ff5823990c30b43c82a5daf0. It is recommended to apply a patch to fix this issue.","debianbug":1102206,"scope":"local","releases":{"bookworm":{"status":"open","repositories":{"bookworm":"5.2.5~ds0-1"},"urgency":"not yet assigned","nodsa":"Minor issue","nodsa_reason":""},"bullseye":{"status":"open","repositories":{"bullseye":"5.0.1~ds0-2"},"urgency":"not yet assigned","nodsa":"Minor issue, DoS","nodsa_reason":"postponed"},"forky":{"status":"resolved","repositories":{"forky":"6.0.4+ds-1"},"fixed_version":"6.0.2+ds-1","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"6.0.4+ds-1"},"fixed_version":"6.0.2+ds-1","urgency":"not yet assigned"},"trixie":{"status":"open","repositories":{"trixie":"5.4.3+ds-2"},"urgency":"not yet assigned","nodsa":"Minor issue","nodsa_reason":""}}},"CVE-2025-3196":{"description":"A vulnerability, which was classified as critical, was found in Open Asset Import Library Assimp 5.4.3. Affected is the function Assimp::MD2Importer::InternReadFile in the library code/AssetLib/MD2/MD2Loader.cpp of the component Malformed File Handler. The manipulation of the argument Name leads to stack-based buffer overflow. The attack needs to be approached locally. The exploit has been disclosed to the public and may be used. It is recommended to upgrade the affected component.","debianbug":1102207,"scope":"local","releases":{"bookworm":{"status":"open","repositories":{"bookworm":"5.2.5~ds0-1"},"urgency":"not yet assigned","nodsa":"Minor issue","nodsa_reason":""},"bullseye":{"status":"open","repositories":{"bullseye":"5.0.1~ds0-2"},"urgency":"not yet assigned","nodsa":"Minor issue, no upstream patch","nodsa_reason":"postponed"},"forky":{"status":"resolved","repositories":{"forky":"6.0.4+ds-1"},"fixed_version":"6.0.2+ds-1","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"6.0.4+ds-1"},"fixed_version":"6.0.2+ds-1","urgency":"not yet assigned"},"trixie":{"status":"open","repositories":{"trixie":"5.4.3+ds-2"},"urgency":"not yet assigned","nodsa":"Minor issue","nodsa_reason":""}}},"CVE-2025-3548":{"description":"A vulnerability, which was classified as critical, has been found in Open Asset Import Library Assimp up to 5.4.3. This issue affects the function aiString::Set in the library include/assimp/types.h of the component File Handler. The manipulation leads to heap-based buffer overflow. It is possible to launch the attack on the local host. The exploit has been disclosed to the public and may be used. It is recommended to apply a patch to fix this issue.","debianbug":1103443,"scope":"local","releases":{"bookworm":{"status":"open","repositories":{"bookworm":"5.2.5~ds0-1"},"urgency":"not yet assigned","nodsa":"Minor issue","nodsa_reason":""},"bullseye":{"status":"open","repositories":{"bullseye":"5.0.1~ds0-2"},"urgency":"not yet assigned","nodsa":"Minor issue","nodsa_reason":"postponed"},"forky":{"status":"resolved","repositories":{"forky":"6.0.4+ds-1"},"fixed_version":"6.0.2+ds-1","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"6.0.4+ds-1"},"fixed_version":"6.0.2+ds-1","urgency":"not yet assigned"},"trixie":{"status":"open","repositories":{"trixie":"5.4.3+ds-2"},"urgency":"not yet assigned","nodsa":"Minor issue","nodsa_reason":""}}},"CVE-2025-3549":{"description":"A vulnerability, which was classified as critical, was found in Open Asset Import Library Assimp 5.4.3. Affected is the function Assimp::MD3Importer::ValidateSurfaceHeaderOffsets of the file code/AssetLib/MD3/MD3Loader.cpp of the component File Handler. The manipulation leads to heap-based buffer overflow. The attack needs to be approached locally. The exploit has been disclosed to the public and may be used.","debianbug":1103444,"scope":"local","releases":{"bookworm":{"status":"open","repositories":{"bookworm":"5.2.5~ds0-1"},"urgency":"not yet assigned","nodsa":"Minor issue","nodsa_reason":""},"bullseye":{"status":"open","repositories":{"bullseye":"5.0.1~ds0-2"},"urgency":"not yet assigned","nodsa":"Minor issue","nodsa_reason":"postponed"},"forky":{"status":"resolved","repositories":{"forky":"6.0.4+ds-1"},"fixed_version":"6.0.3+ds-1","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"6.0.4+ds-1"},"fixed_version":"6.0.3+ds-1","urgency":"not yet assigned"},"trixie":{"status":"open","repositories":{"trixie":"5.4.3+ds-2"},"urgency":"not yet assigned","nodsa":"Minor issue","nodsa_reason":""}}},"CVE-2025-5165":{"description":"A vulnerability was found in Open Asset Import Library Assimp 5.4.3 and classified as problematic. This issue affects the function MDCImporter::ValidateSurfaceHeader of the file assimp/code/AssetLib/MDC/MDCLoader.cpp. The manipulation of the argument pcSurface2 leads to out-of-bounds read. Attacking locally is a requirement. The exploit has been disclosed to the public and may be used. The project decided to collect all Fuzzer bugs in a main-issue to address them in the future.","debianbug":1106591,"scope":"local","releases":{"bookworm":{"status":"open","repositories":{"bookworm":"5.2.5~ds0-1"},"urgency":"not yet assigned","nodsa":"Minor issue","nodsa_reason":""},"bullseye":{"status":"open","repositories":{"bullseye":"5.0.1~ds0-2"},"urgency":"not yet assigned","nodsa":"Minor issue, revisit when/if fixed upstream","nodsa_reason":"postponed"},"forky":{"status":"resolved","repositories":{"forky":"6.0.4+ds-1"},"fixed_version":"6.0.3+ds-1","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"6.0.4+ds-1"},"fixed_version":"6.0.3+ds-1","urgency":"not yet assigned"},"trixie":{"status":"open","repositories":{"trixie":"5.4.3+ds-2"},"urgency":"not yet assigned","nodsa":"Minor issue","nodsa_reason":""}}},"CVE-2025-5166":{"description":"A vulnerability was found in Open Asset Import Library Assimp 5.4.3. It has been classified as problematic. Affected is the function MDCImporter::InternReadFile of the file assimp/code/AssetLib/MDC/MDCLoader.cpp of the component MDC File Parser. The manipulation of the argument pcVerts leads to out-of-bounds read. It is possible to launch the attack on the local host. The exploit has been disclosed to the public and may be used. The project decided to collect all Fuzzer bugs in a main-issue to address them in the future.","debianbug":1106592,"scope":"local","releases":{"bookworm":{"status":"open","repositories":{"bookworm":"5.2.5~ds0-1"},"urgency":"not yet assigned","nodsa":"Minor issue","nodsa_reason":""},"bullseye":{"status":"open","repositories":{"bullseye":"5.0.1~ds0-2"},"urgency":"not yet assigned","nodsa":"Minor issue, revisit when/if fixed upstream","nodsa_reason":"postponed"},"forky":{"status":"resolved","repositories":{"forky":"6.0.4+ds-1"},"fixed_version":"6.0.3+ds-1","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"6.0.4+ds-1"},"fixed_version":"6.0.3+ds-1","urgency":"not yet assigned"},"trixie":{"status":"open","repositories":{"trixie":"5.4.3+ds-2"},"urgency":"not yet assigned","nodsa":"Minor issue","nodsa_reason":""}}},"CVE-2025-5167":{"description":"A vulnerability was found in Open Asset Import Library Assimp 5.4.3. It has been declared as problematic. Affected by this vulnerability is the function LWOImporter::GetS0 in the library assimp/code/AssetLib/LWO/LWOLoader.h. The manipulation of the argument out leads to out-of-bounds read. The attack needs to be approached locally. The exploit has been disclosed to the public and may be used. The project decided to collect all Fuzzer bugs in a main-issue to address them in the future.","debianbug":1106593,"scope":"local","releases":{"bookworm":{"status":"open","repositories":{"bookworm":"5.2.5~ds0-1"},"urgency":"not yet assigned","nodsa":"Minor issue, revisit when/if fixed upstream","nodsa_reason":"postponed"},"bullseye":{"status":"open","repositories":{"bullseye":"5.0.1~ds0-2"},"urgency":"not yet assigned","nodsa":"Minor issue, revisit when/if fixed upstream","nodsa_reason":"postponed"},"forky":{"status":"open","repositories":{"forky":"6.0.4+ds-1"},"urgency":"not yet assigned"},"sid":{"status":"open","repositories":{"sid":"6.0.4+ds-1"},"urgency":"not yet assigned"},"trixie":{"status":"open","repositories":{"trixie":"5.4.3+ds-2"},"urgency":"not yet assigned","nodsa":"Minor issue, revisit when/if fixed upstream","nodsa_reason":"postponed"}}},"CVE-2025-5168":{"description":"A vulnerability was found in Open Asset Import Library Assimp 5.4.3. It has been rated as problematic. Affected by this issue is the function MDLImporter::ImportUVCoordinate_3DGS_MDL345 of the file assimp/code/AssetLib/MDL/MDLLoader.cpp. The manipulation of the argument iIndex leads to out-of-bounds read. An attack has to be approached locally. The exploit has been disclosed to the public and may be used. The project decided to collect all Fuzzer bugs in a main-issue to address them in the future.","debianbug":1106594,"scope":"local","releases":{"bookworm":{"status":"open","repositories":{"bookworm":"5.2.5~ds0-1"},"urgency":"not yet assigned","nodsa":"Minor issue, revisit when/if fixed upstream","nodsa_reason":"postponed"},"bullseye":{"status":"open","repositories":{"bullseye":"5.0.1~ds0-2"},"urgency":"not yet assigned","nodsa":"Minor issue, revisit when/if fixed upstream","nodsa_reason":"postponed"},"forky":{"status":"open","repositories":{"forky":"6.0.4+ds-1"},"urgency":"not yet assigned"},"sid":{"status":"open","repositories":{"sid":"6.0.4+ds-1"},"urgency":"not yet assigned"},"trixie":{"status":"open","repositories":{"trixie":"5.4.3+ds-2"},"urgency":"not yet assigned","nodsa":"Minor issue, revisit when/if fixed upstream","nodsa_reason":"postponed"}}},"CVE-2025-5169":{"description":"A vulnerability classified as problematic has been found in Open Asset Import Library Assimp 5.4.3. This affects the function MDLImporter::InternReadFile_3DGS_MDL345 of the file assimp/code/AssetLib/MDL/MDLLoader.cpp. The manipulation leads to out-of-bounds read. Local access is required to approach this attack. The exploit has been disclosed to the public and may be used. The project decided to collect all Fuzzer bugs in a main-issue to address them in the future.","debianbug":1106595,"scope":"local","releases":{"bookworm":{"status":"open","repositories":{"bookworm":"5.2.5~ds0-1"},"urgency":"not yet assigned","nodsa":"Minor issue, revisit when/if fixed upstream","nodsa_reason":"postponed"},"bullseye":{"status":"open","repositories":{"bullseye":"5.0.1~ds0-2"},"urgency":"not yet assigned","nodsa":"Minor issue, revisit when/if fixed upstream","nodsa_reason":"postponed"},"forky":{"status":"open","repositories":{"forky":"6.0.4+ds-1"},"urgency":"not yet assigned"},"sid":{"status":"open","repositories":{"sid":"6.0.4+ds-1"},"urgency":"not yet assigned"},"trixie":{"status":"open","repositories":{"trixie":"5.4.3+ds-2"},"urgency":"not yet assigned","nodsa":"Minor issue, revisit when/if fixed upstream","nodsa_reason":"postponed"}}},"CVE-2025-5200":{"description":"A vulnerability was found in Open Asset Import Library Assimp 5.4.3 and classified as problematic. This issue affects the function MDLImporter::InternReadFile_Quake1 of the file assimp/code/AssetLib/MDL/MDLLoader.cpp. The manipulation leads to out-of-bounds read. It is possible to launch the attack on the local host. The exploit has been disclosed to the public and may be used. The project decided to collect all Fuzzer bugs in a main-issue to address them in the future.","debianbug":1106731,"scope":"local","releases":{"bookworm":{"status":"open","repositories":{"bookworm":"5.2.5~ds0-1"},"urgency":"not yet assigned","nodsa":"Minor issue, revisit when/if fixed upstream","nodsa_reason":"postponed"},"bullseye":{"status":"open","repositories":{"bullseye":"5.0.1~ds0-2"},"urgency":"not yet assigned","nodsa":"Minor issue, revisit when/if fixed upstream","nodsa_reason":"postponed"},"forky":{"status":"open","repositories":{"forky":"6.0.4+ds-1"},"urgency":"not yet assigned"},"sid":{"status":"open","repositories":{"sid":"6.0.4+ds-1"},"urgency":"not yet assigned"},"trixie":{"status":"open","repositories":{"trixie":"5.4.3+ds-2"},"urgency":"not yet assigned","nodsa":"Minor issue, revisit when/if fixed upstream","nodsa_reason":"postponed"}}},"CVE-2025-5201":{"description":"A vulnerability was found in Open Asset Import Library Assimp 5.4.3. It has been classified as problematic. Affected is the function LWOImporter::CountVertsAndFacesLWO2 of the file assimp/code/AssetLib/LWO/LWOLoader.cpp. The manipulation leads to out-of-bounds read. The attack needs to be approached locally. The exploit has been disclosed to the public and may be used. The project decided to collect all Fuzzer bugs in a main-issue to address them in the future.","debianbug":1106730,"scope":"local","releases":{"bookworm":{"status":"open","repositories":{"bookworm":"5.2.5~ds0-1"},"urgency":"not yet assigned","nodsa":"Minor issue, revisit when/if fixed upstream","nodsa_reason":"postponed"},"bullseye":{"status":"open","repositories":{"bullseye":"5.0.1~ds0-2"},"urgency":"not yet assigned","nodsa":"Minor issue, revisit when/if fixed upstream","nodsa_reason":"postponed"},"forky":{"status":"open","repositories":{"forky":"6.0.4+ds-1"},"urgency":"not yet assigned"},"sid":{"status":"open","repositories":{"sid":"6.0.4+ds-1"},"urgency":"not yet assigned"},"trixie":{"status":"open","repositories":{"trixie":"5.4.3+ds-2"},"urgency":"not yet assigned","nodsa":"Minor issue, revisit when/if fixed upstream","nodsa_reason":"postponed"}}},"CVE-2025-5202":{"description":"A vulnerability was found in Open Asset Import Library Assimp 5.4.3. It has been declared as problematic. Affected by this vulnerability is the function HL1MDLLoader::validate_header of the file assimp/code/AssetLib/MDL/HalfLife/HL1MDLLoader.cpp. The manipulation leads to out-of-bounds read. An attack has to be approached locally. The exploit has been disclosed to the public and may be used. The project decided to collect all Fuzzer bugs in a main-issue to address them in the future.","debianbug":1106732,"scope":"local","releases":{"bookworm":{"status":"open","repositories":{"bookworm":"5.2.5~ds0-1"},"urgency":"not yet assigned","nodsa":"Minor issue, revisit when/if fixed upstream","nodsa_reason":"postponed"},"bullseye":{"status":"open","repositories":{"bullseye":"5.0.1~ds0-2"},"urgency":"not yet assigned","nodsa":"Minor issue, revisit when/if fixed upstream","nodsa_reason":"postponed"},"forky":{"status":"open","repositories":{"forky":"6.0.4+ds-1"},"urgency":"not yet assigned"},"sid":{"status":"open","repositories":{"sid":"6.0.4+ds-1"},"urgency":"not yet assigned"},"trixie":{"status":"open","repositories":{"trixie":"5.4.3+ds-2"},"urgency":"not yet assigned","nodsa":"Minor issue, revisit when/if fixed upstream","nodsa_reason":"postponed"}}},"CVE-2025-5203":{"description":"A vulnerability was found in Open Asset Import Library Assimp 5.4.3. It has been rated as problematic. Affected by this issue is the function SkipSpaces in the library assimp/include/assimp/ParsingUtils.h. The manipulation leads to out-of-bounds read. Local access is required to approach this attack. The exploit has been disclosed to the public and may be used. The project decided to collect all Fuzzer bugs in a main-issue to address them in the future.","debianbug":1106729,"scope":"local","releases":{"bookworm":{"status":"open","repositories":{"bookworm":"5.2.5~ds0-1"},"urgency":"not yet assigned","nodsa":"Minor issue, revisit when/if fixed upstream","nodsa_reason":"postponed"},"bullseye":{"status":"open","repositories":{"bullseye":"5.0.1~ds0-2"},"urgency":"not yet assigned","nodsa":"Minor issue, revisit when/if fixed upstream","nodsa_reason":"postponed"},"forky":{"status":"open","repositories":{"forky":"6.0.4+ds-1"},"urgency":"not yet assigned"},"sid":{"status":"open","repositories":{"sid":"6.0.4+ds-1"},"urgency":"not yet assigned"},"trixie":{"status":"open","repositories":{"trixie":"5.4.3+ds-2"},"urgency":"not yet assigned","nodsa":"Minor issue, revisit when/if fixed upstream","nodsa_reason":"postponed"}}},"CVE-2025-5204":{"description":"A vulnerability classified as problematic has been found in Open Asset Import Library Assimp 5.4.3. This affects the function MDLImporter::ParseSkinLump_3DGS_MDL7 of the file assimp/code/AssetLib/MDL/MDLMaterialLoader.cpp. The manipulation leads to out-of-bounds read. Attacking locally is a requirement. The exploit has been disclosed to the public and may be used. The project decided to collect all Fuzzer bugs in a main-issue to address them in the future.","debianbug":1106685,"scope":"local","releases":{"bookworm":{"status":"open","repositories":{"bookworm":"5.2.5~ds0-1"},"urgency":"not yet assigned","nodsa":"Minor issue, revisit when/if fixed upstream","nodsa_reason":"postponed"},"bullseye":{"status":"open","repositories":{"bullseye":"5.0.1~ds0-2"},"urgency":"not yet assigned","nodsa":"Minor issue, revisit when/if fixed upstream","nodsa_reason":"postponed"},"forky":{"status":"open","repositories":{"forky":"6.0.4+ds-1"},"urgency":"not yet assigned"},"sid":{"status":"open","repositories":{"sid":"6.0.4+ds-1"},"urgency":"not yet assigned"},"trixie":{"status":"open","repositories":{"trixie":"5.4.3+ds-2"},"urgency":"not yet assigned","nodsa":"Minor issue, revisit when/if fixed upstream","nodsa_reason":"postponed"}}},"CVE-2025-6119":{"description":"A vulnerability classified as critical has been found in Open Asset Import Library Assimp up to 5.4.3. Affected is the function Assimp::BVHLoader::ReadNodeChannels in the library assimp/code/AssetLib/BVH/BVHLoader.cpp. The manipulation of the argument pNode leads to use after free. Attacking locally is a requirement. The exploit has been disclosed to the public and may be used. The project decided to collect all Fuzzer bugs in a main-issue to address them in the future.","debianbug":1107935,"scope":"local","releases":{"bookworm":{"status":"open","repositories":{"bookworm":"5.2.5~ds0-1"},"urgency":"not yet assigned","nodsa":"Minor issue, revisit when/if fixed upstream","nodsa_reason":"postponed"},"bullseye":{"status":"open","repositories":{"bullseye":"5.0.1~ds0-2"},"urgency":"not yet assigned","nodsa":"Minor issue","nodsa_reason":"postponed"},"forky":{"status":"open","repositories":{"forky":"6.0.4+ds-1"},"urgency":"not yet assigned"},"sid":{"status":"open","repositories":{"sid":"6.0.4+ds-1"},"urgency":"not yet assigned"},"trixie":{"status":"open","repositories":{"trixie":"5.4.3+ds-2"},"urgency":"not yet assigned","nodsa":"Minor issue, revisit when/if fixed upstream","nodsa_reason":"postponed"}}},"CVE-2025-6120":{"description":"A vulnerability classified as critical was found in Open Asset Import Library Assimp up to 5.4.3. Affected by this vulnerability is the function read_meshes in the library assimp/code/AssetLib/MDL/HalfLife/HL1MDLLoader.cpp. The manipulation leads to heap-based buffer overflow. It is possible to launch the attack on the local host. The exploit has been disclosed to the public and may be used. The project decided to collect all Fuzzer bugs in a main-issue to address them in the future.","debianbug":1107936,"scope":"local","releases":{"bookworm":{"status":"open","repositories":{"bookworm":"5.2.5~ds0-1"},"urgency":"not yet assigned","nodsa":"Minor issue, revisit when/if fixed upstream","nodsa_reason":"postponed"},"bullseye":{"status":"open","repositories":{"bullseye":"5.0.1~ds0-2"},"urgency":"not yet assigned","nodsa":"Minor issue","nodsa_reason":"postponed"},"forky":{"status":"open","repositories":{"forky":"6.0.4+ds-1"},"urgency":"not yet assigned"},"sid":{"status":"open","repositories":{"sid":"6.0.4+ds-1"},"urgency":"not yet assigned"},"trixie":{"status":"open","repositories":{"trixie":"5.4.3+ds-2"},"urgency":"not yet assigned","nodsa":"Minor issue, revisit when/if fixed upstream","nodsa_reason":"postponed"}}}},"asterisk":{"CVE-2003-0761":{"description":"Buffer overflow in the get_msg_text of chan_sip.c in the Session Initiation Protocol (SIP) protocol implementation for Asterisk releases before August 15, 2003, allows remote attackers to execute arbitrary code via certain (1) MESSAGE or (2) INFO requests.","scope":"local","releases":{"bullseye":{"status":"resolved","repositories":{"bullseye":"1:16.28.0~dfsg-0+deb11u4","bullseye-security":"1:16.28.0~dfsg-0+deb11u8"},"fixed_version":"0.5.0","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"1:22.8.2+dfsg+~cs6.15.60671435-1"},"fixed_version":"0.5.0","urgency":"not yet assigned"}}},"CVE-2003-0779":{"description":"SQL injection vulnerability in the Call Detail Record (CDR) logging functionality for Asterisk allows remote attackers to execute arbitrary SQL via a CallerID string.","scope":"local","releases":{"bullseye":{"status":"resolved","repositories":{"bullseye":"1:16.28.0~dfsg-0+deb11u4","bullseye-security":"1:16.28.0~dfsg-0+deb11u8"},"fixed_version":"0.7.0","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"1:22.8.2+dfsg+~cs6.15.60671435-1"},"fixed_version":"0.7.0","urgency":"not yet assigned"}}},"CVE-2005-2081":{"description":"Stack-based buffer overflow in the function that parses commands in Asterisk 1.0.7, when the 'write = command' option is enabled, allows remote attackers to execute arbitrary code via a command that has two double quotes followed by a tab character.","debianbug":315532,"scope":"local","releases":{"bullseye":{"status":"resolved","repositories":{"bullseye":"1:16.28.0~dfsg-0+deb11u4","bullseye-security":"1:16.28.0~dfsg-0+deb11u8"},"fixed_version":"1:1.0.9.dfsg-1","urgency":"unimportant"},"sid":{"status":"resolved","repositories":{"sid":"1:22.8.2+dfsg+~cs6.15.60671435-1"},"fixed_version":"1:1.0.9.dfsg-1","urgency":"unimportant"}}},"CVE-2005-3559":{"description":"Directory traversal vulnerability in vmail.cgi in Asterisk 1.0.9 through 1.2.0-beta1 allows remote attackers to access WAV files via a .. (dot dot) in the folder parameter.","debianbug":338116,"scope":"local","releases":{"bullseye":{"status":"resolved","repositories":{"bullseye":"1:16.28.0~dfsg-0+deb11u4","bullseye-security":"1:16.28.0~dfsg-0+deb11u8"},"fixed_version":"1:1.2.7.1.dfsg-2","urgency":"medium"},"sid":{"status":"resolved","repositories":{"sid":"1:22.8.2+dfsg+~cs6.15.60671435-1"},"fixed_version":"1:1.2.7.1.dfsg-2","urgency":"medium"}}},"CVE-2006-1827":{"description":"Integer signedness error in format_jpeg.c in Asterisk 1.2.6 and earlier allows remote attackers to execute arbitrary code via a length value that passes a length check as a negative number, but triggers a buffer overflow when it is used as an unsigned length.","debianbug":364195,"scope":"local","releases":{"bullseye":{"status":"resolved","repositories":{"bullseye":"1:16.28.0~dfsg-0+deb11u4","bullseye-security":"1:16.28.0~dfsg-0+deb11u8"},"fixed_version":"1:1.2.7.1.dfsg-1","urgency":"medium"},"sid":{"status":"resolved","repositories":{"sid":"1:22.8.2+dfsg+~cs6.15.60671435-1"},"fixed_version":"1:1.2.7.1.dfsg-1","urgency":"medium"}}},"CVE-2006-2898":{"description":"The IAX2 channel driver (chan_iax2) for Asterisk 1.2.x before 1.2.9 and 1.0.x before 1.0.11 allows remote attackers to cause a denial of service (crash) and execute arbitrary code via truncated IAX 2 (IAX2) video frames, which bypasses a length check and leads to a buffer overflow involving negative length check.  NOTE: the vendor advisory claims that only a DoS is possible, but the original researcher is reliable.","debianbug":380054,"scope":"local","releases":{"bullseye":{"status":"resolved","repositories":{"bullseye":"1:16.28.0~dfsg-0+deb11u4","bullseye-security":"1:16.28.0~dfsg-0+deb11u8"},"fixed_version":"1:1.2.10.dfsg-2","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"1:22.8.2+dfsg+~cs6.15.60671435-1"},"fixed_version":"1:1.2.10.dfsg-2","urgency":"not yet assigned"}}},"CVE-2006-4345":{"description":"Stack-based buffer overflow in channels/chan_mgcp.c in MGCP in Asterisk 1.0 through 1.2.10 allows remote attackers to execute arbitrary code via a crafted audit endpoint (AUEP) response.","debianbug":385060,"scope":"local","releases":{"bullseye":{"status":"resolved","repositories":{"bullseye":"1:16.28.0~dfsg-0+deb11u4","bullseye-security":"1:16.28.0~dfsg-0+deb11u8"},"fixed_version":"1:1.2.11.dfsg-1","urgency":"medium"},"sid":{"status":"resolved","repositories":{"sid":"1:22.8.2+dfsg+~cs6.15.60671435-1"},"fixed_version":"1:1.2.11.dfsg-1","urgency":"medium"}}},"CVE-2006-4346":{"description":"Asterisk 1.2.10 supports the use of client-controlled variables to determine filenames in the Record function, which allows remote attackers to (1) execute code via format string specifiers or (2) overwrite files via directory traversals involving unspecified vectors, as demonstrated by the CALLERIDNAME variable.","debianbug":385060,"scope":"local","releases":{"bullseye":{"status":"resolved","repositories":{"bullseye":"1:16.28.0~dfsg-0+deb11u4","bullseye-security":"1:16.28.0~dfsg-0+deb11u8"},"fixed_version":"1:1.2.11.dfsg-1","urgency":"medium"},"sid":{"status":"resolved","repositories":{"sid":"1:22.8.2+dfsg+~cs6.15.60671435-1"},"fixed_version":"1:1.2.11.dfsg-1","urgency":"medium"}}},"CVE-2006-5444":{"description":"Integer overflow in the get_input function in the Skinny channel driver (chan_skinny.c) in Asterisk 1.0.x before 1.0.12 and 1.2.x before 1.2.13, as used by Cisco SCCP phones, allows remote attackers to execute arbitrary code via a certain dlen value that passes a signed integer comparison and leads to a heap-based buffer overflow.","debianbug":394025,"scope":"local","releases":{"bullseye":{"status":"resolved","repositories":{"bullseye":"1:16.28.0~dfsg-0+deb11u4","bullseye-security":"1:16.28.0~dfsg-0+deb11u8"},"fixed_version":"1:1.2.13~dfsg-1","urgency":"medium"},"sid":{"status":"resolved","repositories":{"sid":"1:22.8.2+dfsg+~cs6.15.60671435-1"},"fixed_version":"1:1.2.13~dfsg-1","urgency":"medium"}}},"CVE-2006-5445":{"description":"Unspecified vulnerability in the SIP channel driver (channels/chan_sip.c) in Asterisk 1.2.x before 1.2.13 and 1.4.x before 1.4.0-beta3 allows remote attackers to cause a denial of service (resource consumption) via unspecified vectors that result in the creation of \"a real pvt structure\" that uses more resources than necessary.","debianbug":395080,"scope":"local","releases":{"bullseye":{"status":"resolved","repositories":{"bullseye":"1:16.28.0~dfsg-0+deb11u4","bullseye-security":"1:16.28.0~dfsg-0+deb11u8"},"fixed_version":"1:1.2.13~dfsg-1","urgency":"medium"},"sid":{"status":"resolved","repositories":{"sid":"1:22.8.2+dfsg+~cs6.15.60671435-1"},"fixed_version":"1:1.2.13~dfsg-1","urgency":"medium"}}},"CVE-2007-1306":{"description":"Asterisk 1.4 before 1.4.1 and 1.2 before 1.2.16 allows remote attackers to cause a denial of service (crash) by sending a Session Initiation Protocol (SIP) packet without a URI and SIP-version header, which results in a NULL pointer dereference.","scope":"local","releases":{"bullseye":{"status":"resolved","repositories":{"bullseye":"1:16.28.0~dfsg-0+deb11u4","bullseye-security":"1:16.28.0~dfsg-0+deb11u8"},"fixed_version":"1:1.2.16~dfsg-1","urgency":"medium"},"sid":{"status":"resolved","repositories":{"sid":"1:22.8.2+dfsg+~cs6.15.60671435-1"},"fixed_version":"1:1.2.16~dfsg-1","urgency":"medium"}}},"CVE-2007-1561":{"description":"The channel driver in Asterisk before 1.2.17 and 1.4.x before 1.4.2 allows remote attackers to cause a denial of service (crash) via a SIP INVITE message with an SDP containing one valid and one invalid IP address.","debianbug":415466,"scope":"local","releases":{"bullseye":{"status":"resolved","repositories":{"bullseye":"1:16.28.0~dfsg-0+deb11u4","bullseye-security":"1:16.28.0~dfsg-0+deb11u8"},"fixed_version":"1:1.4.2~dfsg-5","urgency":"medium"},"sid":{"status":"resolved","repositories":{"sid":"1:22.8.2+dfsg+~cs6.15.60671435-1"},"fixed_version":"1:1.4.2~dfsg-5","urgency":"medium"}}},"CVE-2007-1595":{"description":"The Asterisk Extension Language (AEL) in pbx/pbx_ael.c in Asterisk does not properly generate extensions, which allows remote attackers to execute arbitrary extensions and have an unknown impact by specifying an invalid extension in a certain form.","scope":"local","releases":{"bullseye":{"status":"resolved","repositories":{"bullseye":"1:16.28.0~dfsg-0+deb11u4","bullseye-security":"1:16.28.0~dfsg-0+deb11u8"},"fixed_version":"1:1.4.0~dfsg-1","urgency":"low"},"sid":{"status":"resolved","repositories":{"sid":"1:22.8.2+dfsg+~cs6.15.60671435-1"},"fixed_version":"1:1.4.0~dfsg-1","urgency":"low"}}},"CVE-2007-2293":{"description":"Multiple stack-based buffer overflows in the process_sdp function in chan_sip.c of the SIP channel T.38 SDP parser in Asterisk before 1.4.3 allow remote attackers to execute arbitrary code via a long (1) T38FaxRateManagement or (2) T38FaxUdpEC SDP parameter in an SIP message, as demonstrated using SIP INVITE.","scope":"local","releases":{"bullseye":{"status":"resolved","repositories":{"bullseye":"1:16.28.0~dfsg-0+deb11u4","bullseye-security":"1:16.28.0~dfsg-0+deb11u8"},"fixed_version":"1:1.4.3~dfsg-1","urgency":"high"},"sid":{"status":"resolved","repositories":{"sid":"1:22.8.2+dfsg+~cs6.15.60671435-1"},"fixed_version":"1:1.4.3~dfsg-1","urgency":"high"}}},"CVE-2007-2294":{"description":"The Manager Interface in Asterisk before 1.2.18 and 1.4.x before 1.4.3 allows remote attackers to cause a denial of service (crash) by using MD5 authentication to authenticate a user that does not have a password defined in manager.conf, resulting in a NULL pointer dereference.","scope":"local","releases":{"bullseye":{"status":"resolved","repositories":{"bullseye":"1:16.28.0~dfsg-0+deb11u4","bullseye-security":"1:16.28.0~dfsg-0+deb11u8"},"fixed_version":"1:1.4.3~dfsg-1","urgency":"low"},"sid":{"status":"resolved","repositories":{"sid":"1:22.8.2+dfsg+~cs6.15.60671435-1"},"fixed_version":"1:1.4.3~dfsg-1","urgency":"low"}}},"CVE-2007-2297":{"description":"The SIP channel driver (chan_sip) in Asterisk before 1.2.18 and 1.4.x before 1.4.3 does not properly parse SIP UDP packets that do not contain a valid response code, which allows remote attackers to cause a denial of service (crash).","debianbug":419820,"scope":"local","releases":{"bullseye":{"status":"resolved","repositories":{"bullseye":"1:16.28.0~dfsg-0+deb11u4","bullseye-security":"1:16.28.0~dfsg-0+deb11u8"},"fixed_version":"1:1.4.2~dfsg-1","urgency":"medium"},"sid":{"status":"resolved","repositories":{"sid":"1:22.8.2+dfsg+~cs6.15.60671435-1"},"fixed_version":"1:1.4.2~dfsg-1","urgency":"medium"}}},"CVE-2007-2383":{"description":"The Prototype (prototypejs) framework before 1.5.1 RC3 exchanges data using JavaScript Object Notation (JSON) without an associated protection scheme, which allows remote attackers to obtain the data via a web page that retrieves the data through a URL in the SRC attribute of a SCRIPT element and captures the data using other JavaScript code, aka \"JavaScript Hijacking.\"","debianbug":555220,"scope":"local","releases":{"bullseye":{"status":"resolved","repositories":{"bullseye":"1:16.28.0~dfsg-0+deb11u4","bullseye-security":"1:16.28.0~dfsg-0+deb11u8"},"fixed_version":"1:1.6.2.0~rc3-1","urgency":"low"},"sid":{"status":"resolved","repositories":{"sid":"1:22.8.2+dfsg+~cs6.15.60671435-1"},"fixed_version":"1:1.6.2.0~rc3-1","urgency":"low"}}},"CVE-2007-2488":{"description":"The IAX2 channel driver (chan_iax2) in Asterisk before 20070504 does not properly null terminate data, which allows remote attackers to trigger loss of transmitted data, and possibly obtain sensitive information (memory contents) or cause a denial of service (application crash), by sending a frame that lacks a 0 byte.","scope":"local","releases":{"bullseye":{"status":"resolved","repositories":{"bullseye":"1:16.28.0~dfsg-0+deb11u4","bullseye-security":"1:16.28.0~dfsg-0+deb11u8"},"fixed_version":"1:1.4.5~dfsg-1","urgency":"low"},"sid":{"status":"resolved","repositories":{"sid":"1:22.8.2+dfsg+~cs6.15.60671435-1"},"fixed_version":"1:1.4.5~dfsg-1","urgency":"low"}}},"CVE-2007-3762":{"description":"Stack-based buffer overflow in the IAX2 channel driver (chan_iax2) in Asterisk before 1.2.22 and 1.4.x before 1.4.8, Business Edition before B.2.2.1, AsteriskNOW before beta7, Appliance Developer Kit before 0.5.0, and s800i before 1.0.2 allows remote attackers to execute arbitrary code by sending a long (1) voice or (2) video RTP frame.","scope":"local","releases":{"bullseye":{"status":"resolved","repositories":{"bullseye":"1:16.28.0~dfsg-0+deb11u4","bullseye-security":"1:16.28.0~dfsg-0+deb11u8"},"fixed_version":"1:1.4.8~dfsg-1","urgency":"high"},"sid":{"status":"resolved","repositories":{"sid":"1:22.8.2+dfsg+~cs6.15.60671435-1"},"fixed_version":"1:1.4.8~dfsg-1","urgency":"high"}}},"CVE-2007-3763":{"description":"The IAX2 channel driver (chan_iax2) in Asterisk before 1.2.22 and 1.4.x before 1.4.8, Business Edition before B.2.2.1, AsteriskNOW before beta7, Appliance Developer Kit before 0.5.0, and s800i before 1.0.2 allows remote attackers to cause a denial of service (crash) via a crafted (1) LAGRQ or (2) LAGRP frame that contains information elements of IAX frames, which results in a NULL pointer dereference when Asterisk does not properly set an associated variable.","scope":"local","releases":{"bullseye":{"status":"resolved","repositories":{"bullseye":"1:16.28.0~dfsg-0+deb11u4","bullseye-security":"1:16.28.0~dfsg-0+deb11u8"},"fixed_version":"1:1.4.8~dfsg-1","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"1:22.8.2+dfsg+~cs6.15.60671435-1"},"fixed_version":"1:1.4.8~dfsg-1","urgency":"not yet assigned"}}},"CVE-2007-3764":{"description":"The Skinny channel driver (chan_skinny) in Asterisk before 1.2.22 and 1.4.x before 1.4.8, Business Edition before B.2.2.1, AsteriskNOW before beta7, Appliance Developer Kit before 0.5.0, and s800i before 1.0.2 allows remote attackers to cause a denial of service (crash) via a certain data length value in a crafted packet, which results in an \"overly large memcpy.\"","scope":"local","releases":{"bullseye":{"status":"resolved","repositories":{"bullseye":"1:16.28.0~dfsg-0+deb11u4","bullseye-security":"1:16.28.0~dfsg-0+deb11u8"},"fixed_version":"1:1.4.8~dfsg-1","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"1:22.8.2+dfsg+~cs6.15.60671435-1"},"fixed_version":"1:1.4.8~dfsg-1","urgency":"not yet assigned"}}},"CVE-2007-3765":{"description":"The STUN implementation in Asterisk 1.4.x before 1.4.8, AsteriskNOW before beta7, Appliance Developer Kit before 0.5.0, and s800i before 1.0.2 allows remote attackers to cause a denial of service (crash) via a crafted STUN length attribute in a STUN packet sent on an RTP port.","debianbug":433681,"scope":"local","releases":{"bullseye":{"status":"resolved","repositories":{"bullseye":"1:16.28.0~dfsg-0+deb11u4","bullseye-security":"1:16.28.0~dfsg-0+deb11u8"},"fixed_version":"1:1.4.8~dfsg-1","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"1:22.8.2+dfsg+~cs6.15.60671435-1"},"fixed_version":"1:1.4.8~dfsg-1","urgency":"not yet assigned"}}},"CVE-2007-4103":{"description":"The IAX2 channel driver (chan_iax2) in Asterisk Open 1.2.x before 1.2.23, 1.4.x before 1.4.9, and Asterisk Appliance Developer Kit before 0.6.0, when configured to allow unauthenticated calls, allows remote attackers to cause a denial of service (resource exhaustion) via a flood of calls that do not complete a 3-way handshake, which causes an ast_channel to be allocated but not released.","scope":"local","releases":{"bullseye":{"status":"resolved","repositories":{"bullseye":"1:16.28.0~dfsg-0+deb11u4","bullseye-security":"1:16.28.0~dfsg-0+deb11u8"},"fixed_version":"1:1.4.9~dfsg-1","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"1:22.8.2+dfsg+~cs6.15.60671435-1"},"fixed_version":"1:1.4.9~dfsg-1","urgency":"not yet assigned"}}},"CVE-2007-4280":{"description":"The Skinny channel driver (chan_skinny) in Asterisk Open Source before 1.4.10, AsteriskNOW before beta7, Appliance Developer Kit before 0.7.0, and Appliance s800i before 1.0.3 allows remote authenticated users to cause a denial of service (application crash) via a CAPABILITIES_RES_MESSAGE packet with a capabilities count larger than the capabilities_res_message array population.","scope":"local","releases":{"bullseye":{"status":"resolved","repositories":{"bullseye":"1:16.28.0~dfsg-0+deb11u4","bullseye-security":"1:16.28.0~dfsg-0+deb11u8"},"fixed_version":"1:1.4.10~dfsg-1","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"1:22.8.2+dfsg+~cs6.15.60671435-1"},"fixed_version":"1:1.4.10~dfsg-1","urgency":"not yet assigned"}}},"CVE-2007-4455":{"description":"The SIP channel driver (chan_sip) in Asterisk Open Source 1.4.x before 1.4.11, AsteriskNOW before beta7, Asterisk Appliance Developer Kit 0.x before 0.8.0, and s800i (Asterisk Appliance) 1.x before 1.0.3 allows remote attackers to cause a denial of service (memory exhaustion) via a SIP dialog that causes a large number of history entries to be created.","scope":"local","releases":{"bullseye":{"status":"resolved","repositories":{"bullseye":"1:16.28.0~dfsg-0+deb11u4","bullseye-security":"1:16.28.0~dfsg-0+deb11u8"},"fixed_version":"1:1.4.11~dfsg-1","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"1:22.8.2+dfsg+~cs6.15.60671435-1"},"fixed_version":"1:1.4.11~dfsg-1","urgency":"not yet assigned"}}},"CVE-2007-4521":{"description":"Asterisk Open Source 1.4.5 through 1.4.11, when configured to use an IMAP voicemail storage backend, allows remote attackers to cause a denial of service via an e-mail with an \"invalid/corrupted\" MIME body, which triggers a crash when the recipient listens to voicemail.","scope":"local","releases":{"bullseye":{"status":"resolved","repositories":{"bullseye":"1:16.28.0~dfsg-0+deb11u4","bullseye-security":"1:16.28.0~dfsg-0+deb11u8"},"fixed_version":"0","urgency":"unimportant"},"sid":{"status":"resolved","repositories":{"sid":"1:22.8.2+dfsg+~cs6.15.60671435-1"},"fixed_version":"0","urgency":"unimportant"}}},"CVE-2007-5358":{"description":"Multiple buffer overflows in the voicemail functionality in Asterisk 1.4.x before 1.4.13, when using IMAP storage, might allow (1) remote attackers to execute arbitrary code via a long combination of Content-type and Content-description headers, or (2) local users to execute arbitrary code via a long combination of astspooldir, voicemail context, and voicemail mailbox fields.  NOTE: vector 2 requires write access to Asterisk configuration files.","scope":"local","releases":{"bullseye":{"status":"resolved","repositories":{"bullseye":"1:16.28.0~dfsg-0+deb11u4","bullseye-security":"1:16.28.0~dfsg-0+deb11u8"},"fixed_version":"1:1.4.13~dfsg-1","urgency":"medium"},"sid":{"status":"resolved","repositories":{"sid":"1:22.8.2+dfsg+~cs6.15.60671435-1"},"fixed_version":"1:1.4.13~dfsg-1","urgency":"medium"}}},"CVE-2007-6170":{"description":"SQL injection vulnerability in the Call Detail Record Postgres logging engine (cdr_pgsql) in Asterisk 1.4.x before 1.4.15, 1.2.x before 1.2.25, B.x before B.2.3.4, and C.x before C.1.0-beta6 allows remote authenticated users to execute arbitrary SQL commands via (1) ANI and (2) DNIS arguments.","scope":"local","releases":{"bullseye":{"status":"resolved","repositories":{"bullseye":"1:16.28.0~dfsg-0+deb11u4","bullseye-security":"1:16.28.0~dfsg-0+deb11u8"},"fixed_version":"1:1.4.15~dfsg-1","urgency":"medium"},"sid":{"status":"resolved","repositories":{"sid":"1:22.8.2+dfsg+~cs6.15.60671435-1"},"fixed_version":"1:1.4.15~dfsg-1","urgency":"medium"}}},"CVE-2007-6171":{"description":"SQL injection vulnerability in the Postgres Realtime Engine (res_config_pgsql) in Asterisk 1.4.x before 1.4.15 and C.x before C.1.0-beta6 allows remote attackers to execute arbitrary SQL commands via unknown vectors.","scope":"local","releases":{"bullseye":{"status":"resolved","repositories":{"bullseye":"1:16.28.0~dfsg-0+deb11u4","bullseye-security":"1:16.28.0~dfsg-0+deb11u8"},"fixed_version":"1:1.4.15~dfsg-1","urgency":"medium"},"sid":{"status":"resolved","repositories":{"sid":"1:22.8.2+dfsg+~cs6.15.60671435-1"},"fixed_version":"1:1.4.15~dfsg-1","urgency":"medium"}}},"CVE-2007-6430":{"description":"Asterisk Open Source 1.2.x before 1.2.26 and 1.4.x before 1.4.16, and Business Edition B.x.x before B.2.3.6 and C.x.x before C.1.0-beta8, when using database-based registrations (\"realtime\") and host-based authentication, does not check the IP address when the username is correct and there is no password, which allows remote attackers to bypass authentication using a valid username.","debianbug":457063,"scope":"local","releases":{"bullseye":{"status":"resolved","repositories":{"bullseye":"1:16.28.0~dfsg-0+deb11u4","bullseye-security":"1:16.28.0~dfsg-0+deb11u8"},"fixed_version":"1:1.4.16.2~dfsg-1","urgency":"low"},"sid":{"status":"resolved","repositories":{"sid":"1:22.8.2+dfsg+~cs6.15.60671435-1"},"fixed_version":"1:1.4.16.2~dfsg-1","urgency":"low"}}},"CVE-2008-0095":{"description":"The SIP channel driver in Asterisk Open Source 1.4.x before 1.4.17, Business Edition before C.1.0-beta8, AsteriskNOW before beta7, Appliance Developer Kit before Asterisk 1.4 revision 95946, and Appliance s800i 1.0.x before 1.0.3.4 allows remote attackers to cause a denial of service (daemon crash) via a BYE message with an Also (Also transfer) header, which triggers a NULL pointer dereference.","debianbug":458952,"scope":"local","releases":{"bullseye":{"status":"resolved","repositories":{"bullseye":"1:16.28.0~dfsg-0+deb11u4","bullseye-security":"1:16.28.0~dfsg-0+deb11u8"},"fixed_version":"1:1.4.17~dfsg-1","urgency":"medium"},"sid":{"status":"resolved","repositories":{"sid":"1:22.8.2+dfsg+~cs6.15.60671435-1"},"fixed_version":"1:1.4.17~dfsg-1","urgency":"medium"}}},"CVE-2008-1289":{"description":"Multiple buffer overflows in Asterisk Open Source 1.4.x before 1.4.18.1 and 1.4.19-rc3, Open Source 1.6.x before 1.6.0-beta6, Business Edition C.x.x before C.1.6.1, AsteriskNOW 1.0.x before 1.0.2, Appliance Developer Kit before 1.4 revision 109386, and s800i 1.1.x before 1.1.0.2 allow remote attackers to (1) write a zero to an arbitrary memory location via a large RTP payload number, related to the ast_rtp_unset_m_type function in main/rtp.c; or (2) write certain integers to an arbitrary memory location via a large number of RTP payloads, related to the process_sdp function in channels/chan_sip.c.","scope":"local","releases":{"bullseye":{"status":"resolved","repositories":{"bullseye":"1:16.28.0~dfsg-0+deb11u4","bullseye-security":"1:16.28.0~dfsg-0+deb11u8"},"fixed_version":"1:1.4.18.1~dfsg-1","urgency":"medium"},"sid":{"status":"resolved","repositories":{"sid":"1:22.8.2+dfsg+~cs6.15.60671435-1"},"fixed_version":"1:1.4.18.1~dfsg-1","urgency":"medium"}}},"CVE-2008-1332":{"description":"Unspecified vulnerability in Asterisk Open Source 1.2.x before 1.2.27, 1.4.x before 1.4.18.1 and 1.4.19-rc3; Business Edition A.x.x, B.x.x before B.2.5.1, and C.x.x before C.1.6.2; AsteriskNOW 1.0.x before 1.0.2; Appliance Developer Kit before 1.4 revision 109393; and s800i 1.0.x before 1.1.0.2; allows remote attackers to access the SIP channel driver via a crafted From header.","scope":"local","releases":{"bullseye":{"status":"resolved","repositories":{"bullseye":"1:16.28.0~dfsg-0+deb11u4","bullseye-security":"1:16.28.0~dfsg-0+deb11u8"},"fixed_version":"1:1.4.18.1~dfsg-1","urgency":"medium"},"sid":{"status":"resolved","repositories":{"sid":"1:22.8.2+dfsg+~cs6.15.60671435-1"},"fixed_version":"1:1.4.18.1~dfsg-1","urgency":"medium"}}},"CVE-2008-1333":{"description":"Format string vulnerability in Asterisk Open Source 1.6.x before 1.6.0-beta6 might allow remote attackers to execute arbitrary code via logging messages that are not properly handled by (1) the ast_verbose logging API call, or (2) the astman_append function.","scope":"local","releases":{"bullseye":{"status":"resolved","repositories":{"bullseye":"1:16.28.0~dfsg-0+deb11u4","bullseye-security":"1:16.28.0~dfsg-0+deb11u8"},"fixed_version":"1:1.4.18.1~dfsg-1","urgency":"medium"},"sid":{"status":"resolved","repositories":{"sid":"1:22.8.2+dfsg+~cs6.15.60671435-1"},"fixed_version":"1:1.4.18.1~dfsg-1","urgency":"medium"}}},"CVE-2008-1390":{"description":"The AsteriskGUI HTTP server in Asterisk Open Source 1.4.x before 1.4.19-rc3 and 1.6.x before 1.6.0-beta6, Business Edition C.x.x before C.1.6, AsteriskNOW before 1.0.2, Appliance Developer Kit before revision 104704, and s800i 1.0.x before 1.1.0.2 generates insufficiently random manager ID values, which makes it easier for remote attackers to hijack a manager session via a series of ID guesses.","scope":"local","releases":{"bullseye":{"status":"resolved","repositories":{"bullseye":"1:16.28.0~dfsg-0+deb11u4","bullseye-security":"1:16.28.0~dfsg-0+deb11u8"},"fixed_version":"1:1.4.19.1~dfsg-1","urgency":"low"},"sid":{"status":"resolved","repositories":{"sid":"1:22.8.2+dfsg+~cs6.15.60671435-1"},"fixed_version":"1:1.4.19.1~dfsg-1","urgency":"low"}}},"CVE-2008-1897":{"description":"The IAX2 channel driver (chan_iax2) in Asterisk Open Source 1.0.x, 1.2.x before 1.2.28, and 1.4.x before 1.4.19.1; Business Edition A.x.x, B.x.x before B.2.5.2, and C.x.x before C.1.8.1; AsteriskNOW before 1.0.3; Appliance Developer Kit 0.x.x; and s800i before 1.1.0.3, when configured to allow unauthenticated calls, does not verify that an ACK response contains a call number matching the server's reply to a NEW message, which allows remote attackers to cause a denial of service (traffic amplification) via a spoofed ACK response that does not complete a 3-way handshake.  NOTE: this issue exists because of an incomplete fix for CVE-2008-1923.","scope":"local","releases":{"bullseye":{"status":"resolved","repositories":{"bullseye":"1:16.28.0~dfsg-0+deb11u4","bullseye-security":"1:16.28.0~dfsg-0+deb11u8"},"fixed_version":"1:1.4.19.1~dfsg-1","urgency":"medium"},"sid":{"status":"resolved","repositories":{"sid":"1:22.8.2+dfsg+~cs6.15.60671435-1"},"fixed_version":"1:1.4.19.1~dfsg-1","urgency":"medium"}}},"CVE-2008-1923":{"description":"The IAX2 channel driver (chan_iax2) in Asterisk 1.2 before revision 72630 and 1.4 before revision 65679, when configured to allow unauthenticated calls, sends \"early audio\" to an unverified source IP address of a NEW message, which allows remote attackers to cause a denial of service (traffic amplification) via a spoofed NEW message.","scope":"local","releases":{"bullseye":{"status":"resolved","repositories":{"bullseye":"1:16.28.0~dfsg-0+deb11u4","bullseye-security":"1:16.28.0~dfsg-0+deb11u8"},"fixed_version":"1:1.4.19.1~dfsg-1","urgency":"medium"},"sid":{"status":"resolved","repositories":{"sid":"1:22.8.2+dfsg+~cs6.15.60671435-1"},"fixed_version":"1:1.4.19.1~dfsg-1","urgency":"medium"}}},"CVE-2008-2119":{"description":"Asterisk Open Source 1.0.x and 1.2.x before 1.2.29 and Business Edition A.x.x and B.x.x before B.2.5.3, when pedantic parsing (aka pedanticsipchecking) is enabled, allows remote attackers to cause a denial of service (daemon crash) via a SIP INVITE message that lacks a From header, related to invocations of the ast_uri_decode function, and improper handling of (1) an empty const string and (2) a NULL pointer.","scope":"local","releases":{"bullseye":{"status":"resolved","repositories":{"bullseye":"1:16.28.0~dfsg-0+deb11u4","bullseye-security":"1:16.28.0~dfsg-0+deb11u8"},"fixed_version":"1.4","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"1:22.8.2+dfsg+~cs6.15.60671435-1"},"fixed_version":"1.4","urgency":"not yet assigned"}}},"CVE-2008-3263":{"description":"The IAX2 protocol implementation in Asterisk Open Source 1.0.x, 1.2.x before 1.2.30, and 1.4.x before 1.4.21.2; Business Edition A.x.x, B.x.x before B.2.5.4, and C.x.x before C.1.10.3; AsteriskNOW; Appliance Developer Kit 0.x.x; and s800i 1.0.x before 1.2.0.1 allows remote attackers to cause a denial of service (call-number exhaustion and CPU consumption) by quickly sending a large number of IAX2 (IAX) POKE requests.","scope":"local","releases":{"bullseye":{"status":"resolved","repositories":{"bullseye":"1:16.28.0~dfsg-0+deb11u4","bullseye-security":"1:16.28.0~dfsg-0+deb11u8"},"fixed_version":"1:1.4.21.2~dfsg-1","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"1:22.8.2+dfsg+~cs6.15.60671435-1"},"fixed_version":"1:1.4.21.2~dfsg-1","urgency":"not yet assigned"}}},"CVE-2008-3264":{"description":"The FWDOWNL firmware-download implementation in Asterisk Open Source 1.0.x, 1.2.x before 1.2.30, and 1.4.x before 1.4.21.2; Business Edition A.x.x, B.x.x before B.2.5.4, and C.x.x before C.1.10.3; AsteriskNOW; Appliance Developer Kit 0.x.x; and s800i 1.0.x before 1.2.0.1 allows remote attackers to cause a denial of service (traffic amplification) via an IAX2 FWDOWNL request.","scope":"local","releases":{"bullseye":{"status":"resolved","repositories":{"bullseye":"1:16.28.0~dfsg-0+deb11u4","bullseye-security":"1:16.28.0~dfsg-0+deb11u8"},"fixed_version":"1:1.4.21.2~dfsg-1","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"1:22.8.2+dfsg+~cs6.15.60671435-1"},"fixed_version":"1:1.4.21.2~dfsg-1","urgency":"not yet assigned"}}},"CVE-2008-3903":{"description":"Asterisk Open Source 1.2.x before 1.2.32, 1.4.x before 1.4.24.1, and 1.6.0.x before 1.6.0.8; Asterisk Business Edition A.x.x, B.x.x before B.2.5.8, C.1.x.x before C.1.10.5, and C.2.x.x before C.2.3.3; s800i 1.3.x before 1.3.0.2; and Trixbox PBX 2.6.1, when Digest authentication and authalwaysreject are enabled, generates different responses depending on whether a SIP username is valid, which allows remote attackers to enumerate valid usernames.","debianbug":522528,"scope":"local","releases":{"bullseye":{"status":"resolved","repositories":{"bullseye":"1:16.28.0~dfsg-0+deb11u4","bullseye-security":"1:16.28.0~dfsg-0+deb11u8"},"fixed_version":"1:1.6.1.0~dfsg-1","urgency":"low"},"sid":{"status":"resolved","repositories":{"sid":"1:22.8.2+dfsg+~cs6.15.60671435-1"},"fixed_version":"1:1.6.1.0~dfsg-1","urgency":"low"}}},"CVE-2008-5558":{"description":"Asterisk Open Source 1.2.26 through 1.2.30.3 and Business Edition B.2.3.5 through B.2.5.5, when realtime IAX2 users are enabled, allows remote attackers to cause a denial of service (crash) via authentication attempts involving (1) an unknown user or (2) a user using hostname matching.","debianbug":509686,"scope":"local","releases":{"bullseye":{"status":"resolved","repositories":{"bullseye":"1:16.28.0~dfsg-0+deb11u4","bullseye-security":"1:16.28.0~dfsg-0+deb11u8"},"fixed_version":"1:1.4.0~dfsg-1","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"1:22.8.2+dfsg+~cs6.15.60671435-1"},"fixed_version":"1:1.4.0~dfsg-1","urgency":"not yet assigned"}}},"CVE-2008-7220":{"description":"Unspecified vulnerability in Prototype JavaScript framework (prototypejs) before 1.6.0.2 allows attackers to make \"cross-site ajax requests\" via unknown vectors.","debianbug":555220,"scope":"local","releases":{"bullseye":{"status":"resolved","repositories":{"bullseye":"1:16.28.0~dfsg-0+deb11u4","bullseye-security":"1:16.28.0~dfsg-0+deb11u8"},"fixed_version":"1:1.6.2.0~rc3-1","urgency":"low"},"sid":{"status":"resolved","repositories":{"sid":"1:22.8.2+dfsg+~cs6.15.60671435-1"},"fixed_version":"1:1.6.2.0~rc3-1","urgency":"low"}}},"CVE-2009-0041":{"description":"IAX2 in Asterisk Open Source 1.2.x before 1.2.31, 1.4.x before 1.4.23-rc4, and 1.6.x before 1.6.0.3-rc2; Business Edition A.x.x, B.x.x before B.2.5.7, C.1.x.x before C.1.10.4, and C.2.x.x before C.2.1.2.1; and s800i 1.2.x before 1.3.0 responds differently to a failed login attempt depending on whether the user account exists, which allows remote attackers to enumerate valid usernames.","debianbug":513413,"scope":"local","releases":{"bullseye":{"status":"resolved","repositories":{"bullseye":"1:16.28.0~dfsg-0+deb11u4","bullseye-security":"1:16.28.0~dfsg-0+deb11u8"},"fixed_version":"1:1.6.1.0~dfsg~rc3-1","urgency":"low"},"sid":{"status":"resolved","repositories":{"sid":"1:22.8.2+dfsg+~cs6.15.60671435-1"},"fixed_version":"1:1.6.1.0~dfsg~rc3-1","urgency":"low"}}},"CVE-2009-0871":{"description":"The SIP channel driver in Asterisk Open Source 1.4.22, 1.4.23, and 1.4.23.1; 1.6.0 before 1.6.0.6; 1.6.1 before 1.6.1.0-rc2; and Asterisk Business Edition C.2.3, with the pedantic option enabled, allows remote authenticated users to cause a denial of service (crash) via a SIP INVITE request without any headers, which triggers a NULL pointer dereference in the (1) sip_uri_headers_cmp and (2) sip_uri_params_cmp functions.","scope":"local","releases":{"bullseye":{"status":"resolved","repositories":{"bullseye":"1:16.28.0~dfsg-0+deb11u4","bullseye-security":"1:16.28.0~dfsg-0+deb11u8"},"fixed_version":"0","urgency":"unimportant"},"sid":{"status":"resolved","repositories":{"sid":"1:22.8.2+dfsg+~cs6.15.60671435-1"},"fixed_version":"0","urgency":"unimportant"}}},"CVE-2009-2346":{"description":"The IAX2 protocol implementation in Asterisk Open Source 1.2.x before 1.2.35, 1.4.x before 1.4.26.2, 1.6.0.x before 1.6.0.15, and 1.6.1.x before 1.6.1.6; Business Edition B.x.x before B.2.5.10, C.2.x before C.2.4.3, and C.3.x before C.3.1.1; and s800i 1.3.x before 1.3.0.3 allows remote attackers to cause a denial of service (call-number exhaustion) by initiating many IAX2 message exchanges, a related issue to CVE-2008-3263.","debianbug":539473,"scope":"local","releases":{"bullseye":{"status":"resolved","repositories":{"bullseye":"1:16.28.0~dfsg-0+deb11u4","bullseye-security":"1:16.28.0~dfsg-0+deb11u8"},"fixed_version":"1:1.6.2.0~dfsg~beta3-1","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"1:22.8.2+dfsg+~cs6.15.60671435-1"},"fixed_version":"1:1.6.2.0~dfsg~beta3-1","urgency":"not yet assigned"}}},"CVE-2009-2651":{"description":"main/rtp.c in Asterisk Open Source 1.6.1 before 1.6.1.2 allows remote attackers to cause a denial of service (crash) via an RTP text frame without a certain delimiter, which triggers a NULL pointer dereference and the subsequent calculation of an invalid pointer.","debianbug":539473,"scope":"local","releases":{"bullseye":{"status":"resolved","repositories":{"bullseye":"1:16.28.0~dfsg-0+deb11u4","bullseye-security":"1:16.28.0~dfsg-0+deb11u8"},"fixed_version":"1:1.6.2.0~dfsg~rc1-1","urgency":"low"},"sid":{"status":"resolved","repositories":{"sid":"1:22.8.2+dfsg+~cs6.15.60671435-1"},"fixed_version":"1:1.6.2.0~dfsg~rc1-1","urgency":"low"}}},"CVE-2009-2726":{"description":"The SIP channel driver in Asterisk Open Source 1.2.x before 1.2.34, 1.4.x before 1.4.26.1, 1.6.0.x before 1.6.0.12, and 1.6.1.x before 1.6.1.4; Asterisk Business Edition A.x.x, B.x.x before B.2.5.9, C.2.x before C.2.4.1, and C.3.x before C.3.1; and Asterisk Appliance s800i 1.2.x before 1.3.0.3 does not use a maximum width when invoking sscanf style functions, which allows remote attackers to cause a denial of service (stack memory consumption) via SIP packets containing large sequences of ASCII decimal characters, as demonstrated via vectors related to (1) the CSeq value in a SIP header, (2) large Content-Length value, and (3) SDP.","debianbug":541441,"scope":"local","releases":{"bullseye":{"status":"resolved","repositories":{"bullseye":"1:16.28.0~dfsg-0+deb11u4","bullseye-security":"1:16.28.0~dfsg-0+deb11u8"},"fixed_version":"1:1.6.2.0~dfsg~rc1-1","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"1:22.8.2+dfsg+~cs6.15.60671435-1"},"fixed_version":"1:1.6.2.0~dfsg~rc1-1","urgency":"not yet assigned"}}},"CVE-2009-3723":{"description":"asterisk allows calls on prohibited networks","debianbug":552756,"scope":"local","releases":{"bullseye":{"status":"resolved","repositories":{"bullseye":"1:16.28.0~dfsg-0+deb11u4","bullseye-security":"1:16.28.0~dfsg-0+deb11u8"},"fixed_version":"1:1.6.2.0~rc3-2","urgency":"medium"},"sid":{"status":"resolved","repositories":{"sid":"1:22.8.2+dfsg+~cs6.15.60671435-1"},"fixed_version":"1:1.6.2.0~rc3-2","urgency":"medium"}}},"CVE-2009-3727":{"description":"Asterisk Open Source 1.2.x before 1.2.35, 1.4.x before 1.4.26.3, 1.6.0.x before 1.6.0.17, and 1.6.1.x before 1.6.1.9; Business Edition A.x.x, B.x.x before B.2.5.12, C.2.x.x before C.2.4.5, and C.3.x.x before C.3.2.2; AsteriskNOW 1.5; and s800i 1.3.x before 1.3.0.5 generate different error messages depending on whether a SIP username is valid, which allows remote attackers to enumerate valid usernames via multiple crafted REGISTER messages with inconsistent usernames in the URI in the To header and the Digest in the Authorization header.","scope":"local","releases":{"bullseye":{"status":"resolved","repositories":{"bullseye":"1:16.28.0~dfsg-0+deb11u4","bullseye-security":"1:16.28.0~dfsg-0+deb11u8"},"fixed_version":"1:1.6.2.0~rc6-1","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"1:22.8.2+dfsg+~cs6.15.60671435-1"},"fixed_version":"1:1.6.2.0~rc6-1","urgency":"not yet assigned"}}},"CVE-2009-4055":{"description":"rtp.c in Asterisk Open Source 1.2.x before 1.2.37, 1.4.x before 1.4.27.1, 1.6.0.x before 1.6.0.19, and 1.6.1.x before 1.6.1.11; Business Edition B.x.x before B.2.5.13, C.2.x.x before C.2.4.6, and C.3.x.x before C.3.2.3; and s800i 1.3.x before 1.3.0.6 allows remote attackers to cause a denial of service (daemon crash) via an RTP comfort noise payload with a long data length.","debianbug":559103,"scope":"local","releases":{"bullseye":{"status":"resolved","repositories":{"bullseye":"1:16.28.0~dfsg-0+deb11u4","bullseye-security":"1:16.28.0~dfsg-0+deb11u8"},"fixed_version":"1:1.6.2.0~rc7-1","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"1:22.8.2+dfsg+~cs6.15.60671435-1"},"fixed_version":"1:1.6.2.0~rc7-1","urgency":"not yet assigned"}}},"CVE-2010-0441":{"description":"Asterisk Open Source 1.6.0.x before 1.6.0.22, 1.6.1.x before 1.6.1.14, and 1.6.2.x before 1.6.2.2, and Business Edition C.3 before C.3.3.2, allows remote attackers to cause a denial of service (daemon crash) via an SIP T.38 negotiation with an SDP FaxMaxDatagram field that is (1) missing, (2) modified to contain a negative number, or (3) modified to contain a large number.","scope":"local","releases":{"bullseye":{"status":"resolved","repositories":{"bullseye":"1:16.28.0~dfsg-0+deb11u4","bullseye-security":"1:16.28.0~dfsg-0+deb11u8"},"fixed_version":"1:1.6.2.2-1","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"1:22.8.2+dfsg+~cs6.15.60671435-1"},"fixed_version":"1:1.6.2.2-1","urgency":"not yet assigned"}}},"CVE-2010-0685":{"description":"The design of the dialplan functionality in Asterisk Open Source 1.2.x, 1.4.x, and 1.6.x; and Asterisk Business Edition B.x.x and C.x.x, when using the ${EXTEN} channel variable and wildcard pattern matches, allows context-dependent attackers to inject strings into the dialplan using metacharacters that are injected when the variable is expanded, as demonstrated using the Dial application to process a crafted SIP INVITE message that adds an unintended outgoing channel leg.  NOTE: it could be argued that this is not a vulnerability in Asterisk, but a class of vulnerabilities that can occur in any program that uses this feature without the associated filtering functionality that is already available.","scope":"local","releases":{"bullseye":{"status":"resolved","repositories":{"bullseye":"1:16.28.0~dfsg-0+deb11u4","bullseye-security":"1:16.28.0~dfsg-0+deb11u8"},"fixed_version":"1:1.6.2.6-1","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"1:22.8.2+dfsg+~cs6.15.60671435-1"},"fixed_version":"1:1.6.2.6-1","urgency":"not yet assigned"}}},"CVE-2010-1224":{"description":"main/acl.c in Asterisk Open Source 1.6.0.x before 1.6.0.25, 1.6.1.x before 1.6.1.17, and 1.6.2.x before 1.6.2.5 does not properly enforce remote host access controls when CIDR notation \"/0\" is used in permit= and deny= configuration rules, which causes an improper arithmetic shift and might allow remote attackers to bypass ACL rules and access services from unauthorized hosts.","debianbug":576560,"scope":"local","releases":{"bullseye":{"status":"resolved","repositories":{"bullseye":"1:16.28.0~dfsg-0+deb11u4","bullseye-security":"1:16.28.0~dfsg-0+deb11u8"},"fixed_version":"1:1.6.2.6-1","urgency":"low"},"sid":{"status":"resolved","repositories":{"sid":"1:22.8.2+dfsg+~cs6.15.60671435-1"},"fixed_version":"1:1.6.2.6-1","urgency":"low"}}},"CVE-2011-0495":{"description":"Stack-based buffer overflow in the ast_uri_encode function in main/utils.c in Asterisk Open Source before 1.4.38.1, 1.4.39.1, 1.6.1.21, 1.6.2.15.1, 1.6.2.16.1, 1.8.1.2, 1.8.2.; and Business Edition before C.3.6.2; when running in pedantic mode allows remote authenticated users to execute arbitrary code via crafted caller ID data in vectors involving the (1) SIP channel driver, (2) URIENCODE dialplan function, or (3) AGI dialplan function.","debianbug":610487,"scope":"local","releases":{"bullseye":{"status":"resolved","repositories":{"bullseye":"1:16.28.0~dfsg-0+deb11u4","bullseye-security":"1:16.28.0~dfsg-0+deb11u8"},"fixed_version":"1:1.6.2.9-2+squeeze1","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"1:22.8.2+dfsg+~cs6.15.60671435-1"},"fixed_version":"1:1.6.2.9-2+squeeze1","urgency":"not yet assigned"}}},"CVE-2011-1147":{"description":"Multiple stack-based and heap-based buffer overflows in the (1) decode_open_type and (2) udptl_rx_packet functions in main/udptl.c in Asterisk Open Source 1.4.x before 1.4.39.2, 1.6.1.x before 1.6.1.22, 1.6.2.x before 1.6.2.16.2, and 1.8 before 1.8.2.4; Business Edition C.x.x before C.3.6.3; AsteriskNOW 1.5; and s800i (Asterisk Appliance), when T.38 support is enabled, allow remote attackers to cause a denial of service (crash) and possibly execute arbitrary code via a crafted UDPTL packet.","debianbug":614580,"scope":"local","releases":{"bullseye":{"status":"resolved","repositories":{"bullseye":"1:16.28.0~dfsg-0+deb11u4","bullseye-security":"1:16.28.0~dfsg-0+deb11u8"},"fixed_version":"1:1.8.3.3-1","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"1:22.8.2+dfsg+~cs6.15.60671435-1"},"fixed_version":"1:1.8.3.3-1","urgency":"not yet assigned"}}},"CVE-2011-1174":{"description":"manager.c in Asterisk Open Source 1.6.1.x before 1.6.1.24, 1.6.2.x before 1.6.2.17.2, and 1.8.x before 1.8.3.2 allows remote attackers to cause a denial of service (CPU and memory consumption) via a series of manager sessions involving invalid data.","scope":"local","releases":{"bullseye":{"status":"resolved","repositories":{"bullseye":"1:16.28.0~dfsg-0+deb11u4","bullseye-security":"1:16.28.0~dfsg-0+deb11u8"},"fixed_version":"1:1.8.3.3-1","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"1:22.8.2+dfsg+~cs6.15.60671435-1"},"fixed_version":"1:1.8.3.3-1","urgency":"not yet assigned"}}},"CVE-2011-1175":{"description":"tcptls.c in the TCP/TLS server in Asterisk Open Source 1.6.1.x before 1.6.1.23, 1.6.2.x before 1.6.2.17.1, and 1.8.x before 1.8.3.1 allows remote attackers to cause a denial of service (NULL pointer dereference and daemon crash) by establishing many short TCP sessions to services that use a certain TLS API.","scope":"local","releases":{"bullseye":{"status":"resolved","repositories":{"bullseye":"1:16.28.0~dfsg-0+deb11u4","bullseye-security":"1:16.28.0~dfsg-0+deb11u8"},"fixed_version":"1:1.8.3.3-1","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"1:22.8.2+dfsg+~cs6.15.60671435-1"},"fixed_version":"1:1.8.3.3-1","urgency":"not yet assigned"}}},"CVE-2011-1507":{"description":"Asterisk Open Source 1.4.x before 1.4.40.1, 1.6.1.x before 1.6.1.25, 1.6.2.x before 1.6.2.17.3, and 1.8.x before 1.8.3.3 and Asterisk Business Edition C.x.x before C.3.6.4 do not restrict the number of unauthenticated sessions to certain interfaces, which allows remote attackers to cause a denial of service (file descriptor exhaustion and disk space exhaustion) via a series of TCP connections.","scope":"local","releases":{"bullseye":{"status":"resolved","repositories":{"bullseye":"1:16.28.0~dfsg-0+deb11u4","bullseye-security":"1:16.28.0~dfsg-0+deb11u8"},"fixed_version":"1:1.8.3.3-1","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"1:22.8.2+dfsg+~cs6.15.60671435-1"},"fixed_version":"1:1.8.3.3-1","urgency":"not yet assigned"}}},"CVE-2011-1599":{"description":"manager.c in the Manager Interface in Asterisk Open Source 1.4.x before 1.4.40.1, 1.6.1.x before 1.6.1.25, 1.6.2.x before 1.6.2.17.3, and 1.8.x before 1.8.3.3 and Asterisk Business Edition C.x.x before C.3.6.4 does not properly check for the system privilege, which allows remote authenticated users to execute arbitrary commands via an Originate action that has an Async header in conjunction with an Application header.","scope":"local","releases":{"bullseye":{"status":"resolved","repositories":{"bullseye":"1:16.28.0~dfsg-0+deb11u4","bullseye-security":"1:16.28.0~dfsg-0+deb11u8"},"fixed_version":"1:1.8.3.3-1","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"1:22.8.2+dfsg+~cs6.15.60671435-1"},"fixed_version":"1:1.8.3.3-1","urgency":"not yet assigned"}}},"CVE-2011-2216":{"description":"reqresp_parser.c in the SIP channel driver in Asterisk Open Source 1.8.x before 1.8.4.2 does not initialize certain strings, which allows remote attackers to cause a denial of service (NULL pointer dereference and daemon crash) via a malformed Contact header.","debianbug":629130,"scope":"local","releases":{"bullseye":{"status":"resolved","repositories":{"bullseye":"1:16.28.0~dfsg-0+deb11u4","bullseye-security":"1:16.28.0~dfsg-0+deb11u8"},"fixed_version":"1:1.8.4.2-1","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"1:22.8.2+dfsg+~cs6.15.60671435-1"},"fixed_version":"1:1.8.4.2-1","urgency":"not yet assigned"}}},"CVE-2011-2529":{"description":"chan_sip.c in the SIP channel driver in Asterisk Open Source 1.6.x before 1.6.2.18.1 and 1.8.x before 1.8.4.3 does not properly handle '\\0' characters in SIP packets, which allows remote attackers to cause a denial of service (memory corruption) or possibly have unspecified other impact via a crafted packet.","debianbug":631446,"scope":"local","releases":{"bullseye":{"status":"resolved","repositories":{"bullseye":"1:16.28.0~dfsg-0+deb11u4","bullseye-security":"1:16.28.0~dfsg-0+deb11u8"},"fixed_version":"1:1.8.4.3-1","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"1:22.8.2+dfsg+~cs6.15.60671435-1"},"fixed_version":"1:1.8.4.3-1","urgency":"not yet assigned"}}},"CVE-2011-2535":{"description":"chan_iax2.c in the IAX2 channel driver in Asterisk Open Source 1.4.x before 1.4.41.1, 1.6.2.x before 1.6.2.18.1, and 1.8.x before 1.8.4.3, and Asterisk Business Edition C.3 before C.3.7.3, accesses a memory address contained in an option control frame, which allows remote attackers to cause a denial of service (daemon crash) or possibly have unspecified other impact via a crafted frame.","debianbug":631448,"scope":"local","releases":{"bullseye":{"status":"resolved","repositories":{"bullseye":"1:16.28.0~dfsg-0+deb11u4","bullseye-security":"1:16.28.0~dfsg-0+deb11u8"},"fixed_version":"1:1.8.4.3-1","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"1:22.8.2+dfsg+~cs6.15.60671435-1"},"fixed_version":"1:1.8.4.3-1","urgency":"not yet assigned"}}},"CVE-2011-2536":{"description":"chan_sip.c in the SIP channel driver in Asterisk Open Source 1.4.x before 1.4.41.2, 1.6.2.x before 1.6.2.18.2, and 1.8.x before 1.8.4.4, and Asterisk Business Edition C.3.x before C.3.7.3, disregards the alwaysauthreject option and generates different responses for invalid SIP requests depending on whether the user account exists, which allows remote attackers to enumerate account names via a series of requests.","debianbug":632029,"scope":"local","releases":{"bullseye":{"status":"resolved","repositories":{"bullseye":"1:16.28.0~dfsg-0+deb11u4","bullseye-security":"1:16.28.0~dfsg-0+deb11u8"},"fixed_version":"1:1.8.4.4~dfsg-1","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"1:22.8.2+dfsg+~cs6.15.60671435-1"},"fixed_version":"1:1.8.4.4~dfsg-1","urgency":"not yet assigned"}}},"CVE-2011-2665":{"description":"reqresp_parser.c in the SIP channel driver in Asterisk Open Source 1.8.x before 1.8.4.3 allows remote attackers to cause a denial of service (NULL pointer dereference and daemon crash) via a SIP packet with a Contact header that lacks a < (less than) character.","debianbug":631445,"scope":"local","releases":{"bullseye":{"status":"resolved","repositories":{"bullseye":"1:16.28.0~dfsg-0+deb11u4","bullseye-security":"1:16.28.0~dfsg-0+deb11u8"},"fixed_version":"1:1.8.4.3-1","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"1:22.8.2+dfsg+~cs6.15.60671435-1"},"fixed_version":"1:1.8.4.3-1","urgency":"not yet assigned"}}},"CVE-2011-2666":{"description":"The default configuration of the SIP channel driver in Asterisk Open Source 1.4.x through 1.4.41.2 and 1.6.2.x through 1.6.2.18.2 does not enable the alwaysauthreject option, which allows remote attackers to enumerate account names by making a series of invalid SIP requests and observing the differences in the responses for different usernames, a different vulnerability than CVE-2011-2536.","scope":"local","releases":{"bullseye":{"status":"resolved","repositories":{"bullseye":"1:16.28.0~dfsg-0+deb11u4","bullseye-security":"1:16.28.0~dfsg-0+deb11u8"},"fixed_version":"1:1.8.3.3-1","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"1:22.8.2+dfsg+~cs6.15.60671435-1"},"fixed_version":"1:1.8.3.3-1","urgency":"not yet assigned"}}},"CVE-2011-3389":{"description":"The SSL protocol, as used in certain configurations in Microsoft Windows and Microsoft Internet Explorer, Mozilla Firefox, Google Chrome, Opera, and other products, encrypts data by using CBC mode with chained initialization vectors, which allows man-in-the-middle attackers to obtain plaintext HTTP headers via a blockwise chosen-boundary attack (BCBA) on an HTTPS session, in conjunction with JavaScript code that uses (1) the HTML5 WebSocket API, (2) the Java URLConnection API, or (3) the Silverlight WebClient API, aka a \"BEAST\" attack.","scope":"local","releases":{"bullseye":{"status":"resolved","repositories":{"bullseye":"1:16.28.0~dfsg-0+deb11u4","bullseye-security":"1:16.28.0~dfsg-0+deb11u8"},"fixed_version":"1:13.7.2~dfsg-1","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"1:22.8.2+dfsg+~cs6.15.60671435-1"},"fixed_version":"1:13.7.2~dfsg-1","urgency":"not yet assigned"}}},"CVE-2011-4063":{"description":"chan_sip.c in the SIP channel driver in Asterisk Open Source 1.8.x before 1.8.7.1 and 10.x before 10.0.0-rc1 does not properly initialize variables during request parsing, which allows remote authenticated users to cause a denial of service (daemon crash) via a malformed request.","debianbug":647252,"scope":"local","releases":{"bullseye":{"status":"resolved","repositories":{"bullseye":"1:16.28.0~dfsg-0+deb11u4","bullseye-security":"1:16.28.0~dfsg-0+deb11u8"},"fixed_version":"1:1.8.7.1~dfsg-1","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"1:22.8.2+dfsg+~cs6.15.60671435-1"},"fixed_version":"1:1.8.7.1~dfsg-1","urgency":"not yet assigned"}}},"CVE-2011-4597":{"description":"The SIP over UDP implementation in Asterisk Open Source 1.4.x before 1.4.43, 1.6.x before 1.6.2.21, and 1.8.x before 1.8.7.2 uses different port numbers for responses to invalid requests depending on whether a SIP username exists, which allows remote attackers to enumerate usernames via a series of requests.","debianbug":651552,"scope":"local","releases":{"bullseye":{"status":"resolved","repositories":{"bullseye":"1:16.28.0~dfsg-0+deb11u4","bullseye-security":"1:16.28.0~dfsg-0+deb11u8"},"fixed_version":"1:1.8.8.0~dfsg-1","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"1:22.8.2+dfsg+~cs6.15.60671435-1"},"fixed_version":"1:1.8.8.0~dfsg-1","urgency":"not yet assigned"}}},"CVE-2011-4598":{"description":"The handle_request_info function in channels/chan_sip.c in Asterisk Open Source 1.6.2.x before 1.6.2.21 and 1.8.x before 1.8.7.2, when automon is enabled, allows remote attackers to cause a denial of service (NULL pointer dereference and daemon crash) via a crafted sequence of SIP requests.","debianbug":651552,"scope":"local","releases":{"bullseye":{"status":"resolved","repositories":{"bullseye":"1:16.28.0~dfsg-0+deb11u4","bullseye-security":"1:16.28.0~dfsg-0+deb11u8"},"fixed_version":"1:1.8.8.0~dfsg-1","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"1:22.8.2+dfsg+~cs6.15.60671435-1"},"fixed_version":"1:1.8.8.0~dfsg-1","urgency":"not yet assigned"}}},"CVE-2012-0885":{"description":"chan_sip.c in Asterisk Open Source 1.8.x before 1.8.8.2 and 10.x before 10.0.1, when the res_srtp module is used and media support is improperly configured, allows remote attackers to cause a denial of service (NULL pointer dereference and daemon crash) via a crafted SDP message with a crypto attribute and a (1) video or (2) text media type, as demonstrated by CSipSimple.","debianbug":656596,"scope":"local","releases":{"bullseye":{"status":"resolved","repositories":{"bullseye":"1:16.28.0~dfsg-0+deb11u4","bullseye-security":"1:16.28.0~dfsg-0+deb11u8"},"fixed_version":"1:1.8.8.2~dfsg-1","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"1:22.8.2+dfsg+~cs6.15.60671435-1"},"fixed_version":"1:1.8.8.2~dfsg-1","urgency":"not yet assigned"}}},"CVE-2012-1183":{"description":"Stack-based buffer overflow in the milliwatt_generate function in the Miliwatt application in Asterisk 1.4.x before 1.4.44, 1.6.x before 1.6.2.23, 1.8.x before 1.8.10.1, and 10.x before 10.2.1, when the o option is used and the internal_timing option is off, allows remote attackers to cause a denial of service (application crash) via a large number of samples in an audio packet.","debianbug":664411,"scope":"local","releases":{"bullseye":{"status":"resolved","repositories":{"bullseye":"1:16.28.0~dfsg-0+deb11u4","bullseye-security":"1:16.28.0~dfsg-0+deb11u8"},"fixed_version":"1:1.8.10.0~dfsg-1","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"1:22.8.2+dfsg+~cs6.15.60671435-1"},"fixed_version":"1:1.8.10.0~dfsg-1","urgency":"not yet assigned"}}},"CVE-2012-1184":{"description":"Stack-based buffer overflow in the ast_parse_digest function in main/utils.c in Asterisk 1.8.x before 1.8.10.1 and 10.x before 10.2.1 allows remote attackers to cause a denial of service (crash) or possibly execute arbitrary code via a long string in an HTTP Digest Authentication header.","debianbug":664411,"scope":"local","releases":{"bullseye":{"status":"resolved","repositories":{"bullseye":"1:16.28.0~dfsg-0+deb11u4","bullseye-security":"1:16.28.0~dfsg-0+deb11u8"},"fixed_version":"1:1.8.10.0~dfsg-1","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"1:22.8.2+dfsg+~cs6.15.60671435-1"},"fixed_version":"1:1.8.10.0~dfsg-1","urgency":"not yet assigned"}}},"CVE-2012-2186":{"description":"Incomplete blacklist vulnerability in main/manager.c in Asterisk Open Source 1.8.x before 1.8.15.1 and 10.x before 10.7.1, Certified Asterisk 1.8.11 before 1.8.11-cert6, Asterisk Digiumphones 10.x.x-digiumphones before 10.7.1-digiumphones, and Asterisk Business Edition C.3.x before C.3.7.6 allows remote authenticated users to execute arbitrary commands by leveraging originate privileges and providing an ExternalIVR value in an AMI Originate action.","debianbug":680470,"scope":"local","releases":{"bullseye":{"status":"resolved","repositories":{"bullseye":"1:16.28.0~dfsg-0+deb11u4","bullseye-security":"1:16.28.0~dfsg-0+deb11u8"},"fixed_version":"1:1.8.13.1~dfsg-1","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"1:22.8.2+dfsg+~cs6.15.60671435-1"},"fixed_version":"1:1.8.13.1~dfsg-1","urgency":"not yet assigned"}}},"CVE-2012-2414":{"description":"main/manager.c in the Manager Interface in Asterisk Open Source 1.6.2.x before 1.6.2.24, 1.8.x before 1.8.11.1, and 10.x before 10.3.1 and Asterisk Business Edition C.3.x before C.3.7.4 does not properly enforce System class authorization requirements, which allows remote authenticated users to execute arbitrary commands via (1) the originate action in the MixMonitor application, (2) the SHELL and EVAL functions in the GetVar manager action, or (3) the SHELL and EVAL functions in the Status manager action.","debianbug":670180,"scope":"local","releases":{"bullseye":{"status":"resolved","repositories":{"bullseye":"1:16.28.0~dfsg-0+deb11u4","bullseye-security":"1:16.28.0~dfsg-0+deb11u8"},"fixed_version":"1:1.8.11.1~dfsg-1","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"1:22.8.2+dfsg+~cs6.15.60671435-1"},"fixed_version":"1:1.8.11.1~dfsg-1","urgency":"not yet assigned"}}},"CVE-2012-2415":{"description":"Heap-based buffer overflow in chan_skinny.c in the Skinny channel driver in Asterisk Open Source 1.6.2.x before 1.6.2.24, 1.8.x before 1.8.11.1, and 10.x before 10.3.1 allows remote authenticated users to cause a denial of service or possibly have unspecified other impact via a series of KEYPAD_BUTTON_MESSAGE events.","debianbug":670180,"scope":"local","releases":{"bullseye":{"status":"resolved","repositories":{"bullseye":"1:16.28.0~dfsg-0+deb11u4","bullseye-security":"1:16.28.0~dfsg-0+deb11u8"},"fixed_version":"1:1.8.11.1~dfsg-1","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"1:22.8.2+dfsg+~cs6.15.60671435-1"},"fixed_version":"1:1.8.11.1~dfsg-1","urgency":"not yet assigned"}}},"CVE-2012-2416":{"description":"chan_sip.c in the SIP channel driver in Asterisk Open Source 1.8.x before 1.8.11.1 and 10.x before 10.3.1 and Asterisk Business Edition C.3.x before C.3.7.4, when the trustrpid option is enabled, allows remote authenticated users to cause a denial of service (daemon crash) by sending a SIP UPDATE message that triggers a connected-line update attempt without an associated channel.","debianbug":670180,"scope":"local","releases":{"bullseye":{"status":"resolved","repositories":{"bullseye":"1:16.28.0~dfsg-0+deb11u4","bullseye-security":"1:16.28.0~dfsg-0+deb11u8"},"fixed_version":"1:1.8.11.1~dfsg-1","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"1:22.8.2+dfsg+~cs6.15.60671435-1"},"fixed_version":"1:1.8.11.1~dfsg-1","urgency":"not yet assigned"}}},"CVE-2012-2947":{"description":"chan_iax2.c in the IAX2 channel driver in Certified Asterisk 1.8.11-cert before 1.8.11-cert2 and Asterisk Open Source 1.8.x before 1.8.12.1 and 10.x before 10.4.1, when a certain mohinterpret setting is enabled, allows remote attackers to cause a denial of service (daemon crash) by placing a call on hold.","debianbug":675204,"scope":"local","releases":{"bullseye":{"status":"resolved","repositories":{"bullseye":"1:16.28.0~dfsg-0+deb11u4","bullseye-security":"1:16.28.0~dfsg-0+deb11u8"},"fixed_version":"1:1.8.13.0~dfsg-1","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"1:22.8.2+dfsg+~cs6.15.60671435-1"},"fixed_version":"1:1.8.13.0~dfsg-1","urgency":"not yet assigned"}}},"CVE-2012-2948":{"description":"chan_skinny.c in the Skinny (aka SCCP) channel driver in Certified Asterisk 1.8.11-cert before 1.8.11-cert2 and Asterisk Open Source 1.8.x before 1.8.12.1 and 10.x before 10.4.1 allows remote authenticated users to cause a denial of service (NULL pointer dereference and daemon crash) by closing a connection in off-hook mode.","debianbug":675210,"scope":"local","releases":{"bullseye":{"status":"resolved","repositories":{"bullseye":"1:16.28.0~dfsg-0+deb11u4","bullseye-security":"1:16.28.0~dfsg-0+deb11u8"},"fixed_version":"1:1.8.13.0~dfsg-1","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"1:22.8.2+dfsg+~cs6.15.60671435-1"},"fixed_version":"1:1.8.13.0~dfsg-1","urgency":"not yet assigned"}}},"CVE-2012-3553":{"description":"chan_skinny.c in the Skinny (aka SCCP) channel driver in Asterisk Open Source 10.x before 10.5.1 allows remote authenticated users to cause a denial of service (NULL pointer dereference and daemon crash) by sending a Station Key Pad Button message and closing a connection in off-hook mode, a related issue to CVE-2012-2948.","scope":"local","releases":{"bullseye":{"status":"resolved","repositories":{"bullseye":"1:16.28.0~dfsg-0+deb11u4","bullseye-security":"1:16.28.0~dfsg-0+deb11u8"},"fixed_version":"0","urgency":"unimportant"},"sid":{"status":"resolved","repositories":{"sid":"1:22.8.2+dfsg+~cs6.15.60671435-1"},"fixed_version":"0","urgency":"unimportant"}}},"CVE-2012-3812":{"description":"Double free vulnerability in apps/app_voicemail.c in Asterisk Open Source 1.8.x before 1.8.13.1 and 10.x before 10.5.2, Certified Asterisk 1.8.11-certx before 1.8.11-cert4, and Asterisk Digiumphones 10.x.x-digiumphones before 10.5.2-digiumphones allows remote authenticated users to cause a denial of service (daemon crash) by establishing multiple voicemail sessions and accessing both the Urgent mailbox and the INBOX mailbox.","debianbug":680470,"scope":"local","releases":{"bullseye":{"status":"resolved","repositories":{"bullseye":"1:16.28.0~dfsg-0+deb11u4","bullseye-security":"1:16.28.0~dfsg-0+deb11u8"},"fixed_version":"1:1.8.13.1~dfsg-1","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"1:22.8.2+dfsg+~cs6.15.60671435-1"},"fixed_version":"1:1.8.13.1~dfsg-1","urgency":"not yet assigned"}}},"CVE-2012-3863":{"description":"channels/chan_sip.c in Asterisk Open Source 1.8.x before 1.8.13.1 and 10.x before 10.5.2, Asterisk Business Edition C.3.x before C.3.7.5, Certified Asterisk 1.8.11-certx before 1.8.11-cert4, and Asterisk Digiumphones 10.x.x-digiumphones before 10.5.2-digiumphones does not properly handle a provisional response to a SIP reINVITE request, which allows remote authenticated users to cause a denial of service (RTP port exhaustion) via sessions that lack final responses.","scope":"local","releases":{"bullseye":{"status":"resolved","repositories":{"bullseye":"1:16.28.0~dfsg-0+deb11u4","bullseye-security":"1:16.28.0~dfsg-0+deb11u8"},"fixed_version":"1:1.8.13.1~dfsg-1","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"1:22.8.2+dfsg+~cs6.15.60671435-1"},"fixed_version":"1:1.8.13.1~dfsg-1","urgency":"not yet assigned"}}},"CVE-2012-4737":{"description":"channels/chan_iax2.c in Asterisk Open Source 1.8.x before 1.8.15.1 and 10.x before 10.7.1, Certified Asterisk 1.8.11 before 1.8.11-cert7, Asterisk Digiumphones 10.x.x-digiumphones before 10.7.1-digiumphones, and Asterisk Business Edition C.3.x before C.3.7.6 does not enforce ACL rules during certain uses of peer credentials, which allows remote authenticated users to bypass intended outbound-call restrictions by leveraging the availability of these credentials.","debianbug":680470,"scope":"local","releases":{"bullseye":{"status":"resolved","repositories":{"bullseye":"1:16.28.0~dfsg-0+deb11u4","bullseye-security":"1:16.28.0~dfsg-0+deb11u8"},"fixed_version":"1:1.8.13.1~dfsg-1","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"1:22.8.2+dfsg+~cs6.15.60671435-1"},"fixed_version":"1:1.8.13.1~dfsg-1","urgency":"not yet assigned"}}},"CVE-2012-5976":{"description":"Multiple stack consumption vulnerabilities in Asterisk Open Source 1.8.x before 1.8.19.1, 10.x before 10.11.1, and 11.x before 11.1.2; Certified Asterisk 1.8.11 before 1.8.11-cert10; and Asterisk Digiumphones 10.x-digiumphones before 10.11.1-digiumphones allow remote attackers to cause a denial of service (daemon crash) via TCP data using the (1) SIP, (2) HTTP, or (3) XMPP protocol.","debianbug":697230,"scope":"local","releases":{"bullseye":{"status":"resolved","repositories":{"bullseye":"1:16.28.0~dfsg-0+deb11u4","bullseye-security":"1:16.28.0~dfsg-0+deb11u8"},"fixed_version":"1:1.8.13.1~dfsg-2","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"1:22.8.2+dfsg+~cs6.15.60671435-1"},"fixed_version":"1:1.8.13.1~dfsg-2","urgency":"not yet assigned"}}},"CVE-2012-5977":{"description":"Asterisk Open Source 1.8.x before 1.8.19.1, 10.x before 10.11.1, and 11.x before 11.1.2; Certified Asterisk 1.8.11 before 1.8.11-cert10; and Asterisk Digiumphones 10.x-digiumphones before 10.11.1-digiumphones, when anonymous calls are enabled, allow remote attackers to cause a denial of service (resource consumption) by making anonymous calls from multiple sources and consequently adding many entries to the device state cache.","debianbug":697230,"scope":"local","releases":{"bullseye":{"status":"resolved","repositories":{"bullseye":"1:16.28.0~dfsg-0+deb11u4","bullseye-security":"1:16.28.0~dfsg-0+deb11u8"},"fixed_version":"1:1.8.13.1~dfsg-2","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"1:22.8.2+dfsg+~cs6.15.60671435-1"},"fixed_version":"1:1.8.13.1~dfsg-2","urgency":"not yet assigned"}}},"CVE-2013-2264":{"description":"The SIP channel driver in Asterisk Open Source 1.8.x before 1.8.20.2, 10.x before 10.12.2, and 11.x before 11.2.2; Certified Asterisk 1.8.15 before 1.8.15-cert2; Asterisk Business Edition (BE) C.3.x before C.3.8.1; and Asterisk Digiumphones 10.x-digiumphones before 10.12.2-digiumphones exhibits different behavior for invalid INVITE, SUBSCRIBE, and REGISTER transactions depending on whether the user account exists, which allows remote attackers to enumerate account names by (1) reading HTTP status codes, (2) reading additional text in a 403 (aka Forbidden) response, or (3) observing whether certain retransmissions occur.","debianbug":704114,"scope":"local","releases":{"bullseye":{"status":"resolved","repositories":{"bullseye":"1:16.28.0~dfsg-0+deb11u4","bullseye-security":"1:16.28.0~dfsg-0+deb11u8"},"fixed_version":"1:1.8.13.1~dfsg-2","urgency":"low"},"sid":{"status":"resolved","repositories":{"sid":"1:22.8.2+dfsg+~cs6.15.60671435-1"},"fixed_version":"1:1.8.13.1~dfsg-2","urgency":"low"}}},"CVE-2013-2685":{"description":"Stack-based buffer overflow in res/res_format_attr_h264.c in Asterisk Open Source 11.x before 11.2.2 allows remote attackers to execute arbitrary code via a long sprop-parameter-sets H.264 media attribute in a SIP Session Description Protocol (SDP) header.","scope":"local","releases":{"bullseye":{"status":"resolved","repositories":{"bullseye":"1:16.28.0~dfsg-0+deb11u4","bullseye-security":"1:16.28.0~dfsg-0+deb11u8"},"fixed_version":"0","urgency":"unimportant"},"sid":{"status":"resolved","repositories":{"sid":"1:22.8.2+dfsg+~cs6.15.60671435-1"},"fixed_version":"0","urgency":"unimportant"}}},"CVE-2013-2686":{"description":"main/http.c in the HTTP server in Asterisk Open Source 1.8.x before 1.8.20.2, 10.x before 10.12.2, and 11.x before 11.2.2; Certified Asterisk 1.8.15 before 1.8.15-cert2; and Asterisk Digiumphones 10.x-digiumphones before 10.12.2-digiumphones does not properly restrict Content-Length values, which allows remote attackers to conduct stack-consumption attacks and cause a denial of service (daemon crash) via a crafted HTTP POST request.  NOTE: this vulnerability exists because of an incorrect fix for CVE-2012-5976.","debianbug":704114,"scope":"local","releases":{"bullseye":{"status":"resolved","repositories":{"bullseye":"1:16.28.0~dfsg-0+deb11u4","bullseye-security":"1:16.28.0~dfsg-0+deb11u8"},"fixed_version":"1:1.8.13.1~dfsg-2","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"1:22.8.2+dfsg+~cs6.15.60671435-1"},"fixed_version":"1:1.8.13.1~dfsg-2","urgency":"not yet assigned"}}},"CVE-2013-5641":{"description":"The SIP channel driver (channels/chan_sip.c) in Asterisk Open Source 1.8.17.x through 1.8.22.x, 1.8.23.x before 1.8.23.1, and 11.x before 11.5.1 and Certified Asterisk 1.8.15 before 1.8.15-cert3 and 11.2 before 11.2-cert2 allows remote attackers to cause a denial of service (NULL pointer dereference, segmentation fault, and daemon crash) via an ACK with SDP to a previously terminated channel.  NOTE: some of these details are obtained from third party information.","debianbug":721220,"scope":"local","releases":{"bullseye":{"status":"resolved","repositories":{"bullseye":"1:16.28.0~dfsg-0+deb11u4","bullseye-security":"1:16.28.0~dfsg-0+deb11u8"},"fixed_version":"1:11.5.1~dfsg-1","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"1:22.8.2+dfsg+~cs6.15.60671435-1"},"fixed_version":"1:11.5.1~dfsg-1","urgency":"not yet assigned"}}},"CVE-2013-5642":{"description":"The SIP channel driver (channels/chan_sip.c) in Asterisk Open Source 1.8.x before 1.8.23.1, 10.x before 10.12.3, and 11.x before 11.5.1; Certified Asterisk 1.8.15 before 1.8.15-cert3 and 11.2 before 11.2-cert2; and Asterisk Digiumphones 10.x-digiumphones before 10.12.3-digiumphones allows remote attackers to cause a denial of service (NULL pointer dereference, segmentation fault, and daemon crash) via an invalid SDP that defines a media description before the connection description in a SIP request.","debianbug":721220,"scope":"local","releases":{"bullseye":{"status":"resolved","repositories":{"bullseye":"1:16.28.0~dfsg-0+deb11u4","bullseye-security":"1:16.28.0~dfsg-0+deb11u8"},"fixed_version":"1:11.5.1~dfsg-1","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"1:22.8.2+dfsg+~cs6.15.60671435-1"},"fixed_version":"1:11.5.1~dfsg-1","urgency":"not yet assigned"}}},"CVE-2013-7100":{"description":"Buffer overflow in the unpacksms16 function in apps/app_sms.c in Asterisk Open Source 1.8.x before 1.8.24.1, 10.x before 10.12.4, and 11.x before 11.6.1; Asterisk with Digiumphones 10.x-digiumphones before 10.12.4-digiumphones; and Certified Asterisk 1.8.x before 1.8.15-cert4 and 11.x before 11.2-cert3 allows remote attackers to cause a denial of service (daemon crash) via a 16-bit SMS message with an odd number of bytes, which triggers an infinite loop.","debianbug":732355,"scope":"local","releases":{"bullseye":{"status":"resolved","repositories":{"bullseye":"1:16.28.0~dfsg-0+deb11u4","bullseye-security":"1:16.28.0~dfsg-0+deb11u8"},"fixed_version":"1:11.7.0~dfsg-1","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"1:22.8.2+dfsg+~cs6.15.60671435-1"},"fixed_version":"1:11.7.0~dfsg-1","urgency":"not yet assigned"}}},"CVE-2014-2286":{"description":"main/http.c in Asterisk Open Source 1.8.x before 1.8.26.1, 11.8.x before 11.8.1, and 12.1.x before 12.1.1, and Certified Asterisk 1.8.x before 1.8.15-cert5 and 11.6 before 11.6-cert2, allows remote attackers to cause a denial of service (stack consumption) and possibly execute arbitrary code via an HTTP request with a large number of Cookie headers.","debianbug":741313,"scope":"local","releases":{"bullseye":{"status":"resolved","repositories":{"bullseye":"1:16.28.0~dfsg-0+deb11u4","bullseye-security":"1:16.28.0~dfsg-0+deb11u8"},"fixed_version":"1:11.8.1~dfsg-1","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"1:22.8.2+dfsg+~cs6.15.60671435-1"},"fixed_version":"1:11.8.1~dfsg-1","urgency":"not yet assigned"}}},"CVE-2014-2287":{"description":"channels/chan_sip.c in Asterisk Open Source 1.8.x before 1.8.26.1, 11.8.x before 11.8.1, and 12.1.x before 12.1.1, and Certified Asterisk 1.8.15 before 1.8.15-cert5 and 11.6 before 11.6-cert2, when chan_sip has a certain configuration, allows remote authenticated users to cause a denial of service (channel and file descriptor consumption) via an INVITE request with a (1) Session-Expires or (2) Min-SE header with a malformed or invalid value.","debianbug":741313,"scope":"local","releases":{"bullseye":{"status":"resolved","repositories":{"bullseye":"1:16.28.0~dfsg-0+deb11u4","bullseye-security":"1:16.28.0~dfsg-0+deb11u8"},"fixed_version":"1:11.8.1~dfsg-1","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"1:22.8.2+dfsg+~cs6.15.60671435-1"},"fixed_version":"1:11.8.1~dfsg-1","urgency":"not yet assigned"}}},"CVE-2014-2288":{"description":"The PJSIP channel driver in Asterisk Open Source 12.x before 12.1.1, when qualify_frequency \"is enabled on an AOR and the remote SIP server challenges for authentication of the resulting OPTIONS request,\" allows remote attackers to cause a denial of service (crash) via a PJSIP endpoint that does not have an associated outgoing request.","scope":"local","releases":{"bullseye":{"status":"resolved","repositories":{"bullseye":"1:16.28.0~dfsg-0+deb11u4","bullseye-security":"1:16.28.0~dfsg-0+deb11u8"},"fixed_version":"0","urgency":"unimportant"},"sid":{"status":"resolved","repositories":{"sid":"1:22.8.2+dfsg+~cs6.15.60671435-1"},"fixed_version":"0","urgency":"unimportant"}}},"CVE-2014-2289":{"description":"res/res_pjsip_exten_state.c in the PJSIP channel driver in Asterisk Open Source 12.x before 12.1.0 allows remote authenticated users to cause a denial of service (crash) via a SUBSCRIBE request without any Accept headers, which triggers an invalid pointer dereference.","scope":"local","releases":{"bullseye":{"status":"resolved","repositories":{"bullseye":"1:16.28.0~dfsg-0+deb11u4","bullseye-security":"1:16.28.0~dfsg-0+deb11u8"},"fixed_version":"0","urgency":"unimportant"},"sid":{"status":"resolved","repositories":{"sid":"1:22.8.2+dfsg+~cs6.15.60671435-1"},"fixed_version":"0","urgency":"unimportant"}}},"CVE-2014-4045":{"description":"The Publish/Subscribe Framework in the PJSIP channel driver in Asterisk Open Source 12.x before 12.3.1, when sub_min_expiry is set to zero, allows remote attackers to cause a denial of service (assertion failure and crash) via an unsubscribe request when not subscribed to the device.","scope":"local","releases":{"bullseye":{"status":"resolved","repositories":{"bullseye":"1:16.28.0~dfsg-0+deb11u4","bullseye-security":"1:16.28.0~dfsg-0+deb11u8"},"fixed_version":"0","urgency":"unimportant"},"sid":{"status":"resolved","repositories":{"sid":"1:22.8.2+dfsg+~cs6.15.60671435-1"},"fixed_version":"0","urgency":"unimportant"}}},"CVE-2014-4046":{"description":"Asterisk Open Source 11.x before 11.10.1 and 12.x before 12.3.1 and Certified Asterisk 11.6 before 11.6-cert3 allows remote authenticated Manager users to execute arbitrary shell commands via a MixMonitor action.","scope":"local","releases":{"bullseye":{"status":"resolved","repositories":{"bullseye":"1:16.28.0~dfsg-0+deb11u4","bullseye-security":"1:16.28.0~dfsg-0+deb11u8"},"fixed_version":"1:11.10.2~dfsg-1","urgency":"low"},"sid":{"status":"resolved","repositories":{"sid":"1:22.8.2+dfsg+~cs6.15.60671435-1"},"fixed_version":"1:11.10.2~dfsg-1","urgency":"low"}}},"CVE-2014-4047":{"description":"Asterisk Open Source 1.8.x before 1.8.28.1, 11.x before 11.10.1, and 12.x before 12.3.1 and Certified Asterisk 1.8.15 before 1.8.15-cert6 and 11.6 before 11.6-cert3 allows remote attackers to cause a denial of service (connection consumption) via a large number of (1) inactive or (2) incomplete HTTP connections.","scope":"local","releases":{"bullseye":{"status":"resolved","repositories":{"bullseye":"1:16.28.0~dfsg-0+deb11u4","bullseye-security":"1:16.28.0~dfsg-0+deb11u8"},"fixed_version":"1:11.10.2~dfsg-1","urgency":"low"},"sid":{"status":"resolved","repositories":{"sid":"1:22.8.2+dfsg+~cs6.15.60671435-1"},"fixed_version":"1:11.10.2~dfsg-1","urgency":"low"}}},"CVE-2014-4048":{"description":"The PJSIP Channel Driver in Asterisk Open Source before 12.3.1 allows remote attackers to cause a denial of service (deadlock) by terminating a subscription request before it is complete, which triggers a SIP transaction timeout.","scope":"local","releases":{"bullseye":{"status":"resolved","repositories":{"bullseye":"1:16.28.0~dfsg-0+deb11u4","bullseye-security":"1:16.28.0~dfsg-0+deb11u8"},"fixed_version":"0","urgency":"unimportant"},"sid":{"status":"resolved","repositories":{"sid":"1:22.8.2+dfsg+~cs6.15.60671435-1"},"fixed_version":"0","urgency":"unimportant"}}},"CVE-2014-6609":{"description":"The res_pjsip_pubsub module in Asterisk Open Source 12.x before 12.5.1 allows remote authenticated users to cause a denial of service (crash) via crafted headers in a SIP SUBSCRIBE request for an event package.","scope":"local","releases":{"bullseye":{"status":"resolved","repositories":{"bullseye":"1:16.28.0~dfsg-0+deb11u4","bullseye-security":"1:16.28.0~dfsg-0+deb11u8"},"fixed_version":"0","urgency":"unimportant"},"sid":{"status":"resolved","repositories":{"sid":"1:22.8.2+dfsg+~cs6.15.60671435-1"},"fixed_version":"0","urgency":"unimportant"}}},"CVE-2014-6610":{"description":"Asterisk Open Source 11.x before 11.12.1 and 12.x before 12.5.1 and Certified Asterisk 11.6 before 11.6-cert6, when using the res_fax_spandsp module, allows remote authenticated users to cause a denial of service (crash) via an out of call message, which is not properly handled in the ReceiveFax dialplan application.","debianbug":762164,"scope":"local","releases":{"bullseye":{"status":"resolved","repositories":{"bullseye":"1:16.28.0~dfsg-0+deb11u4","bullseye-security":"1:16.28.0~dfsg-0+deb11u8"},"fixed_version":"1:11.12.1~dfsg-1","urgency":"medium"},"sid":{"status":"resolved","repositories":{"sid":"1:22.8.2+dfsg+~cs6.15.60671435-1"},"fixed_version":"1:11.12.1~dfsg-1","urgency":"medium"}}},"CVE-2014-8412":{"description":"The (1) VoIP channel drivers, (2) DUNDi, and (3) Asterisk Manager Interface (AMI) in Asterisk Open Source 1.8.x before 1.8.32.1, 11.x before 11.14.1, 12.x before 12.7.1, and 13.x before 13.0.1 and Certified Asterisk 1.8.28 before 1.8.28-cert3 and 11.6 before 11.6-cert8 allows remote attackers to bypass the ACL restrictions via a packet with a source IP that does not share the address family as the first ACL entry.","debianbug":771463,"scope":"local","releases":{"bullseye":{"status":"resolved","repositories":{"bullseye":"1:16.28.0~dfsg-0+deb11u4","bullseye-security":"1:16.28.0~dfsg-0+deb11u8"},"fixed_version":"1:13.1.0~dfsg-1","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"1:22.8.2+dfsg+~cs6.15.60671435-1"},"fixed_version":"1:13.1.0~dfsg-1","urgency":"not yet assigned"}}},"CVE-2014-8413":{"description":"The res_pjsip_acl module in Asterisk Open Source 12.x before 12.7.1 and 13.x before 13.0.1 does not properly create and load ACLs defined in pjsip.conf at startup, which allows remote attackers to bypass intended PJSIP ACL rules.","scope":"local","releases":{"bullseye":{"status":"resolved","repositories":{"bullseye":"1:16.28.0~dfsg-0+deb11u4","bullseye-security":"1:16.28.0~dfsg-0+deb11u8"},"fixed_version":"1:13.1.0~dfsg-1","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"1:22.8.2+dfsg+~cs6.15.60671435-1"},"fixed_version":"1:13.1.0~dfsg-1","urgency":"not yet assigned"}}},"CVE-2014-8414":{"description":"ConfBridge in Asterisk 11.x before 11.14.1 and Certified Asterisk 11.6 before 11.6-cert8 does not properly handle state changes, which allows remote attackers to cause a denial of service (channel hang and memory consumption) by causing transitions to be delayed, which triggers a state change from hung up to waiting for media.","debianbug":771463,"scope":"local","releases":{"bullseye":{"status":"resolved","repositories":{"bullseye":"1:16.28.0~dfsg-0+deb11u4","bullseye-security":"1:16.28.0~dfsg-0+deb11u8"},"fixed_version":"1:13.1.0~dfsg-1","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"1:22.8.2+dfsg+~cs6.15.60671435-1"},"fixed_version":"1:13.1.0~dfsg-1","urgency":"not yet assigned"}}},"CVE-2014-8415":{"description":"Race condition in the chan_pjsip channel driver in Asterisk Open Source 12.x before 12.7.1 and 13.x before 13.0.1 allows remote attackers to cause a denial of service (assertion failure and crash) via a cancel request for a SIP session with a queued action to (1) answer a session or (2) send ringing.","scope":"local","releases":{"bullseye":{"status":"resolved","repositories":{"bullseye":"1:16.28.0~dfsg-0+deb11u4","bullseye-security":"1:16.28.0~dfsg-0+deb11u8"},"fixed_version":"1:13.1.0~dfsg-1","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"1:22.8.2+dfsg+~cs6.15.60671435-1"},"fixed_version":"1:13.1.0~dfsg-1","urgency":"not yet assigned"}}},"CVE-2014-8416":{"description":"Use-after-free vulnerability in the PJSIP channel driver in Asterisk Open Source 12.x before 12.7.1 and 13.x before 13.0.1, when using the res_pjsip_refer module, allows remote attackers to cause a denial of service (crash) via an in-dialog INVITE with Replaces message, which triggers the channel to be hung up.","scope":"local","releases":{"bullseye":{"status":"resolved","repositories":{"bullseye":"1:16.28.0~dfsg-0+deb11u4","bullseye-security":"1:16.28.0~dfsg-0+deb11u8"},"fixed_version":"1:13.1.0~dfsg-1","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"1:22.8.2+dfsg+~cs6.15.60671435-1"},"fixed_version":"1:13.1.0~dfsg-1","urgency":"not yet assigned"}}},"CVE-2014-8417":{"description":"ConfBridge in Asterisk 11.x before 11.14.1, 12.x before 12.7.1, and 13.x before 13.0.1 and Certified Asterisk 11.6 before 11.6-cert8 allows remote authenticated users to (1) gain privileges via vectors related to an external protocol to the CONFBRIDGE dialplan function or (2) execute arbitrary system commands via a crafted ConfbridgeStartRecord AMI action.","debianbug":771463,"scope":"local","releases":{"bullseye":{"status":"resolved","repositories":{"bullseye":"1:16.28.0~dfsg-0+deb11u4","bullseye-security":"1:16.28.0~dfsg-0+deb11u8"},"fixed_version":"1:13.1.0~dfsg-1","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"1:22.8.2+dfsg+~cs6.15.60671435-1"},"fixed_version":"1:13.1.0~dfsg-1","urgency":"not yet assigned"}}},"CVE-2014-8418":{"description":"The DB dialplan function in Asterisk Open Source 1.8.x before 1.8.32, 11.x before 11.1.4.1, 12.x before 12.7.1, and 13.x before 13.0.1 and Certified Asterisk 1.8 before 1.8.28-cert8 and 11.6 before 11.6-cert8 allows remote authenticated users to gain privileges via a call from an external protocol, as demonstrated by the AMI protocol.","debianbug":771463,"scope":"local","releases":{"bullseye":{"status":"resolved","repositories":{"bullseye":"1:16.28.0~dfsg-0+deb11u4","bullseye-security":"1:16.28.0~dfsg-0+deb11u8"},"fixed_version":"1:13.1.0~dfsg-1","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"1:22.8.2+dfsg+~cs6.15.60671435-1"},"fixed_version":"1:13.1.0~dfsg-1","urgency":"not yet assigned"}}},"CVE-2014-9374":{"description":"Double free vulnerability in the WebSocket Server (res_http_websocket module) in Asterisk Open Source 11.x before 11.14.2, 12.x before 12.7.2, and 13.x before 13.0.2 and Certified Asterisk 11.6 before 11.6-cert9 allows remote attackers to cause a denial of service (crash) by sending a zero length frame after a non-zero length frame.","debianbug":773230,"scope":"local","releases":{"bullseye":{"status":"resolved","repositories":{"bullseye":"1:16.28.0~dfsg-0+deb11u4","bullseye-security":"1:16.28.0~dfsg-0+deb11u8"},"fixed_version":"1:13.1.0~dfsg-1","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"1:22.8.2+dfsg+~cs6.15.60671435-1"},"fixed_version":"1:13.1.0~dfsg-1","urgency":"not yet assigned"}}},"CVE-2015-1558":{"description":"Asterisk Open Source 12.x before 12.8.1 and 13.x before 13.1.1, when using the PJSIP channel driver, does not properly reclaim RTP ports, which allows remote authenticated users to cause a denial of service (file descriptor consumption) via an SDP offer containing only incompatible codecs.","debianbug":780601,"scope":"local","releases":{"bullseye":{"status":"resolved","repositories":{"bullseye":"1:16.28.0~dfsg-0+deb11u4","bullseye-security":"1:16.28.0~dfsg-0+deb11u8"},"fixed_version":"1:13.1.0~dfsg-1.1","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"1:22.8.2+dfsg+~cs6.15.60671435-1"},"fixed_version":"1:13.1.0~dfsg-1.1","urgency":"not yet assigned"}}},"CVE-2015-3008":{"description":"Asterisk Open Source 1.8 before 1.8.32.3, 11.x before 11.17.1, 12.x before 12.8.2, and 13.x before 13.3.2 and Certified Asterisk 1.8.28 before 1.8.28-cert5, 11.6 before 11.6-cert11, and 13.1 before 13.1-cert2, when registering a SIP TLS device, does not properly handle a null byte in a domain name in the subject's Common Name (CN) field of an X.509 certificate, which allows man-in-the-middle attackers to spoof arbitrary SSL servers via a crafted certificate issued by a legitimate Certification Authority.","debianbug":782411,"scope":"local","releases":{"bullseye":{"status":"resolved","repositories":{"bullseye":"1:16.28.0~dfsg-0+deb11u4","bullseye-security":"1:16.28.0~dfsg-0+deb11u8"},"fixed_version":"1:13.7.2~dfsg-1","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"1:22.8.2+dfsg+~cs6.15.60671435-1"},"fixed_version":"1:13.7.2~dfsg-1","urgency":"not yet assigned"}}},"CVE-2016-2232":{"description":"Asterisk Open Source 1.8.x, 11.x before 11.21.1, 12.x, and 13.x before 13.7.1 and Certified Asterisk 1.8.28, 11.6 before 11.6-cert12, and 13.1 before 13.1-cert3 allow remote authenticated users to cause a denial of service (uninitialized pointer dereference and crash) via a zero length error correcting redundancy packet for a UDPTL FAX packet that is lost.","scope":"local","releases":{"bullseye":{"status":"resolved","repositories":{"bullseye":"1:16.28.0~dfsg-0+deb11u4","bullseye-security":"1:16.28.0~dfsg-0+deb11u8"},"fixed_version":"1:13.7.2~dfsg-1","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"1:22.8.2+dfsg+~cs6.15.60671435-1"},"fixed_version":"1:13.7.2~dfsg-1","urgency":"not yet assigned"}}},"CVE-2016-2316":{"description":"chan_sip in Asterisk Open Source 1.8.x, 11.x before 11.21.1, 12.x, and 13.x before 13.7.1 and Certified Asterisk 1.8.28, 11.6 before 11.6-cert12, and 13.1 before 13.1-cert3, when the timert1 sip.conf configuration is set to a value greater than 1245, allows remote attackers to cause a denial of service (file descriptor consumption) via vectors related to large retransmit timeout values.","scope":"local","releases":{"bullseye":{"status":"resolved","repositories":{"bullseye":"1:16.28.0~dfsg-0+deb11u4","bullseye-security":"1:16.28.0~dfsg-0+deb11u8"},"fixed_version":"1:13.7.2~dfsg-1","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"1:22.8.2+dfsg+~cs6.15.60671435-1"},"fixed_version":"1:13.7.2~dfsg-1","urgency":"not yet assigned"}}},"CVE-2016-7550":{"description":"asterisk 13.10.0 is affected by: denial of service issues in asterisk. The impact is: cause a denial of service (remote).","debianbug":838833,"scope":"local","releases":{"bullseye":{"status":"resolved","repositories":{"bullseye":"1:16.28.0~dfsg-0+deb11u4","bullseye-security":"1:16.28.0~dfsg-0+deb11u8"},"fixed_version":"1:13.11.2~dfsg-1","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"1:22.8.2+dfsg+~cs6.15.60671435-1"},"fixed_version":"1:13.11.2~dfsg-1","urgency":"not yet assigned"}}},"CVE-2016-7551":{"description":"chain_sip in Asterisk Open Source 11.x before 11.23.1 and 13.x 13.11.1 and Certified Asterisk 11.6 before 11.6-cert15 and 13.8 before 13.8-cert3 allows remote attackers to cause a denial of service (port exhaustion).","debianbug":838832,"scope":"local","releases":{"bullseye":{"status":"resolved","repositories":{"bullseye":"1:16.28.0~dfsg-0+deb11u4","bullseye-security":"1:16.28.0~dfsg-0+deb11u8"},"fixed_version":"1:13.11.2~dfsg-1","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"1:22.8.2+dfsg+~cs6.15.60671435-1"},"fixed_version":"1:13.11.2~dfsg-1","urgency":"not yet assigned"}}},"CVE-2016-9937":{"description":"An issue was discovered in Asterisk Open Source 13.12.x and 13.13.x before 13.13.1 and 14.x before 14.2.1. If an SDP offer or answer is received with the Opus codec and with the format parameters separated using a space the code responsible for parsing will recursively call itself until it crashes. This occurs as the code does not properly handle spaces separating the parameters. This does NOT require the endpoint to have Opus configured in Asterisk. This also does not require the endpoint to be authenticated. If guest is enabled for chan_sip or anonymous in chan_pjsip an SDP offer or answer is still processed and the crash occurs.","scope":"local","releases":{"bullseye":{"status":"resolved","repositories":{"bullseye":"1:16.28.0~dfsg-0+deb11u4","bullseye-security":"1:16.28.0~dfsg-0+deb11u8"},"fixed_version":"0","urgency":"unimportant"},"sid":{"status":"resolved","repositories":{"sid":"1:22.8.2+dfsg+~cs6.15.60671435-1"},"fixed_version":"0","urgency":"unimportant"}}},"CVE-2016-9938":{"description":"An issue was discovered in Asterisk Open Source 11.x before 11.25.1, 13.x before 13.13.1, and 14.x before 14.2.1 and Certified Asterisk 11.x before 11.6-cert16 and 13.x before 13.8-cert4. The chan_sip channel driver has a liberal definition for whitespace when attempting to strip the content between a SIP header name and a colon character. Rather than following RFC 3261 and stripping only spaces and horizontal tabs, Asterisk treats any non-printable ASCII character as if it were whitespace. This means that headers such as Contact\\x01: will be seen as a valid Contact header. This mostly does not pose a problem until Asterisk is placed in tandem with an authenticating SIP proxy. In such a case, a crafty combination of valid and invalid To headers can cause a proxy to allow an INVITE request into Asterisk without authentication since it believes the request is an in-dialog request. However, because of the bug described above, the request will look like an out-of-dialog request to Asterisk. Asterisk will then process the request as a new call. The result is that Asterisk can process calls from unvetted sources without any authentication. If you do not use a proxy for authentication, then this issue does not affect you. If your proxy is dialog-aware (meaning that the proxy keeps track of what dialogs are currently valid), then this issue does not affect you. If you use chan_pjsip instead of chan_sip, then this issue does not affect you.","debianbug":847668,"scope":"local","releases":{"bullseye":{"status":"resolved","repositories":{"bullseye":"1:16.28.0~dfsg-0+deb11u4","bullseye-security":"1:16.28.0~dfsg-0+deb11u8"},"fixed_version":"1:13.13.1~dfsg-1","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"1:22.8.2+dfsg+~cs6.15.60671435-1"},"fixed_version":"1:13.13.1~dfsg-1","urgency":"not yet assigned"}}},"CVE-2017-14098":{"description":"In the pjsip channel driver (res_pjsip) in Asterisk 13.x before 13.17.1 and 14.x before 14.6.1, a carefully crafted tel URI in a From, To, or Contact header could cause Asterisk to crash.","debianbug":873909,"scope":"local","releases":{"bullseye":{"status":"resolved","repositories":{"bullseye":"1:16.28.0~dfsg-0+deb11u4","bullseye-security":"1:16.28.0~dfsg-0+deb11u8"},"fixed_version":"1:13.17.1~dfsg-1","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"1:22.8.2+dfsg+~cs6.15.60671435-1"},"fixed_version":"1:13.17.1~dfsg-1","urgency":"not yet assigned"}}},"CVE-2017-14099":{"description":"In res/res_rtp_asterisk.c in Asterisk 11.x before 11.25.2, 13.x before 13.17.1, and 14.x before 14.6.1 and Certified Asterisk 11.x before 11.6-cert17 and 13.x before 13.13-cert5, unauthorized data disclosure (media takeover in the RTP stack) is possible with careful timing by an attacker. The \"strictrtp\" option in rtp.conf enables a feature of the RTP stack that learns the source address of media for a session and drops any packets that do not originate from the expected address. This option is enabled by default in Asterisk 11 and above. The \"nat\" and \"rtp_symmetric\" options (for chan_sip and chan_pjsip, respectively) enable symmetric RTP support in the RTP stack. This uses the source address of incoming media as the target address of any sent media. This option is not enabled by default, but is commonly enabled to handle devices behind NAT. A change was made to the strict RTP support in the RTP stack to better tolerate late media when a reinvite occurs. When combined with the symmetric RTP support, this introduced an avenue where media could be hijacked. Instead of only learning a new address when expected, the new code allowed a new source address to be learned at all times. If a flood of RTP traffic was received, the strict RTP support would allow the new address to provide media, and (with symmetric RTP enabled) outgoing traffic would be sent to this new address, allowing the media to be hijacked. Provided the attacker continued to send traffic, they would continue to receive traffic as well.","debianbug":873907,"scope":"local","releases":{"bullseye":{"status":"resolved","repositories":{"bullseye":"1:16.28.0~dfsg-0+deb11u4","bullseye-security":"1:16.28.0~dfsg-0+deb11u8"},"fixed_version":"1:13.17.1~dfsg-1","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"1:22.8.2+dfsg+~cs6.15.60671435-1"},"fixed_version":"1:13.17.1~dfsg-1","urgency":"not yet assigned"}}},"CVE-2017-14100":{"description":"In Asterisk 11.x before 11.25.2, 13.x before 13.17.1, and 14.x before 14.6.1 and Certified Asterisk 11.x before 11.6-cert17 and 13.x before 13.13-cert5, unauthorized command execution is possible. The app_minivm module has an \"externnotify\" program configuration option that is executed by the MinivmNotify dialplan application. The application uses the caller-id name and number as part of a built string passed to the OS shell for interpretation and execution. Since the caller-id name and number can come from an untrusted source, a crafted caller-id name or number allows an arbitrary shell command injection.","debianbug":873908,"scope":"local","releases":{"bullseye":{"status":"resolved","repositories":{"bullseye":"1:16.28.0~dfsg-0+deb11u4","bullseye-security":"1:16.28.0~dfsg-0+deb11u8"},"fixed_version":"1:13.17.1~dfsg-1","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"1:22.8.2+dfsg+~cs6.15.60671435-1"},"fixed_version":"1:13.17.1~dfsg-1","urgency":"not yet assigned"}}},"CVE-2017-14603":{"description":"In Asterisk 11.x before 11.25.3, 13.x before 13.17.2, and 14.x before 14.6.2 and Certified Asterisk 11.x before 11.6-cert18 and 13.x before 13.13-cert6, insufficient RTCP packet validation could allow reading stale buffer contents and when combined with the \"nat\" and \"symmetric_rtp\" options allow redirecting where Asterisk sends the next RTCP report.","debianbug":876328,"scope":"local","releases":{"bullseye":{"status":"resolved","repositories":{"bullseye":"1:16.28.0~dfsg-0+deb11u4","bullseye-security":"1:16.28.0~dfsg-0+deb11u8"},"fixed_version":"1:13.17.2~dfsg-1","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"1:22.8.2+dfsg+~cs6.15.60671435-1"},"fixed_version":"1:13.17.2~dfsg-1","urgency":"not yet assigned"}}},"CVE-2017-16671":{"description":"A Buffer Overflow issue was discovered in Asterisk Open Source 13 before 13.18.1, 14 before 14.7.1, and 15 before 15.1.1 and Certified Asterisk 13.13 before 13.13-cert7. No size checking is done when setting the user field for Party B on a CDR. Thus, it is possible for someone to use an arbitrarily large string and write past the end of the user field storage buffer. NOTE: this is different from CVE-2017-7617, which was only about the Party A buffer.","debianbug":881257,"scope":"local","releases":{"bullseye":{"status":"resolved","repositories":{"bullseye":"1:16.28.0~dfsg-0+deb11u4","bullseye-security":"1:16.28.0~dfsg-0+deb11u8"},"fixed_version":"1:13.18.1~dfsg-1","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"1:22.8.2+dfsg+~cs6.15.60671435-1"},"fixed_version":"1:13.18.1~dfsg-1","urgency":"not yet assigned"}}},"CVE-2017-16672":{"description":"An issue was discovered in Asterisk Open Source 13 before 13.18.1, 14 before 14.7.1, and 15 before 15.1.1 and Certified Asterisk 13.13 before 13.13-cert7. A memory leak occurs when an Asterisk pjsip session object is created and that call gets rejected before the session itself is fully established. When this happens the session object never gets destroyed. Eventually Asterisk can run out of memory and crash.","debianbug":881256,"scope":"local","releases":{"bullseye":{"status":"resolved","repositories":{"bullseye":"1:16.28.0~dfsg-0+deb11u4","bullseye-security":"1:16.28.0~dfsg-0+deb11u8"},"fixed_version":"1:13.18.1~dfsg-1","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"1:22.8.2+dfsg+~cs6.15.60671435-1"},"fixed_version":"1:13.18.1~dfsg-1","urgency":"not yet assigned"}}},"CVE-2017-17090":{"description":"An issue was discovered in chan_skinny.c in Asterisk Open Source 13.18.2 and older, 14.7.2 and older, and 15.1.2 and older, and Certified Asterisk 13.13-cert7 and older. If the chan_skinny (aka SCCP protocol) channel driver is flooded with certain requests, it can cause the asterisk process to use excessive amounts of virtual memory, eventually causing asterisk to stop processing requests of any kind.","debianbug":883342,"scope":"local","releases":{"bullseye":{"status":"resolved","repositories":{"bullseye":"1:16.28.0~dfsg-0+deb11u4","bullseye-security":"1:16.28.0~dfsg-0+deb11u8"},"fixed_version":"1:13.18.3~dfsg-1","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"1:22.8.2+dfsg+~cs6.15.60671435-1"},"fixed_version":"1:13.18.3~dfsg-1","urgency":"not yet assigned"}}},"CVE-2017-17664":{"description":"A Remote Crash issue was discovered in Asterisk Open Source 13.x before 13.18.4, 14.x before 14.7.4, and 15.x before 15.1.4 and Certified Asterisk before 13.13-cert9. Certain compound RTCP packets cause a crash in the RTCP Stack.","debianbug":884345,"scope":"local","releases":{"bullseye":{"status":"resolved","repositories":{"bullseye":"1:16.28.0~dfsg-0+deb11u4","bullseye-security":"1:16.28.0~dfsg-0+deb11u8"},"fixed_version":"1:13.18.5~dfsg-1","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"1:22.8.2+dfsg+~cs6.15.60671435-1"},"fixed_version":"1:13.18.5~dfsg-1","urgency":"not yet assigned"}}},"CVE-2017-17850":{"description":"An issue was discovered in Asterisk 13.18.4 and older, 14.7.4 and older, 15.1.4 and older, and 13.18-cert1 and older. A select set of SIP messages create a dialog in Asterisk. Those SIP messages must contain a contact header. For those messages, if the header was not present and the PJSIP channel driver was used, Asterisk would crash. The severity of this vulnerability is somewhat mitigated if authentication is enabled. If authentication is enabled, a user would have to first be authorized before reaching the crash point.","debianbug":885072,"scope":"local","releases":{"bullseye":{"status":"resolved","repositories":{"bullseye":"1:16.28.0~dfsg-0+deb11u4","bullseye-security":"1:16.28.0~dfsg-0+deb11u8"},"fixed_version":"1:13.18.5~dfsg-1","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"1:22.8.2+dfsg+~cs6.15.60671435-1"},"fixed_version":"1:13.18.5~dfsg-1","urgency":"not yet assigned"}}},"CVE-2017-7617":{"description":"Remote code execution can occur in Asterisk Open Source 13.x before 13.14.1 and 14.x before 14.3.1 and Certified Asterisk 13.13 before 13.13-cert3 because of a buffer overflow in a CDR user field, related to X-ClientCode in chan_sip, the CDR dialplan function, and the AMI Monitor action.","debianbug":859910,"scope":"local","releases":{"bullseye":{"status":"resolved","repositories":{"bullseye":"1:16.28.0~dfsg-0+deb11u4","bullseye-security":"1:16.28.0~dfsg-0+deb11u8"},"fixed_version":"1:13.14.1~dfsg-1","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"1:22.8.2+dfsg+~cs6.15.60671435-1"},"fixed_version":"1:13.14.1~dfsg-1","urgency":"not yet assigned"}}},"CVE-2017-9358":{"description":"A memory exhaustion vulnerability exists in Asterisk Open Source 13.x before 13.15.1 and 14.x before 14.4.1 and Certified Asterisk 13.13 before 13.13-cert4, which can be triggered by sending specially crafted SCCP packets causing an infinite loop and leading to memory exhaustion (by message logging in that loop).","debianbug":863906,"scope":"local","releases":{"bullseye":{"status":"resolved","repositories":{"bullseye":"1:16.28.0~dfsg-0+deb11u4","bullseye-security":"1:16.28.0~dfsg-0+deb11u8"},"fixed_version":"1:13.14.1~dfsg-2","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"1:22.8.2+dfsg+~cs6.15.60671435-1"},"fixed_version":"1:13.14.1~dfsg-2","urgency":"not yet assigned"}}},"CVE-2018-12227":{"description":"An issue was discovered in Asterisk Open Source 13.x before 13.21.1, 14.x before 14.7.7, and 15.x before 15.4.1 and Certified Asterisk 13.18-cert before 13.18-cert4 and 13.21-cert before 13.21-cert2. When endpoint specific ACL rules block a SIP request, they respond with a 403 forbidden. However, if an endpoint is not identified, then a 401 unauthorized response is sent. This vulnerability just discloses which requests hit a defined endpoint. The ACL rules cannot be bypassed to gain access to the disclosed endpoints.","debianbug":902954,"scope":"local","releases":{"bullseye":{"status":"resolved","repositories":{"bullseye":"1:16.28.0~dfsg-0+deb11u4","bullseye-security":"1:16.28.0~dfsg-0+deb11u8"},"fixed_version":"1:13.22.0~dfsg-1","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"1:22.8.2+dfsg+~cs6.15.60671435-1"},"fixed_version":"1:13.22.0~dfsg-1","urgency":"not yet assigned"}}},"CVE-2018-12228":{"description":"An issue was discovered in Asterisk Open Source 15.x before 15.4.1. When connected to Asterisk via TCP/TLS, if the client abruptly disconnects, or sends a specially crafted message, then Asterisk gets caught in an infinite loop while trying to read the data stream. This renders the system unusable.","scope":"local","releases":{"bullseye":{"status":"resolved","repositories":{"bullseye":"1:16.28.0~dfsg-0+deb11u4","bullseye-security":"1:16.28.0~dfsg-0+deb11u8"},"fixed_version":"0","urgency":"unimportant"},"sid":{"status":"resolved","repositories":{"sid":"1:22.8.2+dfsg+~cs6.15.60671435-1"},"fixed_version":"0","urgency":"unimportant"}}},"CVE-2018-17281":{"description":"There is a stack consumption vulnerability in the res_http_websocket.so module of Asterisk through 13.23.0, 14.7.x through 14.7.7, and 15.x through 15.6.0 and Certified Asterisk through 13.21-cert2. It allows an attacker to crash Asterisk via a specially crafted HTTP request to upgrade the connection to a websocket.","debianbug":909554,"scope":"local","releases":{"bullseye":{"status":"resolved","repositories":{"bullseye":"1:16.28.0~dfsg-0+deb11u4","bullseye-security":"1:16.28.0~dfsg-0+deb11u8"},"fixed_version":"1:13.23.1~dfsg-1","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"1:22.8.2+dfsg+~cs6.15.60671435-1"},"fixed_version":"1:13.23.1~dfsg-1","urgency":"not yet assigned"}}},"CVE-2018-19278":{"description":"Buffer overflow in DNS SRV and NAPTR lookups in Digium Asterisk 15.x before 15.6.2 and 16.x before 16.0.1 allows remote attackers to crash Asterisk via a specially crafted DNS SRV or NAPTR response, because a buffer size is supposed to match an expanded length but actually matches a compressed length.","scope":"local","releases":{"bullseye":{"status":"resolved","repositories":{"bullseye":"1:16.28.0~dfsg-0+deb11u4","bullseye-security":"1:16.28.0~dfsg-0+deb11u8"},"fixed_version":"0","urgency":"unimportant"},"sid":{"status":"resolved","repositories":{"sid":"1:22.8.2+dfsg+~cs6.15.60671435-1"},"fixed_version":"0","urgency":"unimportant"}}},"CVE-2018-7284":{"description":"A Buffer Overflow issue was discovered in Asterisk through 13.19.1, 14.x through 14.7.5, and 15.x through 15.2.1, and Certified Asterisk through 13.18-cert2. When processing a SUBSCRIBE request, the res_pjsip_pubsub module stores the accepted formats present in the Accept headers of the request. This code did not limit the number of headers it processed, despite having a fixed limit of 32. If more than 32 Accept headers were present, the code would write outside of its memory and cause a crash.","debianbug":891227,"scope":"local","releases":{"bullseye":{"status":"resolved","repositories":{"bullseye":"1:16.28.0~dfsg-0+deb11u4","bullseye-security":"1:16.28.0~dfsg-0+deb11u8"},"fixed_version":"1:13.20.0~dfsg-1","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"1:22.8.2+dfsg+~cs6.15.60671435-1"},"fixed_version":"1:13.20.0~dfsg-1","urgency":"not yet assigned"}}},"CVE-2018-7285":{"description":"A NULL pointer access issue was discovered in Asterisk 15.x through 15.2.1. The RTP support in Asterisk maintains its own registry of dynamic codecs and desired payload numbers. While an SDP negotiation may result in a codec using a different payload number, these desired ones are still stored internally. When an RTP packet was received, this registry would be consulted if the payload number was not found in the negotiated SDP. This registry was incorrectly consulted for all packets, even those which are dynamic. If the payload number resulted in a codec of a different type than the RTP stream (for example, the payload number resulted in a video codec but the stream carried audio), a crash could occur if no stream of that type had been negotiated. This was due to the code incorrectly assuming that a stream of that type would always exist.","scope":"local","releases":{"bullseye":{"status":"resolved","repositories":{"bullseye":"1:16.28.0~dfsg-0+deb11u4","bullseye-security":"1:16.28.0~dfsg-0+deb11u8"},"fixed_version":"0","urgency":"unimportant"},"sid":{"status":"resolved","repositories":{"sid":"1:22.8.2+dfsg+~cs6.15.60671435-1"},"fixed_version":"0","urgency":"unimportant"}}},"CVE-2018-7286":{"description":"An issue was discovered in Asterisk through 13.19.1, 14.x through 14.7.5, and 15.x through 15.2.1, and Certified Asterisk through 13.18-cert2. res_pjsip allows remote authenticated users to crash Asterisk (segmentation fault) by sending a number of SIP INVITE messages on a TCP or TLS connection and then suddenly closing the connection.","debianbug":891228,"scope":"local","releases":{"bullseye":{"status":"resolved","repositories":{"bullseye":"1:16.28.0~dfsg-0+deb11u4","bullseye-security":"1:16.28.0~dfsg-0+deb11u8"},"fixed_version":"1:13.20.0~dfsg-1","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"1:22.8.2+dfsg+~cs6.15.60671435-1"},"fixed_version":"1:13.20.0~dfsg-1","urgency":"not yet assigned"}}},"CVE-2018-7287":{"description":"An issue was discovered in res_http_websocket.c in Asterisk 15.x through 15.2.1. If the HTTP server is enabled (default is disabled), WebSocket payloads of size 0 are mishandled (with a busy loop).","scope":"local","releases":{"bullseye":{"status":"resolved","repositories":{"bullseye":"1:16.28.0~dfsg-0+deb11u4","bullseye-security":"1:16.28.0~dfsg-0+deb11u8"},"fixed_version":"0","urgency":"unimportant"},"sid":{"status":"resolved","repositories":{"sid":"1:22.8.2+dfsg+~cs6.15.60671435-1"},"fixed_version":"0","urgency":"unimportant"}}},"CVE-2019-12827":{"description":"Buffer overflow in res_pjsip_messaging in Digium Asterisk versions 13.21-cert3, 13.27.0, 15.7.2, 16.4.0 and earlier allows remote authenticated users to crash Asterisk by sending a specially crafted SIP MESSAGE message.","debianbug":931980,"scope":"local","releases":{"bullseye":{"status":"resolved","repositories":{"bullseye":"1:16.28.0~dfsg-0+deb11u4","bullseye-security":"1:16.28.0~dfsg-0+deb11u8"},"fixed_version":"1:16.2.1~dfsg-2","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"1:22.8.2+dfsg+~cs6.15.60671435-1"},"fixed_version":"1:16.2.1~dfsg-2","urgency":"not yet assigned"}}},"CVE-2019-13161":{"description":"An issue was discovered in Asterisk Open Source through 13.27.0, 14.x and 15.x through 15.7.2, and 16.x through 16.4.0, and Certified Asterisk through 13.21-cert3. A pointer dereference in chan_sip while handling SDP negotiation allows an attacker to crash Asterisk when handling an SDP answer to an outgoing T.38 re-invite. To exploit this vulnerability an attacker must cause the chan_sip module to send a T.38 re-invite request to them. Upon receipt, the attacker must send an SDP answer containing both a T.38 UDPTL stream and another media stream containing only a codec (which is not permitted according to the chan_sip configuration).","debianbug":931981,"scope":"local","releases":{"bullseye":{"status":"resolved","repositories":{"bullseye":"1:16.28.0~dfsg-0+deb11u4","bullseye-security":"1:16.28.0~dfsg-0+deb11u8"},"fixed_version":"1:16.2.1~dfsg-2","urgency":"low"},"sid":{"status":"resolved","repositories":{"sid":"1:22.8.2+dfsg+~cs6.15.60671435-1"},"fixed_version":"1:16.2.1~dfsg-2","urgency":"low"}}},"CVE-2019-15297":{"description":"res_pjsip_t38 in Sangoma Asterisk 15.x before 15.7.4 and 16.x before 16.5.1 allows an attacker to trigger a crash by sending a declined stream in a response to a T.38 re-invite initiated by Asterisk. The crash occurs because of a NULL session media object dereference.","debianbug":940060,"scope":"local","releases":{"bullseye":{"status":"resolved","repositories":{"bullseye":"1:16.28.0~dfsg-0+deb11u4","bullseye-security":"1:16.28.0~dfsg-0+deb11u8"},"fixed_version":"1:16.10.0~dfsg-1","urgency":"low"},"sid":{"status":"resolved","repositories":{"sid":"1:22.8.2+dfsg+~cs6.15.60671435-1"},"fixed_version":"1:16.10.0~dfsg-1","urgency":"low"}}},"CVE-2019-15639":{"description":"main/translate.c in Sangoma Asterisk 13.28.0 and 16.5.0 allows a remote attacker to send a specific RTP packet during a call and cause a crash in a specific scenario.","scope":"local","releases":{"bullseye":{"status":"resolved","repositories":{"bullseye":"1:16.28.0~dfsg-0+deb11u4","bullseye-security":"1:16.28.0~dfsg-0+deb11u8"},"fixed_version":"0","urgency":"unimportant"},"sid":{"status":"resolved","repositories":{"sid":"1:22.8.2+dfsg+~cs6.15.60671435-1"},"fixed_version":"0","urgency":"unimportant"}}},"CVE-2019-18610":{"description":"An issue was discovered in manager.c in Sangoma Asterisk through 13.x, 16.x, 17.x and Certified Asterisk 13.21 through 13.21-cert4. A remote authenticated Asterisk Manager Interface (AMI) user without system authorization could use a specially crafted Originate AMI request to execute arbitrary system commands.","debianbug":947377,"scope":"local","releases":{"bullseye":{"status":"resolved","repositories":{"bullseye":"1:16.28.0~dfsg-0+deb11u4","bullseye-security":"1:16.28.0~dfsg-0+deb11u8"},"fixed_version":"1:16.10.0~dfsg-1","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"1:22.8.2+dfsg+~cs6.15.60671435-1"},"fixed_version":"1:16.10.0~dfsg-1","urgency":"not yet assigned"}}},"CVE-2019-18790":{"description":"An issue was discovered in channels/chan_sip.c in Sangoma Asterisk 13.x before 13.29.2, 16.x before 16.6.2, and 17.x before 17.0.1, and Certified Asterisk 13.21 before cert5. A SIP request can be sent to Asterisk that can change a SIP peer's IP address. A REGISTER does not need to occur, and calls can be hijacked as a result. The only thing that needs to be known is the peer's name; authentication details such as passwords do not need to be known. This vulnerability is only exploitable when the nat option is set to the default, or auto_force_rport.","debianbug":947381,"scope":"local","releases":{"bullseye":{"status":"resolved","repositories":{"bullseye":"1:16.28.0~dfsg-0+deb11u4","bullseye-security":"1:16.28.0~dfsg-0+deb11u8"},"fixed_version":"1:16.10.0~dfsg-1","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"1:22.8.2+dfsg+~cs6.15.60671435-1"},"fixed_version":"1:16.10.0~dfsg-1","urgency":"not yet assigned"}}},"CVE-2019-18976":{"description":"An issue was discovered in res_pjsip_t38.c in Sangoma Asterisk through 13.x and Certified Asterisk through 13.21-x. If it receives a re-invite initiating T.38 faxing and has a port of 0 and no c line in the SDP, a NULL pointer dereference and crash will occur. This is different from CVE-2019-18940.","scope":"local","releases":{"bullseye":{"status":"resolved","repositories":{"bullseye":"1:16.28.0~dfsg-0+deb11u4","bullseye-security":"1:16.28.0~dfsg-0+deb11u8"},"fixed_version":"1:16.1.1~dfsg-1","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"1:22.8.2+dfsg+~cs6.15.60671435-1"},"fixed_version":"1:16.1.1~dfsg-1","urgency":"not yet assigned"}}},"CVE-2019-7251":{"description":"An Integer Signedness issue (for a return code) in the res_pjsip_sdp_rtp module in Digium Asterisk versions 15.7.1 and earlier and 16.1.1 and earlier allows remote authenticated users to crash Asterisk via a specially crafted SDP protocol violation.","debianbug":923690,"scope":"local","releases":{"bullseye":{"status":"resolved","repositories":{"bullseye":"1:16.28.0~dfsg-0+deb11u4","bullseye-security":"1:16.28.0~dfsg-0+deb11u8"},"fixed_version":"1:16.2.1~dfsg-1","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"1:22.8.2+dfsg+~cs6.15.60671435-1"},"fixed_version":"1:16.2.1~dfsg-1","urgency":"not yet assigned"}}},"CVE-2020-28242":{"description":"An issue was discovered in Asterisk Open Source 13.x before 13.37.1, 16.x before 16.14.1, 17.x before 17.8.1, and 18.x before 18.0.1 and Certified Asterisk before 16.8-cert5. If Asterisk is challenged on an outbound INVITE and the nonce is changed in each response, Asterisk will continually send INVITEs in a loop. This causes Asterisk to consume more and more memory since the transaction will never terminate (even if the call is hung up), ultimately leading to a restart or shutdown of Asterisk. Outbound authentication must be configured on the endpoint for this to occur.","debianbug":974713,"scope":"local","releases":{"bullseye":{"status":"resolved","repositories":{"bullseye":"1:16.28.0~dfsg-0+deb11u4","bullseye-security":"1:16.28.0~dfsg-0+deb11u8"},"fixed_version":"1:16.15.0~dfsg-1","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"1:22.8.2+dfsg+~cs6.15.60671435-1"},"fixed_version":"1:16.15.0~dfsg-1","urgency":"not yet assigned"}}},"CVE-2020-28327":{"description":"A res_pjsip_session crash was discovered in Asterisk Open Source 13.x before 13.37.1, 16.x before 16.14.1, 17.x before 17.8.1, and 18.x before 18.0.1. and Certified Asterisk before 16.8-cert5. Upon receiving a new SIP Invite, Asterisk did not return the created dialog locked or referenced. This caused a gap between the creation of the dialog object, and its next use by the thread that created it. Depending on some off-nominal circumstances and timing, it was possible for another thread to free said dialog in this gap. Asterisk could then crash when the dialog object, or any of its dependent objects, were dereferenced or accessed next by the initial-creation thread. Note, however, that this crash can only occur when using a connection-oriented protocol (e.g., TCP or TLS, but not UDP) for SIP transport. Also, the remote client must be authenticated, or Asterisk must be configured for anonymous calling.","debianbug":974712,"scope":"local","releases":{"bullseye":{"status":"resolved","repositories":{"bullseye":"1:16.28.0~dfsg-0+deb11u4","bullseye-security":"1:16.28.0~dfsg-0+deb11u8"},"fixed_version":"1:16.15.0~dfsg-1","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"1:22.8.2+dfsg+~cs6.15.60671435-1"},"fixed_version":"1:16.15.0~dfsg-1","urgency":"not yet assigned"}}},"CVE-2020-35652":{"description":"An issue was discovered in res_pjsip_diversion.c in Sangoma Asterisk before 13.38.0, 14.x through 16.x before 16.15.0, 17.x before 17.9.0, and 18.x before 18.1.0. A crash can occur when a SIP message is received with a History-Info header that contains a tel-uri, or when a SIP 181 response is received that contains a tel-uri in the Diversion header.","debianbug":979372,"scope":"local","releases":{"bullseye":{"status":"resolved","repositories":{"bullseye":"1:16.28.0~dfsg-0+deb11u4","bullseye-security":"1:16.28.0~dfsg-0+deb11u8"},"fixed_version":"1:16.15.1~dfsg-1","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"1:22.8.2+dfsg+~cs6.15.60671435-1"},"fixed_version":"1:16.15.1~dfsg-1","urgency":"not yet assigned"}}},"CVE-2020-35776":{"description":"A buffer overflow in res_pjsip_diversion.c in Sangoma Asterisk versions 13.38.1, 16.15.1, 17.9.1, and 18.1.1 allows remote attacker to crash Asterisk by deliberately misusing SIP 181 responses.","debianbug":983158,"scope":"local","releases":{"bullseye":{"status":"resolved","repositories":{"bullseye":"1:16.28.0~dfsg-0+deb11u4","bullseye-security":"1:16.28.0~dfsg-0+deb11u8"},"fixed_version":"1:16.16.1~dfsg-1","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"1:22.8.2+dfsg+~cs6.15.60671435-1"},"fixed_version":"1:16.16.1~dfsg-1","urgency":"not yet assigned"}}},"CVE-2021-26712":{"description":"Incorrect access controls in res_srtp.c in Sangoma Asterisk 13.38.1, 16.16.0, 17.9.1, and 18.2.0 and Certified Asterisk 16.8-cert5 allow a remote unauthenticated attacker to prematurely terminate secure calls by replaying SRTP packets.","scope":"local","releases":{"bullseye":{"status":"resolved","repositories":{"bullseye":"1:16.28.0~dfsg-0+deb11u4","bullseye-security":"1:16.28.0~dfsg-0+deb11u8"},"fixed_version":"0","urgency":"unimportant"},"sid":{"status":"resolved","repositories":{"sid":"1:22.8.2+dfsg+~cs6.15.60671435-1"},"fixed_version":"0","urgency":"unimportant"}}},"CVE-2021-26713":{"description":"A stack-based buffer overflow in res_rtp_asterisk.c in Sangoma Asterisk before 16.16.1, 17.x before 17.9.2, and 18.x before 18.2.1 and Certified Asterisk before 16.8-cert6 allows an authenticated WebRTC client to cause an Asterisk crash by sending multiple hold/unhold requests in quick succession. This is caused by a signedness comparison mismatch.","scope":"local","releases":{"bullseye":{"status":"resolved","repositories":{"bullseye":"1:16.28.0~dfsg-0+deb11u4","bullseye-security":"1:16.28.0~dfsg-0+deb11u8"},"fixed_version":"0","urgency":"unimportant"},"sid":{"status":"resolved","repositories":{"sid":"1:22.8.2+dfsg+~cs6.15.60671435-1"},"fixed_version":"0","urgency":"unimportant"}}},"CVE-2021-26717":{"description":"An issue was discovered in Sangoma Asterisk 16.x before 16.16.1, 17.x before 17.9.2, and 18.x before 18.2.1 and Certified Asterisk before 16.8-cert6. When re-negotiating for T.38, if the initial remote response was delayed just enough, Asterisk would send both audio and T.38 in the SDP. If this happened, and the remote responded with a declined T.38 stream, then Asterisk would crash.","debianbug":983157,"scope":"local","releases":{"bullseye":{"status":"resolved","repositories":{"bullseye":"1:16.28.0~dfsg-0+deb11u4","bullseye-security":"1:16.28.0~dfsg-0+deb11u8"},"fixed_version":"1:16.16.1~dfsg-1","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"1:22.8.2+dfsg+~cs6.15.60671435-1"},"fixed_version":"1:16.16.1~dfsg-1","urgency":"not yet assigned"}}},"CVE-2021-26906":{"description":"An issue was discovered in res_pjsip_session.c in Digium Asterisk through 13.38.1; 14.x, 15.x, and 16.x through 16.16.0; 17.x through 17.9.1; and 18.x through 18.2.0, and Certified Asterisk through 16.8-cert5. An SDP negotiation vulnerability in PJSIP allows a remote server to potentially crash Asterisk by sending specific SIP responses that cause an SDP negotiation failure.","debianbug":983159,"scope":"local","releases":{"bullseye":{"status":"resolved","repositories":{"bullseye":"1:16.28.0~dfsg-0+deb11u4","bullseye-security":"1:16.28.0~dfsg-0+deb11u8"},"fixed_version":"1:16.16.1~dfsg-1","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"1:22.8.2+dfsg+~cs6.15.60671435-1"},"fixed_version":"1:16.16.1~dfsg-1","urgency":"not yet assigned"}}},"CVE-2021-31878":{"description":"An issue was discovered in PJSIP in Asterisk before 16.19.1 and before 18.5.1. To exploit, a re-INVITE without SDP must be received after Asterisk has sent a BYE request.","scope":"local","releases":{"bullseye":{"status":"resolved","repositories":{"bullseye":"1:16.28.0~dfsg-0+deb11u4","bullseye-security":"1:16.28.0~dfsg-0+deb11u8"},"fixed_version":"0","urgency":"unimportant"},"sid":{"status":"resolved","repositories":{"sid":"1:22.8.2+dfsg+~cs6.15.60671435-1"},"fixed_version":"0","urgency":"unimportant"}}},"CVE-2021-32558":{"description":"An issue was discovered in Sangoma Asterisk 13.x before 13.38.3, 16.x before 16.19.1, 17.x before 17.9.4, and 18.x before 18.5.1, and Certified Asterisk before 16.8-cert10. If the IAX2 channel driver receives a packet that contains an unsupported media format, a crash can occur.","debianbug":991710,"scope":"local","releases":{"bullseye":{"status":"resolved","repositories":{"bullseye":"1:16.28.0~dfsg-0+deb11u4","bullseye-security":"1:16.28.0~dfsg-0+deb11u8"},"fixed_version":"1:16.16.1~dfsg-1+deb11u1","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"1:22.8.2+dfsg+~cs6.15.60671435-1"},"fixed_version":"1:16.16.1~dfsg-2","urgency":"not yet assigned"}}},"CVE-2021-32686":{"description":"PJSIP is a free and open source multimedia communication library written in C language implementing standard based protocols such as SIP, SDP, RTP, STUN, TURN, and ICE. In PJSIP before version 2.11.1, there are a couple of issues found in the SSL socket. First, a race condition between callback and destroy, due to the accepted socket having no group lock. Second, the SSL socket parent/listener may get destroyed during handshake. Both issues were reported to happen intermittently in heavy load TLS connections. They cause a crash, resulting in a denial of service. These are fixed in version 2.11.1.","debianbug":991931,"scope":"local","releases":{"bullseye":{"status":"resolved","repositories":{"bullseye":"1:16.28.0~dfsg-0+deb11u4","bullseye-security":"1:16.28.0~dfsg-0+deb11u8"},"fixed_version":"1:16.16.1~dfsg-1+deb11u1","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"1:22.8.2+dfsg+~cs6.15.60671435-1"},"fixed_version":"1:16.16.1~dfsg-2","urgency":"not yet assigned"}}},"CVE-2021-37706":{"description":"PJSIP is a free and open source multimedia communication library written in C language implementing standard based protocols such as SIP, SDP, RTP, STUN, TURN, and ICE. In affected versions if the incoming STUN message contains an ERROR-CODE attribute, the header length is not checked before performing a subtraction operation, potentially resulting in an integer underflow scenario. This issue affects all users that use STUN. A malicious actor located within the victim\u2019s network may forge and send a specially crafted UDP (STUN) message that could remotely execute arbitrary code on the victim\u2019s machine. Users are advised to upgrade as soon as possible. There are no known workarounds.","scope":"local","releases":{"bullseye":{"status":"resolved","repositories":{"bullseye":"1:16.28.0~dfsg-0+deb11u4","bullseye-security":"1:16.28.0~dfsg-0+deb11u8"},"fixed_version":"1:16.28.0~dfsg-0+deb11u1","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"1:22.8.2+dfsg+~cs6.15.60671435-1"},"fixed_version":"1:18.10.1~dfsg+~cs6.10.40431411-1","urgency":"not yet assigned"}}},"CVE-2021-43299":{"description":"Stack overflow in PJSUA API when calling pjsua_player_create. An attacker-controlled 'filename' argument may cause a buffer overflow since it is copied to a fixed-size stack buffer without any size validation.","scope":"local","releases":{"bullseye":{"status":"resolved","repositories":{"bullseye":"1:16.28.0~dfsg-0+deb11u4","bullseye-security":"1:16.28.0~dfsg-0+deb11u8"},"fixed_version":"1:16.28.0~dfsg-0+deb11u1","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"1:22.8.2+dfsg+~cs6.15.60671435-1"},"fixed_version":"1:18.11.1~dfsg+~cs6.10.40431413-1","urgency":"not yet assigned"}}},"CVE-2021-43300":{"description":"Stack overflow in PJSUA API when calling pjsua_recorder_create. An attacker-controlled 'filename' argument may cause a buffer overflow since it is copied to a fixed-size stack buffer without any size validation.","scope":"local","releases":{"bullseye":{"status":"resolved","repositories":{"bullseye":"1:16.28.0~dfsg-0+deb11u4","bullseye-security":"1:16.28.0~dfsg-0+deb11u8"},"fixed_version":"1:16.28.0~dfsg-0+deb11u1","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"1:22.8.2+dfsg+~cs6.15.60671435-1"},"fixed_version":"1:18.11.1~dfsg+~cs6.10.40431413-1","urgency":"not yet assigned"}}},"CVE-2021-43301":{"description":"Stack overflow in PJSUA API when calling pjsua_playlist_create. An attacker-controlled 'file_names' argument may cause a buffer overflow since it is copied to a fixed-size stack buffer without any size validation.","scope":"local","releases":{"bullseye":{"status":"resolved","repositories":{"bullseye":"1:16.28.0~dfsg-0+deb11u4","bullseye-security":"1:16.28.0~dfsg-0+deb11u8"},"fixed_version":"1:16.28.0~dfsg-0+deb11u1","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"1:22.8.2+dfsg+~cs6.15.60671435-1"},"fixed_version":"1:18.11.1~dfsg+~cs6.10.40431413-1","urgency":"not yet assigned"}}},"CVE-2021-43302":{"description":"Read out-of-bounds in PJSUA API when calling pjsua_recorder_create. An attacker-controlled 'filename' argument may cause an out-of-bounds read when the filename is shorter than 4 characters.","scope":"local","releases":{"bullseye":{"status":"resolved","repositories":{"bullseye":"1:16.28.0~dfsg-0+deb11u4","bullseye-security":"1:16.28.0~dfsg-0+deb11u8"},"fixed_version":"1:16.28.0~dfsg-0+deb11u1","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"1:22.8.2+dfsg+~cs6.15.60671435-1"},"fixed_version":"1:18.11.1~dfsg+~cs6.10.40431413-1","urgency":"not yet assigned"}}},"CVE-2021-43303":{"description":"Buffer overflow in PJSUA API when calling pjsua_call_dump. An attacker-controlled 'buffer' argument may cause a buffer overflow, since supplying an output buffer smaller than 128 characters may overflow the output buffer, regardless of the 'maxlen' argument supplied","scope":"local","releases":{"bullseye":{"status":"resolved","repositories":{"bullseye":"1:16.28.0~dfsg-0+deb11u4","bullseye-security":"1:16.28.0~dfsg-0+deb11u8"},"fixed_version":"1:16.28.0~dfsg-0+deb11u1","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"1:22.8.2+dfsg+~cs6.15.60671435-1"},"fixed_version":"1:18.11.1~dfsg+~cs6.10.40431413-1","urgency":"not yet assigned"}}},"CVE-2021-43804":{"description":"PJSIP is a free and open source multimedia communication library written in C language implementing standard based protocols such as SIP, SDP, RTP, STUN, TURN, and ICE. In affected versions if the incoming RTCP BYE message contains a reason's length, this declared length is not checked against the actual received packet size, potentially resulting in an out-of-bound read access. This issue affects all users that use PJMEDIA and RTCP. A malicious actor can send a RTCP BYE message with an invalid reason length. Users are advised to upgrade as soon as possible. There are no known workarounds.","scope":"local","releases":{"bullseye":{"status":"resolved","repositories":{"bullseye":"1:16.28.0~dfsg-0+deb11u4","bullseye-security":"1:16.28.0~dfsg-0+deb11u8"},"fixed_version":"1:16.28.0~dfsg-0+deb11u1","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"1:22.8.2+dfsg+~cs6.15.60671435-1"},"fixed_version":"1:18.12.0~dfsg+~cs6.12.40431413-1","urgency":"not yet assigned"}}},"CVE-2021-43845":{"description":"PJSIP is a free and open source multimedia communication library. In version 2.11.1 and prior, if incoming RTCP XR message contain block, the data field is not checked against the received packet size, potentially resulting in an out-of-bound read access. This affects all users that use PJMEDIA and RTCP XR. A malicious actor can send a RTCP XR message with an invalid packet size.","scope":"local","releases":{"bullseye":{"status":"resolved","repositories":{"bullseye":"1:16.28.0~dfsg-0+deb11u4","bullseye-security":"1:16.28.0~dfsg-0+deb11u8"},"fixed_version":"1:16.28.0~dfsg-0+deb11u1","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"1:22.8.2+dfsg+~cs6.15.60671435-1"},"fixed_version":"1:18.12.0~dfsg+~cs6.12.40431413-1","urgency":"not yet assigned"}}},"CVE-2021-46837":{"description":"res_pjsip_t38 in Sangoma Asterisk 16.x before 16.16.2, 17.x before 17.9.3, and 18.x before 18.2.2, and Certified Asterisk before 16.8-cert7, allows an attacker to trigger a crash by sending an m=image line and zero port in a response to a T.38 re-invite initiated by Asterisk. This is a re-occurrence of the CVE-2019-15297 symptoms but not for exactly the same reason. The crash occurs because there is an append operation relative to the active topology, but this should instead be a replace operation.","debianbug":1018073,"scope":"local","releases":{"bullseye":{"status":"resolved","repositories":{"bullseye":"1:16.28.0~dfsg-0+deb11u4","bullseye-security":"1:16.28.0~dfsg-0+deb11u8"},"fixed_version":"1:16.28.0~dfsg-0+deb11u1","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"1:22.8.2+dfsg+~cs6.15.60671435-1"},"fixed_version":"1:18.9.0~dfsg+~cs6.10.40431411-1","urgency":"not yet assigned"}}},"CVE-2022-21722":{"description":"PJSIP is a free and open source multimedia communication library written in C language implementing standard based protocols such as SIP, SDP, RTP, STUN, TURN, and ICE. In version 2.11.1 and prior, there are various cases where it is possible that certain incoming RTP/RTCP packets can potentially cause out-of-bound read access. This issue affects all users that use PJMEDIA and accept incoming RTP/RTCP. A patch is available as a commit in the `master` branch. There are no known workarounds.","scope":"local","releases":{"bullseye":{"status":"resolved","repositories":{"bullseye":"1:16.28.0~dfsg-0+deb11u4","bullseye-security":"1:16.28.0~dfsg-0+deb11u8"},"fixed_version":"1:16.28.0~dfsg-0+deb11u1","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"1:22.8.2+dfsg+~cs6.15.60671435-1"},"fixed_version":"1:18.12.0~dfsg+~cs6.12.40431413-1","urgency":"not yet assigned"}}},"CVE-2022-21723":{"description":"PJSIP is a free and open source multimedia communication library written in C language implementing standard based protocols such as SIP, SDP, RTP, STUN, TURN, and ICE. In versions 2.11.1 and prior, parsing an incoming SIP message that contains a malformed multipart can potentially cause out-of-bound read access. This issue affects all PJSIP users that accept SIP multipart. The patch is available as commit in the `master` branch. There are no known workarounds.","scope":"local","releases":{"bullseye":{"status":"resolved","repositories":{"bullseye":"1:16.28.0~dfsg-0+deb11u4","bullseye-security":"1:16.28.0~dfsg-0+deb11u8"},"fixed_version":"1:16.28.0~dfsg-0+deb11u1","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"1:22.8.2+dfsg+~cs6.15.60671435-1"},"fixed_version":"1:18.10.1~dfsg+~cs6.10.40431411-1","urgency":"not yet assigned"}}},"CVE-2022-23537":{"description":"PJSIP is a free and open source multimedia communication library written in C language implementing standard based protocols such as SIP, SDP, RTP, STUN, TURN, and ICE. Buffer overread is possible when parsing a specially crafted STUN message with unknown attribute. The vulnerability affects applications that uses STUN including PJNATH and PJSUA-LIB. The patch is available as a commit in the master branch (2.13.1).","debianbug":1032092,"scope":"local","releases":{"bullseye":{"status":"resolved","repositories":{"bullseye":"1:16.28.0~dfsg-0+deb11u4","bullseye-security":"1:16.28.0~dfsg-0+deb11u8"},"fixed_version":"1:16.28.0~dfsg-0+deb11u2","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"1:22.8.2+dfsg+~cs6.15.60671435-1"},"fixed_version":"1:20.4.0~dfsg+~cs6.13.40431414-1","urgency":"not yet assigned"}}},"CVE-2022-23547":{"description":"PJSIP is a free and open source multimedia communication library written in C language implementing standard based protocols such as SIP, SDP, RTP, STUN, TURN, and ICE. This issue is similar to GHSA-9pfh-r8x4-w26w. Possible buffer overread when parsing a certain STUN message. The vulnerability affects applications that uses STUN including PJNATH and PJSUA-LIB. The patch is available as commit in the master branch.","debianbug":1032092,"scope":"local","releases":{"bullseye":{"status":"resolved","repositories":{"bullseye":"1:16.28.0~dfsg-0+deb11u4","bullseye-security":"1:16.28.0~dfsg-0+deb11u8"},"fixed_version":"1:16.28.0~dfsg-0+deb11u2","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"1:22.8.2+dfsg+~cs6.15.60671435-1"},"fixed_version":"1:20.4.0~dfsg+~cs6.13.40431414-1","urgency":"not yet assigned"}}},"CVE-2022-23608":{"description":"PJSIP is a free and open source multimedia communication library written in C language implementing standard based protocols such as SIP, SDP, RTP, STUN, TURN, and ICE. In versions up to and including 2.11.1 when in a dialog set (or forking) scenario, a hash key shared by multiple UAC dialogs can potentially be prematurely freed when one of the dialogs is destroyed . The issue may cause a dialog set to be registered in the hash table multiple times (with different hash keys) leading to undefined behavior such as dialog list collision which eventually leading to endless loop. A patch is available in commit db3235953baa56d2fb0e276ca510fefca751643f which will be included in the next release. There are no known workarounds for this issue.","scope":"local","releases":{"bullseye":{"status":"resolved","repositories":{"bullseye":"1:16.28.0~dfsg-0+deb11u4","bullseye-security":"1:16.28.0~dfsg-0+deb11u8"},"fixed_version":"1:16.28.0~dfsg-0+deb11u1","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"1:22.8.2+dfsg+~cs6.15.60671435-1"},"fixed_version":"1:18.10.1~dfsg+~cs6.10.40431411-1","urgency":"not yet assigned"}}},"CVE-2022-24754":{"description":"PJSIP is a free and open source multimedia communication library written in C language. In versions prior to and including 2.12 PJSIP there is a stack-buffer overflow vulnerability which only impacts PJSIP users who accept hashed digest credentials (credentials with data_type `PJSIP_CRED_DATA_DIGEST`). This issue has been patched in the master branch of the PJSIP repository and will be included with the next release. Users unable to upgrade need to check that the hashed digest data length must be equal to `PJSIP_MD5STRLEN` before passing to PJSIP.","scope":"local","releases":{"bullseye":{"status":"resolved","repositories":{"bullseye":"1:16.28.0~dfsg-0+deb11u4","bullseye-security":"1:16.28.0~dfsg-0+deb11u8"},"fixed_version":"0","urgency":"unimportant"},"sid":{"status":"resolved","repositories":{"sid":"1:22.8.2+dfsg+~cs6.15.60671435-1"},"fixed_version":"0","urgency":"unimportant"}}},"CVE-2022-24763":{"description":"PJSIP is a free and open source multimedia communication library written in the C language. Versions 2.12 and prior contain a denial-of-service vulnerability that affects PJSIP users that consume PJSIP's XML parsing in their apps. Users are advised to update. There are no known workarounds.","debianbug":1014976,"scope":"local","releases":{"bullseye":{"status":"resolved","repositories":{"bullseye":"1:16.28.0~dfsg-0+deb11u4","bullseye-security":"1:16.28.0~dfsg-0+deb11u8"},"fixed_version":"1:16.28.0~dfsg-0+deb11u1","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"1:22.8.2+dfsg+~cs6.15.60671435-1"},"fixed_version":"1:18.14.0~~rc1~dfsg+~cs6.12.40431414-1","urgency":"not yet assigned"}}},"CVE-2022-24764":{"description":"PJSIP is a free and open source multimedia communication library written in C. Versions 2.12 and prior contain a stack buffer overflow vulnerability that affects PJSUA2 users or users that call the API `pjmedia_sdp_print(), pjmedia_sdp_media_print()`. Applications that do not use PJSUA2 and do not directly call `pjmedia_sdp_print()` or `pjmedia_sdp_media_print()` should not be affected. A patch is available on the `master` branch of the `pjsip/pjproject` GitHub repository. There are currently no known workarounds.","debianbug":1014976,"scope":"local","releases":{"bullseye":{"status":"resolved","repositories":{"bullseye":"1:16.28.0~dfsg-0+deb11u4","bullseye-security":"1:16.28.0~dfsg-0+deb11u8"},"fixed_version":"1:16.28.0~dfsg-0+deb11u1","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"1:22.8.2+dfsg+~cs6.15.60671435-1"},"fixed_version":"1:18.14.0~~rc1~dfsg+~cs6.12.40431414-1","urgency":"not yet assigned"}}},"CVE-2022-24786":{"description":"PJSIP is a free and open source multimedia communication library written in C. PJSIP versions 2.12 and prior do not parse incoming RTCP feedback RPSI (Reference Picture Selection Indication) packet, but any app that directly uses pjmedia_rtcp_fb_parse_rpsi() will be affected. A patch is available in the `master` branch of the `pjsip/pjproject` GitHub repository. There are currently no known workarounds.","debianbug":1014976,"scope":"local","releases":{"bullseye":{"status":"resolved","repositories":{"bullseye":"1:16.28.0~dfsg-0+deb11u4","bullseye-security":"1:16.28.0~dfsg-0+deb11u8"},"fixed_version":"1:16.28.0~dfsg-0+deb11u1","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"1:22.8.2+dfsg+~cs6.15.60671435-1"},"fixed_version":"1:18.14.0~~rc1~dfsg+~cs6.12.40431414-1","urgency":"not yet assigned"}}},"CVE-2022-24792":{"description":"PJSIP is a free and open source multimedia communication library written in C. A denial-of-service vulnerability affects applications on a 32-bit systems that use PJSIP versions 2.12 and prior to play/read invalid WAV files. The vulnerability occurs when reading WAV file data chunks with length greater than 31-bit integers. The vulnerability does not affect 64-bit apps and should not affect apps that only plays trusted WAV files. A patch is available on the `master` branch of the `pjsip/project` GitHub repository. As a workaround, apps can reject a WAV file received from an unknown source or validate the file first.","debianbug":1014976,"scope":"local","releases":{"bullseye":{"status":"resolved","repositories":{"bullseye":"1:16.28.0~dfsg-0+deb11u4","bullseye-security":"1:16.28.0~dfsg-0+deb11u8"},"fixed_version":"1:16.28.0~dfsg-0+deb11u1","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"1:22.8.2+dfsg+~cs6.15.60671435-1"},"fixed_version":"1:18.14.0~~rc1~dfsg+~cs6.12.40431414-1","urgency":"not yet assigned"}}},"CVE-2022-24793":{"description":"PJSIP is a free and open source multimedia communication library written in C. A buffer overflow vulnerability in versions 2.12 and prior affects applications that use PJSIP DNS resolution. It doesn't affect PJSIP users who utilize an external resolver. This vulnerability is related to CVE-2023-27585. The difference is that this issue is in parsing the query record `parse_rr()`, while the issue in CVE-2023-27585 is in `parse_query()`. A patch is available in the `master` branch of the `pjsip/pjproject` GitHub repository. A workaround is to disable DNS resolution in PJSIP config (by setting `nameserver_count` to zero) or use an external resolver instead.","debianbug":1014976,"scope":"local","releases":{"bullseye":{"status":"resolved","repositories":{"bullseye":"1:16.28.0~dfsg-0+deb11u4","bullseye-security":"1:16.28.0~dfsg-0+deb11u8"},"fixed_version":"1:16.28.0~dfsg-0+deb11u1","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"1:22.8.2+dfsg+~cs6.15.60671435-1"},"fixed_version":"1:18.14.0~~rc1~dfsg+~cs6.12.40431414-1","urgency":"not yet assigned"}}},"CVE-2022-26498":{"description":"An issue was discovered in Asterisk through 19.x. When using STIR/SHAKEN, it is possible to download files that are not certificates. These files could be much larger than what one would expect to download, leading to Resource Exhaustion. This is fixed in 16.25.2, 18.11.2, and 19.3.2.","scope":"local","releases":{"bullseye":{"status":"resolved","repositories":{"bullseye":"1:16.28.0~dfsg-0+deb11u4","bullseye-security":"1:16.28.0~dfsg-0+deb11u8"},"fixed_version":"1:16.28.0~dfsg-0+deb11u1","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"1:22.8.2+dfsg+~cs6.15.60671435-1"},"fixed_version":"1:18.11.2~dfsg+~cs6.10.40431413-1","urgency":"not yet assigned"}}},"CVE-2022-26499":{"description":"An SSRF issue was discovered in Asterisk through 19.x. When using STIR/SHAKEN, it's possible to send arbitrary requests (such as GET) to interfaces such as localhost by using the Identity header. This is fixed in 16.25.2, 18.11.2, and 19.3.2.","scope":"local","releases":{"bullseye":{"status":"resolved","repositories":{"bullseye":"1:16.28.0~dfsg-0+deb11u4","bullseye-security":"1:16.28.0~dfsg-0+deb11u8"},"fixed_version":"1:16.28.0~dfsg-0+deb11u1","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"1:22.8.2+dfsg+~cs6.15.60671435-1"},"fixed_version":"1:18.11.2~dfsg+~cs6.10.40431413-1","urgency":"not yet assigned"}}},"CVE-2022-26651":{"description":"An issue was discovered in Asterisk through 19.x and Certified Asterisk through 16.8-cert13. The func_odbc module provides possibly inadequate escaping functionality for backslash characters in SQL queries, resulting in user-provided data creating a broken SQL query or possibly a SQL injection. This is fixed in 16.25.2, 18.11.2, and 19.3.2, and 16.8-cert14.","scope":"local","releases":{"bullseye":{"status":"resolved","repositories":{"bullseye":"1:16.28.0~dfsg-0+deb11u4","bullseye-security":"1:16.28.0~dfsg-0+deb11u8"},"fixed_version":"1:16.28.0~dfsg-0+deb11u1","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"1:22.8.2+dfsg+~cs6.15.60671435-1"},"fixed_version":"1:18.11.2~dfsg+~cs6.10.40431413-1","urgency":"not yet assigned"}}},"CVE-2022-31031":{"description":"PJSIP is a free and open source multimedia communication library written in C language implementing standard based protocols such as SIP, SDP, RTP, STUN, TURN, and ICE. In versions prior to and including 2.12.1 a stack buffer overflow vulnerability affects PJSIP users that use STUN in their applications, either by: setting a STUN server in their account/media config in PJSUA/PJSUA2 level, or directly using `pjlib-util/stun_simple` API. A patch is available in commit 450baca which should be included in the next release. There are no known workarounds for this issue.","debianbug":1017004,"scope":"local","releases":{"bullseye":{"status":"resolved","repositories":{"bullseye":"1:16.28.0~dfsg-0+deb11u4","bullseye-security":"1:16.28.0~dfsg-0+deb11u8"},"fixed_version":"1:16.28.0~dfsg-0+deb11u2","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"1:22.8.2+dfsg+~cs6.15.60671435-1"},"fixed_version":"1:20.0.1~dfsg+~cs6.12.40431414-1","urgency":"not yet assigned"}}},"CVE-2022-37325":{"description":"In Sangoma Asterisk through 16.28.0, 17.x and 18.x through 18.14.0, and 19.x through 19.6.0, an incoming Setup message to addons/ooh323c/src/ooq931.c with a malformed Calling or Called Party IE can cause a crash.","scope":"local","releases":{"bullseye":{"status":"resolved","repositories":{"bullseye":"1:16.28.0~dfsg-0+deb11u4","bullseye-security":"1:16.28.0~dfsg-0+deb11u8"},"fixed_version":"1:16.28.0~dfsg-0+deb11u2","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"1:22.8.2+dfsg+~cs6.15.60671435-1"},"fixed_version":"1:20.0.1~dfsg+~cs6.12.40431414-1","urgency":"not yet assigned"}}},"CVE-2022-39244":{"description":"PJSIP is a free and open source multimedia communication library written in C. In versions of PJSIP prior to 2.13 the PJSIP parser, PJMEDIA RTP decoder, and PJMEDIA SDP parser are affeced by a buffer overflow vulnerability. Users connecting to untrusted clients are at risk. This issue has been patched and is available as commit c4d3498 in the master branch and will be included in releases 2.13 and later. Users are advised to upgrade. There are no known workarounds for this issue.","scope":"local","releases":{"bullseye":{"status":"resolved","repositories":{"bullseye":"1:16.28.0~dfsg-0+deb11u4","bullseye-security":"1:16.28.0~dfsg-0+deb11u8"},"fixed_version":"1:16.28.0~dfsg-0+deb11u2","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"1:22.8.2+dfsg+~cs6.15.60671435-1"},"fixed_version":"1:20.0.1~dfsg+~cs6.12.40431414-1","urgency":"not yet assigned"}}},"CVE-2022-39269":{"description":"PJSIP is a free and open source multimedia communication library written in C. When processing certain packets, PJSIP may incorrectly switch from using SRTP media transport to using basic RTP upon SRTP restart, causing the media to be sent insecurely. The vulnerability impacts all PJSIP users that use SRTP. The patch is available as commit d2acb9a in the master branch of the project and will be included in version 2.13. Users are advised to manually patch or to upgrade. There are no known workarounds for this vulnerability.","debianbug":1032092,"scope":"local","releases":{"bullseye":{"status":"resolved","repositories":{"bullseye":"1:16.28.0~dfsg-0+deb11u4","bullseye-security":"1:16.28.0~dfsg-0+deb11u8"},"fixed_version":"1:16.28.0~dfsg-0+deb11u2","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"1:22.8.2+dfsg+~cs6.15.60671435-1"},"fixed_version":"1:20.3.0~dfsg+~cs6.13.40431413-1","urgency":"not yet assigned"}}},"CVE-2022-42705":{"description":"A use-after-free in res_pjsip_pubsub.c in Sangoma Asterisk 16.28, 18.14, 19.6, and certified/18.9-cert2 may allow a remote authenticated attacker to crash Asterisk (denial of service) by performing activity on a subscription via a reliable transport at the same time that Asterisk is also performing activity on that subscription.","scope":"local","releases":{"bullseye":{"status":"resolved","repositories":{"bullseye":"1:16.28.0~dfsg-0+deb11u4","bullseye-security":"1:16.28.0~dfsg-0+deb11u8"},"fixed_version":"1:16.28.0~dfsg-0+deb11u2","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"1:22.8.2+dfsg+~cs6.15.60671435-1"},"fixed_version":"1:20.0.1~dfsg+~cs6.12.40431414-1","urgency":"not yet assigned"}}},"CVE-2022-42706":{"description":"An issue was discovered in Sangoma Asterisk through 16.28, 17 and 18 through 18.14, 19 through 19.6, and certified through 18.9-cert1. GetConfig, via Asterisk Manager Interface, allows a connected application to access files outside of the asterisk configuration directory, aka Directory Traversal.","scope":"local","releases":{"bullseye":{"status":"resolved","repositories":{"bullseye":"1:16.28.0~dfsg-0+deb11u4","bullseye-security":"1:16.28.0~dfsg-0+deb11u8"},"fixed_version":"1:16.28.0~dfsg-0+deb11u2","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"1:22.8.2+dfsg+~cs6.15.60671435-1"},"fixed_version":"1:20.0.1~dfsg+~cs6.12.40431414-1","urgency":"not yet assigned"}}},"CVE-2023-27585":{"description":"PJSIP is a free and open source multimedia communication library written in C. A buffer overflow vulnerability in versions 2.13 and prior affects applications that use PJSIP DNS resolver. It doesn't affect PJSIP users who do not utilise PJSIP DNS resolver. This vulnerability is related to CVE-2022-24793. The difference is that this issue is in parsing the query record `parse_query()`, while the issue in CVE-2022-24793 is in `parse_rr()`. A patch is available as commit `d1c5e4d` in the `master` branch. A workaround is to disable DNS resolution in PJSIP config (by setting `nameserver_count` to zero) or use an external resolver implementation instead.","debianbug":1036697,"scope":"local","releases":{"bullseye":{"status":"resolved","repositories":{"bullseye":"1:16.28.0~dfsg-0+deb11u4","bullseye-security":"1:16.28.0~dfsg-0+deb11u8"},"fixed_version":"1:16.28.0~dfsg-0+deb11u3","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"1:22.8.2+dfsg+~cs6.15.60671435-1"},"fixed_version":"1:20.4.0~dfsg+~cs6.13.40431414-1","urgency":"not yet assigned"}}},"CVE-2023-37457":{"description":"Asterisk is an open source private branch exchange and telephony toolkit. In Asterisk versions 18.20.0 and prior, 20.5.0 and prior, and 21.0.0; as well as ceritifed-asterisk 18.9-cert5 and prior, the 'update' functionality of the PJSIP_HEADER dialplan function can exceed the available buffer space for storing the new value of a header. By doing so this can overwrite memory or cause a crash. This is not externally exploitable, unless dialplan is explicitly written to update a header based on data from an outside source. If the 'update' functionality is not used the vulnerability does not occur. A patch is available at commit a1ca0268254374b515fa5992f01340f7717113fa.","debianbug":1059303,"scope":"local","releases":{"bullseye":{"status":"resolved","repositories":{"bullseye":"1:16.28.0~dfsg-0+deb11u4","bullseye-security":"1:16.28.0~dfsg-0+deb11u8"},"fixed_version":"1:16.28.0~dfsg-0+deb11u4","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"1:22.8.2+dfsg+~cs6.15.60671435-1"},"fixed_version":"1:20.8.1~dfsg+~cs6.14.40431414-1","urgency":"not yet assigned"}}},"CVE-2023-38703":{"description":"PJSIP is a free and open source multimedia communication library written in C with high level API in C, C++, Java, C#, and Python languages. SRTP is a higher level media transport which is stacked upon a lower level media transport such as UDP and ICE. Currently a higher level transport is not synchronized with its lower level transport that may introduce use-after-free issue. This vulnerability affects applications that have SRTP capability (`PJMEDIA_HAS_SRTP` is set) and use underlying media transport other than UDP. This vulnerability\u2019s impact may range from unexpected application termination to control flow hijack/memory corruption. The patch is available as a commit in the master branch.","debianbug":1059303,"scope":"local","releases":{"bullseye":{"status":"resolved","repositories":{"bullseye":"1:16.28.0~dfsg-0+deb11u4","bullseye-security":"1:16.28.0~dfsg-0+deb11u8"},"fixed_version":"1:16.28.0~dfsg-0+deb11u4","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"1:22.8.2+dfsg+~cs6.15.60671435-1"},"fixed_version":"1:20.8.1~dfsg+~cs6.14.40431414-1","urgency":"not yet assigned"}}},"CVE-2023-49294":{"description":"Asterisk is an open source private branch exchange and telephony toolkit. In Asterisk prior to versions 18.20.1, 20.5.1, and 21.0.1, as well as certified-asterisk prior to 18.9-cert6, it is possible to read any arbitrary file even when the `live_dangerously` is not enabled. This allows arbitrary files to be read. Asterisk versions 18.20.1, 20.5.1, and 21.0.1, as well as certified-asterisk prior to 18.9-cert6, contain a fix for this issue.","debianbug":1059032,"scope":"local","releases":{"bullseye":{"status":"resolved","repositories":{"bullseye":"1:16.28.0~dfsg-0+deb11u4","bullseye-security":"1:16.28.0~dfsg-0+deb11u8"},"fixed_version":"1:16.28.0~dfsg-0+deb11u4","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"1:22.8.2+dfsg+~cs6.15.60671435-1"},"fixed_version":"1:20.5.1~dfsg+~cs6.13.40431414-1","urgency":"not yet assigned"}}},"CVE-2023-49786":{"description":"Asterisk is an open source private branch exchange and telephony toolkit. In Asterisk prior to versions 18.20.1, 20.5.1, and 21.0.1; as well as certified-asterisk prior to 18.9-cert6; Asterisk is susceptible to a DoS due to a race condition in the hello handshake phase of the DTLS protocol when handling DTLS-SRTP for media setup. This attack can be done continuously, thus denying new DTLS-SRTP encrypted calls during the attack. Abuse of this vulnerability may lead to a massive Denial of Service on vulnerable Asterisk servers for calls that rely on DTLS-SRTP. Commit d7d7764cb07c8a1872804321302ef93bf62cba05 contains a fix, which is part of versions 18.20.1, 20.5.1, 21.0.1, amd 18.9-cert6.","debianbug":1059033,"scope":"local","releases":{"bullseye":{"status":"resolved","repositories":{"bullseye":"1:16.28.0~dfsg-0+deb11u4","bullseye-security":"1:16.28.0~dfsg-0+deb11u8"},"fixed_version":"1:16.28.0~dfsg-0+deb11u4","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"1:22.8.2+dfsg+~cs6.15.60671435-1"},"fixed_version":"1:20.5.1~dfsg+~cs6.13.40431414-1","urgency":"not yet assigned"}}},"CVE-2024-35190":{"description":"Asterisk is an open source private branch exchange and telephony toolkit. After upgrade to 18.23.0, ALL unauthorized SIP requests are identified as PJSIP Endpoint of local asterisk server. This vulnerability is fixed in 18.23.1, 20.8.1, and 21.3.1.","scope":"local","releases":{"bullseye":{"status":"resolved","repositories":{"bullseye":"1:16.28.0~dfsg-0+deb11u4","bullseye-security":"1:16.28.0~dfsg-0+deb11u8"},"fixed_version":"0","urgency":"unimportant"},"sid":{"status":"resolved","repositories":{"sid":"1:22.8.2+dfsg+~cs6.15.60671435-1"},"fixed_version":"0","urgency":"unimportant"}}},"CVE-2024-42365":{"description":"Asterisk is an open source private branch exchange (PBX) and telephony toolkit. Prior to asterisk versions 18.24.2, 20.9.2, and 21.4.2 and certified-asterisk versions 18.9-cert11 and 20.7-cert2, an AMI user with `write=originate` may change all configuration files in the `/etc/asterisk/` directory. This occurs because they are able to curl remote files and write them to disk, but are also able to append to existing files using the `FILE` function inside the `SET` application. This issue may result in privilege escalation, remote code execution and/or blind server-side request forgery with arbitrary protocol. Asterisk versions 18.24.2, 20.9.2, and 21.4.2 and certified-asterisk versions 18.9-cert11 and 20.7-cert2 contain a fix for this issue.","debianbug":1078574,"scope":"local","releases":{"bullseye":{"status":"resolved","repositories":{"bullseye":"1:16.28.0~dfsg-0+deb11u4","bullseye-security":"1:16.28.0~dfsg-0+deb11u8"},"fixed_version":"1:16.28.0~dfsg-0+deb11u5","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"1:22.8.2+dfsg+~cs6.15.60671435-1"},"fixed_version":"1:20.9.3~dfsg+~cs6.14.60671435-1","urgency":"not yet assigned"}}},"CVE-2024-42491":{"description":"Asterisk is an open-source private branch exchange (PBX). Prior to versions 18.24.3, 20.9.3, and 21.4.3 of Asterisk and versions 18.9-cert12 and 20.7-cert2 of certified-asterisk, if Asterisk attempts to send a SIP request to a URI whose host portion starts with `.1` or `[.1]`, and res_resolver_unbound is loaded, Asterisk will crash with a SEGV. To receive a patch, users should upgrade to one of the following versions: 18.24.3, 20.9.3, 21.4.3, certified-18.9-cert12, certified-20.7-cert2. Two workarounds are available. Disable res_resolver_unbound by setting `noload = res_resolver_unbound.so` in modules.conf, or set `rewrite_contact = yes` on all PJSIP endpoints. NOTE: This may not be appropriate for all Asterisk configurations.","scope":"local","releases":{"bullseye":{"status":"resolved","repositories":{"bullseye":"1:16.28.0~dfsg-0+deb11u4","bullseye-security":"1:16.28.0~dfsg-0+deb11u8"},"fixed_version":"1:16.28.0~dfsg-0+deb11u5","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"1:22.8.2+dfsg+~cs6.15.60671435-1"},"fixed_version":"1:20.9.3~dfsg+~cs6.14.60671435-1","urgency":"not yet assigned"}}},"CVE-2024-53566":{"description":"An issue in the action_listcategories() function of Sangoma Asterisk v22/22.0.0/22.0.0-rc1/22.0.0-rc2/22.0.0-pre1 allows attackers to execute a path traversal.","scope":"local","releases":{"bullseye":{"status":"resolved","repositories":{"bullseye":"1:16.28.0~dfsg-0+deb11u4","bullseye-security":"1:16.28.0~dfsg-0+deb11u8"},"fixed_version":"1:16.28.0~dfsg-0+deb11u6","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"1:22.8.2+dfsg+~cs6.15.60671435-1"},"fixed_version":"1:22.1.1~dfsg+~cs6.14.60671435-1","urgency":"not yet assigned"}}},"CVE-2024-57520":{"description":"Insecure Permissions vulnerability in asterisk v22 allows a remote attacker to execute arbitrary code via the action_createconfig function. NOTE: this is disputed by the Supplier because the impact is limited to creating empty files outside of the Asterisk product directory (aka directory traversal) and the attack can only be performed by a privileged user who has the ability to manage the configuration.","scope":"local","releases":{"bullseye":{"status":"open","repositories":{"bullseye":"1:16.28.0~dfsg-0+deb11u4","bullseye-security":"1:16.28.0~dfsg-0+deb11u8"},"urgency":"unimportant"},"sid":{"status":"resolved","repositories":{"sid":"1:22.8.2+dfsg+~cs6.15.60671435-1"},"fixed_version":"1:22.3.0~dfsg+~cs6.15.60671435-1","urgency":"unimportant"}}},"CVE-2025-1131":{"description":"A local privilege escalation vulnerability exists in the safe_asterisk script included with the Asterisk toolkit package. When Asterisk is started via this script (common in SysV init or FreePBX environments), it sources all .sh files located in /etc/asterisk/startup.d/ as root, without validating ownership or permissions.   Non-root users with legitimate write access to /etc/asterisk can exploit this behaviour by placing malicious scripts in the startup.d directory, which will then execute with root privileges upon service restart.","scope":"local","releases":{"bullseye":{"status":"resolved","repositories":{"bullseye":"1:16.28.0~dfsg-0+deb11u4","bullseye-security":"1:16.28.0~dfsg-0+deb11u8"},"fixed_version":"1:16.28.0~dfsg-0+deb11u8","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"1:22.8.2+dfsg+~cs6.15.60671435-1"},"fixed_version":"1:22.5.1~dfsg+~cs6.15.60671435-1","urgency":"not yet assigned"}}},"CVE-2025-47779":{"description":"Asterisk is an open-source private branch exchange (PBX). Prior to versions 18.26.2, 20.14.1, 21.9.1, and 22.4.1 of Asterisk and versions 18.9-cert14 and 20.7-cert5 of certified-asterisk, SIP requests of the type MESSAGE (RFC 3428) authentication do not get proper alignment. An authenticated attacker can spoof any user identity to send spam messages to the user with their authorization token. Abuse of this security issue allows authenticated attackers to send fake chat messages can be spoofed to appear to come from trusted entities. Even administrators who follow Security best practices and Security Considerations can be impacted. Therefore, abuse can lead to spam and enable social engineering, phishing and similar attacks. Versions 18.26.2, 20.14.1, 21.9.1, and 22.4.1 of Asterisk and versions 18.9-cert14 and 20.7-cert5 of certified-asterisk fix the issue.","debianbug":1106528,"scope":"local","releases":{"bullseye":{"status":"resolved","repositories":{"bullseye":"1:16.28.0~dfsg-0+deb11u4","bullseye-security":"1:16.28.0~dfsg-0+deb11u8"},"fixed_version":"1:16.28.0~dfsg-0+deb11u7","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"1:22.8.2+dfsg+~cs6.15.60671435-1"},"fixed_version":"1:22.4.1~dfsg+~cs6.15.60671435-1","urgency":"not yet assigned"}}},"CVE-2025-47780":{"description":"Asterisk is an open-source private branch exchange (PBX). Prior to versions 18.26.2, 20.14.1, 21.9.1, and 22.4.1 of Asterisk and versions 18.9-cert14 and 20.7-cert5 of certified-asterisk, trying to disallow shell commands to be run via the Asterisk command line interface (CLI) by configuring `cli_permissions.conf` (e.g. with the config line `deny=!*`) does not work which could lead to a security risk. If an administrator running an Asterisk instance relies on the `cli_permissions.conf` file to work and expects it to deny all attempts to execute shell commands, then this could lead to a security vulnerability. Versions 18.26.2, 20.14.1, 21.9.1, and 22.4.1 of Asterisk and versions 18.9-cert14 and 20.7-cert5 of certified-asterisk fix the issue.","debianbug":1106530,"scope":"local","releases":{"bullseye":{"status":"resolved","repositories":{"bullseye":"1:16.28.0~dfsg-0+deb11u4","bullseye-security":"1:16.28.0~dfsg-0+deb11u8"},"fixed_version":"1:16.28.0~dfsg-0+deb11u7","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"1:22.8.2+dfsg+~cs6.15.60671435-1"},"fixed_version":"1:22.4.1~dfsg+~cs6.15.60671435-1","urgency":"not yet assigned"}}},"CVE-2025-49832":{"description":"Asterisk is an open source private branch exchange and telephony toolkit. In versions up to and including 18.26.2, between 20.00.0 and 20.15.0, 20.7-cert6, 21.00.0, 22.00.0 through 22.5.0, there is a remote DoS and possible RCE condition in `asterisk/res/res_stir_shaken /verification.c` that can be exploited when an attacker can set an arbitrary Identity header, or STIR/SHAKEN is enabled, with verification set in the SIP profile associated with the endpoint to be attacked. This is fixed in versions 18.26.3, 20.7-cert6, 20.15.1, 21.10.1 and 22.5.1.","debianbug":1110317,"scope":"local","releases":{"bullseye":{"status":"resolved","repositories":{"bullseye":"1:16.28.0~dfsg-0+deb11u4","bullseye-security":"1:16.28.0~dfsg-0+deb11u8"},"fixed_version":"0","urgency":"unimportant"},"sid":{"status":"resolved","repositories":{"sid":"1:22.8.2+dfsg+~cs6.15.60671435-1"},"fixed_version":"1:22.5.1~dfsg+~cs6.15.60671435-1","urgency":"not yet assigned"}}},"CVE-2025-54995":{"description":"Asterisk is an open source private branch exchange and telephony toolkit. Prior to versions 18.26.4 and 18.9-cert17, RTP UDP ports and internal resources can leak due to a lack of session termination. This could result in leaks and resource exhaustion. This issue has been patched in versions 18.26.4 and 18.9-cert17.","scope":"local","releases":{"bullseye":{"status":"resolved","repositories":{"bullseye":"1:16.28.0~dfsg-0+deb11u4","bullseye-security":"1:16.28.0~dfsg-0+deb11u8"},"fixed_version":"1:16.28.0~dfsg-0+deb11u8","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"1:22.8.2+dfsg+~cs6.15.60671435-1"},"fixed_version":"1:22.2.0~dfsg+~cs6.15.60671435-1","urgency":"not yet assigned"}}},"CVE-2025-57767":{"description":"Asterisk is an open source private branch exchange and telephony toolkit. Prior to versions 20.15.2, 21.10.2, and 22.5.2, if a SIP request is received with an Authorization header that contains a realm that wasn't in a previous 401 response's WWW-Authenticate header, or an Authorization header with an incorrect realm was received without a previous 401 response being sent, the get_authorization_header() function in res_pjsip_authenticator_digest will return a NULL. This wasn't being checked before attempting to get the digest algorithm from the header which causes a SEGV. This issue has been patched in versions 20.15.2, 21.10.2, and 22.5.2. There are no workarounds.","debianbug":1112470,"scope":"local","releases":{"bullseye":{"status":"resolved","repositories":{"bullseye":"1:16.28.0~dfsg-0+deb11u4","bullseye-security":"1:16.28.0~dfsg-0+deb11u8"},"fixed_version":"0","urgency":"unimportant"},"sid":{"status":"resolved","repositories":{"sid":"1:22.8.2+dfsg+~cs6.15.60671435-1"},"fixed_version":"1:22.5.2~dfsg+~cs6.15.60671435-1","urgency":"not yet assigned"}}},"CVE-2026-23738":{"description":"Asterisk is an open source private branch exchange and telephony toolkit. Prior to versions 20.7-cert9, 20.18.2, 21.12.1, 22.8.2, and 23.2.2, user supplied/control values for Cookies and any GET variable query Parameter are directly interpolated into the HTML of the page using ast_str_append. The endpoint at GET /httpstatus is the potential vulnerable endpoint relating to asterisk/main /http.c. This issue has been patched in versions 20.7-cert9, 20.18.2, 21.12.1, 22.8.2, and 23.2.2.","debianbug":1127438,"scope":"local","releases":{"bullseye":{"status":"open","repositories":{"bullseye":"1:16.28.0~dfsg-0+deb11u4","bullseye-security":"1:16.28.0~dfsg-0+deb11u8"},"urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"1:22.8.2+dfsg+~cs6.15.60671435-1"},"fixed_version":"1:22.8.2+dfsg+~cs6.15.60671435-1","urgency":"not yet assigned"}}},"CVE-2026-23739":{"description":"Asterisk is an open source private branch exchange and telephony toolkit. Prior to versions 20.7-cert9, 20.18.2, 21.12.1, 22.8.2, and 23.2.2, the ast_xml_open() function in xml.c parses XML documents using libxml with unsafe parsing options that enable entity expansion and XInclude processing. Specifically, it invokes xmlReadFile() with the XML_PARSE_NOENT flag and later processes XIncludes via xmlXIncludeProcess().If any untrusted or user-supplied XML file is passed to this function, it can allow an attacker to trigger XML External Entity (XXE) or XInclude-based local file disclosure, potentially exposing sensitive files from the host system. This can also be triggered in other cases in which the user is able to supply input in xml format that triggers the asterisk process to parse it. This issue has been patched in versions 20.7-cert9, 20.18.2, 21.12.1, 22.8.2, and 23.2.2.","debianbug":1127438,"scope":"local","releases":{"bullseye":{"status":"open","repositories":{"bullseye":"1:16.28.0~dfsg-0+deb11u4","bullseye-security":"1:16.28.0~dfsg-0+deb11u8"},"urgency":"unimportant"},"sid":{"status":"resolved","repositories":{"sid":"1:22.8.2+dfsg+~cs6.15.60671435-1"},"fixed_version":"1:22.8.2+dfsg+~cs6.15.60671435-1","urgency":"unimportant"}}},"CVE-2026-23740":{"description":"Asterisk is an open source private branch exchange and telephony toolkit. Prior to versions 20.7-cert9, 20.18.2, 21.12.1, 22.8.2, and 23.2.2, when ast_coredumper writes its gdb init and output files to a directory that is world-writable (for example /tmp), an attacker with write permission(which is all users on a linux system) to that directory can cause root to execute arbitrary commands or overwrite arbitrary files by controlling the gdb init file and output paths. This issue has been patched in versions 20.7-cert9, 20.18.2, 21.12.1, 22.8.2, and 23.2.2.","debianbug":1127438,"scope":"local","releases":{"bullseye":{"status":"open","repositories":{"bullseye":"1:16.28.0~dfsg-0+deb11u4","bullseye-security":"1:16.28.0~dfsg-0+deb11u8"},"urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"1:22.8.2+dfsg+~cs6.15.60671435-1"},"fixed_version":"1:22.8.2+dfsg+~cs6.15.60671435-1","urgency":"not yet assigned"}}},"CVE-2026-23741":{"description":"Asterisk is an open source private branch exchange and telephony toolkit. Prior to versions 20.7-cert9, 20.18.2, 21.12.1, 22.8.2, and 23.2.2, the asterisk/contrib/scripts/ast_coredumper runs as root, as noted by the NOTES tag on line 689 of the ast_coredumper file. The script will source the contents of /etc/asterisk/ast_debug_tools.conf, which resides in a folder that is writeable by the asterisk user:group. Due to the /etc/asterisk/ast_debug_tools.conf file following bash semantics and it being loaded; an attacker with write permissions may add or modify the file such that when the root ast_coredumper is run; it would source and thereby execute arbitrary bash code found in the /etc/asterisk/ast_debug_tools.conf. This issue has been patched in versions 20.7-cert9, 20.18.2, 21.12.1, 22.8.2, and 23.2.2.","debianbug":1127438,"scope":"local","releases":{"bullseye":{"status":"open","repositories":{"bullseye":"1:16.28.0~dfsg-0+deb11u4","bullseye-security":"1:16.28.0~dfsg-0+deb11u8"},"urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"1:22.8.2+dfsg+~cs6.15.60671435-1"},"fixed_version":"1:22.8.2+dfsg+~cs6.15.60671435-1","urgency":"not yet assigned"}}},"TEMP-0000000-964ED9":{"releases":{"bullseye":{"status":"resolved","repositories":{"bullseye":"1:16.28.0~dfsg-0+deb11u4","bullseye-security":"1:16.28.0~dfsg-0+deb11u8"},"fixed_version":"1:13.8.2~dfsg-1","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"1:22.8.2+dfsg+~cs6.15.60671435-1"},"fixed_version":"1:13.8.2~dfsg-1","urgency":"not yet assigned"}}}},"astropy":{"CVE-2023-41334":{"description":"Astropy is a project for astronomy in Python that fosters interoperability between Python astronomy packages. Version 5.3.2 of the Astropy core package is vulnerable to remote code execution due to improper input validation in the `TranformGraph().to_dot_graph` function. A malicious user can provide a command or a script file as a value to the `savelayout` argument, which will be placed as the first value in a list of arguments passed to `subprocess.Popen`.  Although an error will be raised, the command or script will be executed successfully. Version 5.3.3 fixes this issue.","scope":"local","releases":{"bookworm":{"status":"open","repositories":{"bookworm":"5.2.1-2"},"urgency":"not yet assigned","nodsa":"Minor issue","nodsa_reason":""},"bullseye":{"status":"open","repositories":{"bullseye":"4.2-6"},"urgency":"not yet assigned","nodsa":"Minor issue","nodsa_reason":""},"forky":{"status":"resolved","repositories":{"forky":"7.2.0-1"},"fixed_version":"5.3.3-1","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"7.2.0-1"},"fixed_version":"5.3.3-1","urgency":"not yet assigned"},"trixie":{"status":"resolved","repositories":{"trixie":"7.0.1-3"},"fixed_version":"5.3.3-1","urgency":"not yet assigned"}}}},"async-http-client":{"CVE-2013-7397":{"description":"Async Http Client (aka AHC or async-http-client) before 1.9.0 skips X.509 certificate verification unless both a keyStore location and a trustStore location are explicitly set, which allows man-in-the-middle attackers to spoof HTTPS servers by presenting an arbitrary certificate during use of a typical AHC configuration, as demonstrated by a configuration that does not send client certificates.","scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"2.12.3-1"},"fixed_version":"1.6.5-3","urgency":"not yet assigned"},"bullseye":{"status":"resolved","repositories":{"bullseye":"2.12.2-1"},"fixed_version":"1.6.5-3","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"2.12.3-1"},"fixed_version":"1.6.5-3","urgency":"not yet assigned"}}},"CVE-2013-7398":{"description":"main/java/com/ning/http/client/AsyncHttpClientConfig.java in Async Http Client (aka AHC or async-http-client) before 1.9.0 does not require a hostname match during verification of X.509 certificates, which allows man-in-the-middle attackers to spoof HTTPS servers via an arbitrary valid certificate.","scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"2.12.3-1"},"fixed_version":"0","urgency":"unimportant"},"bullseye":{"status":"resolved","repositories":{"bullseye":"2.12.2-1"},"fixed_version":"0","urgency":"unimportant"},"sid":{"status":"resolved","repositories":{"sid":"2.12.3-1"},"fixed_version":"0","urgency":"unimportant"}}},"CVE-2017-14063":{"description":"Async Http Client (aka async-http-client) before 2.0.35 can be tricked into connecting to a host different from the one extracted by java.net.URI if a '?' character occurs in a fragment identifier. Similar bugs were previously identified in cURL (CVE-2016-8624) and Oracle Java 8 java.net.URL.","scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"2.12.3-1"},"fixed_version":"0","urgency":"unimportant"},"bullseye":{"status":"resolved","repositories":{"bullseye":"2.12.2-1"},"fixed_version":"0","urgency":"unimportant"},"sid":{"status":"resolved","repositories":{"sid":"2.12.3-1"},"fixed_version":"0","urgency":"unimportant"}}},"CVE-2024-53990":{"description":"The AsyncHttpClient (AHC) library allows Java applications to easily execute HTTP requests and asynchronously process HTTP responses. When making any HTTP request, the automatically enabled and self-managed CookieStore (aka cookie jar) will silently replace explicitly defined Cookies with any that have the same name from the cookie jar. For services that operate with multiple users, this can result in one user's Cookie being used for another user's requests.","debianbug":1089228,"scope":"local","releases":{"bookworm":{"status":"open","repositories":{"bookworm":"2.12.3-1"},"urgency":"not yet assigned","nodsa":"Minor issue","nodsa_reason":""},"bullseye":{"status":"open","repositories":{"bullseye":"2.12.2-1"},"urgency":"not yet assigned","nodsa":"Minor issue","nodsa_reason":"postponed"},"sid":{"status":"open","repositories":{"sid":"2.12.3-1"},"urgency":"not yet assigned"}}}},"asyncpg":{"CVE-2020-17446":{"description":"asyncpg before 0.21.0 allows a malicious PostgreSQL server to trigger a crash or execute arbitrary code (on a database client) via a crafted server response, because of access to an uninitialized pointer in the array data decoder.","scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"0.27.0-1"},"fixed_version":"0.21.0-1","urgency":"not yet assigned"},"bullseye":{"status":"resolved","repositories":{"bullseye":"0.21.0-1"},"fixed_version":"0.21.0-1","urgency":"not yet assigned"},"forky":{"status":"resolved","repositories":{"forky":"0.30.0-1.1"},"fixed_version":"0.21.0-1","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"0.30.0-1.1"},"fixed_version":"0.21.0-1","urgency":"not yet assigned"},"trixie":{"status":"resolved","repositories":{"trixie":"0.30.0-1.1"},"fixed_version":"0.21.0-1","urgency":"not yet assigned"}}}},"at-spi2-atk":{"CVE-2012-3378":{"description":"The register_application function in atk-adaptor/bridge.c in GNOME at-spi2-atk 2.5.2 does not seed the random number generator and generates predictable temporary file names, which makes it easier for local users to create or truncate files via a symlink attack on a temporary socket file in /tmp/at-spi2.","debianbug":678026,"scope":"local","releases":{"bullseye":{"status":"resolved","repositories":{"bullseye":"2.38.0-1"},"fixed_version":"2.5.3-1","urgency":"not yet assigned"}}}},"atari800":{"CVE-2003-0630":{"description":"Multiple buffer overflows in the atari800.svgalib setuid program of the Atari 800 emulator (atari800) before 1.2.2 allow local users to gain privileges via long command line arguments, as demonstrated with the -osa_rom argument.","scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"5.0.0-1"},"fixed_version":"1.3.1-2","urgency":"not yet assigned"},"bullseye":{"status":"resolved","repositories":{"bullseye":"4.1.0-3"},"fixed_version":"1.3.1-2","urgency":"not yet assigned"},"forky":{"status":"resolved","repositories":{"forky":"5.2.0-2"},"fixed_version":"1.3.1-2","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"5.2.0-2"},"fixed_version":"1.3.1-2","urgency":"not yet assigned"},"trixie":{"status":"resolved","repositories":{"trixie":"5.2.0-2"},"fixed_version":"1.3.1-2","urgency":"not yet assigned"}}},"CVE-2004-1076":{"description":"Multiple buffer overflows in the RtConfigLoad function in rt-config.c for Atari800 before 1.3.4 allow local users to execute arbitrary code via large values in the configuration file.","scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"5.0.0-1"},"fixed_version":"1.3.2-1","urgency":"not yet assigned"},"bullseye":{"status":"resolved","repositories":{"bullseye":"4.1.0-3"},"fixed_version":"1.3.2-1","urgency":"not yet assigned"},"forky":{"status":"resolved","repositories":{"forky":"5.2.0-2"},"fixed_version":"1.3.2-1","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"5.2.0-2"},"fixed_version":"1.3.2-1","urgency":"not yet assigned"},"trixie":{"status":"resolved","repositories":{"trixie":"5.2.0-2"},"fixed_version":"1.3.2-1","urgency":"not yet assigned"}}}},"atftp":{"CVE-2003-0380":{"description":"Buffer overflow in atftp daemon (atftpd) 0.6.1 and earlier, and possibly later versions, allows remote attackers to cause a denial of service (crash) and possibly execute arbitrary code via a long filename.","scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"0.8.0-3"},"fixed_version":"0.6.2","urgency":"not yet assigned"},"bullseye":{"status":"resolved","repositories":{"bullseye":"0.7.git20120829-3.3+deb11u2"},"fixed_version":"0.6.2","urgency":"not yet assigned"},"forky":{"status":"resolved","repositories":{"forky":"0.8.0-8"},"fixed_version":"0.6.2","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"0.8.0-8"},"fixed_version":"0.6.2","urgency":"not yet assigned"},"trixie":{"status":"resolved","repositories":{"trixie":"0.8.0-8"},"fixed_version":"0.6.2","urgency":"not yet assigned"}}},"CVE-2004-1485":{"description":"Buffer overflow in the TFTP client in InetUtils 1.4.2 allows remote malicious DNS servers to execute arbitrary code via a large DNS response that is handled by the gethostbyname function.","scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"0.8.0-3"},"fixed_version":"0","urgency":"unimportant"},"bullseye":{"status":"resolved","repositories":{"bullseye":"0.7.git20120829-3.3+deb11u2"},"fixed_version":"0","urgency":"unimportant"},"forky":{"status":"resolved","repositories":{"forky":"0.8.0-8"},"fixed_version":"0","urgency":"unimportant"},"sid":{"status":"resolved","repositories":{"sid":"0.8.0-8"},"fixed_version":"0","urgency":"unimportant"},"trixie":{"status":"resolved","repositories":{"trixie":"0.8.0-8"},"fixed_version":"0","urgency":"unimportant"}}},"CVE-2019-11365":{"description":"An issue was discovered in atftpd in atftp 0.7.1. A remote attacker may send a crafted packet triggering a stack-based buffer overflow due to an insecurely implemented strncpy call. The vulnerability is triggered by sending an error packet of 3 bytes or fewer. There are multiple instances of this vulnerable strncpy pattern within the code base, specifically within tftpd_file.c, tftp_file.c, tftpd_mtftp.c, and tftp_mtftp.c.","debianbug":927553,"scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"0.8.0-3"},"fixed_version":"0.7.git20120829-3.1","urgency":"not yet assigned"},"bullseye":{"status":"resolved","repositories":{"bullseye":"0.7.git20120829-3.3+deb11u2"},"fixed_version":"0.7.git20120829-3.1","urgency":"not yet assigned"},"forky":{"status":"resolved","repositories":{"forky":"0.8.0-8"},"fixed_version":"0.7.git20120829-3.1","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"0.8.0-8"},"fixed_version":"0.7.git20120829-3.1","urgency":"not yet assigned"},"trixie":{"status":"resolved","repositories":{"trixie":"0.8.0-8"},"fixed_version":"0.7.git20120829-3.1","urgency":"not yet assigned"}}},"CVE-2019-11366":{"description":"An issue was discovered in atftpd in atftp 0.7.1. It does not lock the thread_list_mutex mutex before assigning the current thread data structure. As a result, the daemon is vulnerable to a denial of service attack due to a NULL pointer dereference. If thread_data is NULL when assigned to current, and modified by another thread before a certain tftpd_list.c check, there is a crash when dereferencing current->next.","debianbug":927553,"scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"0.8.0-3"},"fixed_version":"0.7.git20120829-3.1","urgency":"not yet assigned"},"bullseye":{"status":"resolved","repositories":{"bullseye":"0.7.git20120829-3.3+deb11u2"},"fixed_version":"0.7.git20120829-3.1","urgency":"not yet assigned"},"forky":{"status":"resolved","repositories":{"forky":"0.8.0-8"},"fixed_version":"0.7.git20120829-3.1","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"0.8.0-8"},"fixed_version":"0.7.git20120829-3.1","urgency":"not yet assigned"},"trixie":{"status":"resolved","repositories":{"trixie":"0.8.0-8"},"fixed_version":"0.7.git20120829-3.1","urgency":"not yet assigned"}}},"CVE-2020-6097":{"description":"An exploitable denial of service vulnerability exists in the atftpd daemon functionality of atftp 0.7.git20120829-3.1+b1. A specially crafted sequence of RRQ-Multicast requests trigger an assert() call resulting in denial-of-service. An attacker can send a sequence of malicious packets to trigger this vulnerability.","debianbug":970066,"scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"0.8.0-3"},"fixed_version":"0.7.git20120829-3.2","urgency":"not yet assigned"},"bullseye":{"status":"resolved","repositories":{"bullseye":"0.7.git20120829-3.3+deb11u2"},"fixed_version":"0.7.git20120829-3.2","urgency":"not yet assigned"},"forky":{"status":"resolved","repositories":{"forky":"0.8.0-8"},"fixed_version":"0.7.git20120829-3.2","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"0.8.0-8"},"fixed_version":"0.7.git20120829-3.2","urgency":"not yet assigned"},"trixie":{"status":"resolved","repositories":{"trixie":"0.8.0-8"},"fixed_version":"0.7.git20120829-3.2","urgency":"not yet assigned"}}},"CVE-2021-41054":{"description":"tftpd_file.c in atftp through 0.7.4 has a buffer overflow because buffer-size handling does not properly consider the combination of data, OACK, and other options.","debianbug":994895,"scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"0.8.0-3"},"fixed_version":"0.7.git20210915-1","urgency":"not yet assigned"},"bullseye":{"status":"resolved","repositories":{"bullseye":"0.7.git20120829-3.3+deb11u2"},"fixed_version":"0.7.git20120829-3.3+deb11u1","urgency":"not yet assigned"},"forky":{"status":"resolved","repositories":{"forky":"0.8.0-8"},"fixed_version":"0.7.git20210915-1","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"0.8.0-8"},"fixed_version":"0.7.git20210915-1","urgency":"not yet assigned"},"trixie":{"status":"resolved","repositories":{"trixie":"0.8.0-8"},"fixed_version":"0.7.git20210915-1","urgency":"not yet assigned"}}},"CVE-2021-46671":{"description":"options.c in atftp before 0.7.5 reads past the end of an array, and consequently discloses server-side /etc/group data to a remote client.","debianbug":1004974,"scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"0.8.0-3"},"fixed_version":"0.7.git20210915-1","urgency":"not yet assigned"},"bullseye":{"status":"resolved","repositories":{"bullseye":"0.7.git20120829-3.3+deb11u2"},"fixed_version":"0.7.git20120829-3.3+deb11u2","urgency":"not yet assigned"},"forky":{"status":"resolved","repositories":{"forky":"0.8.0-8"},"fixed_version":"0.7.git20210915-1","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"0.8.0-8"},"fixed_version":"0.7.git20210915-1","urgency":"not yet assigned"},"trixie":{"status":"resolved","repositories":{"trixie":"0.8.0-8"},"fixed_version":"0.7.git20210915-1","urgency":"not yet assigned"}}},"TEMP-0000000-4C54C0":{"releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"0.8.0-3"},"fixed_version":"0.7.dfsg-11","urgency":"low"},"bullseye":{"status":"resolved","repositories":{"bullseye":"0.7.git20120829-3.3+deb11u2"},"fixed_version":"0.7.dfsg-11","urgency":"low"},"forky":{"status":"resolved","repositories":{"forky":"0.8.0-8"},"fixed_version":"0.7.dfsg-11","urgency":"low"},"sid":{"status":"resolved","repositories":{"sid":"0.8.0-8"},"fixed_version":"0.7.dfsg-11","urgency":"low"},"trixie":{"status":"resolved","repositories":{"trixie":"0.8.0-8"},"fixed_version":"0.7.dfsg-11","urgency":"low"}}}},"atheme-services":{"CVE-2014-9773":{"description":"modules/chanserv/flags.c in Atheme before 7.2.7 allows remote attackers to modify the Anope FLAGS behavior by registering and dropping the (1) LIST, (2) CLEAR, or (3) MODIFY keyword nicks.","scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"7.2.12-1"},"fixed_version":"7.0.7-2","urgency":"not yet assigned"},"bullseye":{"status":"resolved","repositories":{"bullseye":"7.2.11-1"},"fixed_version":"7.0.7-2","urgency":"not yet assigned"},"forky":{"status":"resolved","repositories":{"forky":"7.2.12-2.1"},"fixed_version":"7.0.7-2","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"7.2.12-2.1"},"fixed_version":"7.0.7-2","urgency":"not yet assigned"},"trixie":{"status":"resolved","repositories":{"trixie":"7.2.12-2"},"fixed_version":"7.0.7-2","urgency":"not yet assigned"}}},"CVE-2016-4478":{"description":"Buffer overflow in the xmlrpc_char_encode function in modules/transport/xmlrpc/xmlrpclib.c in Atheme before 7.2.7 allows remote attackers to cause a denial of service via vectors related to XMLRPC response encoding.","scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"7.2.12-1"},"fixed_version":"7.0.7-2","urgency":"not yet assigned"},"bullseye":{"status":"resolved","repositories":{"bullseye":"7.2.11-1"},"fixed_version":"7.0.7-2","urgency":"not yet assigned"},"forky":{"status":"resolved","repositories":{"forky":"7.2.12-2.1"},"fixed_version":"7.0.7-2","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"7.2.12-2.1"},"fixed_version":"7.0.7-2","urgency":"not yet assigned"},"trixie":{"status":"resolved","repositories":{"trixie":"7.2.12-2"},"fixed_version":"7.0.7-2","urgency":"not yet assigned"}}},"CVE-2017-6384":{"description":"Memory leak in the login_user function in saslserv/main.c in saslserv/main.so in Atheme 7.2.7 allows a remote unauthenticated attacker to consume memory and cause a denial of service. This is fixed in 7.2.8.","debianbug":855588,"scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"7.2.12-1"},"fixed_version":"7.2.9-1","urgency":"not yet assigned"},"bullseye":{"status":"resolved","repositories":{"bullseye":"7.2.11-1"},"fixed_version":"7.2.9-1","urgency":"not yet assigned"},"forky":{"status":"resolved","repositories":{"forky":"7.2.12-2.1"},"fixed_version":"7.2.9-1","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"7.2.12-2.1"},"fixed_version":"7.2.9-1","urgency":"not yet assigned"},"trixie":{"status":"resolved","repositories":{"trixie":"7.2.12-2"},"fixed_version":"7.2.9-1","urgency":"not yet assigned"}}},"CVE-2022-24976":{"description":"Atheme IRC Services before 7.2.12, when used in conjunction with InspIRCd, allows authentication bypass by ending an IRC handshake at a certain point during a challenge-response login sequence.","scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"7.2.12-1"},"fixed_version":"7.2.12-1","urgency":"not yet assigned"},"bullseye":{"status":"open","repositories":{"bullseye":"7.2.11-1"},"urgency":"not yet assigned","nodsa":"Minor issue; can be fixed via point release","nodsa_reason":""},"forky":{"status":"resolved","repositories":{"forky":"7.2.12-2.1"},"fixed_version":"7.2.12-1","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"7.2.12-2.1"},"fixed_version":"7.2.12-1","urgency":"not yet assigned"},"trixie":{"status":"resolved","repositories":{"trixie":"7.2.12-2"},"fixed_version":"7.2.12-1","urgency":"not yet assigned"}}},"CVE-2024-27508":{"description":"Atheme 7.2.12 contains a memory leak vulnerability in /atheme/src/crypto-benchmark/main.c.","scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"7.2.12-1"},"fixed_version":"0","urgency":"unimportant"},"bullseye":{"status":"resolved","repositories":{"bullseye":"7.2.11-1"},"fixed_version":"0","urgency":"unimportant"},"forky":{"status":"resolved","repositories":{"forky":"7.2.12-2.1"},"fixed_version":"0","urgency":"unimportant"},"sid":{"status":"resolved","repositories":{"sid":"7.2.12-2.1"},"fixed_version":"0","urgency":"unimportant"},"trixie":{"status":"resolved","repositories":{"trixie":"7.2.12-2"},"fixed_version":"0","urgency":"unimportant"}}}},"atomicparsley":{"CVE-2021-37231":{"description":"A stack-buffer-overflow occurs in Atomicparsley 20210124.204813.840499f through APar_readX() in src/util.cpp while parsing a crafted mp4 file because of the missing boundary check.","debianbug":993372,"scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"20210715.151551.e7ad03a-1"},"fixed_version":"20210715.151551.e7ad03a-1","urgency":"not yet assigned"},"bullseye":{"status":"open","repositories":{"bullseye":"0.9.6-2"},"urgency":"not yet assigned","nodsa":"Minor issue","nodsa_reason":""},"forky":{"status":"resolved","repositories":{"forky":"20240608.083822.1ed9031-1"},"fixed_version":"20210715.151551.e7ad03a-1","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"20240608.083822.1ed9031-1"},"fixed_version":"20210715.151551.e7ad03a-1","urgency":"not yet assigned"},"trixie":{"status":"resolved","repositories":{"trixie":"20240608.083822.1ed9031-1"},"fixed_version":"20210715.151551.e7ad03a-1","urgency":"not yet assigned"}}},"CVE-2021-37232":{"description":"A stack overflow vulnerability occurs in Atomicparsley 20210124.204813.840499f through APar_read64() in src/util.cpp due to the lack of buffer size of uint32_buffer while reading more bytes in APar_read64.","debianbug":993366,"scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"20210715.151551.e7ad03a-1"},"fixed_version":"20210715.151551.e7ad03a-1","urgency":"not yet assigned"},"bullseye":{"status":"open","repositories":{"bullseye":"0.9.6-2"},"urgency":"not yet assigned","nodsa":"Minor issue","nodsa_reason":""},"forky":{"status":"resolved","repositories":{"forky":"20240608.083822.1ed9031-1"},"fixed_version":"20210715.151551.e7ad03a-1","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"20240608.083822.1ed9031-1"},"fixed_version":"20210715.151551.e7ad03a-1","urgency":"not yet assigned"},"trixie":{"status":"resolved","repositories":{"trixie":"20240608.083822.1ed9031-1"},"fixed_version":"20210715.151551.e7ad03a-1","urgency":"not yet assigned"}}}},"atop":{"CVE-2011-3618":{"description":"atop: symlink attack possible due to insecure tempfile handling","debianbug":622794,"scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"2.8.1-1+deb12u1","bookworm-security":"2.8.1-1+deb12u1"},"fixed_version":"1.23-1.1","urgency":"low"},"bullseye":{"status":"resolved","repositories":{"bullseye":"2.6.0-2","bullseye-security":"2.6.0-2+deb11u1"},"fixed_version":"1.23-1.1","urgency":"low"},"forky":{"status":"resolved","repositories":{"forky":"2.12.1-1"},"fixed_version":"1.23-1.1","urgency":"low"},"sid":{"status":"resolved","repositories":{"sid":"2.12.1-1"},"fixed_version":"1.23-1.1","urgency":"low"},"trixie":{"status":"resolved","repositories":{"trixie":"2.11.1-3"},"fixed_version":"1.23-1.1","urgency":"low"}}},"CVE-2025-31160":{"description":"atop through 2.11.0 allows local users to cause a denial of service (e.g., assertion failure and application exit) or possibly have unspecified other impact by running certain types of unprivileged processes while a different user runs atop.","scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"2.8.1-1+deb12u1","bookworm-security":"2.8.1-1+deb12u1"},"fixed_version":"2.8.1-1+deb12u1","urgency":"not yet assigned"},"bullseye":{"status":"resolved","repositories":{"bullseye":"2.6.0-2","bullseye-security":"2.6.0-2+deb11u1"},"fixed_version":"2.6.0-2+deb11u1","urgency":"not yet assigned"},"forky":{"status":"resolved","repositories":{"forky":"2.12.1-1"},"fixed_version":"2.11.1-1","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"2.12.1-1"},"fixed_version":"2.11.1-1","urgency":"not yet assigned"},"trixie":{"status":"resolved","repositories":{"trixie":"2.11.1-3"},"fixed_version":"2.11.1-1","urgency":"not yet assigned"}}}},"atril":{"CVE-2017-1000083":{"description":"backend/comics/comics-document.c (aka the comic book backend) in GNOME Evince before 3.24.1 allows remote attackers to execute arbitrary commands via a .cbt file that is a TAR archive containing a filename beginning with a \"--\" command-line option substring, as demonstrated by a --checkpoint-action=exec=bash at the beginning of the filename.","debianbug":868500,"scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"1.26.0-2+deb12u3","bookworm-security":"1.26.0-2+deb12u3"},"fixed_version":"1.16.1-2.1","urgency":"not yet assigned"},"bullseye":{"status":"resolved","repositories":{"bullseye":"1.24.0-1+deb11u1","bullseye-security":"1.24.0-1+deb11u1"},"fixed_version":"1.16.1-2.1","urgency":"not yet assigned"},"forky":{"status":"resolved","repositories":{"forky":"1.28.2-1"},"fixed_version":"1.16.1-2.1","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"1.28.2-1"},"fixed_version":"1.16.1-2.1","urgency":"not yet assigned"},"trixie":{"status":"resolved","repositories":{"trixie":"1.26.2-4"},"fixed_version":"1.16.1-2.1","urgency":"not yet assigned"}}},"CVE-2017-1000159":{"description":"Command injection in evince via filename when printing to PDF. This affects versions earlier than 3.25.91.","scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"1.26.0-2+deb12u3","bookworm-security":"1.26.0-2+deb12u3"},"fixed_version":"1.20.0-1","urgency":"low"},"bullseye":{"status":"resolved","repositories":{"bullseye":"1.24.0-1+deb11u1","bullseye-security":"1.24.0-1+deb11u1"},"fixed_version":"1.20.0-1","urgency":"low"},"forky":{"status":"resolved","repositories":{"forky":"1.28.2-1"},"fixed_version":"1.20.0-1","urgency":"low"},"sid":{"status":"resolved","repositories":{"sid":"1.28.2-1"},"fixed_version":"1.20.0-1","urgency":"low"},"trixie":{"status":"resolved","repositories":{"trixie":"1.26.2-4"},"fixed_version":"1.20.0-1","urgency":"low"}}},"CVE-2019-1010006":{"description":"Evince 3.26.0 is affected by buffer overflow. The impact is: DOS / Possible code execution. The component is: backend/tiff/tiff-document.c. The attack vector is: Victim must open a crafted PDF file. The issue occurs because of an incorrect integer overflow protection mechanism in tiff_document_render and tiff_document_get_thumbnail.","scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"1.26.0-2+deb12u3","bookworm-security":"1.26.0-2+deb12u3"},"fixed_version":"1.22.2-1","urgency":"not yet assigned"},"bullseye":{"status":"resolved","repositories":{"bullseye":"1.24.0-1+deb11u1","bullseye-security":"1.24.0-1+deb11u1"},"fixed_version":"1.22.2-1","urgency":"not yet assigned"},"forky":{"status":"resolved","repositories":{"forky":"1.28.2-1"},"fixed_version":"1.22.2-1","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"1.28.2-1"},"fixed_version":"1.22.2-1","urgency":"not yet assigned"},"trixie":{"status":"resolved","repositories":{"trixie":"1.26.2-4"},"fixed_version":"1.22.2-1","urgency":"not yet assigned"}}},"CVE-2019-11459":{"description":"The tiff_document_render() and tiff_document_get_thumbnail() functions in the TIFF document backend in GNOME Evince through 3.32.0 did not handle errors from TIFFReadRGBAImageOriented(), leading to uninitialized memory use when processing certain TIFF image files.","debianbug":927821,"scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"1.26.0-2+deb12u3","bookworm-security":"1.26.0-2+deb12u3"},"fixed_version":"1.22.3-1","urgency":"unimportant"},"bullseye":{"status":"resolved","repositories":{"bullseye":"1.24.0-1+deb11u1","bullseye-security":"1.24.0-1+deb11u1"},"fixed_version":"1.22.3-1","urgency":"unimportant"},"forky":{"status":"resolved","repositories":{"forky":"1.28.2-1"},"fixed_version":"1.22.3-1","urgency":"unimportant"},"sid":{"status":"resolved","repositories":{"sid":"1.28.2-1"},"fixed_version":"1.22.3-1","urgency":"unimportant"},"trixie":{"status":"resolved","repositories":{"trixie":"1.26.2-4"},"fixed_version":"1.22.3-1","urgency":"unimportant"}}},"CVE-2023-51698":{"description":"Atril is a simple multi-page document viewer. Atril is vulnerable to a critical Command Injection Vulnerability. This vulnerability gives the attacker immediate access to the target system when the target user opens a crafted document or clicks on a crafted link/URL using a maliciously crafted CBT document which is a TAR archive. A patch is available at commit ce41df6.","debianbug":1060751,"scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"1.26.0-2+deb12u3","bookworm-security":"1.26.0-2+deb12u3"},"fixed_version":"1.26.0-2+deb12u2","urgency":"not yet assigned"},"bullseye":{"status":"resolved","repositories":{"bullseye":"1.24.0-1+deb11u1","bullseye-security":"1.24.0-1+deb11u1"},"fixed_version":"1.24.0-1+deb11u1","urgency":"not yet assigned"},"forky":{"status":"resolved","repositories":{"forky":"1.28.2-1"},"fixed_version":"1.26.1-4","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"1.28.2-1"},"fixed_version":"1.26.1-4","urgency":"not yet assigned"},"trixie":{"status":"resolved","repositories":{"trixie":"1.26.2-4"},"fixed_version":"1.26.1-4","urgency":"not yet assigned"}}},"CVE-2023-52076":{"description":"Atril Document Viewer is the default document reader of the MATE desktop environment for Linux. A path traversal and arbitrary file write vulnerability exists in versions of Atril prior to 1.26.2. This vulnerability is capable of writing arbitrary files anywhere on the filesystem to which the user opening a crafted document has access. The only limitation is that this vulnerability cannot be exploited to overwrite existing files, but that doesn't stop an attacker from achieving Remote Command Execution on the target system. Version 1.26.2 of Atril contains a patch for this vulnerability.","debianbug":1061522,"scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"1.26.0-2+deb12u3","bookworm-security":"1.26.0-2+deb12u3"},"fixed_version":"1.26.0-2+deb12u3","urgency":"not yet assigned"},"bullseye":{"status":"resolved","repositories":{"bullseye":"1.24.0-1+deb11u1","bullseye-security":"1.24.0-1+deb11u1"},"fixed_version":"1.24.0-1+deb11u1","urgency":"not yet assigned"},"forky":{"status":"resolved","repositories":{"forky":"1.28.2-1"},"fixed_version":"1.26.2-1","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"1.28.2-1"},"fixed_version":"1.26.2-1","urgency":"not yet assigned"},"trixie":{"status":"resolved","repositories":{"trixie":"1.26.2-4"},"fixed_version":"1.26.2-1","urgency":"not yet assigned"}}}},"aubio":{"CVE-2017-17054":{"description":"In aubio 0.4.6, a divide-by-zero error exists in the function new_aubio_source_wavread() in source_wavread.c, which may lead to DoS when playing a crafted audio file.","debianbug":883355,"scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"0.4.9-4.3"},"fixed_version":"0.4.6-1","urgency":"not yet assigned"},"bullseye":{"status":"resolved","repositories":{"bullseye":"0.4.9-4"},"fixed_version":"0.4.6-1","urgency":"not yet assigned"},"forky":{"status":"resolved","repositories":{"forky":"0.4.9-5"},"fixed_version":"0.4.6-1","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"0.4.9-5"},"fixed_version":"0.4.6-1","urgency":"not yet assigned"},"trixie":{"status":"resolved","repositories":{"trixie":"0.4.9-4.7"},"fixed_version":"0.4.6-1","urgency":"not yet assigned"}}},"CVE-2017-17554":{"description":"A NULL pointer dereference (DoS) Vulnerability was found in the function aubio_source_avcodec_readframe in io/source_avcodec.c of aubio 0.4.6, which may lead to DoS when playing a crafted audio file.","debianbug":884237,"scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"0.4.9-4.3"},"fixed_version":"0.4.6-1","urgency":"low"},"bullseye":{"status":"resolved","repositories":{"bullseye":"0.4.9-4"},"fixed_version":"0.4.6-1","urgency":"low"},"forky":{"status":"resolved","repositories":{"forky":"0.4.9-5"},"fixed_version":"0.4.6-1","urgency":"low"},"sid":{"status":"resolved","repositories":{"sid":"0.4.9-5"},"fixed_version":"0.4.6-1","urgency":"low"},"trixie":{"status":"resolved","repositories":{"trixie":"0.4.9-4.7"},"fixed_version":"0.4.6-1","urgency":"low"}}},"CVE-2017-17555":{"description":"The swri_audio_convert function in audioconvert.c in FFmpeg libswresample through 3.0.101, as used in FFmpeg 3.4.1, aubio 0.4.6, and other products, allows remote attackers to cause a denial of service (NULL pointer dereference and application crash) via a crafted audio file.","debianbug":884232,"scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"0.4.9-4.3"},"fixed_version":"0.4.6-1","urgency":"low"},"bullseye":{"status":"resolved","repositories":{"bullseye":"0.4.9-4"},"fixed_version":"0.4.6-1","urgency":"low"},"forky":{"status":"resolved","repositories":{"forky":"0.4.9-5"},"fixed_version":"0.4.6-1","urgency":"low"},"sid":{"status":"resolved","repositories":{"sid":"0.4.9-5"},"fixed_version":"0.4.6-1","urgency":"low"},"trixie":{"status":"resolved","repositories":{"trixie":"0.4.9-4.7"},"fixed_version":"0.4.6-1","urgency":"low"}}},"CVE-2018-14521":{"description":"An issue was discovered in aubio 0.4.6. A SEGV signal can occur in aubio_source_avcodec_readframe in io/source_avcodec.c, as demonstrated by aubiomfcc.","debianbug":904908,"scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"0.4.9-4.3"},"fixed_version":"0.4.6-1","urgency":"not yet assigned"},"bullseye":{"status":"resolved","repositories":{"bullseye":"0.4.9-4"},"fixed_version":"0.4.6-1","urgency":"not yet assigned"},"forky":{"status":"resolved","repositories":{"forky":"0.4.9-5"},"fixed_version":"0.4.6-1","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"0.4.9-5"},"fixed_version":"0.4.6-1","urgency":"not yet assigned"},"trixie":{"status":"resolved","repositories":{"trixie":"0.4.9-4.7"},"fixed_version":"0.4.6-1","urgency":"not yet assigned"}}},"CVE-2018-14522":{"description":"An issue was discovered in aubio 0.4.6. A SEGV signal can occur in aubio_pitch_set_unit in pitch/pitch.c, as demonstrated by aubionotes.","debianbug":904907,"scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"0.4.9-4.3"},"fixed_version":"0.4.6-1","urgency":"not yet assigned"},"bullseye":{"status":"resolved","repositories":{"bullseye":"0.4.9-4"},"fixed_version":"0.4.6-1","urgency":"not yet assigned"},"forky":{"status":"resolved","repositories":{"forky":"0.4.9-5"},"fixed_version":"0.4.6-1","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"0.4.9-5"},"fixed_version":"0.4.6-1","urgency":"not yet assigned"},"trixie":{"status":"resolved","repositories":{"trixie":"0.4.9-4.7"},"fixed_version":"0.4.6-1","urgency":"not yet assigned"}}},"CVE-2018-14523":{"description":"An issue was discovered in aubio 0.4.6. A buffer over-read can occur in new_aubio_pitchyinfft in pitch/pitchyinfft.c, as demonstrated by aubionotes.","debianbug":904906,"scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"0.4.9-4.3"},"fixed_version":"0.4.6-1","urgency":"not yet assigned"},"bullseye":{"status":"resolved","repositories":{"bullseye":"0.4.9-4"},"fixed_version":"0.4.6-1","urgency":"not yet assigned"},"forky":{"status":"resolved","repositories":{"forky":"0.4.9-5"},"fixed_version":"0.4.6-1","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"0.4.9-5"},"fixed_version":"0.4.6-1","urgency":"not yet assigned"},"trixie":{"status":"resolved","repositories":{"trixie":"0.4.9-4.7"},"fixed_version":"0.4.6-1","urgency":"not yet assigned"}}},"CVE-2018-19800":{"description":"aubio v0.4.0 to v0.4.8 has a Buffer Overflow in new_aubio_tempo.","debianbug":930186,"scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"0.4.9-4.3"},"fixed_version":"0.4.9-1","urgency":"not yet assigned"},"bullseye":{"status":"resolved","repositories":{"bullseye":"0.4.9-4"},"fixed_version":"0.4.9-1","urgency":"not yet assigned"},"forky":{"status":"resolved","repositories":{"forky":"0.4.9-5"},"fixed_version":"0.4.9-1","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"0.4.9-5"},"fixed_version":"0.4.9-1","urgency":"not yet assigned"},"trixie":{"status":"resolved","repositories":{"trixie":"0.4.9-4.7"},"fixed_version":"0.4.9-1","urgency":"not yet assigned"}}},"CVE-2018-19801":{"description":"aubio v0.4.0 to v0.4.8 has a NULL pointer dereference in new_aubio_filterbank via invalid n_filters.","debianbug":930186,"scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"0.4.9-4.3"},"fixed_version":"0.4.9-1","urgency":"not yet assigned"},"bullseye":{"status":"resolved","repositories":{"bullseye":"0.4.9-4"},"fixed_version":"0.4.9-1","urgency":"not yet assigned"},"forky":{"status":"resolved","repositories":{"forky":"0.4.9-5"},"fixed_version":"0.4.9-1","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"0.4.9-5"},"fixed_version":"0.4.9-1","urgency":"not yet assigned"},"trixie":{"status":"resolved","repositories":{"trixie":"0.4.9-4.7"},"fixed_version":"0.4.9-1","urgency":"not yet assigned"}}},"CVE-2018-19802":{"description":"aubio v0.4.0 to v0.4.8 has a new_aubio_onset NULL pointer dereference.","debianbug":930186,"scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"0.4.9-4.3"},"fixed_version":"0.4.9-1","urgency":"not yet assigned"},"bullseye":{"status":"resolved","repositories":{"bullseye":"0.4.9-4"},"fixed_version":"0.4.9-1","urgency":"not yet assigned"},"forky":{"status":"resolved","repositories":{"forky":"0.4.9-5"},"fixed_version":"0.4.9-1","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"0.4.9-5"},"fixed_version":"0.4.9-1","urgency":"not yet assigned"},"trixie":{"status":"resolved","repositories":{"trixie":"0.4.9-4.7"},"fixed_version":"0.4.9-1","urgency":"not yet assigned"}}}},"auctex":{"TEMP-0506961-3C07AF":{"debianbug":506961,"releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"12.2-1"},"fixed_version":"11.83-7.3","urgency":"low"},"bullseye":{"status":"resolved","repositories":{"bullseye":"12.2-1"},"fixed_version":"11.83-7.3","urgency":"low"},"forky":{"status":"resolved","repositories":{"forky":"13.2-1.1"},"fixed_version":"11.83-7.3","urgency":"low"},"sid":{"status":"resolved","repositories":{"sid":"13.2-1.1"},"fixed_version":"11.83-7.3","urgency":"low"},"trixie":{"status":"resolved","repositories":{"trixie":"13.2-1.1"},"fixed_version":"11.83-7.3","urgency":"low"}}}},"audacity":{"CVE-2007-6061":{"description":"Audacity 1.3.2 creates a temporary directory with a predictable name without checking for previous existence of that directory, which allows local users to cause a denial of service (recording deadlock) by creating the directory before Audacity is run.  NOTE: this issue can be leveraged to delete arbitrary files or directories via a symlink attack.","debianbug":453283,"scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"3.2.4+dfsg-1"},"fixed_version":"1.3.4-1.1","urgency":"low"},"bullseye":{"status":"resolved","repositories":{"bullseye":"2.4.2~dfsg0-5"},"fixed_version":"1.3.4-1.1","urgency":"low"},"forky":{"status":"resolved","repositories":{"forky":"3.7.7+dfsg-1"},"fixed_version":"1.3.4-1.1","urgency":"low"},"sid":{"status":"resolved","repositories":{"sid":"3.7.7+dfsg-1"},"fixed_version":"1.3.4-1.1","urgency":"low"},"trixie":{"status":"resolved","repositories":{"trixie":"3.7.3+dfsg-1"},"fixed_version":"1.3.4-1.1","urgency":"low"}}},"CVE-2009-0490":{"description":"Stack-based buffer overflow in the String_parse::get_nonspace_quoted function in lib-src/allegro/strparse.cpp in Audacity 1.2.6 and other versions before 1.3.6 allows remote attackers to cause a denial of service (crash) and possibly execute arbitrary code via a .gro file containing a long string.","debianbug":514138,"scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"3.2.4+dfsg-1"},"fixed_version":"1.3.6-1","urgency":"not yet assigned"},"bullseye":{"status":"resolved","repositories":{"bullseye":"2.4.2~dfsg0-5"},"fixed_version":"1.3.6-1","urgency":"not yet assigned"},"forky":{"status":"resolved","repositories":{"forky":"3.7.7+dfsg-1"},"fixed_version":"1.3.6-1","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"3.7.7+dfsg-1"},"fixed_version":"1.3.6-1","urgency":"not yet assigned"},"trixie":{"status":"resolved","repositories":{"trixie":"3.7.3+dfsg-1"},"fixed_version":"1.3.6-1","urgency":"not yet assigned"}}},"CVE-2009-3560":{"description":"The big2_toUtf8 function in lib/xmltok.c in libexpat in Expat 2.0.1, as used in the XML-Twig module for Perl, allows context-dependent attackers to cause a denial of service (application crash) via an XML document with malformed UTF-8 sequences that trigger a buffer over-read, related to the doProlog function in lib/xmlparse.c, a different vulnerability than CVE-2009-2625 and CVE-2009-3720.","debianbug":560919,"scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"3.2.4+dfsg-1"},"fixed_version":"1.3.2-1","urgency":"unimportant"},"bullseye":{"status":"resolved","repositories":{"bullseye":"2.4.2~dfsg0-5"},"fixed_version":"1.3.2-1","urgency":"unimportant"},"forky":{"status":"resolved","repositories":{"forky":"3.7.7+dfsg-1"},"fixed_version":"1.3.2-1","urgency":"unimportant"},"sid":{"status":"resolved","repositories":{"sid":"3.7.7+dfsg-1"},"fixed_version":"1.3.2-1","urgency":"unimportant"},"trixie":{"status":"resolved","repositories":{"trixie":"3.7.3+dfsg-1"},"fixed_version":"1.3.2-1","urgency":"unimportant"}}},"CVE-2009-3720":{"description":"The updatePosition function in lib/xmltok_impl.c in libexpat in Expat 2.0.1, as used in Python, PyXML, w3c-libwww, and other software, allows context-dependent attackers to cause a denial of service (application crash) via an XML document with crafted UTF-8 sequences that trigger a buffer over-read, a different vulnerability than CVE-2009-2625.","debianbug":560919,"scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"3.2.4+dfsg-1"},"fixed_version":"1.3.2-1","urgency":"unimportant"},"bullseye":{"status":"resolved","repositories":{"bullseye":"2.4.2~dfsg0-5"},"fixed_version":"1.3.2-1","urgency":"unimportant"},"forky":{"status":"resolved","repositories":{"forky":"3.7.7+dfsg-1"},"fixed_version":"1.3.2-1","urgency":"unimportant"},"sid":{"status":"resolved","repositories":{"sid":"3.7.7+dfsg-1"},"fixed_version":"1.3.2-1","urgency":"unimportant"},"trixie":{"status":"resolved","repositories":{"trixie":"3.7.3+dfsg-1"},"fixed_version":"1.3.2-1","urgency":"unimportant"}}},"CVE-2016-2540":{"description":"Audacity before 2.1.2 allows remote attackers to cause a denial of service (memory corruption and application crash) via a crafted FORMATCHUNK structure.","scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"3.2.4+dfsg-1"},"fixed_version":"2.1.2-1","urgency":"unimportant"},"bullseye":{"status":"resolved","repositories":{"bullseye":"2.4.2~dfsg0-5"},"fixed_version":"2.1.2-1","urgency":"unimportant"},"forky":{"status":"resolved","repositories":{"forky":"3.7.7+dfsg-1"},"fixed_version":"2.1.2-1","urgency":"unimportant"},"sid":{"status":"resolved","repositories":{"sid":"3.7.7+dfsg-1"},"fixed_version":"2.1.2-1","urgency":"unimportant"},"trixie":{"status":"resolved","repositories":{"trixie":"3.7.3+dfsg-1"},"fixed_version":"2.1.2-1","urgency":"unimportant"}}},"CVE-2016-2541":{"description":"Audacity before 2.1.2 allows remote attackers to cause a denial of service (memory corruption and application crash) via a crafted MP2 file.","scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"3.2.4+dfsg-1"},"fixed_version":"2.1.2-1","urgency":"unimportant"},"bullseye":{"status":"resolved","repositories":{"bullseye":"2.4.2~dfsg0-5"},"fixed_version":"2.1.2-1","urgency":"unimportant"},"forky":{"status":"resolved","repositories":{"forky":"3.7.7+dfsg-1"},"fixed_version":"2.1.2-1","urgency":"unimportant"},"sid":{"status":"resolved","repositories":{"sid":"3.7.7+dfsg-1"},"fixed_version":"2.1.2-1","urgency":"unimportant"},"trixie":{"status":"resolved","repositories":{"trixie":"3.7.3+dfsg-1"},"fixed_version":"2.1.2-1","urgency":"unimportant"}}},"CVE-2017-1000010":{"description":"Audacity 2.1.2 through 2.3.2 is vulnerable to Dll HIjacking in the avformat-55.dll resulting arbitrary code execution.","scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"3.2.4+dfsg-1"},"fixed_version":"0","urgency":"unimportant"},"bullseye":{"status":"resolved","repositories":{"bullseye":"2.4.2~dfsg0-5"},"fixed_version":"0","urgency":"unimportant"},"forky":{"status":"resolved","repositories":{"forky":"3.7.7+dfsg-1"},"fixed_version":"0","urgency":"unimportant"},"sid":{"status":"resolved","repositories":{"sid":"3.7.7+dfsg-1"},"fixed_version":"0","urgency":"unimportant"},"trixie":{"status":"resolved","repositories":{"trixie":"3.7.3+dfsg-1"},"fixed_version":"0","urgency":"unimportant"}}},"CVE-2020-11867":{"description":"Audacity through 2.3.3 saves temporary files to /var/tmp/audacity-$USER by default. After Audacity creates the temporary directory, it sets its permissions to 755. Any user on the system can read and play the temporary audio .au files located there.","debianbug":976874,"scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"3.2.4+dfsg-1"},"fixed_version":"2.4.2~dfsg0-4","urgency":"not yet assigned"},"bullseye":{"status":"resolved","repositories":{"bullseye":"2.4.2~dfsg0-5"},"fixed_version":"2.4.2~dfsg0-4","urgency":"not yet assigned"},"forky":{"status":"resolved","repositories":{"forky":"3.7.7+dfsg-1"},"fixed_version":"2.4.2~dfsg0-4","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"3.7.7+dfsg-1"},"fixed_version":"2.4.2~dfsg0-4","urgency":"not yet assigned"},"trixie":{"status":"resolved","repositories":{"trixie":"3.7.3+dfsg-1"},"fixed_version":"2.4.2~dfsg0-4","urgency":"not yet assigned"}}}},"audiofile":{"CVE-2008-5824":{"description":"Heap-based buffer overflow in msadpcm.c in libaudiofile in audiofile 0.2.6 allows context-dependent attackers to cause a denial of service (application crash) or possibly execute arbitrary code via a crafted WAV file.","debianbug":510205,"scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"0.3.6-5+deb12u1"},"fixed_version":"0.2.6-7.1","urgency":"medium"},"bullseye":{"status":"resolved","repositories":{"bullseye":"0.3.6-5","bullseye-security":"0.3.6-5+deb11u1"},"fixed_version":"0.2.6-7.1","urgency":"medium"},"forky":{"status":"resolved","repositories":{"forky":"0.3.6-7"},"fixed_version":"0.2.6-7.1","urgency":"medium"},"sid":{"status":"resolved","repositories":{"sid":"0.3.6-7"},"fixed_version":"0.2.6-7.1","urgency":"medium"},"trixie":{"status":"resolved","repositories":{"trixie":"0.3.6-7"},"fixed_version":"0.2.6-7.1","urgency":"medium"}}},"CVE-2015-7747":{"description":"Buffer overflow in the afReadFrames function in audiofile (aka libaudiofile and Audio File Library) allows user-assisted remote attackers to cause a denial of service (program crash) or possibly execute arbitrary code via a crafted audio file, as demonstrated by sixteen-stereo-to-eight-mono.c.","debianbug":801102,"scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"0.3.6-5+deb12u1"},"fixed_version":"0.3.6-3","urgency":"not yet assigned"},"bullseye":{"status":"resolved","repositories":{"bullseye":"0.3.6-5","bullseye-security":"0.3.6-5+deb11u1"},"fixed_version":"0.3.6-3","urgency":"not yet assigned"},"forky":{"status":"resolved","repositories":{"forky":"0.3.6-7"},"fixed_version":"0.3.6-3","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"0.3.6-7"},"fixed_version":"0.3.6-3","urgency":"not yet assigned"},"trixie":{"status":"resolved","repositories":{"trixie":"0.3.6-7"},"fixed_version":"0.3.6-3","urgency":"not yet assigned"}}},"CVE-2017-6827":{"description":"Heap-based buffer overflow in the MSADPCM::initializeCoefficients function in MSADPCM.cpp in audiofile (aka libaudiofile and Audio File Library) 0.3.6 allows remote attackers to have unspecified impact via a crafted audio file.","debianbug":857651,"scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"0.3.6-5+deb12u1"},"fixed_version":"0.3.6-4","urgency":"not yet assigned"},"bullseye":{"status":"resolved","repositories":{"bullseye":"0.3.6-5","bullseye-security":"0.3.6-5+deb11u1"},"fixed_version":"0.3.6-4","urgency":"not yet assigned"},"forky":{"status":"resolved","repositories":{"forky":"0.3.6-7"},"fixed_version":"0.3.6-4","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"0.3.6-7"},"fixed_version":"0.3.6-4","urgency":"not yet assigned"},"trixie":{"status":"resolved","repositories":{"trixie":"0.3.6-7"},"fixed_version":"0.3.6-4","urgency":"not yet assigned"}}},"CVE-2017-6828":{"description":"Heap-based buffer overflow in the readValue function in FileHandle.cpp in audiofile (aka libaudiofile and Audio File Library) 0.3.6 allows remote attackers to have unspecified impact via a crafted WAV file.","debianbug":857651,"scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"0.3.6-5+deb12u1"},"fixed_version":"0.3.6-4","urgency":"not yet assigned"},"bullseye":{"status":"resolved","repositories":{"bullseye":"0.3.6-5","bullseye-security":"0.3.6-5+deb11u1"},"fixed_version":"0.3.6-4","urgency":"not yet assigned"},"forky":{"status":"resolved","repositories":{"forky":"0.3.6-7"},"fixed_version":"0.3.6-4","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"0.3.6-7"},"fixed_version":"0.3.6-4","urgency":"not yet assigned"},"trixie":{"status":"resolved","repositories":{"trixie":"0.3.6-7"},"fixed_version":"0.3.6-4","urgency":"not yet assigned"}}},"CVE-2017-6829":{"description":"The decodeSample function in IMA.cpp in Audio File Library (aka audiofile) 0.3.6 allows remote attackers to cause a denial of service (crash) via a crafted file.","debianbug":857651,"scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"0.3.6-5+deb12u1"},"fixed_version":"0.3.6-4","urgency":"not yet assigned"},"bullseye":{"status":"resolved","repositories":{"bullseye":"0.3.6-5","bullseye-security":"0.3.6-5+deb11u1"},"fixed_version":"0.3.6-4","urgency":"not yet assigned"},"forky":{"status":"resolved","repositories":{"forky":"0.3.6-7"},"fixed_version":"0.3.6-4","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"0.3.6-7"},"fixed_version":"0.3.6-4","urgency":"not yet assigned"},"trixie":{"status":"resolved","repositories":{"trixie":"0.3.6-7"},"fixed_version":"0.3.6-4","urgency":"not yet assigned"}}},"CVE-2017-6830":{"description":"Heap-based buffer overflow in the alaw2linear_buf function in G711.cpp in Audio File Library (aka audiofile) 0.3.6 allows remote attackers to cause a denial of service (crash) via a crafted file.","debianbug":857651,"scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"0.3.6-5+deb12u1"},"fixed_version":"0.3.6-4","urgency":"not yet assigned"},"bullseye":{"status":"resolved","repositories":{"bullseye":"0.3.6-5","bullseye-security":"0.3.6-5+deb11u1"},"fixed_version":"0.3.6-4","urgency":"not yet assigned"},"forky":{"status":"resolved","repositories":{"forky":"0.3.6-7"},"fixed_version":"0.3.6-4","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"0.3.6-7"},"fixed_version":"0.3.6-4","urgency":"not yet assigned"},"trixie":{"status":"resolved","repositories":{"trixie":"0.3.6-7"},"fixed_version":"0.3.6-4","urgency":"not yet assigned"}}},"CVE-2017-6831":{"description":"Heap-based buffer overflow in the decodeBlockWAVE function in IMA.cpp in Audio File Library (aka audiofile) 0.3.6, 0.3.5, 0.3.4, 0.3.3, 0.3.2, 0.3.1, 0.3.0 and 0.2.7 allows remote attackers to cause a denial of service (crash) via a crafted file.","debianbug":857651,"scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"0.3.6-5+deb12u1"},"fixed_version":"0.3.6-4","urgency":"not yet assigned"},"bullseye":{"status":"resolved","repositories":{"bullseye":"0.3.6-5","bullseye-security":"0.3.6-5+deb11u1"},"fixed_version":"0.3.6-4","urgency":"not yet assigned"},"forky":{"status":"resolved","repositories":{"forky":"0.3.6-7"},"fixed_version":"0.3.6-4","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"0.3.6-7"},"fixed_version":"0.3.6-4","urgency":"not yet assigned"},"trixie":{"status":"resolved","repositories":{"trixie":"0.3.6-7"},"fixed_version":"0.3.6-4","urgency":"not yet assigned"}}},"CVE-2017-6832":{"description":"Heap-based buffer overflow in the decodeBlock in MSADPCM.cpp in Audio File Library (aka audiofile) 0.3.6, 0.3.5, 0.3.4, 0.3.3, 0.3.2, 0.3.1, 0.3.0, 0.2.7 allows remote attackers to cause a denial of service (crash) via a crafted file.","debianbug":857651,"scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"0.3.6-5+deb12u1"},"fixed_version":"0.3.6-4","urgency":"not yet assigned"},"bullseye":{"status":"resolved","repositories":{"bullseye":"0.3.6-5","bullseye-security":"0.3.6-5+deb11u1"},"fixed_version":"0.3.6-4","urgency":"not yet assigned"},"forky":{"status":"resolved","repositories":{"forky":"0.3.6-7"},"fixed_version":"0.3.6-4","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"0.3.6-7"},"fixed_version":"0.3.6-4","urgency":"not yet assigned"},"trixie":{"status":"resolved","repositories":{"trixie":"0.3.6-7"},"fixed_version":"0.3.6-4","urgency":"not yet assigned"}}},"CVE-2017-6833":{"description":"The runPull function in libaudiofile/modules/BlockCodec.cpp in Audio File Library (aka audiofile) 0.3.6 allows remote attackers to cause a denial of service (divide-by-zero error and crash) via a crafted file.","debianbug":857651,"scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"0.3.6-5+deb12u1"},"fixed_version":"0.3.6-4","urgency":"not yet assigned"},"bullseye":{"status":"resolved","repositories":{"bullseye":"0.3.6-5","bullseye-security":"0.3.6-5+deb11u1"},"fixed_version":"0.3.6-4","urgency":"not yet assigned"},"forky":{"status":"resolved","repositories":{"forky":"0.3.6-7"},"fixed_version":"0.3.6-4","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"0.3.6-7"},"fixed_version":"0.3.6-4","urgency":"not yet assigned"},"trixie":{"status":"resolved","repositories":{"trixie":"0.3.6-7"},"fixed_version":"0.3.6-4","urgency":"not yet assigned"}}},"CVE-2017-6834":{"description":"Heap-based buffer overflow in the ulaw2linear_buf function in G711.cpp in Audio File Library (aka audiofile) 0.3.6, 0.3.5, 0.3.4, 0.3.3, 0.3.2, 0.3.1, 0.3.0, 0.2.7 allows remote attackers to cause a denial of service (crash) via a crafted file.","debianbug":857651,"scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"0.3.6-5+deb12u1"},"fixed_version":"0.3.6-4","urgency":"not yet assigned"},"bullseye":{"status":"resolved","repositories":{"bullseye":"0.3.6-5","bullseye-security":"0.3.6-5+deb11u1"},"fixed_version":"0.3.6-4","urgency":"not yet assigned"},"forky":{"status":"resolved","repositories":{"forky":"0.3.6-7"},"fixed_version":"0.3.6-4","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"0.3.6-7"},"fixed_version":"0.3.6-4","urgency":"not yet assigned"},"trixie":{"status":"resolved","repositories":{"trixie":"0.3.6-7"},"fixed_version":"0.3.6-4","urgency":"not yet assigned"}}},"CVE-2017-6835":{"description":"The reset1 function in libaudiofile/modules/BlockCodec.cpp in Audio File Library (aka audiofile) 0.3.6 allows remote attackers to cause a denial of service (divide-by-zero error and crash) via a crafted file.","debianbug":857651,"scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"0.3.6-5+deb12u1"},"fixed_version":"0.3.6-4","urgency":"not yet assigned"},"bullseye":{"status":"resolved","repositories":{"bullseye":"0.3.6-5","bullseye-security":"0.3.6-5+deb11u1"},"fixed_version":"0.3.6-4","urgency":"not yet assigned"},"forky":{"status":"resolved","repositories":{"forky":"0.3.6-7"},"fixed_version":"0.3.6-4","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"0.3.6-7"},"fixed_version":"0.3.6-4","urgency":"not yet assigned"},"trixie":{"status":"resolved","repositories":{"trixie":"0.3.6-7"},"fixed_version":"0.3.6-4","urgency":"not yet assigned"}}},"CVE-2017-6836":{"description":"Heap-based buffer overflow in the Expand3To4Module::run function in libaudiofile/modules/SimpleModule.h in Audio File Library (aka audiofile) 0.3.6, 0.3.5, 0.3.4, 0.3.3, 0.3.2, 0.3.1, 0.3.0 allows remote attackers to cause a denial of service (crash) via a crafted file.","debianbug":857651,"scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"0.3.6-5+deb12u1"},"fixed_version":"0.3.6-4","urgency":"not yet assigned"},"bullseye":{"status":"resolved","repositories":{"bullseye":"0.3.6-5","bullseye-security":"0.3.6-5+deb11u1"},"fixed_version":"0.3.6-4","urgency":"not yet assigned"},"forky":{"status":"resolved","repositories":{"forky":"0.3.6-7"},"fixed_version":"0.3.6-4","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"0.3.6-7"},"fixed_version":"0.3.6-4","urgency":"not yet assigned"},"trixie":{"status":"resolved","repositories":{"trixie":"0.3.6-7"},"fixed_version":"0.3.6-4","urgency":"not yet assigned"}}},"CVE-2017-6837":{"description":"WAVE.cpp in Audio File Library (aka audiofile) 0.3.6 allows remote attackers to cause a denial of service (crash) via vectors related to a large number of coefficients.","debianbug":857651,"scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"0.3.6-5+deb12u1"},"fixed_version":"0.3.6-4","urgency":"not yet assigned"},"bullseye":{"status":"resolved","repositories":{"bullseye":"0.3.6-5","bullseye-security":"0.3.6-5+deb11u1"},"fixed_version":"0.3.6-4","urgency":"not yet assigned"},"forky":{"status":"resolved","repositories":{"forky":"0.3.6-7"},"fixed_version":"0.3.6-4","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"0.3.6-7"},"fixed_version":"0.3.6-4","urgency":"not yet assigned"},"trixie":{"status":"resolved","repositories":{"trixie":"0.3.6-7"},"fixed_version":"0.3.6-4","urgency":"not yet assigned"}}},"CVE-2017-6838":{"description":"Integer overflow in sfcommands/sfconvert.c in Audio File Library (aka audiofile) 0.3.6 allows remote attackers to cause a denial of service (crash) via a crafted file.","debianbug":857651,"scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"0.3.6-5+deb12u1"},"fixed_version":"0.3.6-4","urgency":"not yet assigned"},"bullseye":{"status":"resolved","repositories":{"bullseye":"0.3.6-5","bullseye-security":"0.3.6-5+deb11u1"},"fixed_version":"0.3.6-4","urgency":"not yet assigned"},"forky":{"status":"resolved","repositories":{"forky":"0.3.6-7"},"fixed_version":"0.3.6-4","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"0.3.6-7"},"fixed_version":"0.3.6-4","urgency":"not yet assigned"},"trixie":{"status":"resolved","repositories":{"trixie":"0.3.6-7"},"fixed_version":"0.3.6-4","urgency":"not yet assigned"}}},"CVE-2017-6839":{"description":"Integer overflow in modules/MSADPCM.cpp in Audio File Library (aka audiofile) 0.3.6 allows remote attackers to cause a denial of service (crash) via a crafted file.","debianbug":857651,"scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"0.3.6-5+deb12u1"},"fixed_version":"0.3.6-4","urgency":"not yet assigned"},"bullseye":{"status":"resolved","repositories":{"bullseye":"0.3.6-5","bullseye-security":"0.3.6-5+deb11u1"},"fixed_version":"0.3.6-4","urgency":"not yet assigned"},"forky":{"status":"resolved","repositories":{"forky":"0.3.6-7"},"fixed_version":"0.3.6-4","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"0.3.6-7"},"fixed_version":"0.3.6-4","urgency":"not yet assigned"},"trixie":{"status":"resolved","repositories":{"trixie":"0.3.6-7"},"fixed_version":"0.3.6-4","urgency":"not yet assigned"}}},"CVE-2018-13440":{"description":"The audiofile Audio File Library 0.3.6 has a NULL pointer dereference bug in ModuleState::setup in modules/ModuleState.cpp, which allows an attacker to cause a denial of service via a crafted caf file, as demonstrated by sfconvert.","debianbug":903499,"scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"0.3.6-5+deb12u1"},"fixed_version":"0.3.6-5","urgency":"low"},"bullseye":{"status":"resolved","repositories":{"bullseye":"0.3.6-5","bullseye-security":"0.3.6-5+deb11u1"},"fixed_version":"0.3.6-5","urgency":"low"},"forky":{"status":"resolved","repositories":{"forky":"0.3.6-7"},"fixed_version":"0.3.6-5","urgency":"low"},"sid":{"status":"resolved","repositories":{"sid":"0.3.6-7"},"fixed_version":"0.3.6-5","urgency":"low"},"trixie":{"status":"resolved","repositories":{"trixie":"0.3.6-7"},"fixed_version":"0.3.6-5","urgency":"low"}}},"CVE-2018-17095":{"description":"An issue has been discovered in mpruett Audio File Library (aka audiofile) 0.3.6, 0.3.5, 0.3.4, 0.3.3, 0.3.2, 0.3.1, 0.3.0. A heap-based buffer overflow in Expand3To4Module::run has occurred when running sfconvert.","debianbug":913166,"scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"0.3.6-5+deb12u1"},"fixed_version":"0.3.6-5","urgency":"low"},"bullseye":{"status":"resolved","repositories":{"bullseye":"0.3.6-5","bullseye-security":"0.3.6-5+deb11u1"},"fixed_version":"0.3.6-5","urgency":"low"},"forky":{"status":"resolved","repositories":{"forky":"0.3.6-7"},"fixed_version":"0.3.6-5","urgency":"low"},"sid":{"status":"resolved","repositories":{"sid":"0.3.6-7"},"fixed_version":"0.3.6-5","urgency":"low"},"trixie":{"status":"resolved","repositories":{"trixie":"0.3.6-7"},"fixed_version":"0.3.6-5","urgency":"low"}}},"CVE-2019-13147":{"description":"In Audio File Library (aka audiofile) 0.3.6, there exists one NULL pointer dereference bug in ulaw2linear_buf in G711.cpp in libmodules.a that allows an attacker to cause a denial of service via a crafted file.","debianbug":931343,"scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"0.3.6-5+deb12u1"},"fixed_version":"0.3.6-5+deb12u1","urgency":"not yet assigned"},"bullseye":{"status":"resolved","repositories":{"bullseye":"0.3.6-5","bullseye-security":"0.3.6-5+deb11u1"},"fixed_version":"0.3.6-5+deb11u1","urgency":"not yet assigned"},"forky":{"status":"resolved","repositories":{"forky":"0.3.6-7"},"fixed_version":"0.3.6-6","urgency":"low"},"sid":{"status":"resolved","repositories":{"sid":"0.3.6-7"},"fixed_version":"0.3.6-6","urgency":"low"},"trixie":{"status":"resolved","repositories":{"trixie":"0.3.6-7"},"fixed_version":"0.3.6-6","urgency":"low"}}},"CVE-2020-18781":{"description":"Heap buffer overflow vulnerability in FilePOSIX::read in File.cpp in audiofile 0.3.6 may cause denial-of-service via a crafted wav file, this bug can be triggered by the executable sfconvert.","scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"0.3.6-5+deb12u1"},"fixed_version":"0.3.6-4","urgency":"not yet assigned"},"bullseye":{"status":"resolved","repositories":{"bullseye":"0.3.6-5","bullseye-security":"0.3.6-5+deb11u1"},"fixed_version":"0.3.6-4","urgency":"not yet assigned"},"forky":{"status":"resolved","repositories":{"forky":"0.3.6-7"},"fixed_version":"0.3.6-4","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"0.3.6-7"},"fixed_version":"0.3.6-4","urgency":"not yet assigned"},"trixie":{"status":"resolved","repositories":{"trixie":"0.3.6-7"},"fixed_version":"0.3.6-4","urgency":"not yet assigned"}}},"CVE-2022-24599":{"description":"In autofile Audio File Library 0.3.6, there exists one memory leak vulnerability in printfileinfo, in printinfo.c, which allows an attacker to leak sensitive information via a crafted file. The printfileinfo function calls the copyrightstring function to get data, however, it dosn't use zero bytes to truncate the data.","debianbug":1008017,"scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"0.3.6-5+deb12u1"},"fixed_version":"0.3.6-5+deb12u1","urgency":"not yet assigned"},"bullseye":{"status":"resolved","repositories":{"bullseye":"0.3.6-5","bullseye-security":"0.3.6-5+deb11u1"},"fixed_version":"0.3.6-5+deb11u1","urgency":"not yet assigned"},"forky":{"status":"resolved","repositories":{"forky":"0.3.6-7"},"fixed_version":"0.3.6-6","urgency":"unimportant"},"sid":{"status":"resolved","repositories":{"sid":"0.3.6-7"},"fixed_version":"0.3.6-6","urgency":"unimportant"},"trixie":{"status":"resolved","repositories":{"trixie":"0.3.6-7"},"fixed_version":"0.3.6-6","urgency":"unimportant"}}},"CVE-2025-50950":{"description":"Audiofile v0.3.7 was discovered to contain a NULL pointer dereference via the ModuleState::setup function.","debianbug":1118940,"scope":"local","releases":{"bookworm":{"status":"open","repositories":{"bookworm":"0.3.6-5+deb12u1"},"urgency":"not yet assigned","nodsa":"Minor issue","nodsa_reason":""},"bullseye":{"status":"open","repositories":{"bullseye":"0.3.6-5","bullseye-security":"0.3.6-5+deb11u1"},"urgency":"not yet assigned","nodsa":"Minor issue","nodsa_reason":"postponed"},"forky":{"status":"open","repositories":{"forky":"0.3.6-7"},"urgency":"not yet assigned"},"sid":{"status":"open","repositories":{"sid":"0.3.6-7"},"urgency":"not yet assigned"},"trixie":{"status":"open","repositories":{"trixie":"0.3.6-7"},"urgency":"not yet assigned","nodsa":"Minor issue","nodsa_reason":""}}}},"audiolink":{"CVE-2008-4942":{"description":"audiolink in audiolink 0.05 allows local users to overwrite arbitrary files via a symlink attack on the (1) /tmp/audiolink.db.tmp and (2) /tmp/audiolink.tb.tmp temporary files.","debianbug":496433,"scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"0.05-4"},"fixed_version":"0.05-1.1","urgency":"low"},"bullseye":{"status":"resolved","repositories":{"bullseye":"0.05-4"},"fixed_version":"0.05-1.1","urgency":"low"},"forky":{"status":"resolved","repositories":{"forky":"0.05-4"},"fixed_version":"0.05-1.1","urgency":"low"},"sid":{"status":"resolved","repositories":{"sid":"0.05-4"},"fixed_version":"0.05-1.1","urgency":"low"},"trixie":{"status":"resolved","repositories":{"trixie":"0.05-4"},"fixed_version":"0.05-1.1","urgency":"low"}}}},"audit":{"CVE-2008-1628":{"description":"Stack-based buffer overflow in the audit_log_user_command function in lib/audit_logging.c in Linux Audit before 1.7 might allow remote attackers to execute arbitrary code via a long command argument. NOTE: some of these details are obtained from third party information.","debianbug":475227,"scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"1:3.0.9-1"},"fixed_version":"1.5.3-2.1","urgency":"medium"},"bullseye":{"status":"resolved","repositories":{"bullseye":"1:3.0-2"},"fixed_version":"1.5.3-2.1","urgency":"medium"},"forky":{"status":"resolved","repositories":{"forky":"1:4.1.2-1"},"fixed_version":"1.5.3-2.1","urgency":"medium"},"sid":{"status":"resolved","repositories":{"sid":"1:4.1.2-1"},"fixed_version":"1.5.3-2.1","urgency":"medium"},"trixie":{"status":"resolved","repositories":{"trixie":"1:4.0.2-2"},"fixed_version":"1.5.3-2.1","urgency":"medium"}}},"CVE-2015-5186":{"description":"Audit before 2.4.4 in Linux does not sanitize escape characters in filenames.","debianbug":795457,"scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"1:3.0.9-1"},"fixed_version":"1:2.4.4-1","urgency":"unimportant"},"bullseye":{"status":"resolved","repositories":{"bullseye":"1:3.0-2"},"fixed_version":"1:2.4.4-1","urgency":"unimportant"},"forky":{"status":"resolved","repositories":{"forky":"1:4.1.2-1"},"fixed_version":"1:2.4.4-1","urgency":"unimportant"},"sid":{"status":"resolved","repositories":{"sid":"1:4.1.2-1"},"fixed_version":"1:2.4.4-1","urgency":"unimportant"},"trixie":{"status":"resolved","repositories":{"trixie":"1:4.0.2-2"},"fixed_version":"1:2.4.4-1","urgency":"unimportant"}}}},"augeas":{"CVE-2012-0786":{"description":"The transform_save function in transform.c in Augeas before 1.0.0 allows local users to overwrite arbitrary files and obtain sensitive information via a symlink attack on a .augnew file.","debianbug":731132,"scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"1.14.0-1"},"fixed_version":"1.0.0-1","urgency":"low"},"bullseye":{"status":"resolved","repositories":{"bullseye":"1.12.0-2"},"fixed_version":"1.0.0-1","urgency":"low"},"forky":{"status":"resolved","repositories":{"forky":"1.14.1-1.1"},"fixed_version":"1.0.0-1","urgency":"low"},"sid":{"status":"resolved","repositories":{"sid":"1.14.1-1.1"},"fixed_version":"1.0.0-1","urgency":"low"},"trixie":{"status":"resolved","repositories":{"trixie":"1.14.1-1"},"fixed_version":"1.0.0-1","urgency":"low"}}},"CVE-2012-0787":{"description":"The clone_file function in transfer.c in Augeas before 1.0.0, when copy_if_rename_fails is set and EXDEV or EBUSY is returned by the rename function, allows local users to overwrite arbitrary files and obtain sensitive information via a bind mount on the (1) .augsave or (2) destination file when using the backup save option, or (3) .augnew file when using the newfile save option.","debianbug":731132,"scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"1.14.0-1"},"fixed_version":"1.0.0-1","urgency":"low"},"bullseye":{"status":"resolved","repositories":{"bullseye":"1.12.0-2"},"fixed_version":"1.0.0-1","urgency":"low"},"forky":{"status":"resolved","repositories":{"forky":"1.14.1-1.1"},"fixed_version":"1.0.0-1","urgency":"low"},"sid":{"status":"resolved","repositories":{"sid":"1.14.1-1.1"},"fixed_version":"1.0.0-1","urgency":"low"},"trixie":{"status":"resolved","repositories":{"trixie":"1.14.1-1"},"fixed_version":"1.0.0-1","urgency":"low"}}},"CVE-2012-6607":{"description":"The transform_save function in transform.c in Augeas before 1.0.0 allows local users to overwrite arbitrary files and obtain sensitive information via a symlink attack on a .augsave file in a backup save action, a different vector than CVE-2012-0786.","scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"1.14.0-1"},"fixed_version":"1.0.0-1","urgency":"low"},"bullseye":{"status":"resolved","repositories":{"bullseye":"1.12.0-2"},"fixed_version":"1.0.0-1","urgency":"low"},"forky":{"status":"resolved","repositories":{"forky":"1.14.1-1.1"},"fixed_version":"1.0.0-1","urgency":"low"},"sid":{"status":"resolved","repositories":{"sid":"1.14.1-1.1"},"fixed_version":"1.0.0-1","urgency":"low"},"trixie":{"status":"resolved","repositories":{"trixie":"1.14.1-1"},"fixed_version":"1.0.0-1","urgency":"low"}}},"CVE-2013-6412":{"description":"The transform_save function in transform.c in Augeas 1.0.0 through 1.1.0 does not properly calculate the permission values when the umask contains a \"7,\" which causes world-writable permissions to be used for new files and allows local users to modify the files via unspecified vectors.","debianbug":731111,"scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"1.14.0-1"},"fixed_version":"1.2.0-0.1","urgency":"not yet assigned"},"bullseye":{"status":"resolved","repositories":{"bullseye":"1.12.0-2"},"fixed_version":"1.2.0-0.1","urgency":"not yet assigned"},"forky":{"status":"resolved","repositories":{"forky":"1.14.1-1.1"},"fixed_version":"1.2.0-0.1","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"1.14.1-1.1"},"fixed_version":"1.2.0-0.1","urgency":"not yet assigned"},"trixie":{"status":"resolved","repositories":{"trixie":"1.14.1-1"},"fixed_version":"1.2.0-0.1","urgency":"not yet assigned"}}},"CVE-2017-7555":{"description":"Augeas versions up to and including 1.8.0 are vulnerable to heap-based buffer overflow due to improper handling of escaped strings. Attacker could send crafted strings that would cause the application using augeas to copy past the end of a buffer, leading to a crash or possible code execution.","debianbug":872400,"scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"1.14.0-1"},"fixed_version":"1.8.1-1","urgency":"not yet assigned"},"bullseye":{"status":"resolved","repositories":{"bullseye":"1.12.0-2"},"fixed_version":"1.8.1-1","urgency":"not yet assigned"},"forky":{"status":"resolved","repositories":{"forky":"1.14.1-1.1"},"fixed_version":"1.8.1-1","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"1.14.1-1.1"},"fixed_version":"1.8.1-1","urgency":"not yet assigned"},"trixie":{"status":"resolved","repositories":{"trixie":"1.14.1-1"},"fixed_version":"1.8.1-1","urgency":"not yet assigned"}}},"CVE-2025-2588":{"description":"A vulnerability has been found in Hercules Augeas 1.14.1 and classified as problematic. This vulnerability affects the function re_case_expand of the file src/fa.c. The manipulation of the argument re leads to null pointer dereference. Attacking locally is a requirement. The exploit has been disclosed to the public and may be used.","debianbug":1101714,"scope":"local","releases":{"bookworm":{"status":"open","repositories":{"bookworm":"1.14.0-1"},"urgency":"not yet assigned","nodsa":"Minor issue","nodsa_reason":""},"bullseye":{"status":"open","repositories":{"bullseye":"1.12.0-2"},"urgency":"not yet assigned","nodsa":"Minor issue","nodsa_reason":"postponed"},"forky":{"status":"resolved","repositories":{"forky":"1.14.1-1.1"},"fixed_version":"1.14.1-1.1","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"1.14.1-1.1"},"fixed_version":"1.14.1-1.1","urgency":"not yet assigned"},"trixie":{"status":"open","repositories":{"trixie":"1.14.1-1"},"urgency":"not yet assigned","nodsa":"Minor issue","nodsa_reason":"","next_point_update":true}}}},"autofs":{"CVE-2007-5964":{"description":"The default configuration of autofs 5 in some Linux distributions, such as Red Hat Enterprise Linux (RHEL) 5, omits the nosuid option for the hosts (/net filesystem) map, which allows local users to gain privileges via a setuid program on a remote NFS server.","scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"5.1.8-2+deb12u2"},"fixed_version":"3.1.4-8","urgency":"medium"},"bullseye":{"status":"resolved","repositories":{"bullseye":"5.1.7-1+deb11u2"},"fixed_version":"3.1.4-8","urgency":"medium"},"forky":{"status":"resolved","repositories":{"forky":"5.1.9-1.2"},"fixed_version":"3.1.4-8","urgency":"medium"},"sid":{"status":"resolved","repositories":{"sid":"5.1.9-1.2"},"fixed_version":"3.1.4-8","urgency":"medium"},"trixie":{"status":"resolved","repositories":{"trixie":"5.1.9-1.2"},"fixed_version":"3.1.4-8","urgency":"medium"}}},"CVE-2007-6285":{"description":"The default configuration for autofs 5 (autofs5) in some Linux distributions, such as Red Hat Enterprise Linux (RHEL) 4 and 5, does not specify the nodev mount option for the -hosts map, which allows local users to access \"important devices\" by operating a remote NFS server and creating special device files on that server, as demonstrated by the /dev/mem device.","scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"5.1.8-2+deb12u2"},"fixed_version":"0","urgency":"unimportant"},"bullseye":{"status":"resolved","repositories":{"bullseye":"5.1.7-1+deb11u2"},"fixed_version":"0","urgency":"unimportant"},"forky":{"status":"resolved","repositories":{"forky":"5.1.9-1.2"},"fixed_version":"0","urgency":"unimportant"},"sid":{"status":"resolved","repositories":{"sid":"5.1.9-1.2"},"fixed_version":"0","urgency":"unimportant"},"trixie":{"status":"resolved","repositories":{"trixie":"5.1.9-1.2"},"fixed_version":"0","urgency":"unimportant"}}},"CVE-2012-2697":{"description":"Unspecified vulnerability in autofs, as used in Red Hat Enterprise Linux (RHEL) 5, allows local users to cause a denial of service (autofs crash and delayed mounts) or prevent \"mount expiration\" via unspecified vectors related to \"using an LDAP-based automount map.\"","scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"5.1.8-2+deb12u2"},"fixed_version":"5.0.6-1","urgency":"not yet assigned"},"bullseye":{"status":"resolved","repositories":{"bullseye":"5.1.7-1+deb11u2"},"fixed_version":"5.0.6-1","urgency":"not yet assigned"},"forky":{"status":"resolved","repositories":{"forky":"5.1.9-1.2"},"fixed_version":"5.0.6-1","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"5.1.9-1.2"},"fixed_version":"5.0.6-1","urgency":"not yet assigned"},"trixie":{"status":"resolved","repositories":{"trixie":"5.1.9-1.2"},"fixed_version":"5.0.6-1","urgency":"not yet assigned"}}},"CVE-2014-8169":{"description":"automount 5.0.8, when a program map uses certain interpreted languages, uses the calling user's USER and HOME environment variable values instead of the values for the user used to run the mapped program, which allows local users to gain privileges via a Trojan horse program in the user home directory.","debianbug":779591,"scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"5.1.8-2+deb12u2"},"fixed_version":"5.0.8-2","urgency":"not yet assigned"},"bullseye":{"status":"resolved","repositories":{"bullseye":"5.1.7-1+deb11u2"},"fixed_version":"5.0.8-2","urgency":"not yet assigned"},"forky":{"status":"resolved","repositories":{"forky":"5.1.9-1.2"},"fixed_version":"5.0.8-2","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"5.1.9-1.2"},"fixed_version":"5.0.8-2","urgency":"not yet assigned"},"trixie":{"status":"resolved","repositories":{"trixie":"5.1.9-1.2"},"fixed_version":"5.0.8-2","urgency":"not yet assigned"}}}},"autogen":{"CVE-2025-8746":{"description":"A vulnerability, which was classified as problematic, was found in GNU libopts up to 27.6. Affected is the function __strstr_sse2. The manipulation leads to memory corruption. Local access is required to approach this attack. The exploit has been disclosed to the public and may be used. This issue was initially reported to the tcpreplay project, but the code maintainer explains, that this \"bug appears to be in libopts which is an external library.\" This vulnerability only affects products that are no longer supported by the maintainer.","scope":"local","releases":{"bookworm":{"status":"open","repositories":{"bookworm":"1:5.18.16-5"},"urgency":"unimportant"},"bullseye":{"status":"open","repositories":{"bullseye":"1:5.18.16-4"},"urgency":"unimportant"},"forky":{"status":"open","repositories":{"forky":"1:5.18.16-7"},"urgency":"unimportant"},"sid":{"status":"open","repositories":{"sid":"1:5.18.16-7"},"urgency":"unimportant"},"trixie":{"status":"open","repositories":{"trixie":"1:5.18.16-7"},"urgency":"unimportant"}}}},"autojump":{"CVE-2013-2012":{"description":"autojump before 21.5.8 allows local users to gain privileges via a Trojan horse custom_install directory in the current working directory.","scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"22.5.1-1.1"},"fixed_version":"0","urgency":"unimportant"},"bullseye":{"status":"resolved","repositories":{"bullseye":"22.5.1-1.1"},"fixed_version":"0","urgency":"unimportant"},"forky":{"status":"resolved","repositories":{"forky":"22.5.1-1.1"},"fixed_version":"0","urgency":"unimportant"},"sid":{"status":"resolved","repositories":{"sid":"22.5.1-1.1"},"fixed_version":"0","urgency":"unimportant"},"trixie":{"status":"resolved","repositories":{"trixie":"22.5.1-1.1"},"fixed_version":"0","urgency":"unimportant"}}}},"autokey":{"CVE-2010-0398":{"description":"The init script in autokey before 0.61.3-2 allows local attackers to write to arbitrary files via a symlink attack.","scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"0.95.10-2.1"},"fixed_version":"0.61.3-2","urgency":"not yet assigned"},"bullseye":{"status":"resolved","repositories":{"bullseye":"0.95.10-2"},"fixed_version":"0.61.3-2","urgency":"not yet assigned"},"forky":{"status":"resolved","repositories":{"forky":"0.96.0-1"},"fixed_version":"0.61.3-2","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"0.96.0-1"},"fixed_version":"0.61.3-2","urgency":"not yet assigned"},"trixie":{"status":"resolved","repositories":{"trixie":"0.96.0-1"},"fixed_version":"0.61.3-2","urgency":"not yet assigned"}}}},"automake":{"CVE-2009-4029":{"description":"The (1) dist or (2) distcheck rules in GNU Automake 1.11.1, 1.10.3, and release branches branch-1-4 through branch-1-9, when producing a distribution tarball for a package that uses Automake, assign insecure permissions (777) to directories in the build tree, which introduces a race condition that allows local users to modify the contents of package files, introduce Trojan horse programs, or conduct other attacks before the build is complete.","scope":"local","releases":{"forky":{"status":"resolved","repositories":{"forky":"1:1.18.1-4"},"fixed_version":"1:1.4-p6-13.1","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"1:1.18.1-4"},"fixed_version":"1:1.4-p6-13.1","urgency":"not yet assigned"}}},"CVE-2012-3386":{"description":"The \"make distcheck\" rule in GNU Automake before 1.11.6 and 1.12.x before 1.12.2 grants world-writable permissions to the extraction directory, which introduces a race condition that allows local users to execute arbitrary code via unspecified vectors.","scope":"local","releases":{"forky":{"status":"resolved","repositories":{"forky":"1:1.18.1-4"},"fixed_version":"1:1.4-p6-13.1","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"1:1.18.1-4"},"fixed_version":"1:1.4-p6-13.1","urgency":"not yet assigned"}}}},"automake1.11":{"CVE-2012-3386":{"description":"The \"make distcheck\" rule in GNU Automake before 1.11.6 and 1.12.x before 1.12.2 grants world-writable permissions to the extraction directory, which introduces a race condition that allows local users to execute arbitrary code via unspecified vectors.","debianbug":681097,"scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"1:1.11.6-6"},"fixed_version":"1:1.11.6-1","urgency":"not yet assigned"},"bullseye":{"status":"resolved","repositories":{"bullseye":"1:1.11.6-6"},"fixed_version":"1:1.11.6-1","urgency":"not yet assigned"}}},"TEMP-0827346-22ED59":{"debianbug":827346,"releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"1:1.11.6-6"},"fixed_version":"1:1.11.6-4","urgency":"unimportant"},"bullseye":{"status":"resolved","repositories":{"bullseye":"1:1.11.6-6"},"fixed_version":"1:1.11.6-4","urgency":"unimportant"}}}},"automysqlbackup":{"TEMP-0706099-FAF305":{"debianbug":706099,"releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"2.6+debian.4-4"},"fixed_version":"2.6+debian.3-1","urgency":"not yet assigned"},"bullseye":{"status":"resolved","repositories":{"bullseye":"2.6+debian.4-3+deb11u1"},"fixed_version":"2.6+debian.3-1","urgency":"not yet assigned"},"forky":{"status":"resolved","repositories":{"forky":"2.6+debian.4-4"},"fixed_version":"2.6+debian.3-1","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"2.6+debian.4-4"},"fixed_version":"2.6+debian.3-1","urgency":"not yet assigned"},"trixie":{"status":"resolved","repositories":{"trixie":"2.6+debian.4-4"},"fixed_version":"2.6+debian.3-1","urgency":"not yet assigned"}}}},"autopostgresqlbackup":{"TEMP-0706095-6DFA71":{"debianbug":706095,"releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"1.1-1.1"},"fixed_version":"1.0-2","urgency":"not yet assigned"},"forky":{"status":"resolved","repositories":{"forky":"2.5-1"},"fixed_version":"1.0-2","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"2.5-1"},"fixed_version":"1.0-2","urgency":"not yet assigned"},"trixie":{"status":"resolved","repositories":{"trixie":"2.5-1"},"fixed_version":"1.0-2","urgency":"not yet assigned"}}}},"autopsy":{"CVE-2018-1000838":{"description":"autopsy version <= 4.9.0 contains a XML External Entity (XXE) vulnerability in CaseMetadata XML Parser that can result in Disclosure of confidential data, denial of service, SSRF, port scanning. This attack appear to be exploitable via Specially crafted CaseMetadata.","scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"2.24-5"},"fixed_version":"0","urgency":"unimportant"},"bullseye":{"status":"resolved","repositories":{"bullseye":"2.24-5"},"fixed_version":"0","urgency":"unimportant"},"forky":{"status":"resolved","repositories":{"forky":"2.24-6"},"fixed_version":"0","urgency":"unimportant"},"sid":{"status":"resolved","repositories":{"sid":"2.24-6"},"fixed_version":"0","urgency":"unimportant"},"trixie":{"status":"resolved","repositories":{"trixie":"2.24-6"},"fixed_version":"0","urgency":"unimportant"}}}},"avahi":{"CVE-2006-2288":{"description":"Avahi before 0.6.10 allows local users to cause a denial of service (mDNS/DNS-SD service disconnect) via unspecified mDNS name conflicts.","scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"0.8-10+deb12u1"},"fixed_version":"0.6.10-1","urgency":"low"},"bullseye":{"status":"resolved","repositories":{"bullseye":"0.8-5+deb11u2","bullseye-security":"0.8-5+deb11u3"},"fixed_version":"0.6.10-1","urgency":"low"},"forky":{"status":"resolved","repositories":{"forky":"0.8-18"},"fixed_version":"0.6.10-1","urgency":"low"},"sid":{"status":"resolved","repositories":{"sid":"0.8-18"},"fixed_version":"0.6.10-1","urgency":"low"},"trixie":{"status":"resolved","repositories":{"trixie":"0.8-16"},"fixed_version":"0.6.10-1","urgency":"low"}}},"CVE-2006-2289":{"description":"Buffer overflow in avahi-core in Avahi before 0.6.10 allows local users to execute arbitrary code via unknown vectors.","scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"0.8-10+deb12u1"},"fixed_version":"0.6.10-1","urgency":"medium"},"bullseye":{"status":"resolved","repositories":{"bullseye":"0.8-5+deb11u2","bullseye-security":"0.8-5+deb11u3"},"fixed_version":"0.6.10-1","urgency":"medium"},"forky":{"status":"resolved","repositories":{"forky":"0.8-18"},"fixed_version":"0.6.10-1","urgency":"medium"},"sid":{"status":"resolved","repositories":{"sid":"0.8-18"},"fixed_version":"0.6.10-1","urgency":"medium"},"trixie":{"status":"resolved","repositories":{"trixie":"0.8-16"},"fixed_version":"0.6.10-1","urgency":"medium"}}},"CVE-2006-5461":{"description":"Avahi before 0.6.15 does not verify the sender identity of netlink messages to ensure that they come from the kernel instead of another process, which allows local users to spoof network changes to Avahi.","scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"0.8-10+deb12u1"},"fixed_version":"0.6.15-1","urgency":"low"},"bullseye":{"status":"resolved","repositories":{"bullseye":"0.8-5+deb11u2","bullseye-security":"0.8-5+deb11u3"},"fixed_version":"0.6.15-1","urgency":"low"},"forky":{"status":"resolved","repositories":{"forky":"0.8-18"},"fixed_version":"0.6.15-1","urgency":"low"},"sid":{"status":"resolved","repositories":{"sid":"0.8-18"},"fixed_version":"0.6.15-1","urgency":"low"},"trixie":{"status":"resolved","repositories":{"trixie":"0.8-16"},"fixed_version":"0.6.15-1","urgency":"low"}}},"CVE-2006-6870":{"description":"The consume_labels function in avahi-core/dns.c in Avahi before 0.6.16 allows remote attackers to cause a denial of service (infinite loop) via a crafted compressed DNS response with a label that points to itself.","scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"0.8-10+deb12u1"},"fixed_version":"0.6.16-1","urgency":"low"},"bullseye":{"status":"resolved","repositories":{"bullseye":"0.8-5+deb11u2","bullseye-security":"0.8-5+deb11u3"},"fixed_version":"0.6.16-1","urgency":"low"},"forky":{"status":"resolved","repositories":{"forky":"0.8-18"},"fixed_version":"0.6.16-1","urgency":"low"},"sid":{"status":"resolved","repositories":{"sid":"0.8-18"},"fixed_version":"0.6.16-1","urgency":"low"},"trixie":{"status":"resolved","repositories":{"trixie":"0.8-16"},"fixed_version":"0.6.16-1","urgency":"low"}}},"CVE-2007-3372":{"description":"The Avahi daemon in Avahi before 0.6.20 allows attackers to cause a denial of service (exit) via empty TXT data over D-Bus, which triggers an assert error.","scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"0.8-10+deb12u1"},"fixed_version":"0.6.20-2","urgency":"low"},"bullseye":{"status":"resolved","repositories":{"bullseye":"0.8-5+deb11u2","bullseye-security":"0.8-5+deb11u3"},"fixed_version":"0.6.20-2","urgency":"low"},"forky":{"status":"resolved","repositories":{"forky":"0.8-18"},"fixed_version":"0.6.20-2","urgency":"low"},"sid":{"status":"resolved","repositories":{"sid":"0.8-18"},"fixed_version":"0.6.20-2","urgency":"low"},"trixie":{"status":"resolved","repositories":{"trixie":"0.8-16"},"fixed_version":"0.6.20-2","urgency":"low"}}},"CVE-2008-5081":{"description":"The originates_from_local_legacy_unicast_socket function (avahi-core/server.c) in avahi-daemon in Avahi before 0.6.24 allows remote attackers to cause a denial of service (crash) via a crafted mDNS packet with a source port of 0, which triggers an assertion failure.","debianbug":508700,"scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"0.8-10+deb12u1"},"fixed_version":"0.6.23-3","urgency":"low"},"bullseye":{"status":"resolved","repositories":{"bullseye":"0.8-5+deb11u2","bullseye-security":"0.8-5+deb11u3"},"fixed_version":"0.6.23-3","urgency":"low"},"forky":{"status":"resolved","repositories":{"forky":"0.8-18"},"fixed_version":"0.6.23-3","urgency":"low"},"sid":{"status":"resolved","repositories":{"sid":"0.8-18"},"fixed_version":"0.6.23-3","urgency":"low"},"trixie":{"status":"resolved","repositories":{"trixie":"0.8-16"},"fixed_version":"0.6.23-3","urgency":"low"}}},"CVE-2009-0758":{"description":"The originates_from_local_legacy_unicast_socket function in avahi-core/server.c in avahi-daemon 0.6.23 does not account for the network byte order of a port number when processing incoming multicast packets, which allows remote attackers to cause a denial of service (network bandwidth and CPU consumption) via a crafted legacy unicast mDNS query packet that triggers a multicast packet storm.","debianbug":517683,"scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"0.8-10+deb12u1"},"fixed_version":"0.6.24-3","urgency":"low"},"bullseye":{"status":"resolved","repositories":{"bullseye":"0.8-5+deb11u2","bullseye-security":"0.8-5+deb11u3"},"fixed_version":"0.6.24-3","urgency":"low"},"forky":{"status":"resolved","repositories":{"forky":"0.8-18"},"fixed_version":"0.6.24-3","urgency":"low"},"sid":{"status":"resolved","repositories":{"sid":"0.8-18"},"fixed_version":"0.6.24-3","urgency":"low"},"trixie":{"status":"resolved","repositories":{"trixie":"0.8-16"},"fixed_version":"0.6.24-3","urgency":"low"}}},"CVE-2010-2244":{"description":"The AvahiDnsPacket function in avahi-core/socket.c in avahi-daemon in Avahi 0.6.16 and 0.6.25 allows remote attackers to cause a denial of service (assertion failure and daemon exit) via a DNS packet with an invalid checksum followed by a DNS packet with a valid checksum, a different vulnerability than CVE-2008-5081.","scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"0.8-10+deb12u1"},"fixed_version":"0.6.26-1","urgency":"not yet assigned"},"bullseye":{"status":"resolved","repositories":{"bullseye":"0.8-5+deb11u2","bullseye-security":"0.8-5+deb11u3"},"fixed_version":"0.6.26-1","urgency":"not yet assigned"},"forky":{"status":"resolved","repositories":{"forky":"0.8-18"},"fixed_version":"0.6.26-1","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"0.8-18"},"fixed_version":"0.6.26-1","urgency":"not yet assigned"},"trixie":{"status":"resolved","repositories":{"trixie":"0.8-16"},"fixed_version":"0.6.26-1","urgency":"not yet assigned"}}},"CVE-2011-1002":{"description":"avahi-core/socket.c in avahi-daemon in Avahi before 0.6.29 allows remote attackers to cause a denial of service (infinite loop) via an empty mDNS (1) IPv4 or (2) IPv6 UDP packet to port 5353.  NOTE: this vulnerability exists because of an incorrect fix for CVE-2010-2244.","debianbug":614785,"scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"0.8-10+deb12u1"},"fixed_version":"0.6.28-4","urgency":"not yet assigned"},"bullseye":{"status":"resolved","repositories":{"bullseye":"0.8-5+deb11u2","bullseye-security":"0.8-5+deb11u3"},"fixed_version":"0.6.28-4","urgency":"not yet assigned"},"forky":{"status":"resolved","repositories":{"forky":"0.8-18"},"fixed_version":"0.6.28-4","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"0.8-18"},"fixed_version":"0.6.28-4","urgency":"not yet assigned"},"trixie":{"status":"resolved","repositories":{"trixie":"0.8-16"},"fixed_version":"0.6.28-4","urgency":"not yet assigned"}}},"CVE-2017-6519":{"description":"avahi-daemon in Avahi through 0.6.32 and 0.7 inadvertently responds to IPv6 unicast queries with source addresses that are not on-link, which allows remote attackers to cause a denial of service (traffic amplification) and may cause information leakage by obtaining potentially sensitive  information from the responding device via port-5353 UDP packets.  NOTE: this may overlap CVE-2015-2809.","debianbug":917047,"scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"0.8-10+deb12u1"},"fixed_version":"0.7-5","urgency":"unimportant"},"bullseye":{"status":"resolved","repositories":{"bullseye":"0.8-5+deb11u2","bullseye-security":"0.8-5+deb11u3"},"fixed_version":"0.7-5","urgency":"unimportant"},"forky":{"status":"resolved","repositories":{"forky":"0.8-18"},"fixed_version":"0.7-5","urgency":"unimportant"},"sid":{"status":"resolved","repositories":{"sid":"0.8-18"},"fixed_version":"0.7-5","urgency":"unimportant"},"trixie":{"status":"resolved","repositories":{"trixie":"0.8-16"},"fixed_version":"0.7-5","urgency":"unimportant"}}},"CVE-2021-26720":{"description":"avahi-daemon-check-dns.sh in the Debian avahi package through 0.8-4 is executed as root via /etc/network/if-up.d/avahi-daemon, and allows a local attacker to cause a denial of service or create arbitrary empty files via a symlink attack on files under /run/avahi-daemon. NOTE: this only affects the packaging for Debian GNU/Linux (used indirectly by SUSE), not the upstream Avahi product.","scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"0.8-10+deb12u1"},"fixed_version":"0.8-4","urgency":"not yet assigned"},"bullseye":{"status":"resolved","repositories":{"bullseye":"0.8-5+deb11u2","bullseye-security":"0.8-5+deb11u3"},"fixed_version":"0.8-4","urgency":"not yet assigned"},"forky":{"status":"resolved","repositories":{"forky":"0.8-18"},"fixed_version":"0.8-4","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"0.8-18"},"fixed_version":"0.8-4","urgency":"not yet assigned"},"trixie":{"status":"resolved","repositories":{"trixie":"0.8-16"},"fixed_version":"0.8-4","urgency":"not yet assigned"}}},"CVE-2021-3468":{"description":"A flaw was found in avahi in versions 0.6 up to 0.8. The event used to signal the termination of the client connection on the avahi Unix socket is not correctly handled in the client_work function, allowing a local attacker to trigger an infinite loop. The highest threat from this vulnerability is to the availability of the avahi service, which becomes unresponsive after this flaw is triggered.","debianbug":984938,"scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"0.8-10+deb12u1"},"fixed_version":"0.8-7","urgency":"not yet assigned"},"bullseye":{"status":"resolved","repositories":{"bullseye":"0.8-5+deb11u2","bullseye-security":"0.8-5+deb11u3"},"fixed_version":"0.8-5+deb11u2","urgency":"not yet assigned"},"forky":{"status":"resolved","repositories":{"forky":"0.8-18"},"fixed_version":"0.8-7","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"0.8-18"},"fixed_version":"0.8-7","urgency":"not yet assigned"},"trixie":{"status":"resolved","repositories":{"trixie":"0.8-16"},"fixed_version":"0.8-7","urgency":"not yet assigned"}}},"CVE-2021-3502":{"description":"A flaw was found in avahi 0.8-5. A reachable assertion is present in avahi_s_host_name_resolver_start function allowing a local attacker to crash the avahi service by requesting hostname resolutions through the avahi socket or dbus methods for invalid hostnames. The highest threat from this vulnerability is to the service availability.","debianbug":986018,"scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"0.8-10+deb12u1"},"fixed_version":"0.8-6","urgency":"not yet assigned"},"bullseye":{"status":"resolved","repositories":{"bullseye":"0.8-5+deb11u2","bullseye-security":"0.8-5+deb11u3"},"fixed_version":"0.8-5+deb11u1","urgency":"not yet assigned"},"forky":{"status":"resolved","repositories":{"forky":"0.8-18"},"fixed_version":"0.8-6","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"0.8-18"},"fixed_version":"0.8-6","urgency":"not yet assigned"},"trixie":{"status":"resolved","repositories":{"trixie":"0.8-16"},"fixed_version":"0.8-6","urgency":"not yet assigned"}}},"CVE-2023-1981":{"description":"A vulnerability was found in the avahi library. This flaw allows an unprivileged user to make a dbus call, causing the avahi daemon to crash.","debianbug":1034594,"scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"0.8-10+deb12u1"},"fixed_version":"0.8-10","urgency":"not yet assigned"},"bullseye":{"status":"resolved","repositories":{"bullseye":"0.8-5+deb11u2","bullseye-security":"0.8-5+deb11u3"},"fixed_version":"0.8-5+deb11u3","urgency":"not yet assigned"},"forky":{"status":"resolved","repositories":{"forky":"0.8-18"},"fixed_version":"0.8-10","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"0.8-18"},"fixed_version":"0.8-10","urgency":"not yet assigned"},"trixie":{"status":"resolved","repositories":{"trixie":"0.8-16"},"fixed_version":"0.8-10","urgency":"not yet assigned"}}},"CVE-2023-38469":{"description":"A vulnerability was found in Avahi, where a reachable assertion exists in avahi_dns_packet_append_record.","debianbug":1054876,"scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"0.8-10+deb12u1"},"fixed_version":"0.8-10+deb12u1","urgency":"not yet assigned"},"bullseye":{"status":"resolved","repositories":{"bullseye":"0.8-5+deb11u2","bullseye-security":"0.8-5+deb11u3"},"fixed_version":"0.8-5+deb11u3","urgency":"not yet assigned"},"forky":{"status":"resolved","repositories":{"forky":"0.8-18"},"fixed_version":"0.8-14","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"0.8-18"},"fixed_version":"0.8-14","urgency":"not yet assigned"},"trixie":{"status":"resolved","repositories":{"trixie":"0.8-16"},"fixed_version":"0.8-14","urgency":"not yet assigned"}}},"CVE-2023-38470":{"description":"A vulnerability was found in Avahi. A reachable assertion exists in the avahi_escape_label() function.","debianbug":1054877,"scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"0.8-10+deb12u1"},"fixed_version":"0.8-10+deb12u1","urgency":"not yet assigned"},"bullseye":{"status":"resolved","repositories":{"bullseye":"0.8-5+deb11u2","bullseye-security":"0.8-5+deb11u3"},"fixed_version":"0.8-5+deb11u3","urgency":"not yet assigned"},"forky":{"status":"resolved","repositories":{"forky":"0.8-18"},"fixed_version":"0.8-14","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"0.8-18"},"fixed_version":"0.8-14","urgency":"not yet assigned"},"trixie":{"status":"resolved","repositories":{"trixie":"0.8-16"},"fixed_version":"0.8-14","urgency":"not yet assigned"}}},"CVE-2023-38471":{"description":"A vulnerability was found in Avahi. A reachable assertion exists in the dbus_set_host_name function.","debianbug":1054878,"scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"0.8-10+deb12u1"},"fixed_version":"0.8-10+deb12u1","urgency":"not yet assigned"},"bullseye":{"status":"resolved","repositories":{"bullseye":"0.8-5+deb11u2","bullseye-security":"0.8-5+deb11u3"},"fixed_version":"0.8-5+deb11u3","urgency":"not yet assigned"},"forky":{"status":"resolved","repositories":{"forky":"0.8-18"},"fixed_version":"0.8-14","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"0.8-18"},"fixed_version":"0.8-14","urgency":"not yet assigned"},"trixie":{"status":"resolved","repositories":{"trixie":"0.8-16"},"fixed_version":"0.8-14","urgency":"not yet assigned"}}},"CVE-2023-38472":{"description":"A vulnerability was found in Avahi. A reachable assertion exists in the avahi_rdata_parse() function.","debianbug":1054879,"scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"0.8-10+deb12u1"},"fixed_version":"0.8-10+deb12u1","urgency":"not yet assigned"},"bullseye":{"status":"resolved","repositories":{"bullseye":"0.8-5+deb11u2","bullseye-security":"0.8-5+deb11u3"},"fixed_version":"0.8-5+deb11u3","urgency":"not yet assigned"},"forky":{"status":"resolved","repositories":{"forky":"0.8-18"},"fixed_version":"0.8-14","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"0.8-18"},"fixed_version":"0.8-14","urgency":"not yet assigned"},"trixie":{"status":"resolved","repositories":{"trixie":"0.8-16"},"fixed_version":"0.8-14","urgency":"not yet assigned"}}},"CVE-2023-38473":{"description":"A vulnerability was found in Avahi. A reachable assertion exists in the avahi_alternative_host_name() function.","debianbug":1054880,"scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"0.8-10+deb12u1"},"fixed_version":"0.8-10+deb12u1","urgency":"not yet assigned"},"bullseye":{"status":"resolved","repositories":{"bullseye":"0.8-5+deb11u2","bullseye-security":"0.8-5+deb11u3"},"fixed_version":"0.8-5+deb11u3","urgency":"not yet assigned"},"forky":{"status":"resolved","repositories":{"forky":"0.8-18"},"fixed_version":"0.8-14","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"0.8-18"},"fixed_version":"0.8-14","urgency":"not yet assigned"},"trixie":{"status":"resolved","repositories":{"trixie":"0.8-16"},"fixed_version":"0.8-14","urgency":"not yet assigned"}}},"CVE-2024-52615":{"description":"A flaw was found in Avahi-daemon, which relies on fixed source ports for wide-area DNS queries. This issue simplifies attacks where malicious DNS responses are injected.","debianbug":1088110,"scope":"local","releases":{"bookworm":{"status":"open","repositories":{"bookworm":"0.8-10+deb12u1"},"urgency":"not yet assigned","nodsa":"Minor issue; workarounds/mitigation exist by setting enable-wide-area=no","nodsa_reason":""},"bullseye":{"status":"open","repositories":{"bullseye":"0.8-5+deb11u2","bullseye-security":"0.8-5+deb11u3"},"urgency":"not yet assigned","nodsa":"Minor issue; workarounds/mitigation exist by setting enable-wide-area=no","nodsa_reason":"postponed"},"forky":{"status":"open","repositories":{"forky":"0.8-18"},"urgency":"not yet assigned"},"sid":{"status":"open","repositories":{"sid":"0.8-18"},"urgency":"not yet assigned"},"trixie":{"status":"open","repositories":{"trixie":"0.8-16"},"urgency":"not yet assigned","nodsa":"Minor issue; workarounds/mitigation exist by setting enable-wide-area=no","nodsa_reason":""}}},"CVE-2024-52616":{"description":"A flaw was found in the Avahi-daemon, where it initializes DNS transaction IDs randomly only once at startup, incrementing them sequentially after that. This predictable behavior facilitates DNS spoofing attacks, allowing attackers to guess transaction IDs.","debianbug":1088111,"scope":"local","releases":{"bookworm":{"status":"open","repositories":{"bookworm":"0.8-10+deb12u1"},"urgency":"not yet assigned","nodsa":"Minor issue; workarounds/mitigation exist by setting enable-wide-area=no","nodsa_reason":""},"bullseye":{"status":"open","repositories":{"bullseye":"0.8-5+deb11u2","bullseye-security":"0.8-5+deb11u3"},"urgency":"not yet assigned","nodsa":"Minor issue; workarounds/mitigation exist by setting enable-wide-area=no","nodsa_reason":"postponed"},"forky":{"status":"resolved","repositories":{"forky":"0.8-18"},"fixed_version":"0.8-18","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"0.8-18"},"fixed_version":"0.8-18","urgency":"not yet assigned"},"trixie":{"status":"open","repositories":{"trixie":"0.8-16"},"urgency":"not yet assigned","nodsa":"Minor issue; workarounds/mitigation exist by setting enable-wide-area=no","nodsa_reason":""}}},"CVE-2025-59529":{"description":"Avahi is a system which facilitates service discovery on a local network via the mDNS/DNS-SD protocol suite. In versions up to and including 0.9-rc2, the simple protocol server ignores the documented client limit and accepts unlimited connections, allowing for easy local DoS. Although `CLIENTS_MAX` is defined, `server_work()` unconditionally `accept()`s and `client_new()` always appends the new client and increments `n_clients`. There is no check against the limit. When client cannot be accepted as a result of maximal socket number of avahi-daemon, it logs unconditionally error per each connection. Unprivileged local users can exhaust daemon memory and file descriptors, causing a denial of service system-wide for mDNS/DNS-SD. Exhausting local file descriptors causes increased system load caused by logging errors of each of request. Overloading prevents glibc calls using nss-mdns plugins to resolve `*.local.` names and link-local addresses. As of time of publication, no known patched versions are available, but a candidate fix is available in pull request 808, and some workarounds are available. Simple clients are offered for nss-mdns package functionality. It is not possible to disable the unix socket `/run/avahi-daemon/socket`, but resolution requests received via DBus are not affected directly. Tools avahi-resolve, avahi-resolve-address and avahi-resolve-host-name are not affected, they use DBus interface. It is possible to change permissions of unix socket after avahi-daemon is started. But avahi-daemon does not provide any configuration for it. Additional access restrictions like SELinux can also prevent unwanted tools to access the socket and keep resolution working for trusted users.","debianbug":1123671,"scope":"local","releases":{"bookworm":{"status":"open","repositories":{"bookworm":"0.8-10+deb12u1"},"urgency":"not yet assigned","nodsa":"Minor issue, revisit when fixed upstream","nodsa_reason":"postponed"},"bullseye":{"status":"open","repositories":{"bullseye":"0.8-5+deb11u2","bullseye-security":"0.8-5+deb11u3"},"urgency":"not yet assigned","nodsa":"Minor issue, revisit when fixed upstream","nodsa_reason":"postponed"},"forky":{"status":"open","repositories":{"forky":"0.8-18"},"urgency":"not yet assigned"},"sid":{"status":"open","repositories":{"sid":"0.8-18"},"urgency":"not yet assigned"},"trixie":{"status":"open","repositories":{"trixie":"0.8-16"},"urgency":"not yet assigned","nodsa":"Minor issue, revisit when fixed upstream","nodsa_reason":"postponed"}}},"CVE-2025-68276":{"description":"Avahi is a system which facilitates service discovery on a local network via the mDNS/DNS-SD protocol suite. In 0.9-rc2 and earlier, an unprivileged local users can crash avahi-daemon (with wide-area disabled) by creating record browsers with the AVAHI_LOOKUP_USE_WIDE_AREA flag set via D-Bus. This can be done by either calling the RecordBrowserNew method directly or creating hostname/address/service resolvers/browsers that create those browsers internally themselves.","debianbug":1125417,"scope":"local","releases":{"bookworm":{"status":"open","repositories":{"bookworm":"0.8-10+deb12u1"},"urgency":"not yet assigned","nodsa":"Minor issue","nodsa_reason":""},"bullseye":{"status":"open","repositories":{"bullseye":"0.8-5+deb11u2","bullseye-security":"0.8-5+deb11u3"},"urgency":"not yet assigned","nodsa":"Minor issue, clean/assertion crash, revisit when 0.9 is released and packaged","nodsa_reason":"postponed"},"forky":{"status":"resolved","repositories":{"forky":"0.8-18"},"fixed_version":"0.8-18","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"0.8-18"},"fixed_version":"0.8-18","urgency":"not yet assigned"},"trixie":{"status":"open","repositories":{"trixie":"0.8-16"},"urgency":"not yet assigned","nodsa":"Minor issue","nodsa_reason":""}}},"CVE-2025-68468":{"description":"Avahi is a system which facilitates service discovery on a local network via the mDNS/DNS-SD protocol suite. In 0.9-rc2 and earlier, avahi-daemon can be crashed by sending unsolicited announcements containing CNAME resource records pointing it to resource records with short TTLs. As soon as they expire avahi-daemon crashes.","debianbug":1125418,"scope":"local","releases":{"bookworm":{"status":"open","repositories":{"bookworm":"0.8-10+deb12u1"},"urgency":"not yet assigned","nodsa":"Minor issue","nodsa_reason":""},"bullseye":{"status":"open","repositories":{"bullseye":"0.8-5+deb11u2","bullseye-security":"0.8-5+deb11u3"},"urgency":"not yet assigned","nodsa":"Minor issue, clean/assertion crash, revisit when 0.9 is released and packaged","nodsa_reason":"postponed"},"forky":{"status":"resolved","repositories":{"forky":"0.8-18"},"fixed_version":"0.8-18","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"0.8-18"},"fixed_version":"0.8-18","urgency":"not yet assigned"},"trixie":{"status":"open","repositories":{"trixie":"0.8-16"},"urgency":"not yet assigned","nodsa":"Minor issue","nodsa_reason":""}}},"CVE-2025-68471":{"description":"Avahi is a system which facilitates service discovery on a local network via the mDNS/DNS-SD protocol suite. In 0.9-rc2 and earlier, avahi-daemon can be crashed by sending 2 unsolicited announcements with CNAME resource records 2 seconds apart.","debianbug":1125419,"scope":"local","releases":{"bookworm":{"status":"open","repositories":{"bookworm":"0.8-10+deb12u1"},"urgency":"not yet assigned","nodsa":"Minor issue","nodsa_reason":""},"bullseye":{"status":"open","repositories":{"bullseye":"0.8-5+deb11u2","bullseye-security":"0.8-5+deb11u3"},"urgency":"not yet assigned","nodsa":"Minor issue, clean/assertion crash, revisit when 0.9 is released and packaged","nodsa_reason":"postponed"},"forky":{"status":"resolved","repositories":{"forky":"0.8-18"},"fixed_version":"0.8-18","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"0.8-18"},"fixed_version":"0.8-18","urgency":"not yet assigned"},"trixie":{"status":"open","repositories":{"trixie":"0.8-16"},"urgency":"not yet assigned","nodsa":"Minor issue","nodsa_reason":""}}},"CVE-2026-24401":{"description":"Avahi is a system which facilitates service discovery on a local network via the mDNS/DNS-SD protocol suite. In versions 0.9rc2 and below, avahi-daemon can be crashed via a segmentation fault by sending an unsolicited mDNS response containing a recursive CNAME record, where the alias and canonical name point to the same domain (e.g., \"h.local\" as a CNAME for \"h.local\"). This causes unbounded recursion in the lookup_handle_cname function, leading to stack exhaustion. The vulnerability affects record browsers where AVAHI_LOOKUP_USE_MULTICAST is set explicitly, which includes record browsers created by resolvers used by nss-mdns. This issue is patched in commit 78eab31128479f06e30beb8c1cbf99dd921e2524.","debianbug":1126342,"scope":"local","releases":{"bookworm":{"status":"open","repositories":{"bookworm":"0.8-10+deb12u1"},"urgency":"not yet assigned","nodsa":"Minor issue","nodsa_reason":""},"bullseye":{"status":"open","repositories":{"bullseye":"0.8-5+deb11u2","bullseye-security":"0.8-5+deb11u3"},"urgency":"not yet assigned","nodsa":"Minor issue, DoS","nodsa_reason":"postponed"},"forky":{"status":"resolved","repositories":{"forky":"0.8-18"},"fixed_version":"0.8-18","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"0.8-18"},"fixed_version":"0.8-18","urgency":"not yet assigned"},"trixie":{"status":"open","repositories":{"trixie":"0.8-16"},"urgency":"not yet assigned","nodsa":"Minor issue","nodsa_reason":""}}}},"aview":{"CVE-2008-4935":{"description":"asciiview in aview 1.3.0 allows local users to overwrite arbitrary files via a symlink attack on a /tmp/aview#####.pgm temporary file.","debianbug":496422,"scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"1.3.0rc1-9.1"},"fixed_version":"1.3.0rc1-8.1","urgency":"low"},"bullseye":{"status":"resolved","repositories":{"bullseye":"1.3.0rc1-9"},"fixed_version":"1.3.0rc1-8.1","urgency":"low"},"forky":{"status":"resolved","repositories":{"forky":"1.3.0rc1-11"},"fixed_version":"1.3.0rc1-8.1","urgency":"low"},"sid":{"status":"resolved","repositories":{"sid":"1.3.0rc1-11"},"fixed_version":"1.3.0rc1-8.1","urgency":"low"},"trixie":{"status":"resolved","repositories":{"trixie":"1.3.0rc1-11"},"fixed_version":"1.3.0rc1-8.1","urgency":"low"}}}},"awffull":{"CVE-2007-0510":{"description":"Multiple buffer overflows in (1) graphs.c, (2) output.c, and (3) preserve.c in AWFFull 3.7.1 and earlier have unknown impact and attack vectors.  NOTE: some of these details are obtained from third party information.  NOTE: There may not be any attack vector that crosses privilege boundaries.","scope":"local","releases":{"bookworm":{"status":"open","repositories":{"bookworm":"3.10.2-8"},"urgency":"unimportant"},"bullseye":{"status":"open","repositories":{"bullseye":"3.10.2-6"},"urgency":"unimportant"},"forky":{"status":"open","repositories":{"forky":"3.10.2-11"},"urgency":"unimportant"},"sid":{"status":"open","repositories":{"sid":"3.10.2-11"},"urgency":"unimportant"},"trixie":{"status":"open","repositories":{"trixie":"3.10.2-10+deb13u1"},"urgency":"unimportant"}}},"CVE-2007-3299":{"description":"Cross-site scripting (XSS) vulnerability in AWFFull before 3.7.4, when AllSearchStr (aka the All Search Terms report) is enabled, allows remote attackers to inject arbitrary web script or HTML via a search string.","scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"3.10.2-8"},"fixed_version":"3.7.4final-1","urgency":"unimportant"},"bullseye":{"status":"resolved","repositories":{"bullseye":"3.10.2-6"},"fixed_version":"3.7.4final-1","urgency":"unimportant"},"forky":{"status":"resolved","repositories":{"forky":"3.10.2-11"},"fixed_version":"3.7.4final-1","urgency":"unimportant"},"sid":{"status":"resolved","repositories":{"sid":"3.10.2-11"},"fixed_version":"3.7.4final-1","urgency":"unimportant"},"trixie":{"status":"resolved","repositories":{"trixie":"3.10.2-10+deb13u1"},"fixed_version":"3.7.4final-1","urgency":"unimportant"}}}},"awl":{"CVE-2020-11728":{"description":"An issue was discovered in DAViCal Andrew's Web Libraries (AWL) through 0.60. Session management does not use a sufficiently hard-to-guess session key. Anyone who can guess the microsecond time (and the incrementing session_id) can impersonate a session.","debianbug":956650,"scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"0.64-1"},"fixed_version":"0.61-1","urgency":"not yet assigned"},"bullseye":{"status":"resolved","repositories":{"bullseye":"0.62-1"},"fixed_version":"0.61-1","urgency":"not yet assigned"},"forky":{"status":"resolved","repositories":{"forky":"0.64-1.1"},"fixed_version":"0.61-1","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"0.64-1.1"},"fixed_version":"0.61-1","urgency":"not yet assigned"},"trixie":{"status":"resolved","repositories":{"trixie":"0.64-1.1"},"fixed_version":"0.61-1","urgency":"not yet assigned"}}},"CVE-2020-11729":{"description":"An issue was discovered in DAViCal Andrew's Web Libraries (AWL) through 0.60. Long-term session cookies, uses to provide long-term session continuity, are not generated securely, enabling a brute-force attack that may be successful.","debianbug":956650,"scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"0.64-1"},"fixed_version":"0.61-1","urgency":"not yet assigned"},"bullseye":{"status":"resolved","repositories":{"bullseye":"0.62-1"},"fixed_version":"0.61-1","urgency":"not yet assigned"},"forky":{"status":"resolved","repositories":{"forky":"0.64-1.1"},"fixed_version":"0.61-1","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"0.64-1.1"},"fixed_version":"0.61-1","urgency":"not yet assigned"},"trixie":{"status":"resolved","repositories":{"trixie":"0.64-1.1"},"fixed_version":"0.61-1","urgency":"not yet assigned"}}}},"awstats":{"CVE-2005-0116":{"description":"AWStats 6.1, and other versions before 6.3, allows remote attackers to execute arbitrary commands via shell metacharacters in the configdir parameter to aswtats.pl.","scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"7.8-3+deb12u1"},"fixed_version":"6.2-1.1","urgency":"not yet assigned"},"bullseye":{"status":"resolved","repositories":{"bullseye":"7.8-2+deb11u1"},"fixed_version":"6.2-1.1","urgency":"not yet assigned"},"forky":{"status":"resolved","repositories":{"forky":"8.0-3"},"fixed_version":"6.2-1.1","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"8.0-3"},"fixed_version":"6.2-1.1","urgency":"not yet assigned"},"trixie":{"status":"resolved","repositories":{"trixie":"7.9-1"},"fixed_version":"6.2-1.1","urgency":"not yet assigned"}}},"CVE-2005-0362":{"description":"awstats.pl in AWStats 6.2 allows remote attackers to execute arbitrary commands via shell metacharacters in the (1) \"pluginmode\", (2) \"loadplugin\", or (3) \"noloadplugin\" parameters.","scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"7.8-3+deb12u1"},"fixed_version":"6.2-1.2","urgency":"not yet assigned"},"bullseye":{"status":"resolved","repositories":{"bullseye":"7.8-2+deb11u1"},"fixed_version":"6.2-1.2","urgency":"not yet assigned"},"forky":{"status":"resolved","repositories":{"forky":"8.0-3"},"fixed_version":"6.2-1.2","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"8.0-3"},"fixed_version":"6.2-1.2","urgency":"not yet assigned"},"trixie":{"status":"resolved","repositories":{"trixie":"7.9-1"},"fixed_version":"6.2-1.2","urgency":"not yet assigned"}}},"CVE-2005-0363":{"description":"awstats.pl in AWStats 4.0 and 6.2 allows remote attackers to execute arbitrary commands via shell metacharacters in the config parameter.","scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"7.8-3+deb12u1"},"fixed_version":"6.2-1.2","urgency":"not yet assigned"},"bullseye":{"status":"resolved","repositories":{"bullseye":"7.8-2+deb11u1"},"fixed_version":"6.2-1.2","urgency":"not yet assigned"},"forky":{"status":"resolved","repositories":{"forky":"8.0-3"},"fixed_version":"6.2-1.2","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"8.0-3"},"fixed_version":"6.2-1.2","urgency":"not yet assigned"},"trixie":{"status":"resolved","repositories":{"trixie":"7.9-1"},"fixed_version":"6.2-1.2","urgency":"not yet assigned"}}},"CVE-2005-0435":{"description":"awstats.pl in AWStats 6.3 and 6.4 allows remote attackers to read server web logs by setting the loadplugin and pluginmode parameters to rawlog.","scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"7.8-3+deb12u1"},"fixed_version":"6.3-1","urgency":"not yet assigned"},"bullseye":{"status":"resolved","repositories":{"bullseye":"7.8-2+deb11u1"},"fixed_version":"6.3-1","urgency":"not yet assigned"},"forky":{"status":"resolved","repositories":{"forky":"8.0-3"},"fixed_version":"6.3-1","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"8.0-3"},"fixed_version":"6.3-1","urgency":"not yet assigned"},"trixie":{"status":"resolved","repositories":{"trixie":"7.9-1"},"fixed_version":"6.3-1","urgency":"not yet assigned"}}},"CVE-2005-0436":{"description":"Direct code injection vulnerability in awstats.pl in AWStats 6.3 and 6.4 allows remote attackers to execute portions of Perl code via the PluginMode parameter.","scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"7.8-3+deb12u1"},"fixed_version":"6.3-1","urgency":"not yet assigned"},"bullseye":{"status":"resolved","repositories":{"bullseye":"7.8-2+deb11u1"},"fixed_version":"6.3-1","urgency":"not yet assigned"},"forky":{"status":"resolved","repositories":{"forky":"8.0-3"},"fixed_version":"6.3-1","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"8.0-3"},"fixed_version":"6.3-1","urgency":"not yet assigned"},"trixie":{"status":"resolved","repositories":{"trixie":"7.9-1"},"fixed_version":"6.3-1","urgency":"not yet assigned"}}},"CVE-2005-0437":{"description":"Directory traversal vulnerability in awstats.pl in AWStats 6.3 and 6.4 allows remote attackers to include arbitrary Perl modules via .. (dot dot) sequences in the loadplugin parameter.","scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"7.8-3+deb12u1"},"fixed_version":"6.3-1","urgency":"not yet assigned"},"bullseye":{"status":"resolved","repositories":{"bullseye":"7.8-2+deb11u1"},"fixed_version":"6.3-1","urgency":"not yet assigned"},"forky":{"status":"resolved","repositories":{"forky":"8.0-3"},"fixed_version":"6.3-1","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"8.0-3"},"fixed_version":"6.3-1","urgency":"not yet assigned"},"trixie":{"status":"resolved","repositories":{"trixie":"7.9-1"},"fixed_version":"6.3-1","urgency":"not yet assigned"}}},"CVE-2005-0438":{"description":"awstats.pl in AWStats 6.3 and 6.4 allows remote attackers to obtain sensitive information by setting the debug parameter.","scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"7.8-3+deb12u1"},"fixed_version":"6.3-1","urgency":"not yet assigned"},"bullseye":{"status":"resolved","repositories":{"bullseye":"7.8-2+deb11u1"},"fixed_version":"6.3-1","urgency":"not yet assigned"},"forky":{"status":"resolved","repositories":{"forky":"8.0-3"},"fixed_version":"6.3-1","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"8.0-3"},"fixed_version":"6.3-1","urgency":"not yet assigned"},"trixie":{"status":"resolved","repositories":{"trixie":"7.9-1"},"fixed_version":"6.3-1","urgency":"not yet assigned"}}},"CVE-2005-1527":{"description":"Eval injection vulnerability in awstats.pl in AWStats 6.4 and earlier, when a URLPlugin is enabled, allows remote attackers to execute arbitrary Perl code via the HTTP Referrer, which is used in a $url parameter that is inserted into an eval function call.","debianbug":322591,"scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"7.8-3+deb12u1"},"fixed_version":"6.4-1.1","urgency":"medium"},"bullseye":{"status":"resolved","repositories":{"bullseye":"7.8-2+deb11u1"},"fixed_version":"6.4-1.1","urgency":"medium"},"forky":{"status":"resolved","repositories":{"forky":"8.0-3"},"fixed_version":"6.4-1.1","urgency":"medium"},"sid":{"status":"resolved","repositories":{"sid":"8.0-3"},"fixed_version":"6.4-1.1","urgency":"medium"},"trixie":{"status":"resolved","repositories":{"trixie":"7.9-1"},"fixed_version":"6.4-1.1","urgency":"medium"}}},"CVE-2006-1945":{"description":"Cross-site scripting (XSS) vulnerability in awstats.pl in AWStats 6.5 and earlier allows remote attackers to inject arbitrary web script or HTML via the config parameter.  NOTE: this might be the same core issue as CVE-2005-2732.","debianbug":364443,"scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"7.8-3+deb12u1"},"fixed_version":"6.5-2","urgency":"medium"},"bullseye":{"status":"resolved","repositories":{"bullseye":"7.8-2+deb11u1"},"fixed_version":"6.5-2","urgency":"medium"},"forky":{"status":"resolved","repositories":{"forky":"8.0-3"},"fixed_version":"6.5-2","urgency":"medium"},"sid":{"status":"resolved","repositories":{"sid":"8.0-3"},"fixed_version":"6.5-2","urgency":"medium"},"trixie":{"status":"resolved","repositories":{"trixie":"7.9-1"},"fixed_version":"6.5-2","urgency":"medium"}}},"CVE-2006-2237":{"description":"The web interface for AWStats 6.4 and 6.5, when statistics updates are enabled, allows remote attackers to execute arbitrary code via shell metacharacters in the migrate parameter.","debianbug":365909,"scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"7.8-3+deb12u1"},"fixed_version":"6.5-2","urgency":"medium"},"bullseye":{"status":"resolved","repositories":{"bullseye":"7.8-2+deb11u1"},"fixed_version":"6.5-2","urgency":"medium"},"forky":{"status":"resolved","repositories":{"forky":"8.0-3"},"fixed_version":"6.5-2","urgency":"medium"},"sid":{"status":"resolved","repositories":{"sid":"8.0-3"},"fixed_version":"6.5-2","urgency":"medium"},"trixie":{"status":"resolved","repositories":{"trixie":"7.9-1"},"fixed_version":"6.5-2","urgency":"medium"}}},"CVE-2006-2644":{"description":"AWStats 6.5, and possibly other versions, allows remote authenticated users to execute arbitrary code by using the configdir parameter to awstats.pl to upload a configuration file whose name contains shell metacharacters, then access that file using the LogFile directive.","debianbug":365910,"scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"7.8-3+deb12u1"},"fixed_version":"6.5-2","urgency":"not yet assigned"},"bullseye":{"status":"resolved","repositories":{"bullseye":"7.8-2+deb11u1"},"fixed_version":"6.5-2","urgency":"not yet assigned"},"forky":{"status":"resolved","repositories":{"forky":"8.0-3"},"fixed_version":"6.5-2","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"8.0-3"},"fixed_version":"6.5-2","urgency":"not yet assigned"},"trixie":{"status":"resolved","repositories":{"trixie":"7.9-1"},"fixed_version":"6.5-2","urgency":"not yet assigned"}}},"CVE-2006-3681":{"description":"Multiple cross-site scripting (XSS) vulnerabilities in awstats.pl in AWStats 6.5 build 1.857 and earlier allow remote attackers to inject arbitrary web script or HTML via the (1) refererpagesfilter, (2) refererpagesfilterex, (3) urlfilterex, (4) urlfilter, (5) hostfilter, or (6) hostfilterex parameters, a different set of vectors than CVE-2006-1945.","debianbug":378960,"scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"7.8-3+deb12u1"},"fixed_version":"6.5-2","urgency":"unimportant"},"bullseye":{"status":"resolved","repositories":{"bullseye":"7.8-2+deb11u1"},"fixed_version":"6.5-2","urgency":"unimportant"},"forky":{"status":"resolved","repositories":{"forky":"8.0-3"},"fixed_version":"6.5-2","urgency":"unimportant"},"sid":{"status":"resolved","repositories":{"sid":"8.0-3"},"fixed_version":"6.5-2","urgency":"unimportant"},"trixie":{"status":"resolved","repositories":{"trixie":"7.9-1"},"fixed_version":"6.5-2","urgency":"unimportant"}}},"CVE-2006-3682":{"description":"awstats.pl in AWStats 6.5 build 1.857 and earlier allows remote attackers to obtain the installation path via the (1) year, (2) pluginmode or (3) month parameters.","debianbug":378960,"scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"7.8-3+deb12u1"},"fixed_version":"6.5-2","urgency":"low"},"bullseye":{"status":"resolved","repositories":{"bullseye":"7.8-2+deb11u1"},"fixed_version":"6.5-2","urgency":"low"},"forky":{"status":"resolved","repositories":{"forky":"8.0-3"},"fixed_version":"6.5-2","urgency":"low"},"sid":{"status":"resolved","repositories":{"sid":"8.0-3"},"fixed_version":"6.5-2","urgency":"low"},"trixie":{"status":"resolved","repositories":{"trixie":"7.9-1"},"fixed_version":"6.5-2","urgency":"low"}}},"CVE-2008-3714":{"description":"Cross-site scripting (XSS) vulnerability in awstats.pl in AWStats 6.8 allows remote attackers to inject arbitrary web script or HTML via the query_string, a different vulnerability than CVE-2006-3681 and CVE-2006-1945.","debianbug":495432,"scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"7.8-3+deb12u1"},"fixed_version":"6.7.dfsg-5.1","urgency":"low"},"bullseye":{"status":"resolved","repositories":{"bullseye":"7.8-2+deb11u1"},"fixed_version":"6.7.dfsg-5.1","urgency":"low"},"forky":{"status":"resolved","repositories":{"forky":"8.0-3"},"fixed_version":"6.7.dfsg-5.1","urgency":"low"},"sid":{"status":"resolved","repositories":{"sid":"8.0-3"},"fixed_version":"6.7.dfsg-5.1","urgency":"low"},"trixie":{"status":"resolved","repositories":{"trixie":"7.9-1"},"fixed_version":"6.7.dfsg-5.1","urgency":"low"}}},"CVE-2008-5080":{"description":"awstats.pl in AWStats 6.8 and earlier does not properly remove quote characters, which allows remote attackers to conduct cross-site scripting (XSS) attacks via the query_string parameter.  NOTE: this issue exists because of an incomplete fix for CVE-2008-3714.","debianbug":495432,"scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"7.8-3+deb12u1"},"fixed_version":"6.7.dfsg-5.1","urgency":"low"},"bullseye":{"status":"resolved","repositories":{"bullseye":"7.8-2+deb11u1"},"fixed_version":"6.7.dfsg-5.1","urgency":"low"},"forky":{"status":"resolved","repositories":{"forky":"8.0-3"},"fixed_version":"6.7.dfsg-5.1","urgency":"low"},"sid":{"status":"resolved","repositories":{"sid":"8.0-3"},"fixed_version":"6.7.dfsg-5.1","urgency":"low"},"trixie":{"status":"resolved","repositories":{"trixie":"7.9-1"},"fixed_version":"6.7.dfsg-5.1","urgency":"low"}}},"CVE-2009-5020":{"description":"Open redirect vulnerability in awredir.pl in AWStats before 6.95 allows remote attackers to redirect users to arbitrary web sites and conduct phishing attacks via unspecified vectors.","scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"7.8-3+deb12u1"},"fixed_version":"6.9.5~dfsg-1","urgency":"unimportant"},"bullseye":{"status":"resolved","repositories":{"bullseye":"7.8-2+deb11u1"},"fixed_version":"6.9.5~dfsg-1","urgency":"unimportant"},"forky":{"status":"resolved","repositories":{"forky":"8.0-3"},"fixed_version":"6.9.5~dfsg-1","urgency":"unimportant"},"sid":{"status":"resolved","repositories":{"sid":"8.0-3"},"fixed_version":"6.9.5~dfsg-1","urgency":"unimportant"},"trixie":{"status":"resolved","repositories":{"trixie":"7.9-1"},"fixed_version":"6.9.5~dfsg-1","urgency":"unimportant"}}},"CVE-2010-4367":{"description":"awstats.cgi in AWStats before 7.0 accepts a configdir parameter in the URL, which allows remote attackers to execute arbitrary commands via a crafted configuration file located on a (1) WebDAV server or (2) NFS server.","debianbug":606263,"scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"7.8-3+deb12u1"},"fixed_version":"6.9.5~dfsg-5","urgency":"low"},"bullseye":{"status":"resolved","repositories":{"bullseye":"7.8-2+deb11u1"},"fixed_version":"6.9.5~dfsg-5","urgency":"low"},"forky":{"status":"resolved","repositories":{"forky":"8.0-3"},"fixed_version":"6.9.5~dfsg-5","urgency":"low"},"sid":{"status":"resolved","repositories":{"sid":"8.0-3"},"fixed_version":"6.9.5~dfsg-5","urgency":"low"},"trixie":{"status":"resolved","repositories":{"trixie":"7.9-1"},"fixed_version":"6.9.5~dfsg-5","urgency":"low"}}},"CVE-2010-4368":{"description":"awstats.cgi in AWStats before 7.0 on Windows accepts a configdir parameter in the URL, which allows remote attackers to execute arbitrary commands via a crafted configuration file located at a UNC share pathname.","scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"7.8-3+deb12u1"},"fixed_version":"0","urgency":"unimportant"},"bullseye":{"status":"resolved","repositories":{"bullseye":"7.8-2+deb11u1"},"fixed_version":"0","urgency":"unimportant"},"forky":{"status":"resolved","repositories":{"forky":"8.0-3"},"fixed_version":"0","urgency":"unimportant"},"sid":{"status":"resolved","repositories":{"sid":"8.0-3"},"fixed_version":"0","urgency":"unimportant"},"trixie":{"status":"resolved","repositories":{"trixie":"7.9-1"},"fixed_version":"0","urgency":"unimportant"}}},"CVE-2010-4369":{"description":"Directory traversal vulnerability in AWStats before 7.0 allows remote attackers to have an unspecified impact via a crafted LoadPlugin directory.","debianbug":606263,"scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"7.8-3+deb12u1"},"fixed_version":"6.9.5~dfsg-5","urgency":"low"},"bullseye":{"status":"resolved","repositories":{"bullseye":"7.8-2+deb11u1"},"fixed_version":"6.9.5~dfsg-5","urgency":"low"},"forky":{"status":"resolved","repositories":{"forky":"8.0-3"},"fixed_version":"6.9.5~dfsg-5","urgency":"low"},"sid":{"status":"resolved","repositories":{"sid":"8.0-3"},"fixed_version":"6.9.5~dfsg-5","urgency":"low"},"trixie":{"status":"resolved","repositories":{"trixie":"7.9-1"},"fixed_version":"6.9.5~dfsg-5","urgency":"low"}}},"CVE-2012-4547":{"description":"Unspecified vulnerability in awredir.pl in AWStats before 7.1 has unknown impact and attack vectors.","scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"7.8-3+deb12u1"},"fixed_version":"7.1~dfsg-1","urgency":"unimportant"},"bullseye":{"status":"resolved","repositories":{"bullseye":"7.8-2+deb11u1"},"fixed_version":"7.1~dfsg-1","urgency":"unimportant"},"forky":{"status":"resolved","repositories":{"forky":"8.0-3"},"fixed_version":"7.1~dfsg-1","urgency":"unimportant"},"sid":{"status":"resolved","repositories":{"sid":"8.0-3"},"fixed_version":"7.1~dfsg-1","urgency":"unimportant"},"trixie":{"status":"resolved","repositories":{"trixie":"7.9-1"},"fixed_version":"7.1~dfsg-1","urgency":"unimportant"}}},"CVE-2017-1000501":{"description":"Awstats version 7.6 and earlier is vulnerable to a path traversal flaw in the handling of the \"config\" and \"migrate\" parameters resulting in unauthenticated remote code execution.","debianbug":885835,"scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"7.8-3+deb12u1"},"fixed_version":"7.6+dfsg-2","urgency":"not yet assigned"},"bullseye":{"status":"resolved","repositories":{"bullseye":"7.8-2+deb11u1"},"fixed_version":"7.6+dfsg-2","urgency":"not yet assigned"},"forky":{"status":"resolved","repositories":{"forky":"8.0-3"},"fixed_version":"7.6+dfsg-2","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"8.0-3"},"fixed_version":"7.6+dfsg-2","urgency":"not yet assigned"},"trixie":{"status":"resolved","repositories":{"trixie":"7.9-1"},"fixed_version":"7.6+dfsg-2","urgency":"not yet assigned"}}},"CVE-2018-10245":{"description":"A Full Path Disclosure vulnerability in AWStats through 7.6 allows remote attackers to know where the config file is allocated, obtaining the full path of the server, a similar issue to CVE-2006-3682. The attack can, for example, use the awstats.pl framename and update parameters.","scope":"local","releases":{"bookworm":{"status":"open","repositories":{"bookworm":"7.8-3+deb12u1"},"urgency":"unimportant"},"bullseye":{"status":"open","repositories":{"bullseye":"7.8-2+deb11u1"},"urgency":"unimportant"},"forky":{"status":"open","repositories":{"forky":"8.0-3"},"urgency":"unimportant"},"sid":{"status":"open","repositories":{"sid":"8.0-3"},"urgency":"unimportant"},"trixie":{"status":"open","repositories":{"trixie":"7.9-1"},"urgency":"unimportant"}}},"CVE-2020-29600":{"description":"In AWStats through 7.7, cgi-bin/awstats.pl?config= accepts an absolute pathname, even though it was intended to only read a file in the /etc/awstats/awstats.conf format. NOTE: this issue exists because of an incomplete fix for CVE-2017-1000501.","debianbug":891469,"scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"7.8-3+deb12u1"},"fixed_version":"7.8-1","urgency":"not yet assigned"},"bullseye":{"status":"resolved","repositories":{"bullseye":"7.8-2+deb11u1"},"fixed_version":"7.8-1","urgency":"not yet assigned"},"forky":{"status":"resolved","repositories":{"forky":"8.0-3"},"fixed_version":"7.8-1","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"8.0-3"},"fixed_version":"7.8-1","urgency":"not yet assigned"},"trixie":{"status":"resolved","repositories":{"trixie":"7.9-1"},"fixed_version":"7.8-1","urgency":"not yet assigned"}}},"CVE-2020-35176":{"description":"In AWStats through 7.8, cgi-bin/awstats.pl?config= accepts a partial absolute pathname (omitting the initial /etc), even though it was intended to only read a file in the /etc/awstats/awstats.conf format. NOTE: this issue exists because of an incomplete fix for CVE-2017-1000501 and CVE-2020-29600.","debianbug":977190,"scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"7.8-3+deb12u1"},"fixed_version":"7.8-2","urgency":"not yet assigned"},"bullseye":{"status":"resolved","repositories":{"bullseye":"7.8-2+deb11u1"},"fixed_version":"7.8-2","urgency":"not yet assigned"},"forky":{"status":"resolved","repositories":{"forky":"8.0-3"},"fixed_version":"7.8-2","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"8.0-3"},"fixed_version":"7.8-2","urgency":"not yet assigned"},"trixie":{"status":"resolved","repositories":{"trixie":"7.9-1"},"fixed_version":"7.8-2","urgency":"not yet assigned"}}},"CVE-2022-46391":{"description":"AWStats 7.x through 7.8 allows XSS in the hostinfo plugin due to printing a response from Net::XWhois without proper checks.","debianbug":1025410,"scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"7.8-3+deb12u1"},"fixed_version":"7.8-3","urgency":"not yet assigned"},"bullseye":{"status":"resolved","repositories":{"bullseye":"7.8-2+deb11u1"},"fixed_version":"7.8-2+deb11u1","urgency":"not yet assigned"},"forky":{"status":"resolved","repositories":{"forky":"8.0-3"},"fixed_version":"7.8-3","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"8.0-3"},"fixed_version":"7.8-3","urgency":"not yet assigned"},"trixie":{"status":"resolved","repositories":{"trixie":"7.9-1"},"fixed_version":"7.8-3","urgency":"not yet assigned"}}}},"ax25-tools":{"CVE-2011-2910":{"description":"The AX.25 daemon (ax25d) in ax25-tools before 0.0.8-13 does not check the return value of a setuid call. The setuid call is responsible for dropping privileges but if the call fails the daemon would continue to run with root privileges which can allow possible privilege escalation.","debianbug":638198,"scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"0.0.10-rc5+git20190411+3595f87-6"},"fixed_version":"0.0.8-13.2","urgency":"low"},"bullseye":{"status":"resolved","repositories":{"bullseye":"0.0.10-rc5+git20190411+3595f87-5"},"fixed_version":"0.0.8-13.2","urgency":"low"},"forky":{"status":"resolved","repositories":{"forky":"0.0.10-rc5+git20230513+d3e6d4f-3"},"fixed_version":"0.0.8-13.2","urgency":"low"},"sid":{"status":"resolved","repositories":{"sid":"0.0.10-rc5+git20230513+d3e6d4f-3"},"fixed_version":"0.0.8-13.2","urgency":"low"},"trixie":{"status":"resolved","repositories":{"trixie":"0.0.10-rc5+git20230513+d3e6d4f-3"},"fixed_version":"0.0.8-13.2","urgency":"low"}}}},"axel":{"CVE-2005-0390":{"description":"Buffer overflow in the HTTP redirection capability in conn.c for Axel before 1.0b may allow remote attackers to execute arbitrary code.","scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"2.17.11-3"},"fixed_version":"1.0b-1","urgency":"not yet assigned"},"bullseye":{"status":"resolved","repositories":{"bullseye":"2.17.10-2"},"fixed_version":"1.0b-1","urgency":"not yet assigned"},"forky":{"status":"resolved","repositories":{"forky":"2.17.14-3"},"fixed_version":"1.0b-1","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"2.17.14-3"},"fixed_version":"1.0b-1","urgency":"not yet assigned"},"trixie":{"status":"resolved","repositories":{"trixie":"2.17.14-2"},"fixed_version":"1.0b-1","urgency":"not yet assigned"}}},"CVE-2020-13614":{"description":"An issue was discovered in ssl.c in Axel before 2.17.8. The TLS implementation lacks hostname verification.","scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"2.17.11-3"},"fixed_version":"2.17.8-1","urgency":"not yet assigned"},"bullseye":{"status":"resolved","repositories":{"bullseye":"2.17.10-2"},"fixed_version":"2.17.8-1","urgency":"not yet assigned"},"forky":{"status":"resolved","repositories":{"forky":"2.17.14-3"},"fixed_version":"2.17.8-1","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"2.17.14-3"},"fixed_version":"2.17.8-1","urgency":"not yet assigned"},"trixie":{"status":"resolved","repositories":{"trixie":"2.17.14-2"},"fixed_version":"2.17.8-1","urgency":"not yet assigned"}}},"TEMP-0000000-3D82DC":{"releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"2.17.11-3"},"fixed_version":"2.2","urgency":"unimportant"},"bullseye":{"status":"resolved","repositories":{"bullseye":"2.17.10-2"},"fixed_version":"2.2","urgency":"unimportant"},"forky":{"status":"resolved","repositories":{"forky":"2.17.14-3"},"fixed_version":"2.2","urgency":"unimportant"},"sid":{"status":"resolved","repositories":{"sid":"2.17.14-3"},"fixed_version":"2.2","urgency":"unimportant"},"trixie":{"status":"resolved","repositories":{"trixie":"2.17.14-2"},"fixed_version":"2.2","urgency":"unimportant"}}}},"axiom":{"CVE-2014-1640":{"description":"axiom-test.sh in axiom 20100701-1.1 uses tempfile to create a safe temporary file but appends a suffix to the original filename and writes to this new filename, which allows local users to overwrite arbitrary files via a symlink attack on the new filename.","debianbug":736358,"scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"20170501-12"},"fixed_version":"20120501-17","urgency":"low"},"bullseye":{"status":"resolved","repositories":{"bullseye":"20170501-6"},"fixed_version":"20120501-17","urgency":"low"},"forky":{"status":"resolved","repositories":{"forky":"20210105dp1-1"},"fixed_version":"20120501-17","urgency":"low"},"sid":{"status":"resolved","repositories":{"sid":"20210105dp1-1"},"fixed_version":"20120501-17","urgency":"low"},"trixie":{"status":"resolved","repositories":{"trixie":"20210105dp1-1"},"fixed_version":"20120501-17","urgency":"low"}}}},"axis":{"CVE-2007-2353":{"description":"Apache Axis 1.0 allows remote attackers to obtain sensitive information by requesting a non-existent WSDL file, which reveals the installation path in the resulting exception message.","scope":"local","releases":{"bookworm":{"status":"open","repositories":{"bookworm":"1.4-28+deb12u1"},"urgency":"unimportant"},"bullseye":{"status":"open","repositories":{"bullseye":"1.4-28+deb11u1"},"urgency":"unimportant"},"forky":{"status":"open","repositories":{"forky":"1.4-29"},"urgency":"unimportant"},"sid":{"status":"open","repositories":{"sid":"1.4-29"},"urgency":"unimportant"},"trixie":{"status":"open","repositories":{"trixie":"1.4-29"},"urgency":"unimportant"}}},"CVE-2010-2103":{"description":"Cross-site scripting (XSS) vulnerability in axis2-admin/axis2-admin/engagingglobally in the administration console in Apache Axis2/Java 1.4.1, 1.5.1, and possibly other versions, as used in SAP Business Objects 12, 3com IMC, and possibly other products, allows remote attackers to inject arbitrary web script or HTML via the modules parameter.  NOTE: some of these details are obtained from third party information.","scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"1.4-28+deb12u1"},"fixed_version":"0","urgency":"unimportant"},"bullseye":{"status":"resolved","repositories":{"bullseye":"1.4-28+deb11u1"},"fixed_version":"0","urgency":"unimportant"},"forky":{"status":"resolved","repositories":{"forky":"1.4-29"},"fixed_version":"0","urgency":"unimportant"},"sid":{"status":"resolved","repositories":{"sid":"1.4-29"},"fixed_version":"0","urgency":"unimportant"},"trixie":{"status":"resolved","repositories":{"trixie":"1.4-29"},"fixed_version":"0","urgency":"unimportant"}}},"CVE-2012-5784":{"description":"Apache Axis 1.4 and earlier, as used in PayPal Payments Pro, PayPal Mass Pay, PayPal Transactional Information SOAP, the Java Message Service implementation in Apache ActiveMQ, and other products, does not verify that the server hostname matches a domain name in the subject's Common Name (CN) or subjectAltName field of the X.509 certificate, which allows man-in-the-middle attackers to spoof SSL servers via an arbitrary valid certificate.","debianbug":692650,"scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"1.4-28+deb12u1"},"fixed_version":"1.4-16.1","urgency":"low"},"bullseye":{"status":"resolved","repositories":{"bullseye":"1.4-28+deb11u1"},"fixed_version":"1.4-16.1","urgency":"low"},"forky":{"status":"resolved","repositories":{"forky":"1.4-29"},"fixed_version":"1.4-16.1","urgency":"low"},"sid":{"status":"resolved","repositories":{"sid":"1.4-29"},"fixed_version":"1.4-16.1","urgency":"low"},"trixie":{"status":"resolved","repositories":{"trixie":"1.4-29"},"fixed_version":"1.4-16.1","urgency":"low"}}},"CVE-2014-3596":{"description":"The getCN function in Apache Axis 1.4 and earlier does not properly verify that the server hostname matches a domain name in the subject's Common Name (CN) or subjectAltName field of the X.509 certificate, which allows man-in-the-middle attackers to spoof SSL servers via a certificate with a subject that specifies a common name in a field that is not the CN field. NOTE: this issue exists because of an incomplete fix for CVE-2012-5784.","debianbug":762444,"scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"1.4-28+deb12u1"},"fixed_version":"1.4-21","urgency":"low"},"bullseye":{"status":"resolved","repositories":{"bullseye":"1.4-28+deb11u1"},"fixed_version":"1.4-21","urgency":"low"},"forky":{"status":"resolved","repositories":{"forky":"1.4-29"},"fixed_version":"1.4-21","urgency":"low"},"sid":{"status":"resolved","repositories":{"sid":"1.4-29"},"fixed_version":"1.4-21","urgency":"low"},"trixie":{"status":"resolved","repositories":{"trixie":"1.4-29"},"fixed_version":"1.4-21","urgency":"low"}}},"CVE-2018-8032":{"description":"Apache Axis 1.x up to and including 1.4 is vulnerable to a cross-site scripting (XSS) attack in the default servlet/services.","debianbug":905328,"scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"1.4-28+deb12u1"},"fixed_version":"1.4-28","urgency":"not yet assigned"},"bullseye":{"status":"resolved","repositories":{"bullseye":"1.4-28+deb11u1"},"fixed_version":"1.4-28","urgency":"not yet assigned"},"forky":{"status":"resolved","repositories":{"forky":"1.4-29"},"fixed_version":"1.4-28","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"1.4-29"},"fixed_version":"1.4-28","urgency":"not yet assigned"},"trixie":{"status":"resolved","repositories":{"trixie":"1.4-29"},"fixed_version":"1.4-28","urgency":"not yet assigned"}}},"CVE-2019-0227":{"description":"A Server Side Request Forgery (SSRF) vulnerability affected the Apache Axis 1.4 distribution that was last released in 2006. Security and bug commits commits continue in the projects Axis 1.x Subversion repository, legacy users are encouraged to build from source. The successor to Axis 1.x is Axis2, the latest version is 1.7.9 and is not vulnerable to this issue.","debianbug":929266,"scope":"local","releases":{"bookworm":{"status":"open","repositories":{"bookworm":"1.4-28+deb12u1"},"urgency":"unimportant"},"bullseye":{"status":"open","repositories":{"bullseye":"1.4-28+deb11u1"},"urgency":"unimportant"},"forky":{"status":"open","repositories":{"forky":"1.4-29"},"urgency":"unimportant"},"sid":{"status":"open","repositories":{"sid":"1.4-29"},"urgency":"unimportant"},"trixie":{"status":"open","repositories":{"trixie":"1.4-29"},"urgency":"unimportant"}}},"CVE-2023-40743":{"description":"** UNSUPPORTED WHEN ASSIGNED ** When integrating Apache Axis 1.x in an application, it may not have been obvious that looking up a service through \"ServiceFactory.getService\" allows potentially dangerous lookup mechanisms such as LDAP. When passing untrusted input to this API method, this could expose the application to DoS, SSRF and even attacks leading to RCE.  As Axis 1 has been EOL we recommend you migrate to a different SOAP engine, such as Apache Axis 2/Java. As a workaround, you may review your code to verify no untrusted or unsanitized input is passed to \"ServiceFactory.getService\", or by applying the patch from  https://github.com/apache/axis-axis1-java/commit/7e66753427466590d6def0125e448d2791723210 . The Apache Axis project does not expect to create an Axis 1.x release fixing this problem, though contributors that would like to work towards this are welcome.","debianbug":1051288,"scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"1.4-28+deb12u1"},"fixed_version":"1.4-28+deb12u1","urgency":"not yet assigned"},"bullseye":{"status":"resolved","repositories":{"bullseye":"1.4-28+deb11u1"},"fixed_version":"1.4-28+deb11u1","urgency":"not yet assigned"},"forky":{"status":"resolved","repositories":{"forky":"1.4-29"},"fixed_version":"1.4-29","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"1.4-29"},"fixed_version":"1.4-29","urgency":"not yet assigned"},"trixie":{"status":"resolved","repositories":{"trixie":"1.4-29"},"fixed_version":"1.4-29","urgency":"not yet assigned"}}},"CVE-2023-51441":{"description":"** UNSUPPORTED WHEN ASSIGNED ** Improper Input Validation vulnerability in Apache Axis allowed users with access to the admin service to perform possible SSRF This issue affects Apache Axis: through 1.3.  As Axis 1 has been EOL we recommend you migrate to a different SOAP engine, such as Apache Axis 2/Java. Alternatively you could use a build of Axis with the patch from  https://github.com/apache/axis-axis1-java/commit/685c309febc64aa393b2d64a05f90e7eb9f73e06  applied. The Apache Axis project does not expect to create an Axis 1.x release  fixing this problem, though contributors that would like to work towards  this are welcome.","debianbug":1060169,"scope":"local","releases":{"bookworm":{"status":"open","repositories":{"bookworm":"1.4-28+deb12u1"},"urgency":"not yet assigned","nodsa":"Minor issue","nodsa_reason":"ignored"},"bullseye":{"status":"open","repositories":{"bullseye":"1.4-28+deb11u1"},"urgency":"not yet assigned","nodsa":"Minor issue","nodsa_reason":""},"forky":{"status":"open","repositories":{"forky":"1.4-29"},"urgency":"not yet assigned"},"sid":{"status":"open","repositories":{"sid":"1.4-29"},"urgency":"not yet assigned"},"trixie":{"status":"open","repositories":{"trixie":"1.4-29"},"urgency":"not yet assigned","nodsa":"Minor issue","nodsa_reason":"ignored"}}}},"azure-cli":{"CVE-2022-39327":{"description":"Azure CLI is the command-line interface for Microsoft Azure. In versions previous to 2.40.0, Azure CLI contains a vulnerability for potential code injection. Critical scenarios are where a hosting machine runs an Azure CLI command where parameter values have been provided by an external source. The vulnerability is only applicable when the Azure CLI command is run on a Windows machine and with any version of PowerShell and when the parameter value contains the `&` or `|` symbols. If any of these prerequisites are not met, this vulnerability is not applicable. Users should upgrade to version 2.40.0 or greater to receive a a mitigation for the vulnerability.","scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"2.45.0-1"},"fixed_version":"0","urgency":"unimportant"},"bullseye":{"status":"resolved","repositories":{"bullseye":"2.18.0-2"},"fixed_version":"0","urgency":"unimportant"},"sid":{"status":"resolved","repositories":{"sid":"2.84.0-1"},"fixed_version":"0","urgency":"unimportant"},"trixie":{"status":"resolved","repositories":{"trixie":"2.74.0-1"},"fixed_version":"0","urgency":"unimportant"}}}},"azure-uamqp-python":{"CVE-2024-21646":{"description":"Azure uAMQP is a general purpose C library for AMQP 1.0. The UAMQP library is used by several clients to implement AMQP protocol communication.  When clients using this library receive a crafted binary type data, an integer overflow or wraparound or memory safety issue can occur and may cause remote code execution.  This vulnerability has been patched in release 2024-01-01.","scope":"local","releases":{"bookworm":{"status":"open","repositories":{"bookworm":"1.5.3-1"},"urgency":"not yet assigned","nodsa":"Minor issue","nodsa_reason":""},"bullseye":{"status":"open","repositories":{"bullseye":"1.2.13-1"},"urgency":"not yet assigned","nodsa":"Minor issue","nodsa_reason":""},"forky":{"status":"resolved","repositories":{"forky":"1.6.11-2"},"fixed_version":"1.6.8-1","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"1.6.11-2"},"fixed_version":"1.6.8-1","urgency":"not yet assigned"},"trixie":{"status":"resolved","repositories":{"trixie":"1.6.11-1"},"fixed_version":"1.6.8-1","urgency":"not yet assigned"}}},"CVE-2024-25110":{"description":"The UAMQP is a general purpose C library for AMQP 1.0. During a call to open_get_offered_capabilities, a memory allocation may fail causing a use-after-free issue and if a client called it during connection communication it may cause a remote code execution. Users are advised to update the submodule with commit `30865c9c`. There are no known workarounds for this vulnerability.","debianbug":1064051,"scope":"local","releases":{"bookworm":{"status":"open","repositories":{"bookworm":"1.5.3-1"},"urgency":"not yet assigned","nodsa":"Minor issue","nodsa_reason":""},"bullseye":{"status":"open","repositories":{"bullseye":"1.2.13-1"},"urgency":"not yet assigned","nodsa":"Minor issue","nodsa_reason":""},"forky":{"status":"resolved","repositories":{"forky":"1.6.11-2"},"fixed_version":"1.6.8-2","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"1.6.11-2"},"fixed_version":"1.6.8-2","urgency":"not yet assigned"},"trixie":{"status":"resolved","repositories":{"trixie":"1.6.11-1"},"fixed_version":"1.6.8-2","urgency":"not yet assigned"}}},"CVE-2024-27099":{"description":"The uAMQP is a C library for AMQP 1.0 communication to Azure Cloud Services. When processing an incorrect `AMQP_VALUE` failed state, may cause a double free problem. This may cause a RCE. Update submodule with commit 2ca42b6e4e098af2d17e487814a91d05f6ae4987.","debianbug":1064996,"scope":"local","releases":{"bookworm":{"status":"open","repositories":{"bookworm":"1.5.3-1"},"urgency":"not yet assigned","nodsa":"Minor issue","nodsa_reason":""},"bullseye":{"status":"open","repositories":{"bullseye":"1.2.13-1"},"urgency":"not yet assigned","nodsa":"Minor issue","nodsa_reason":""},"forky":{"status":"resolved","repositories":{"forky":"1.6.11-2"},"fixed_version":"1.6.8-2","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"1.6.11-2"},"fixed_version":"1.6.8-2","urgency":"not yet assigned"},"trixie":{"status":"resolved","repositories":{"trixie":"1.6.11-1"},"fixed_version":"1.6.8-2","urgency":"not yet assigned"}}},"CVE-2024-29195":{"description":"The azure-c-shared-utility is a C library for AMQP/MQTT communication to Azure Cloud Services. This library may be used by the Azure IoT C SDK for communication between IoT Hub and IoT Hub devices. An attacker can cause an integer wraparound or under-allocation or heap buffer overflow due to vulnerabilities in parameter checking mechanism, by exploiting the buffer length parameter in Azure C SDK, which may lead to remote code execution. Requirements for RCE are 1. Compromised Azure account allowing malformed payloads to be sent to the device via IoT Hub service, 2. By passing IoT hub service max message payload limit of 128KB, and 3. Ability to overwrite code space with remote code. Fixed in commit https://github.com/Azure/azure-c-shared-utility/commit/1129147c38ac02ad974c4c701a1e01b2141b9fe2.","debianbug":1068457,"scope":"local","releases":{"bookworm":{"status":"open","repositories":{"bookworm":"1.5.3-1"},"urgency":"not yet assigned","nodsa":"Minor issue","nodsa_reason":""},"bullseye":{"status":"open","repositories":{"bullseye":"1.2.13-1"},"urgency":"not yet assigned","nodsa":"Minor issue","nodsa_reason":""},"forky":{"status":"resolved","repositories":{"forky":"1.6.11-2"},"fixed_version":"1.6.9-2","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"1.6.11-2"},"fixed_version":"1.6.9-2","urgency":"not yet assigned"},"trixie":{"status":"resolved","repositories":{"trixie":"1.6.11-1"},"fixed_version":"1.6.9-2","urgency":"not yet assigned"}}}},"backbone":{"CVE-2016-10537":{"description":"backbone is a module that adds in structure to a JavaScript heavy application through key-value pairs and custom events connecting to your RESTful API through JSON There exists a potential Cross Site Scripting vulnerability in the `Model#Escape` function of backbone 0.3.3 and earlier, if a user is able to supply input. This is due to the regex that's replacing things to miss the conversion of things such as `<` to `<`.","scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"1.4.1~dfsg+~1.4.15-3"},"fixed_version":"0.5.3-1","urgency":"not yet assigned"},"bullseye":{"status":"resolved","repositories":{"bullseye":"1.4.0~dfsg+~1.4.5-2"},"fixed_version":"0.5.3-1","urgency":"not yet assigned"},"forky":{"status":"resolved","repositories":{"forky":"1.4.1~dfsg+~1.4.15-4"},"fixed_version":"0.5.3-1","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"1.4.1~dfsg+~1.4.15-4"},"fixed_version":"0.5.3-1","urgency":"not yet assigned"},"trixie":{"status":"resolved","repositories":{"trixie":"1.4.1~dfsg+~1.4.15-3"},"fixed_version":"0.5.3-1","urgency":"not yet assigned"}}}},"backintime":{"CVE-2009-3611":{"description":"common/snapshots.py in Back In Time (aka backintime) 0.9.26 changes certain permissions to 0777 before deleting the files in an old backup snapshot, which allows local users to obtain sensitive information by reading these files, or interfere with backup integrity by modifying files that are shared across snapshots.","debianbug":543785,"scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"1.3.3-4"},"fixed_version":"0.9.26-3","urgency":"not yet assigned"},"bullseye":{"status":"resolved","repositories":{"bullseye":"1.2.1-3"},"fixed_version":"0.9.26-3","urgency":"not yet assigned"},"forky":{"status":"resolved","repositories":{"forky":"1.6.1-1"},"fixed_version":"0.9.26-3","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"1.6.1-1"},"fixed_version":"0.9.26-3","urgency":"not yet assigned"},"trixie":{"status":"resolved","repositories":{"trixie":"1.5.5-1"},"fixed_version":"0.9.26-3","urgency":"not yet assigned"}}},"CVE-2017-16667":{"description":"backintime (aka Back in Time) before 1.1.24 did improper escaping/quoting of file paths used as arguments to the 'notify-send' command, leading to some parts of file paths being executed as shell commands within an os.system call in qt4/plugins/notifyplugin.py. This could allow an attacker to craft an unreadable file with a specific name to run arbitrary shell commands.","debianbug":881205,"scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"1.3.3-4"},"fixed_version":"1.1.24-0.1","urgency":"not yet assigned"},"bullseye":{"status":"resolved","repositories":{"bullseye":"1.2.1-3"},"fixed_version":"1.1.24-0.1","urgency":"not yet assigned"},"forky":{"status":"resolved","repositories":{"forky":"1.6.1-1"},"fixed_version":"1.1.24-0.1","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"1.6.1-1"},"fixed_version":"1.1.24-0.1","urgency":"not yet assigned"},"trixie":{"status":"resolved","repositories":{"trixie":"1.5.5-1"},"fixed_version":"1.1.24-0.1","urgency":"not yet assigned"}}},"CVE-2017-7572":{"description":"The _checkPolkitPrivilege function in serviceHelper.py in Back In Time (aka backintime) 1.1.18 and earlier uses a deprecated polkit authorization method (unix-process) that is subject to a race condition (time of check, time of use). With this authorization method, the owner of a process requesting a polkit operation is checked by polkitd via /proc/<pid>/status, by which time the requesting process may have been replaced by a different process with the same PID that has different privileges then the original requester.","debianbug":859815,"scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"1.3.3-4"},"fixed_version":"1.1.12-2","urgency":"not yet assigned"},"bullseye":{"status":"resolved","repositories":{"bullseye":"1.2.1-3"},"fixed_version":"1.1.12-2","urgency":"not yet assigned"},"forky":{"status":"resolved","repositories":{"forky":"1.6.1-1"},"fixed_version":"1.1.12-2","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"1.6.1-1"},"fixed_version":"1.1.12-2","urgency":"not yet assigned"},"trixie":{"status":"resolved","repositories":{"trixie":"1.5.5-1"},"fixed_version":"1.1.12-2","urgency":"not yet assigned"}}}},"backup-manager":{"CVE-2005-1855":{"description":"Backup Manager (backup-manager) before 0.5.8 creates backup files with world-readable default permissions, which allows local users to obtain sensitive information.","scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"0.7.14-1.3"},"fixed_version":"0.5.8-2","urgency":"medium"},"bullseye":{"status":"resolved","repositories":{"bullseye":"0.7.14-1.2"},"fixed_version":"0.5.8-2","urgency":"medium"},"forky":{"status":"resolved","repositories":{"forky":"0.7.14-3"},"fixed_version":"0.5.8-2","urgency":"medium"},"sid":{"status":"resolved","repositories":{"sid":"0.7.14-3"},"fixed_version":"0.5.8-2","urgency":"medium"},"trixie":{"status":"resolved","repositories":{"trixie":"0.7.14-3"},"fixed_version":"0.5.8-2","urgency":"medium"}}},"CVE-2005-1856":{"description":"The CD-burning feature in backup-manager 0.5.8 and earlier uses a fixed filename in a world-writable directory for logging, which allows local users to overwrite files via a symlink attack.","debianbug":315582,"scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"0.7.14-1.3"},"fixed_version":"0.5.8-2","urgency":"low"},"bullseye":{"status":"resolved","repositories":{"bullseye":"0.7.14-1.2"},"fixed_version":"0.5.8-2","urgency":"low"},"forky":{"status":"resolved","repositories":{"forky":"0.7.14-3"},"fixed_version":"0.5.8-2","urgency":"low"},"sid":{"status":"resolved","repositories":{"sid":"0.7.14-3"},"fixed_version":"0.5.8-2","urgency":"low"},"trixie":{"status":"resolved","repositories":{"trixie":"0.7.14-3"},"fixed_version":"0.5.8-2","urgency":"low"}}},"CVE-2007-2766":{"description":"lib/backup-methods.sh in Backup Manager before 0.7.6 provides the MySQL password as a plaintext command line argument, which allows local users to obtain this password by listing the process and its arguments, related to lib/backup-methods.sh.","scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"0.7.14-1.3"},"fixed_version":"0.7.6-1","urgency":"low"},"bullseye":{"status":"resolved","repositories":{"bullseye":"0.7.14-1.2"},"fixed_version":"0.7.6-1","urgency":"low"},"forky":{"status":"resolved","repositories":{"forky":"0.7.14-3"},"fixed_version":"0.7.6-1","urgency":"low"},"sid":{"status":"resolved","repositories":{"sid":"0.7.14-3"},"fixed_version":"0.7.6-1","urgency":"low"},"trixie":{"status":"resolved","repositories":{"trixie":"0.7.14-3"},"fixed_version":"0.7.6-1","urgency":"low"}}},"CVE-2007-4656":{"description":"backup-manager-upload in Backup Manager before 0.6.3 provides the FTP server hostname, username, and password as plaintext command line arguments during FTP uploads, which allows local users to obtain sensitive information by listing the process and its arguments, a different vulnerability than CVE-2007-2766.","debianbug":439392,"scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"0.7.14-1.3"},"fixed_version":"0.7.6-3","urgency":"not yet assigned"},"bullseye":{"status":"resolved","repositories":{"bullseye":"0.7.14-1.2"},"fixed_version":"0.7.6-3","urgency":"not yet assigned"},"forky":{"status":"resolved","repositories":{"forky":"0.7.14-3"},"fixed_version":"0.7.6-3","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"0.7.14-3"},"fixed_version":"0.7.6-3","urgency":"not yet assigned"},"trixie":{"status":"resolved","repositories":{"trixie":"0.7.14-3"},"fixed_version":"0.7.6-3","urgency":"not yet assigned"}}},"TEMP-0000000-E06059":{"releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"0.7.14-1.3"},"fixed_version":"0.7.9-1","urgency":"low"},"bullseye":{"status":"resolved","repositories":{"bullseye":"0.7.14-1.2"},"fixed_version":"0.7.9-1","urgency":"low"},"forky":{"status":"resolved","repositories":{"forky":"0.7.14-3"},"fixed_version":"0.7.9-1","urgency":"low"},"sid":{"status":"resolved","repositories":{"sid":"0.7.14-3"},"fixed_version":"0.7.9-1","urgency":"low"},"trixie":{"status":"resolved","repositories":{"trixie":"0.7.14-3"},"fixed_version":"0.7.9-1","urgency":"low"}}}},"backupninja":{"CVE-2005-3111":{"description":"The handler code for backupninja 0.8 and earlier creates temporary files with predictable filenames, which allows local users to modify arbitrary files via a symlink attack.","scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"1.2.2-1"},"fixed_version":"0.8-2","urgency":"medium"},"bullseye":{"status":"resolved","repositories":{"bullseye":"1.2.1-1"},"fixed_version":"0.8-2","urgency":"medium"},"forky":{"status":"resolved","repositories":{"forky":"1.2.2-1"},"fixed_version":"0.8-2","urgency":"medium"},"sid":{"status":"resolved","repositories":{"sid":"1.2.2-1"},"fixed_version":"0.8-2","urgency":"medium"},"trixie":{"status":"resolved","repositories":{"trixie":"1.2.2-1"},"fixed_version":"0.8-2","urgency":"medium"}}}},"backuppc":{"CVE-2009-3369":{"description":"CgiUserConfigEdit in BackupPC 3.1.0, when SSH keys and Rsync are in use in a multi-user environment, does not restrict users from the ClientNameAlias function, which allows remote authenticated users to read and write sensitive files by modifying ClientNameAlias to match another system, then initiating a backup or restore.","debianbug":542218,"scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"4.4.0-8"},"fixed_version":"3.1.0-8","urgency":"low"},"bullseye":{"status":"resolved","repositories":{"bullseye":"4.4.0-3"},"fixed_version":"3.1.0-8","urgency":"low"},"forky":{"status":"resolved","repositories":{"forky":"4.4.0-11"},"fixed_version":"3.1.0-8","urgency":"low"},"sid":{"status":"resolved","repositories":{"sid":"4.4.0-11"},"fixed_version":"3.1.0-8","urgency":"low"},"trixie":{"status":"resolved","repositories":{"trixie":"4.4.0-11"},"fixed_version":"3.1.0-8","urgency":"low"}}},"CVE-2011-3361":{"description":"Cross-site scripting (XSS) vulnerability in CGI/Browse.pm in BackupPC 3.2.0 and possibly other versions before 3.2.1 allows remote attackers to inject arbitrary web script or HTML via the num parameter in a browse action to index.cgi.","debianbug":641450,"scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"4.4.0-8"},"fixed_version":"3.2.1-2","urgency":"not yet assigned"},"bullseye":{"status":"resolved","repositories":{"bullseye":"4.4.0-3"},"fixed_version":"3.2.1-2","urgency":"not yet assigned"},"forky":{"status":"resolved","repositories":{"forky":"4.4.0-11"},"fixed_version":"3.2.1-2","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"4.4.0-11"},"fixed_version":"3.2.1-2","urgency":"not yet assigned"},"trixie":{"status":"resolved","repositories":{"trixie":"4.4.0-11"},"fixed_version":"3.2.1-2","urgency":"not yet assigned"}}},"CVE-2011-4923":{"description":"Cross-site scripting (XSS) vulnerability in View.pm in BackupPC 3.0.0, 3.1.0, 3.2.0, 3.2.1, and possibly earlier allows remote attackers to inject arbitrary web script or HTML via the num parameter in a view action to index.cgi, related to the log file viewer, a different vulnerability than CVE-2011-3361.","debianbug":646865,"scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"4.4.0-8"},"fixed_version":"3.2.1-2","urgency":"not yet assigned"},"bullseye":{"status":"resolved","repositories":{"bullseye":"4.4.0-3"},"fixed_version":"3.2.1-2","urgency":"not yet assigned"},"forky":{"status":"resolved","repositories":{"forky":"4.4.0-11"},"fixed_version":"3.2.1-2","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"4.4.0-11"},"fixed_version":"3.2.1-2","urgency":"not yet assigned"},"trixie":{"status":"resolved","repositories":{"trixie":"4.4.0-11"},"fixed_version":"3.2.1-2","urgency":"not yet assigned"}}},"CVE-2011-5081":{"description":"Cross-site scripting (XSS) vulnerability in RestoreFile.pm in BackupPC 3.1.0, 3.2.1, and possibly other earlier versions allows remote attackers to inject arbitrary web script or HTML via the share parameter in a RestoreFile action to index.cgi.","debianbug":661011,"scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"4.4.0-8"},"fixed_version":"3.1.0-9.1","urgency":"low"},"bullseye":{"status":"resolved","repositories":{"bullseye":"4.4.0-3"},"fixed_version":"3.1.0-9.1","urgency":"low"},"forky":{"status":"resolved","repositories":{"forky":"4.4.0-11"},"fixed_version":"3.1.0-9.1","urgency":"low"},"sid":{"status":"resolved","repositories":{"sid":"4.4.0-11"},"fixed_version":"3.1.0-9.1","urgency":"low"},"trixie":{"status":"resolved","repositories":{"trixie":"4.4.0-11"},"fixed_version":"3.1.0-9.1","urgency":"low"}}},"TEMP-0000000-B5C878":{"releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"4.4.0-8"},"fixed_version":"3.1.0-6","urgency":"not yet assigned"},"bullseye":{"status":"resolved","repositories":{"bullseye":"4.4.0-3"},"fixed_version":"3.1.0-6","urgency":"not yet assigned"},"forky":{"status":"resolved","repositories":{"forky":"4.4.0-11"},"fixed_version":"3.1.0-6","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"4.4.0-11"},"fixed_version":"3.1.0-6","urgency":"not yet assigned"},"trixie":{"status":"resolved","repositories":{"trixie":"4.4.0-11"},"fixed_version":"3.1.0-6","urgency":"not yet assigned"}}}},"bacula":{"CVE-2005-2096":{"description":"zlib 1.2 and later versions allows remote attackers to cause a denial of service (crash) via a crafted compressed stream with an incomplete code description of a length greater than 1, which leads to a buffer overflow, as demonstrated using a crafted PNG file.","debianbug":318014,"scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"9.6.7-7"},"fixed_version":"1.36.3-2","urgency":"medium"},"bullseye":{"status":"resolved","repositories":{"bullseye":"9.6.7-3"},"fixed_version":"1.36.3-2","urgency":"medium"},"forky":{"status":"resolved","repositories":{"forky":"15.0.3-5"},"fixed_version":"1.36.3-2","urgency":"medium"},"sid":{"status":"resolved","repositories":{"sid":"15.0.3-5"},"fixed_version":"1.36.3-2","urgency":"medium"},"trixie":{"status":"resolved","repositories":{"trixie":"15.0.3-3"},"fixed_version":"1.36.3-2","urgency":"medium"}}},"CVE-2005-2995":{"description":"bacula 1.36.3 and earlier allows local users to modify or read sensitive files via symlink attacks on (1) the temporary file used by autoconf/randpass when openssl is not available, or (2) the mtx.[PID] temporary file in mtx-changer.in.","debianbug":329271,"scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"9.6.7-7"},"fixed_version":"1.38.9-1","urgency":"low"},"bullseye":{"status":"resolved","repositories":{"bullseye":"9.6.7-3"},"fixed_version":"1.38.9-1","urgency":"low"},"forky":{"status":"resolved","repositories":{"forky":"15.0.3-5"},"fixed_version":"1.38.9-1","urgency":"low"},"sid":{"status":"resolved","repositories":{"sid":"15.0.3-5"},"fixed_version":"1.38.9-1","urgency":"low"},"trixie":{"status":"resolved","repositories":{"trixie":"15.0.3-3"},"fixed_version":"1.38.9-1","urgency":"low"}}},"CVE-2007-5626":{"description":"make_catalog_backup in Bacula 2.2.5, and probably earlier, sends a MySQL password as a command line argument, and sometimes transmits cleartext e-mail containing this command line, which allows context-dependent attackers to obtain the password by listing the process and its arguments, or by sniffing the network.","debianbug":446809,"scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"9.6.7-7"},"fixed_version":"5.0.0-1","urgency":"unimportant"},"bullseye":{"status":"resolved","repositories":{"bullseye":"9.6.7-3"},"fixed_version":"5.0.0-1","urgency":"unimportant"},"forky":{"status":"resolved","repositories":{"forky":"15.0.3-5"},"fixed_version":"5.0.0-1","urgency":"unimportant"},"sid":{"status":"resolved","repositories":{"sid":"15.0.3-5"},"fixed_version":"5.0.0-1","urgency":"unimportant"},"trixie":{"status":"resolved","repositories":{"trixie":"15.0.3-3"},"fixed_version":"5.0.0-1","urgency":"unimportant"}}},"CVE-2008-5373":{"description":"mtx-changer.Adic-Scalar-24 in bacula-common 2.4.2 allows local users to overwrite arbitrary files via a symlink attack on a /tmp/mtx.##### temporary file, probably a related issue to CVE-2005-2995.","debianbug":509301,"scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"9.6.7-7"},"fixed_version":"2.4.0-1","urgency":"unimportant"},"bullseye":{"status":"resolved","repositories":{"bullseye":"9.6.7-3"},"fixed_version":"2.4.0-1","urgency":"unimportant"},"forky":{"status":"resolved","repositories":{"forky":"15.0.3-5"},"fixed_version":"2.4.0-1","urgency":"unimportant"},"sid":{"status":"resolved","repositories":{"sid":"15.0.3-5"},"fixed_version":"2.4.0-1","urgency":"unimportant"},"trixie":{"status":"resolved","repositories":{"trixie":"15.0.3-3"},"fixed_version":"2.4.0-1","urgency":"unimportant"}}},"CVE-2012-4430":{"description":"The dump_resource function in dird/dird_conf.c in Bacula before 5.2.11 does not properly enforce ACL rules, which allows remote authenticated users to obtain resource dump information via unspecified vectors.","debianbug":687923,"scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"9.6.7-7"},"fixed_version":"5.2.6+dfsg-4","urgency":"not yet assigned"},"bullseye":{"status":"resolved","repositories":{"bullseye":"9.6.7-3"},"fixed_version":"5.2.6+dfsg-4","urgency":"not yet assigned"},"forky":{"status":"resolved","repositories":{"forky":"15.0.3-5"},"fixed_version":"5.2.6+dfsg-4","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"15.0.3-5"},"fixed_version":"5.2.6+dfsg-4","urgency":"not yet assigned"},"trixie":{"status":"resolved","repositories":{"trixie":"15.0.3-3"},"fixed_version":"5.2.6+dfsg-4","urgency":"not yet assigned"}}},"CVE-2020-11061":{"description":"In Bareos Director less than or equal to 16.2.10, 17.2.9, 18.2.8, and 19.2.7, a heap overflow allows a malicious client to corrupt the director's memory via oversized digest strings sent during initialization of a verify job. Disabling verify jobs mitigates the problem. This issue is also patched in Bareos versions 19.2.8, 18.2.9 and 17.2.10.","scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"9.6.7-7"},"fixed_version":"9.6.5-1","urgency":"not yet assigned"},"bullseye":{"status":"resolved","repositories":{"bullseye":"9.6.7-3"},"fixed_version":"9.6.5-1","urgency":"not yet assigned"},"forky":{"status":"resolved","repositories":{"forky":"15.0.3-5"},"fixed_version":"9.6.5-1","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"15.0.3-5"},"fixed_version":"9.6.5-1","urgency":"not yet assigned"},"trixie":{"status":"resolved","repositories":{"trixie":"15.0.3-3"},"fixed_version":"9.6.5-1","urgency":"not yet assigned"}}}},"balsa":{"CVE-2003-0167":{"description":"Multiple off-by-one buffer overflows in the IMAP capability for Mutt 1.3.28 and earlier, and Balsa 1.2.4 and earlier, allow a remote malicious IMAP server to cause a denial of service (crash) and possibly execute arbitrary code via a specially crafted mail folder, a different vulnerability than CVE-2003-0140.","scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"2.6.4-2"},"fixed_version":"2.0.10","urgency":"not yet assigned"},"bullseye":{"status":"resolved","repositories":{"bullseye":"2.6.1-1"},"fixed_version":"2.0.10","urgency":"not yet assigned"},"forky":{"status":"resolved","repositories":{"forky":"2.6.5-3"},"fixed_version":"2.0.10","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"2.6.5-3"},"fixed_version":"2.0.10","urgency":"not yet assigned"},"trixie":{"status":"resolved","repositories":{"trixie":"2.6.4-4"},"fixed_version":"2.0.10","urgency":"not yet assigned"}}},"CVE-2007-1558":{"description":"The APOP protocol allows remote attackers to guess the first 3 characters of a password via man-in-the-middle (MITM) attacks that use crafted message IDs and MD5 collisions.  NOTE: this design-level issue potentially affects all products that use APOP, including (1) Thunderbird 1.x before 1.5.0.12 and 2.x before 2.0.0.4, (2) Evolution, (3) mutt, (4) fetchmail before 6.3.8, (5) SeaMonkey 1.0.x before 1.0.9 and 1.1.x before 1.1.2, (6) Balsa 2.3.16 and earlier, (7) Mailfilter before 0.8.2, and possibly other products.","scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"2.6.4-2"},"fixed_version":"2.3.17-1","urgency":"unimportant"},"bullseye":{"status":"resolved","repositories":{"bullseye":"2.6.1-1"},"fixed_version":"2.3.17-1","urgency":"unimportant"},"forky":{"status":"resolved","repositories":{"forky":"2.6.5-3"},"fixed_version":"2.3.17-1","urgency":"unimportant"},"sid":{"status":"resolved","repositories":{"sid":"2.6.5-3"},"fixed_version":"2.3.17-1","urgency":"unimportant"},"trixie":{"status":"resolved","repositories":{"trixie":"2.6.4-4"},"fixed_version":"2.3.17-1","urgency":"unimportant"}}},"CVE-2007-5007":{"description":"Stack-based buffer overflow in the ir_fetch_seq function in balsa before 2.3.20 might allow remote IMAP servers to execute arbitrary code via a long response to a FETCH command.","scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"2.6.4-2"},"fixed_version":"2.3.20-1","urgency":"low"},"bullseye":{"status":"resolved","repositories":{"bullseye":"2.6.1-1"},"fixed_version":"2.3.20-1","urgency":"low"},"forky":{"status":"resolved","repositories":{"forky":"2.6.5-3"},"fixed_version":"2.3.20-1","urgency":"low"},"sid":{"status":"resolved","repositories":{"sid":"2.6.5-3"},"fixed_version":"2.3.20-1","urgency":"low"},"trixie":{"status":"resolved","repositories":{"trixie":"2.6.4-4"},"fixed_version":"2.3.20-1","urgency":"low"}}},"CVE-2020-16118":{"description":"In GNOME Balsa before 2.6.0, a malicious server operator or man in the middle can trigger a NULL pointer dereference and client crash by sending a PREAUTH response to imap_mbox_connect in libbalsa/imap/imap-handle.c.","scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"2.6.4-2"},"fixed_version":"2.6.0-1","urgency":"not yet assigned"},"bullseye":{"status":"resolved","repositories":{"bullseye":"2.6.1-1"},"fixed_version":"2.6.0-1","urgency":"not yet assigned"},"forky":{"status":"resolved","repositories":{"forky":"2.6.5-3"},"fixed_version":"2.6.0-1","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"2.6.5-3"},"fixed_version":"2.6.0-1","urgency":"not yet assigned"},"trixie":{"status":"resolved","repositories":{"trixie":"2.6.4-4"},"fixed_version":"2.6.0-1","urgency":"not yet assigned"}}}},"barbican":{"CVE-2022-23451":{"description":"An authorization flaw was found in openstack-barbican. The default policy rules for the secret metadata API allowed any authenticated user to add, modify, or delete metadata from any secret regardless of ownership. This flaw allows an attacker on the network to modify or delete protected data, causing a denial of service by consuming protected resources.","scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"1:15.0.1-2"},"fixed_version":"1:14.0.0~rc1-2","urgency":"not yet assigned"},"bullseye":{"status":"open","repositories":{"bullseye":"1:11.0.0-3+deb11u1","bullseye-security":"1:11.0.0-3+deb11u1"},"urgency":"not yet assigned","nodsa":"Minor issue","nodsa_reason":""},"forky":{"status":"resolved","repositories":{"forky":"1:21.0.0-4"},"fixed_version":"1:14.0.0~rc1-2","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"1:21.0.0-4"},"fixed_version":"1:14.0.0~rc1-2","urgency":"not yet assigned"},"trixie":{"status":"resolved","repositories":{"trixie":"1:20.0.0-3"},"fixed_version":"1:14.0.0~rc1-2","urgency":"not yet assigned"}}},"CVE-2022-23452":{"description":"An authorization flaw was found in openstack-barbican, where anyone with an admin role could add secrets to a different project container. This flaw allows an attacker on the network to consume protected resources and cause a denial of service.","scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"1:15.0.1-2"},"fixed_version":"1:14.0.0~rc1-2","urgency":"not yet assigned"},"bullseye":{"status":"open","repositories":{"bullseye":"1:11.0.0-3+deb11u1","bullseye-security":"1:11.0.0-3+deb11u1"},"urgency":"not yet assigned","nodsa":"Minor issue","nodsa_reason":""},"forky":{"status":"resolved","repositories":{"forky":"1:21.0.0-4"},"fixed_version":"1:14.0.0~rc1-2","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"1:21.0.0-4"},"fixed_version":"1:14.0.0~rc1-2","urgency":"not yet assigned"},"trixie":{"status":"resolved","repositories":{"trixie":"1:20.0.0-3"},"fixed_version":"1:14.0.0~rc1-2","urgency":"not yet assigned"}}},"CVE-2022-3100":{"description":"A flaw was found in the openstack-barbican component. This issue allows an access policy bypass via a query string when accessing the API.","debianbug":1021139,"scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"1:15.0.1-2"},"fixed_version":"1:15.0.0~rc3-1","urgency":"not yet assigned"},"bullseye":{"status":"resolved","repositories":{"bullseye":"1:11.0.0-3+deb11u1","bullseye-security":"1:11.0.0-3+deb11u1"},"fixed_version":"1:11.0.0-3+deb11u1","urgency":"not yet assigned"},"forky":{"status":"resolved","repositories":{"forky":"1:21.0.0-4"},"fixed_version":"1:15.0.0~rc3-1","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"1:21.0.0-4"},"fixed_version":"1:15.0.0~rc3-1","urgency":"not yet assigned"},"trixie":{"status":"resolved","repositories":{"trixie":"1:20.0.0-3"},"fixed_version":"1:15.0.0~rc3-1","urgency":"not yet assigned"}}},"CVE-2023-1633":{"description":"A credentials leak flaw was found in OpenStack Barbican. This flaw allows a local authenticated attacker to read the configuration file, gaining access to sensitive credentials.","scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"1:15.0.1-2"},"fixed_version":"0","urgency":"unimportant"},"bullseye":{"status":"resolved","repositories":{"bullseye":"1:11.0.0-3+deb11u1","bullseye-security":"1:11.0.0-3+deb11u1"},"fixed_version":"0","urgency":"unimportant"},"forky":{"status":"resolved","repositories":{"forky":"1:21.0.0-4"},"fixed_version":"0","urgency":"unimportant"},"sid":{"status":"resolved","repositories":{"sid":"1:21.0.0-4"},"fixed_version":"0","urgency":"unimportant"},"trixie":{"status":"resolved","repositories":{"trixie":"1:20.0.0-3"},"fixed_version":"0","urgency":"unimportant"}}},"CVE-2023-1636":{"description":"A vulnerability was found in OpenStack Barbican containers. This vulnerability is only applicable to deployments that utilize an all-in-one configuration. Barbican containers share the same CGROUP, USER, and NET namespace with the host system and other OpenStack services. If any service is compromised, it could gain access to the data transmitted to and from Barbican.","scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"1:15.0.1-2"},"fixed_version":"0","urgency":"unimportant"},"bullseye":{"status":"resolved","repositories":{"bullseye":"1:11.0.0-3+deb11u1","bullseye-security":"1:11.0.0-3+deb11u1"},"fixed_version":"0","urgency":"unimportant"},"forky":{"status":"resolved","repositories":{"forky":"1:21.0.0-4"},"fixed_version":"0","urgency":"unimportant"},"sid":{"status":"resolved","repositories":{"sid":"1:21.0.0-4"},"fixed_version":"0","urgency":"unimportant"},"trixie":{"status":"resolved","repositories":{"trixie":"1:20.0.0-3"},"fixed_version":"0","urgency":"unimportant"}}}},"barcode":{"CVE-2018-25154":{"description":"GNU Barcode 0.99 contains a buffer overflow vulnerability in its code 93 encoding process that allows attackers to trigger memory corruption. Attackers can exploit boundary errors during input file processing to potentially execute arbitrary code on the affected system.","scope":"local","releases":{"bookworm":{"status":"open","repositories":{"bookworm":"0.99-6"},"urgency":"unimportant"},"bullseye":{"status":"open","repositories":{"bullseye":"0.99-4"},"urgency":"unimportant"},"forky":{"status":"open","repositories":{"forky":"0.99-9"},"urgency":"unimportant"},"sid":{"status":"open","repositories":{"sid":"0.99-9"},"urgency":"unimportant"},"trixie":{"status":"open","repositories":{"trixie":"0.99-9"},"urgency":"unimportant"}}}},"barnowl":{"CVE-2009-0363":{"description":"Multiple buffer overflows in (a) BarnOwl before 1.0.5 and (b) owl 2.1.11 allow remote attackers to execute arbitrary code via vectors involving (1) a crafted zcrypt message, related to zcrypt.c; (2) a reply command on a message with a Zephyr Cc: list, related to zwrite.c; and unspecified other use of the products.","scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"1.10-2"},"fixed_version":"1.0.5-1","urgency":"not yet assigned"},"bullseye":{"status":"resolved","repositories":{"bullseye":"1.10-2"},"fixed_version":"1.0.5-1","urgency":"not yet assigned"},"forky":{"status":"resolved","repositories":{"forky":"1.10-2"},"fixed_version":"1.0.5-1","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"1.10-2"},"fixed_version":"1.0.5-1","urgency":"not yet assigned"},"trixie":{"status":"resolved","repositories":{"trixie":"1.10-2"},"fixed_version":"1.0.5-1","urgency":"not yet assigned"}}},"CVE-2010-0793":{"description":"Buffer overflow in BarnOwl before 1.5.1 allows remote attackers to cause a denial of service (crash) and possibly execute arbitrary code via a crafted CC: header.","debianbug":574418,"scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"1.10-2"},"fixed_version":"1.5.1-1","urgency":"not yet assigned"},"bullseye":{"status":"resolved","repositories":{"bullseye":"1.10-2"},"fixed_version":"1.5.1-1","urgency":"not yet assigned"},"forky":{"status":"resolved","repositories":{"forky":"1.10-2"},"fixed_version":"1.5.1-1","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"1.10-2"},"fixed_version":"1.5.1-1","urgency":"not yet assigned"},"trixie":{"status":"resolved","repositories":{"trixie":"1.10-2"},"fixed_version":"1.5.1-1","urgency":"not yet assigned"}}},"CVE-2010-2725":{"description":"BarnOwl before 1.6.2 does not check the return code of calls to the (1) ZPending and (2) ZReceiveNotice functions in libzephyr, which allows remote attackers to cause a denial of service (crash) and possibly execute arbitrary code via unknown vectors.","debianbug":593299,"scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"1.10-2"},"fixed_version":"1.6.2-1","urgency":"not yet assigned"},"bullseye":{"status":"resolved","repositories":{"bullseye":"1.10-2"},"fixed_version":"1.6.2-1","urgency":"not yet assigned"},"forky":{"status":"resolved","repositories":{"forky":"1.10-2"},"fixed_version":"1.6.2-1","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"1.10-2"},"fixed_version":"1.6.2-1","urgency":"not yet assigned"},"trixie":{"status":"resolved","repositories":{"trixie":"1.10-2"},"fixed_version":"1.6.2-1","urgency":"not yet assigned"}}}},"base-files":{"CVE-2010-0834":{"description":"The base-files package before 5.0.0ubuntu7.1 on Ubuntu 9.10 and before 5.0.0ubuntu20.10.04.2 on Ubuntu 10.04 LTS, as shipped on Dell Latitude 2110 netbooks, does not require authentication for package installation, which allows remote archive servers and man-in-the-middle attackers to execute arbitrary code via a crafted package.","scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"12.4+deb12u13"},"fixed_version":"0","urgency":"unimportant"},"bullseye":{"status":"resolved","repositories":{"bullseye":"11.1+deb11u11"},"fixed_version":"0","urgency":"unimportant"},"forky":{"status":"resolved","repositories":{"forky":"14"},"fixed_version":"0","urgency":"unimportant"},"sid":{"status":"resolved","repositories":{"sid":"14"},"fixed_version":"0","urgency":"unimportant"},"trixie":{"status":"resolved","repositories":{"trixie":"13.8+deb13u3"},"fixed_version":"0","urgency":"unimportant"}}},"CVE-2018-6557":{"description":"The MOTD update script in the base-files package in Ubuntu 18.04 LTS before 10.1ubuntu2.2, and Ubuntu 18.10 before 10.1ubuntu6 incorrectly handled temporary files. A local attacker could use this issue to cause a denial of service, or possibly escalate privileges if kernel symlink restrictions were disabled.","scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"12.4+deb12u13"},"fixed_version":"0","urgency":"unimportant"},"bullseye":{"status":"resolved","repositories":{"bullseye":"11.1+deb11u11"},"fixed_version":"0","urgency":"unimportant"},"forky":{"status":"resolved","repositories":{"forky":"14"},"fixed_version":"0","urgency":"unimportant"},"sid":{"status":"resolved","repositories":{"sid":"14"},"fixed_version":"0","urgency":"unimportant"},"trixie":{"status":"resolved","repositories":{"trixie":"13.8+deb13u3"},"fixed_version":"0","urgency":"unimportant"}}}},"base-passwd":{"TEMP-0274229-6E02C2":{"debianbug":274229,"releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"3.6.1"},"fixed_version":"3.5.30","urgency":"unimportant"},"bullseye":{"status":"resolved","repositories":{"bullseye":"3.5.51"},"fixed_version":"3.5.30","urgency":"unimportant"},"forky":{"status":"resolved","repositories":{"forky":"3.6.8"},"fixed_version":"3.5.30","urgency":"unimportant"},"sid":{"status":"resolved","repositories":{"sid":"3.6.8"},"fixed_version":"3.5.30","urgency":"unimportant"},"trixie":{"status":"resolved","repositories":{"trixie":"3.6.7"},"fixed_version":"3.5.30","urgency":"unimportant"}}}},"bash":{"CVE-2008-5374":{"description":"bash-doc 3.2 allows local users to overwrite arbitrary files via a symlink attack on a /tmp/cb#####.? temporary file, related to the (1) aliasconv.sh, (2) aliasconv.bash, and (3) cshtobash scripts.","debianbug":509279,"scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"5.2.15-2"},"fixed_version":"4.0-2","urgency":"unimportant"},"bullseye":{"status":"resolved","repositories":{"bullseye":"5.1-2+deb11u1"},"fixed_version":"4.0-2","urgency":"unimportant"},"forky":{"status":"resolved","repositories":{"forky":"5.3-2"},"fixed_version":"4.0-2","urgency":"unimportant"},"sid":{"status":"resolved","repositories":{"sid":"5.3-2"},"fixed_version":"4.0-2","urgency":"unimportant"},"trixie":{"status":"resolved","repositories":{"trixie":"5.2.37-2"},"fixed_version":"4.0-2","urgency":"unimportant"}}},"CVE-2010-0002":{"description":"The /etc/profile.d/60alias.sh script in the Mandriva bash package for Bash 2.05b, 3.0, 3.2, 3.2.48, and 4.0 enables the --show-control-chars option in LS_OPTIONS, which allows local users to send escape sequences to terminal emulators, or hide the existence of a file, via a crafted filename.","scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"5.2.15-2"},"fixed_version":"0","urgency":"unimportant"},"bullseye":{"status":"resolved","repositories":{"bullseye":"5.1-2+deb11u1"},"fixed_version":"0","urgency":"unimportant"},"forky":{"status":"resolved","repositories":{"forky":"5.3-2"},"fixed_version":"0","urgency":"unimportant"},"sid":{"status":"resolved","repositories":{"sid":"5.3-2"},"fixed_version":"0","urgency":"unimportant"},"trixie":{"status":"resolved","repositories":{"trixie":"5.2.37-2"},"fixed_version":"0","urgency":"unimportant"}}},"CVE-2012-3410":{"description":"Stack-based buffer overflow in lib/sh/eaccess.c in GNU Bash before 4.2 patch 33 might allow local users to bypass intended restricted shell access via a long filename in /dev/fd, which is not properly handled when expanding the /dev/fd prefix.","debianbug":681278,"scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"5.2.15-2"},"fixed_version":"4.2-4","urgency":"low"},"bullseye":{"status":"resolved","repositories":{"bullseye":"5.1-2+deb11u1"},"fixed_version":"4.2-4","urgency":"low"},"forky":{"status":"resolved","repositories":{"forky":"5.3-2"},"fixed_version":"4.2-4","urgency":"low"},"sid":{"status":"resolved","repositories":{"sid":"5.3-2"},"fixed_version":"4.2-4","urgency":"low"},"trixie":{"status":"resolved","repositories":{"trixie":"5.2.37-2"},"fixed_version":"4.2-4","urgency":"low"}}},"CVE-2012-6711":{"description":"A heap-based buffer overflow exists in GNU Bash before 4.3 when wide characters, not supported by the current locale set in the LC_CTYPE environment variable, are printed through the echo built-in function. A local attacker, who can provide data to print through the \"echo -e\" built-in function, may use this flaw to crash a script or execute code with the privileges of the bash process. This occurs because ansicstr() in lib/sh/strtrans.c mishandles u32cconv().","scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"5.2.15-2"},"fixed_version":"4.3-1","urgency":"not yet assigned"},"bullseye":{"status":"resolved","repositories":{"bullseye":"5.1-2+deb11u1"},"fixed_version":"4.3-1","urgency":"not yet assigned"},"forky":{"status":"resolved","repositories":{"forky":"5.3-2"},"fixed_version":"4.3-1","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"5.3-2"},"fixed_version":"4.3-1","urgency":"not yet assigned"},"trixie":{"status":"resolved","repositories":{"trixie":"5.2.37-2"},"fixed_version":"4.3-1","urgency":"not yet assigned"}}},"CVE-2014-6271":{"description":"GNU Bash through 4.3 processes trailing strings after function definitions in the values of environment variables, which allows remote attackers to execute arbitrary code via a crafted environment, as demonstrated by vectors involving the ForceCommand feature in OpenSSH sshd, the mod_cgi and mod_cgid modules in the Apache HTTP Server, scripts executed by unspecified DHCP clients, and other situations in which setting the environment occurs across a privilege boundary from Bash execution, aka \"ShellShock.\"  NOTE: the original fix for this issue was incorrect; CVE-2014-7169 has been assigned to cover the vulnerability that is still present after the incorrect fix.","scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"5.2.15-2"},"fixed_version":"4.3-9.1","urgency":"not yet assigned"},"bullseye":{"status":"resolved","repositories":{"bullseye":"5.1-2+deb11u1"},"fixed_version":"4.3-9.1","urgency":"not yet assigned"},"forky":{"status":"resolved","repositories":{"forky":"5.3-2"},"fixed_version":"4.3-9.1","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"5.3-2"},"fixed_version":"4.3-9.1","urgency":"not yet assigned"},"trixie":{"status":"resolved","repositories":{"trixie":"5.2.37-2"},"fixed_version":"4.3-9.1","urgency":"not yet assigned"}}},"CVE-2014-6277":{"description":"GNU Bash through 4.3 bash43-026 does not properly parse function definitions in the values of environment variables, which allows remote attackers to execute arbitrary code or cause a denial of service (uninitialized memory access, and untrusted-pointer read and write operations) via a crafted environment, as demonstrated by vectors involving the ForceCommand feature in OpenSSH sshd, the mod_cgi and mod_cgid modules in the Apache HTTP Server, scripts executed by unspecified DHCP clients, and other situations in which setting the environment occurs across a privilege boundary from Bash execution.  NOTE: this vulnerability exists because of an incomplete fix for CVE-2014-6271 and CVE-2014-7169.","scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"5.2.15-2"},"fixed_version":"4.3-9.2","urgency":"not yet assigned"},"bullseye":{"status":"resolved","repositories":{"bullseye":"5.1-2+deb11u1"},"fixed_version":"4.3-9.2","urgency":"not yet assigned"},"forky":{"status":"resolved","repositories":{"forky":"5.3-2"},"fixed_version":"4.3-9.2","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"5.3-2"},"fixed_version":"4.3-9.2","urgency":"not yet assigned"},"trixie":{"status":"resolved","repositories":{"trixie":"5.2.37-2"},"fixed_version":"4.3-9.2","urgency":"not yet assigned"}}},"CVE-2014-6278":{"description":"GNU Bash through 4.3 bash43-026 does not properly parse function definitions in the values of environment variables, which allows remote attackers to execute arbitrary commands via a crafted environment, as demonstrated by vectors involving the ForceCommand feature in OpenSSH sshd, the mod_cgi and mod_cgid modules in the Apache HTTP Server, scripts executed by unspecified DHCP clients, and other situations in which setting the environment occurs across a privilege boundary from Bash execution.  NOTE: this vulnerability exists because of an incomplete fix for CVE-2014-6271, CVE-2014-7169, and CVE-2014-6277.","scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"5.2.15-2"},"fixed_version":"4.3-9.2","urgency":"high"},"bullseye":{"status":"resolved","repositories":{"bullseye":"5.1-2+deb11u1"},"fixed_version":"4.3-9.2","urgency":"high"},"forky":{"status":"resolved","repositories":{"forky":"5.3-2"},"fixed_version":"4.3-9.2","urgency":"high"},"sid":{"status":"resolved","repositories":{"sid":"5.3-2"},"fixed_version":"4.3-9.2","urgency":"high"},"trixie":{"status":"resolved","repositories":{"trixie":"5.2.37-2"},"fixed_version":"4.3-9.2","urgency":"high"}}},"CVE-2014-7169":{"description":"GNU Bash through 4.3 bash43-025 processes trailing strings after certain malformed function definitions in the values of environment variables, which allows remote attackers to write to files or possibly have unknown other impact via a crafted environment, as demonstrated by vectors involving the ForceCommand feature in OpenSSH sshd, the mod_cgi and mod_cgid modules in the Apache HTTP Server, scripts executed by unspecified DHCP clients, and other situations in which setting the environment occurs across a privilege boundary from Bash execution.  NOTE: this vulnerability exists because of an incomplete fix for CVE-2014-6271.","debianbug":762760,"scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"5.2.15-2"},"fixed_version":"4.3-9.2","urgency":"not yet assigned"},"bullseye":{"status":"resolved","repositories":{"bullseye":"5.1-2+deb11u1"},"fixed_version":"4.3-9.2","urgency":"not yet assigned"},"forky":{"status":"resolved","repositories":{"forky":"5.3-2"},"fixed_version":"4.3-9.2","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"5.3-2"},"fixed_version":"4.3-9.2","urgency":"not yet assigned"},"trixie":{"status":"resolved","repositories":{"trixie":"5.2.37-2"},"fixed_version":"4.3-9.2","urgency":"not yet assigned"}}},"CVE-2014-7186":{"description":"The redirection implementation in parse.y in GNU Bash through 4.3 bash43-026 allows remote attackers to cause a denial of service (out-of-bounds array access and application crash) or possibly have unspecified other impact via crafted use of here documents, aka the \"redir_stack\" issue.","scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"5.2.15-2"},"fixed_version":"4.3-9.2","urgency":"not yet assigned"},"bullseye":{"status":"resolved","repositories":{"bullseye":"5.1-2+deb11u1"},"fixed_version":"4.3-9.2","urgency":"not yet assigned"},"forky":{"status":"resolved","repositories":{"forky":"5.3-2"},"fixed_version":"4.3-9.2","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"5.3-2"},"fixed_version":"4.3-9.2","urgency":"not yet assigned"},"trixie":{"status":"resolved","repositories":{"trixie":"5.2.37-2"},"fixed_version":"4.3-9.2","urgency":"not yet assigned"}}},"CVE-2014-7187":{"description":"Off-by-one error in the read_token_word function in parse.y in GNU Bash through 4.3 bash43-026 allows remote attackers to cause a denial of service (out-of-bounds array access and application crash) or possibly have unspecified other impact via deeply nested for loops, aka the \"word_lineno\" issue.","scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"5.2.15-2"},"fixed_version":"4.3-9.2","urgency":"not yet assigned"},"bullseye":{"status":"resolved","repositories":{"bullseye":"5.1-2+deb11u1"},"fixed_version":"4.3-9.2","urgency":"not yet assigned"},"forky":{"status":"resolved","repositories":{"forky":"5.3-2"},"fixed_version":"4.3-9.2","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"5.3-2"},"fixed_version":"4.3-9.2","urgency":"not yet assigned"},"trixie":{"status":"resolved","repositories":{"trixie":"5.2.37-2"},"fixed_version":"4.3-9.2","urgency":"not yet assigned"}}},"CVE-2016-0634":{"description":"The expansion of '\\h' in the prompt string in bash 4.3 allows remote authenticated users to execute arbitrary code via shell metacharacters placed in 'hostname' of a machine.","scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"5.2.15-2"},"fixed_version":"4.4-1","urgency":"unimportant"},"bullseye":{"status":"resolved","repositories":{"bullseye":"5.1-2+deb11u1"},"fixed_version":"4.4-1","urgency":"unimportant"},"forky":{"status":"resolved","repositories":{"forky":"5.3-2"},"fixed_version":"4.4-1","urgency":"unimportant"},"sid":{"status":"resolved","repositories":{"sid":"5.3-2"},"fixed_version":"4.4-1","urgency":"unimportant"},"trixie":{"status":"resolved","repositories":{"trixie":"5.2.37-2"},"fixed_version":"4.4-1","urgency":"unimportant"}}},"CVE-2016-7543":{"description":"Bash before 4.4 allows local users to execute arbitrary commands with root privileges via crafted SHELLOPTS and PS4 environment variables.","scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"5.2.15-2"},"fixed_version":"4.4-1","urgency":"not yet assigned"},"bullseye":{"status":"resolved","repositories":{"bullseye":"5.1-2+deb11u1"},"fixed_version":"4.4-1","urgency":"not yet assigned"},"forky":{"status":"resolved","repositories":{"forky":"5.3-2"},"fixed_version":"4.4-1","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"5.3-2"},"fixed_version":"4.4-1","urgency":"not yet assigned"},"trixie":{"status":"resolved","repositories":{"trixie":"5.2.37-2"},"fixed_version":"4.4-1","urgency":"not yet assigned"}}},"CVE-2016-9401":{"description":"popd in bash might allow local users to bypass the restricted shell and cause a use-after-free via a crafted address.","debianbug":844727,"scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"5.2.15-2"},"fixed_version":"4.4-3","urgency":"not yet assigned"},"bullseye":{"status":"resolved","repositories":{"bullseye":"5.1-2+deb11u1"},"fixed_version":"4.4-3","urgency":"not yet assigned"},"forky":{"status":"resolved","repositories":{"forky":"5.3-2"},"fixed_version":"4.4-3","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"5.3-2"},"fixed_version":"4.4-3","urgency":"not yet assigned"},"trixie":{"status":"resolved","repositories":{"trixie":"5.2.37-2"},"fixed_version":"4.4-3","urgency":"not yet assigned"}}},"CVE-2017-5932":{"description":"The path autocompletion feature in Bash 4.4 allows local users to gain privileges via a crafted filename starting with a \" (double quote) character and a command substitution metacharacter.","scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"5.2.15-2"},"fixed_version":"4.4-3","urgency":"not yet assigned"},"bullseye":{"status":"resolved","repositories":{"bullseye":"5.1-2+deb11u1"},"fixed_version":"4.4-3","urgency":"not yet assigned"},"forky":{"status":"resolved","repositories":{"forky":"5.3-2"},"fixed_version":"4.4-3","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"5.3-2"},"fixed_version":"4.4-3","urgency":"not yet assigned"},"trixie":{"status":"resolved","repositories":{"trixie":"5.2.37-2"},"fixed_version":"4.4-3","urgency":"not yet assigned"}}},"CVE-2019-18276":{"description":"An issue was discovered in disable_priv_mode in shell.c in GNU Bash through 5.0 patch 11. By default, if Bash is run with its effective UID not equal to its real UID, it will drop privileges by setting its effective UID to its real UID. However, it does so incorrectly. On Linux and other systems that support \"saved UID\" functionality, the saved UID is not dropped. An attacker with command execution in the shell can use \"enable -f\" for runtime loading of a new builtin, which can be a shared object that calls setuid() and therefore regains privileges. However, binaries running with an effective UID of 0 are unaffected.","scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"5.2.15-2"},"fixed_version":"5.1~rc1-2","urgency":"unimportant"},"bullseye":{"status":"resolved","repositories":{"bullseye":"5.1-2+deb11u1"},"fixed_version":"5.1~rc1-2","urgency":"unimportant"},"forky":{"status":"resolved","repositories":{"forky":"5.3-2"},"fixed_version":"5.1~rc1-2","urgency":"unimportant"},"sid":{"status":"resolved","repositories":{"sid":"5.3-2"},"fixed_version":"5.1~rc1-2","urgency":"unimportant"},"trixie":{"status":"resolved","repositories":{"trixie":"5.2.37-2"},"fixed_version":"5.1~rc1-2","urgency":"unimportant"}}},"CVE-2019-9924":{"description":"rbash in Bash before 4.4-beta2 did not prevent the shell user from modifying BASH_CMDS, thus allowing the user to execute any command with the permissions of the shell.","scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"5.2.15-2"},"fixed_version":"4.4-1","urgency":"low"},"bullseye":{"status":"resolved","repositories":{"bullseye":"5.1-2+deb11u1"},"fixed_version":"4.4-1","urgency":"low"},"forky":{"status":"resolved","repositories":{"forky":"5.3-2"},"fixed_version":"4.4-1","urgency":"low"},"sid":{"status":"resolved","repositories":{"sid":"5.3-2"},"fixed_version":"4.4-1","urgency":"low"},"trixie":{"status":"resolved","repositories":{"trixie":"5.2.37-2"},"fixed_version":"4.4-1","urgency":"low"}}},"CVE-2022-3715":{"description":"A flaw was found in the bash package, where a heap-buffer overflow can occur in valid parameter_transform. This issue may lead to memory problems.","debianbug":1030355,"scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"5.2.15-2"},"fixed_version":"5.2-1","urgency":"not yet assigned"},"bullseye":{"status":"open","repositories":{"bullseye":"5.1-2+deb11u1"},"urgency":"not yet assigned","nodsa":"Minor issue","nodsa_reason":""},"forky":{"status":"resolved","repositories":{"forky":"5.3-2"},"fixed_version":"5.2-1","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"5.3-2"},"fixed_version":"5.2-1","urgency":"not yet assigned"},"trixie":{"status":"resolved","repositories":{"trixie":"5.2.37-2"},"fixed_version":"5.2-1","urgency":"not yet assigned"}}},"TEMP-0841856-B18BAF":{"debianbug":841856,"releases":{"bookworm":{"status":"open","repositories":{"bookworm":"5.2.15-2"},"urgency":"unimportant"},"bullseye":{"status":"open","repositories":{"bullseye":"5.1-2+deb11u1"},"urgency":"unimportant"},"forky":{"status":"open","repositories":{"forky":"5.3-2"},"urgency":"unimportant"},"sid":{"status":"open","repositories":{"sid":"5.3-2"},"urgency":"unimportant"},"trixie":{"status":"open","repositories":{"trixie":"5.2.37-2"},"urgency":"unimportant"}}}},"bash-completion":{"CVE-2018-7738":{"description":"In util-linux before 2.32-rc1, bash-completion/umount allows local users to gain privileges by embedding shell commands in a mountpoint name, which is mishandled during a umount command (within Bash) by a different user, as demonstrated by logging in as root and entering umount followed by a tab character for autocompletion.","scope":"local","releases":{"bookworm":{"status":"open","repositories":{"bookworm":"1:2.11-6"},"urgency":"unimportant"},"bullseye":{"status":"open","repositories":{"bullseye":"1:2.11-2"},"urgency":"unimportant"},"forky":{"status":"open","repositories":{"forky":"1:2.16.0-8"},"urgency":"unimportant"},"sid":{"status":"open","repositories":{"sid":"1:2.16.0-8"},"urgency":"unimportant"},"trixie":{"status":"open","repositories":{"trixie":"1:2.16.0-7"},"urgency":"unimportant"}}},"TEMP-0259987-89C19C":{"debianbug":259987,"releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"1:2.11-6"},"fixed_version":"200811xx~bzr1223","urgency":"not yet assigned"},"bullseye":{"status":"resolved","repositories":{"bullseye":"1:2.11-2"},"fixed_version":"200811xx~bzr1223","urgency":"not yet assigned"},"forky":{"status":"resolved","repositories":{"forky":"1:2.16.0-8"},"fixed_version":"200811xx~bzr1223","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"1:2.16.0-8"},"fixed_version":"200811xx~bzr1223","urgency":"not yet assigned"},"trixie":{"status":"resolved","repositories":{"trixie":"1:2.16.0-7"},"fixed_version":"200811xx~bzr1223","urgency":"not yet assigned"}}}},"batik":{"CVE-2005-0508":{"description":"Unknown vulnerability in Squiggle for Batik before 1.5.1 allows attackers to bypass certain access controls via certain features of the Rhino scripting engine due to a \"script security issue.\"","scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"1.16+dfsg-1+deb12u1"},"fixed_version":"1.5.1-1","urgency":"not yet assigned"},"bullseye":{"status":"resolved","repositories":{"bullseye":"1.12-4+deb11u2","bullseye-security":"1.12-4+deb11u3"},"fixed_version":"1.5.1-1","urgency":"not yet assigned"},"forky":{"status":"resolved","repositories":{"forky":"1.18+dfsg-2"},"fixed_version":"1.5.1-1","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"1.18+dfsg-2"},"fixed_version":"1.5.1-1","urgency":"not yet assigned"},"trixie":{"status":"resolved","repositories":{"trixie":"1.18+dfsg-2"},"fixed_version":"1.5.1-1","urgency":"not yet assigned"}}},"CVE-2015-0250":{"description":"XML external entity (XXE) vulnerability in the SVG to (1) PNG and (2) JPG conversion classes in Apache Batik 1.x before 1.8 allows remote attackers to read arbitrary files or cause a denial of service via a crafted SVG file.","debianbug":780897,"scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"1.16+dfsg-1+deb12u1"},"fixed_version":"1.7+dfsg-5","urgency":"not yet assigned"},"bullseye":{"status":"resolved","repositories":{"bullseye":"1.12-4+deb11u2","bullseye-security":"1.12-4+deb11u3"},"fixed_version":"1.7+dfsg-5","urgency":"not yet assigned"},"forky":{"status":"resolved","repositories":{"forky":"1.18+dfsg-2"},"fixed_version":"1.7+dfsg-5","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"1.18+dfsg-2"},"fixed_version":"1.7+dfsg-5","urgency":"not yet assigned"},"trixie":{"status":"resolved","repositories":{"trixie":"1.18+dfsg-2"},"fixed_version":"1.7+dfsg-5","urgency":"not yet assigned"}}},"CVE-2017-5662":{"description":"In Apache Batik before 1.9, files lying on the filesystem of the server which uses batik can be revealed to arbitrary users who send maliciously formed SVG files. The file types that can be shown depend on the user context in which the exploitable application is running. If the user is root a full compromise of the server - including confidential or sensitive files - would be possible. XXE can also be used to attack the availability of the server via denial of service as the references within a xml document can trivially trigger an amplification attack.","debianbug":860566,"scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"1.16+dfsg-1+deb12u1"},"fixed_version":"1.9-1","urgency":"not yet assigned"},"bullseye":{"status":"resolved","repositories":{"bullseye":"1.12-4+deb11u2","bullseye-security":"1.12-4+deb11u3"},"fixed_version":"1.9-1","urgency":"not yet assigned"},"forky":{"status":"resolved","repositories":{"forky":"1.18+dfsg-2"},"fixed_version":"1.9-1","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"1.18+dfsg-2"},"fixed_version":"1.9-1","urgency":"not yet assigned"},"trixie":{"status":"resolved","repositories":{"trixie":"1.18+dfsg-2"},"fixed_version":"1.9-1","urgency":"not yet assigned"}}},"CVE-2018-8013":{"description":"In Apache Batik 1.x before 1.10, when deserializing subclass of `AbstractDocument`, the class takes a string from the inputStream as the class name which then use it to call the no-arg constructor of the class. Fix was to check the class type before calling newInstance in deserialization.","debianbug":899374,"scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"1.16+dfsg-1+deb12u1"},"fixed_version":"1.10-1","urgency":"not yet assigned"},"bullseye":{"status":"resolved","repositories":{"bullseye":"1.12-4+deb11u2","bullseye-security":"1.12-4+deb11u3"},"fixed_version":"1.10-1","urgency":"not yet assigned"},"forky":{"status":"resolved","repositories":{"forky":"1.18+dfsg-2"},"fixed_version":"1.10-1","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"1.18+dfsg-2"},"fixed_version":"1.10-1","urgency":"not yet assigned"},"trixie":{"status":"resolved","repositories":{"trixie":"1.18+dfsg-2"},"fixed_version":"1.10-1","urgency":"not yet assigned"}}},"CVE-2019-17566":{"description":"Apache Batik is vulnerable to server-side request forgery, caused by improper input validation by the \"xlink:href\" attributes. By using a specially-crafted argument, an attacker could exploit this vulnerability to cause the underlying server to make arbitrary GET requests.","debianbug":964510,"scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"1.16+dfsg-1+deb12u1"},"fixed_version":"1.12-1.1","urgency":"not yet assigned"},"bullseye":{"status":"resolved","repositories":{"bullseye":"1.12-4+deb11u2","bullseye-security":"1.12-4+deb11u3"},"fixed_version":"1.12-1.1","urgency":"not yet assigned"},"forky":{"status":"resolved","repositories":{"forky":"1.18+dfsg-2"},"fixed_version":"1.12-1.1","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"1.18+dfsg-2"},"fixed_version":"1.12-1.1","urgency":"not yet assigned"},"trixie":{"status":"resolved","repositories":{"trixie":"1.18+dfsg-2"},"fixed_version":"1.12-1.1","urgency":"not yet assigned"}}},"CVE-2020-11987":{"description":"Apache Batik 1.13 is vulnerable to server-side request forgery, caused by improper input validation by the NodePickerPanel. By using a specially-crafted argument, an attacker could exploit this vulnerability to cause the underlying server to make arbitrary GET requests.","debianbug":984829,"scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"1.16+dfsg-1+deb12u1"},"fixed_version":"1.14-1","urgency":"not yet assigned"},"bullseye":{"status":"resolved","repositories":{"bullseye":"1.12-4+deb11u2","bullseye-security":"1.12-4+deb11u3"},"fixed_version":"1.12-4+deb11u3","urgency":"not yet assigned"},"forky":{"status":"resolved","repositories":{"forky":"1.18+dfsg-2"},"fixed_version":"1.14-1","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"1.18+dfsg-2"},"fixed_version":"1.14-1","urgency":"not yet assigned"},"trixie":{"status":"resolved","repositories":{"trixie":"1.18+dfsg-2"},"fixed_version":"1.14-1","urgency":"not yet assigned"}}},"CVE-2022-38398":{"description":"Server-Side Request Forgery (SSRF) vulnerability in Batik of Apache XML Graphics allows an attacker to load a url thru the jar protocol. This issue affects Apache XML Graphics Batik 1.14.","debianbug":1020589,"scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"1.16+dfsg-1+deb12u1"},"fixed_version":"1.15+dfsg-1","urgency":"not yet assigned"},"bullseye":{"status":"resolved","repositories":{"bullseye":"1.12-4+deb11u2","bullseye-security":"1.12-4+deb11u3"},"fixed_version":"1.12-4+deb11u3","urgency":"not yet assigned"},"forky":{"status":"resolved","repositories":{"forky":"1.18+dfsg-2"},"fixed_version":"1.15+dfsg-1","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"1.18+dfsg-2"},"fixed_version":"1.15+dfsg-1","urgency":"not yet assigned"},"trixie":{"status":"resolved","repositories":{"trixie":"1.18+dfsg-2"},"fixed_version":"1.15+dfsg-1","urgency":"not yet assigned"}}},"CVE-2022-38648":{"description":"Server-Side Request Forgery (SSRF) vulnerability in Batik of Apache XML Graphics allows an attacker to fetch external resources. This issue affects Apache XML Graphics Batik 1.14.","debianbug":1020589,"scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"1.16+dfsg-1+deb12u1"},"fixed_version":"1.15+dfsg-1","urgency":"not yet assigned"},"bullseye":{"status":"resolved","repositories":{"bullseye":"1.12-4+deb11u2","bullseye-security":"1.12-4+deb11u3"},"fixed_version":"1.12-4+deb11u3","urgency":"not yet assigned"},"forky":{"status":"resolved","repositories":{"forky":"1.18+dfsg-2"},"fixed_version":"1.15+dfsg-1","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"1.18+dfsg-2"},"fixed_version":"1.15+dfsg-1","urgency":"not yet assigned"},"trixie":{"status":"resolved","repositories":{"trixie":"1.18+dfsg-2"},"fixed_version":"1.15+dfsg-1","urgency":"not yet assigned"}}},"CVE-2022-40146":{"description":"Server-Side Request Forgery (SSRF) vulnerability in Batik of Apache XML Graphics allows an attacker to access files using a Jar url. This issue affects Apache XML Graphics Batik 1.14.","debianbug":1020589,"scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"1.16+dfsg-1+deb12u1"},"fixed_version":"1.15+dfsg-1","urgency":"not yet assigned"},"bullseye":{"status":"resolved","repositories":{"bullseye":"1.12-4+deb11u2","bullseye-security":"1.12-4+deb11u3"},"fixed_version":"1.12-4+deb11u3","urgency":"not yet assigned"},"forky":{"status":"resolved","repositories":{"forky":"1.18+dfsg-2"},"fixed_version":"1.15+dfsg-1","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"1.18+dfsg-2"},"fixed_version":"1.15+dfsg-1","urgency":"not yet assigned"},"trixie":{"status":"resolved","repositories":{"trixie":"1.18+dfsg-2"},"fixed_version":"1.15+dfsg-1","urgency":"not yet assigned"}}},"CVE-2022-41704":{"description":"A vulnerability in Batik of Apache XML Graphics allows an attacker to run untrusted Java code from an SVG. This issue affects Apache XML Graphics prior to 1.16. It is recommended to update to version 1.16.","scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"1.16+dfsg-1+deb12u1"},"fixed_version":"1.16+dfsg-1","urgency":"not yet assigned"},"bullseye":{"status":"resolved","repositories":{"bullseye":"1.12-4+deb11u2","bullseye-security":"1.12-4+deb11u3"},"fixed_version":"1.12-4+deb11u1","urgency":"not yet assigned"},"forky":{"status":"resolved","repositories":{"forky":"1.18+dfsg-2"},"fixed_version":"1.16+dfsg-1","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"1.18+dfsg-2"},"fixed_version":"1.16+dfsg-1","urgency":"not yet assigned"},"trixie":{"status":"resolved","repositories":{"trixie":"1.18+dfsg-2"},"fixed_version":"1.16+dfsg-1","urgency":"not yet assigned"}}},"CVE-2022-42890":{"description":"A vulnerability in Batik of Apache XML Graphics allows an attacker to run Java code from untrusted SVG via JavaScript. This issue affects Apache XML Graphics prior to 1.16. Users are recommended to upgrade to version 1.16.","scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"1.16+dfsg-1+deb12u1"},"fixed_version":"1.16+dfsg-1","urgency":"not yet assigned"},"bullseye":{"status":"resolved","repositories":{"bullseye":"1.12-4+deb11u2","bullseye-security":"1.12-4+deb11u3"},"fixed_version":"1.12-4+deb11u1","urgency":"not yet assigned"},"forky":{"status":"resolved","repositories":{"forky":"1.18+dfsg-2"},"fixed_version":"1.16+dfsg-1","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"1.18+dfsg-2"},"fixed_version":"1.16+dfsg-1","urgency":"not yet assigned"},"trixie":{"status":"resolved","repositories":{"trixie":"1.18+dfsg-2"},"fixed_version":"1.16+dfsg-1","urgency":"not yet assigned"}}},"CVE-2022-44729":{"description":"Server-Side Request Forgery (SSRF) vulnerability in Apache Software Foundation Apache XML Graphics Batik.This issue affects Apache XML Graphics Batik: 1.16.  On version 1.16, a malicious SVG could trigger loading external resources by default, causing resource consumption or in some cases even information disclosure. Users are recommended to upgrade to version 1.17 or later.","scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"1.16+dfsg-1+deb12u1"},"fixed_version":"1.16+dfsg-1+deb12u1","urgency":"not yet assigned"},"bullseye":{"status":"resolved","repositories":{"bullseye":"1.12-4+deb11u2","bullseye-security":"1.12-4+deb11u3"},"fixed_version":"1.12-4+deb11u2","urgency":"not yet assigned"},"forky":{"status":"resolved","repositories":{"forky":"1.18+dfsg-2"},"fixed_version":"1.17+dfsg-1","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"1.18+dfsg-2"},"fixed_version":"1.17+dfsg-1","urgency":"not yet assigned"},"trixie":{"status":"resolved","repositories":{"trixie":"1.18+dfsg-2"},"fixed_version":"1.17+dfsg-1","urgency":"not yet assigned"}}},"CVE-2022-44730":{"description":"Server-Side Request Forgery (SSRF) vulnerability in Apache Software Foundation Apache XML Graphics Batik.This issue affects Apache XML Graphics Batik: 1.16.  A malicious SVG can probe user profile / data and send it directly as parameter to a URL.","scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"1.16+dfsg-1+deb12u1"},"fixed_version":"1.16+dfsg-1+deb12u1","urgency":"not yet assigned"},"bullseye":{"status":"resolved","repositories":{"bullseye":"1.12-4+deb11u2","bullseye-security":"1.12-4+deb11u3"},"fixed_version":"1.12-4+deb11u2","urgency":"not yet assigned"},"forky":{"status":"resolved","repositories":{"forky":"1.18+dfsg-2"},"fixed_version":"1.17+dfsg-1","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"1.18+dfsg-2"},"fixed_version":"1.17+dfsg-1","urgency":"not yet assigned"},"trixie":{"status":"resolved","repositories":{"trixie":"1.18+dfsg-2"},"fixed_version":"1.17+dfsg-1","urgency":"not yet assigned"}}}},"bcel":{"CVE-2022-34169":{"description":"The Apache Xalan Java XSLT library is vulnerable to an integer truncation issue when processing malicious XSLT stylesheets. This can be used to corrupt Java class files generated by the internal XSLTC compiler and execute arbitrary Java bytecode. Users are recommended to update to version 2.7.3 or later. Note: Java runtimes (such as OpenJDK) include repackaged copies of Xalan.","debianbug":1015860,"scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"6.5.0-2"},"fixed_version":"6.5.0-2","urgency":"not yet assigned"},"bullseye":{"status":"resolved","repositories":{"bullseye":"6.5.0-1+deb11u1","bullseye-security":"6.5.0-1+deb11u1"},"fixed_version":"6.5.0-1+deb11u1","urgency":"not yet assigned"},"forky":{"status":"resolved","repositories":{"forky":"6.10.0-1"},"fixed_version":"6.5.0-2","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"6.10.0-1"},"fixed_version":"6.5.0-2","urgency":"not yet assigned"},"trixie":{"status":"resolved","repositories":{"trixie":"6.10.0-1"},"fixed_version":"6.5.0-2","urgency":"not yet assigned"}}},"CVE-2022-42920":{"description":"Apache Commons BCEL has a number of APIs that would normally only allow changing specific class characteristics. However, due to an out-of-bounds writing issue, these APIs can be used to produce arbitrary bytecode. This could be abused in applications that pass attacker-controllable data to those APIs, giving the attacker more control over the resulting bytecode than otherwise expected. Update to Apache Commons BCEL 6.6.0.","scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"6.5.0-2"},"fixed_version":"6.5.0-2","urgency":"not yet assigned"},"bullseye":{"status":"resolved","repositories":{"bullseye":"6.5.0-1+deb11u1","bullseye-security":"6.5.0-1+deb11u1"},"fixed_version":"6.5.0-1+deb11u1","urgency":"not yet assigned"},"forky":{"status":"resolved","repositories":{"forky":"6.10.0-1"},"fixed_version":"6.5.0-2","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"6.10.0-1"},"fixed_version":"6.5.0-2","urgency":"not yet assigned"},"trixie":{"status":"resolved","repositories":{"trixie":"6.10.0-1"},"fixed_version":"6.5.0-2","urgency":"not yet assigned"}}}},"bchunk":{"CVE-2017-15953":{"description":"bchunk (related to BinChunker) 1.2.0 and 1.2.1 is vulnerable to a heap-based buffer overflow and crash when processing a malformed CUE (.cue) file.","debianbug":880116,"scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"1.2.2+git20220715+ds-2"},"fixed_version":"1.2.0-12.1","urgency":"not yet assigned"},"bullseye":{"status":"resolved","repositories":{"bullseye":"1.2.2-2"},"fixed_version":"1.2.0-12.1","urgency":"not yet assigned"},"forky":{"status":"resolved","repositories":{"forky":"1.2.2+git20220715+ds-4"},"fixed_version":"1.2.0-12.1","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"1.2.2+git20220715+ds-4"},"fixed_version":"1.2.0-12.1","urgency":"not yet assigned"},"trixie":{"status":"resolved","repositories":{"trixie":"1.2.2+git20220715+ds-3.1"},"fixed_version":"1.2.0-12.1","urgency":"not yet assigned"}}},"CVE-2017-15954":{"description":"bchunk (related to BinChunker) 1.2.0 and 1.2.1 is vulnerable to a heap-based buffer overflow (with a resultant invalid free) and crash when processing a malformed CUE (.cue) file.","debianbug":880116,"scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"1.2.2+git20220715+ds-2"},"fixed_version":"1.2.0-12.1","urgency":"not yet assigned"},"bullseye":{"status":"resolved","repositories":{"bullseye":"1.2.2-2"},"fixed_version":"1.2.0-12.1","urgency":"not yet assigned"},"forky":{"status":"resolved","repositories":{"forky":"1.2.2+git20220715+ds-4"},"fixed_version":"1.2.0-12.1","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"1.2.2+git20220715+ds-4"},"fixed_version":"1.2.0-12.1","urgency":"not yet assigned"},"trixie":{"status":"resolved","repositories":{"trixie":"1.2.2+git20220715+ds-3.1"},"fixed_version":"1.2.0-12.1","urgency":"not yet assigned"}}},"CVE-2017-15955":{"description":"bchunk (related to BinChunker) 1.2.0 and 1.2.1 is vulnerable to an \"Access violation near NULL on destination operand\" and crash when processing a malformed CUE (.cue) file.","debianbug":880116,"scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"1.2.2+git20220715+ds-2"},"fixed_version":"1.2.0-12.1","urgency":"not yet assigned"},"bullseye":{"status":"resolved","repositories":{"bullseye":"1.2.2-2"},"fixed_version":"1.2.0-12.1","urgency":"not yet assigned"},"forky":{"status":"resolved","repositories":{"forky":"1.2.2+git20220715+ds-4"},"fixed_version":"1.2.0-12.1","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"1.2.2+git20220715+ds-4"},"fixed_version":"1.2.0-12.1","urgency":"not yet assigned"},"trixie":{"status":"resolved","repositories":{"trixie":"1.2.2+git20220715+ds-3.1"},"fixed_version":"1.2.0-12.1","urgency":"not yet assigned"}}}},"bcron":{"CVE-2012-6110":{"description":"bcron-exec in bcron before 0.10 does not close file descriptors associated with temporary files when running a cron job, which allows local users to modify job files and send spam messages by accessing an open file descriptor.","debianbug":686650,"scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"0.11-19"},"fixed_version":"0.09-13","urgency":"low"},"bullseye":{"status":"resolved","repositories":{"bullseye":"0.11-9"},"fixed_version":"0.09-13","urgency":"low"},"forky":{"status":"resolved","repositories":{"forky":"0.11-24"},"fixed_version":"0.09-13","urgency":"low"},"sid":{"status":"resolved","repositories":{"sid":"0.11-24"},"fixed_version":"0.09-13","urgency":"low"},"trixie":{"status":"resolved","repositories":{"trixie":"0.11-23"},"fixed_version":"0.09-13","urgency":"low"}}}},"beagle":{"CVE-2005-4791":{"description":"Multiple untrusted search path vulnerabilities in SUSE Linux 10.0 cause the working directory to be added to LD_LIBRARY_PATH, which might allow local users to execute arbitrary code via (1) liferea or (2) banshee.","scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"220722-1"},"fixed_version":"0.2.13-1","urgency":"low"},"bullseye":{"status":"resolved","repositories":{"bullseye":"5.1-200518+dfsg-1"},"fixed_version":"0.2.13-1","urgency":"low"},"forky":{"status":"resolved","repositories":{"forky":"250227-2"},"fixed_version":"0.2.13-1","urgency":"low"},"sid":{"status":"resolved","repositories":{"sid":"250227-2"},"fixed_version":"0.2.13-1","urgency":"low"},"trixie":{"status":"resolved","repositories":{"trixie":"241217-3"},"fixed_version":"0.2.13-1","urgency":"low"}}},"CVE-2006-1296":{"description":"Untrusted search path vulnerability in Beagle 0.2.2.1 might allow local users to gain privileges via a malicious beagle-info program in the current working directory, or possibly directories specified in the PATH.","debianbug":357392,"scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"220722-1"},"fixed_version":"0.2.3-1","urgency":"low"},"bullseye":{"status":"resolved","repositories":{"bullseye":"5.1-200518+dfsg-1"},"fixed_version":"0.2.3-1","urgency":"low"},"forky":{"status":"resolved","repositories":{"forky":"250227-2"},"fixed_version":"0.2.3-1","urgency":"low"},"sid":{"status":"resolved","repositories":{"sid":"250227-2"},"fixed_version":"0.2.3-1","urgency":"low"},"trixie":{"status":"resolved","repositories":{"trixie":"241217-3"},"fixed_version":"0.2.3-1","urgency":"low"}}},"CVE-2006-1865":{"description":"Argument injection vulnerability in Beagle before 0.2.5 allows attackers to execute arbitrary commands via crafted filenames that inject command line arguments when Beagle launches external helper applications while indexing.","debianbug":365371,"scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"220722-1"},"fixed_version":"0.2.6-2","urgency":"medium"},"bullseye":{"status":"resolved","repositories":{"bullseye":"5.1-200518+dfsg-1"},"fixed_version":"0.2.6-2","urgency":"medium"},"forky":{"status":"resolved","repositories":{"forky":"250227-2"},"fixed_version":"0.2.6-2","urgency":"medium"},"sid":{"status":"resolved","repositories":{"sid":"250227-2"},"fixed_version":"0.2.6-2","urgency":"medium"},"trixie":{"status":"resolved","repositories":{"trixie":"241217-3"},"fixed_version":"0.2.6-2","urgency":"medium"}}}},"beaker":{"CVE-2012-3458":{"description":"Beaker before 1.6.4, when using PyCrypto to encrypt sessions, uses AES in ECB cipher mode, which might allow remote attackers to obtain portions of sensitive session data via unspecified vectors.","debianbug":684890,"scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"1.11.0-3"},"fixed_version":"1.6.3-1.1","urgency":"not yet assigned"},"bullseye":{"status":"resolved","repositories":{"bullseye":"1.11.0-1.1"},"fixed_version":"1.6.3-1.1","urgency":"not yet assigned"},"forky":{"status":"resolved","repositories":{"forky":"1.13.0-3"},"fixed_version":"1.6.3-1.1","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"1.13.0-3"},"fixed_version":"1.6.3-1.1","urgency":"not yet assigned"},"trixie":{"status":"resolved","repositories":{"trixie":"1.13.0-1"},"fixed_version":"1.6.3-1.1","urgency":"not yet assigned"}}},"CVE-2013-7489":{"description":"The Beaker library through 1.11.0 for Python is affected by deserialization of untrusted data, which could lead to arbitrary code execution.","debianbug":966197,"scope":"local","releases":{"bookworm":{"status":"open","repositories":{"bookworm":"1.11.0-3"},"urgency":"unimportant"},"bullseye":{"status":"open","repositories":{"bullseye":"1.11.0-1.1"},"urgency":"unimportant"},"forky":{"status":"open","repositories":{"forky":"1.13.0-3"},"urgency":"unimportant"},"sid":{"status":"open","repositories":{"sid":"1.13.0-3"},"urgency":"unimportant"},"trixie":{"status":"open","repositories":{"trixie":"1.13.0-1"},"urgency":"unimportant"}}}},"beanstalkd":{"CVE-2010-2060":{"description":"The put command functionality in beanstalkd 1.4.5 and earlier allows remote attackers to execute arbitrary Beanstalk commands via the body in a job that is too big, which is not properly handled by the dispatch_cmd function in prot.c.","debianbug":585162,"scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"1.12-2"},"fixed_version":"1.4.6-1","urgency":"unimportant"},"bullseye":{"status":"resolved","repositories":{"bullseye":"1.12-2"},"fixed_version":"1.4.6-1","urgency":"unimportant"},"forky":{"status":"resolved","repositories":{"forky":"1.13-1"},"fixed_version":"1.4.6-1","urgency":"unimportant"},"sid":{"status":"resolved","repositories":{"sid":"1.13-1"},"fixed_version":"1.4.6-1","urgency":"unimportant"},"trixie":{"status":"resolved","repositories":{"trixie":"1.13-1"},"fixed_version":"1.4.6-1","urgency":"unimportant"}}}},"beep":{"CVE-2018-0492":{"description":"Johnathan Nightingale beep through 1.3.4, if setuid, has a race condition that allows local privilege escalation.","debianbug":894667,"scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"1.4.9-1"},"fixed_version":"1.3-5","urgency":"not yet assigned"},"bullseye":{"status":"resolved","repositories":{"bullseye":"1.4.9-1"},"fixed_version":"1.3-5","urgency":"not yet assigned"},"forky":{"status":"resolved","repositories":{"forky":"1.4.9-1.1"},"fixed_version":"1.3-5","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"1.4.9-1.1"},"fixed_version":"1.3-5","urgency":"not yet assigned"},"trixie":{"status":"resolved","repositories":{"trixie":"1.4.9-1.1"},"fixed_version":"1.3-5","urgency":"not yet assigned"}}},"CVE-2018-1000532":{"description":"beep version 1.3 and up contains a External Control of File Name or Path vulnerability in --device option that can result in Local unprivileged user can inhibit execution of arbitrary programs by other users, allowing DoS. This attack appear to be exploitable via The system must allow local users to run beep.","debianbug":902722,"scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"1.4.9-1"},"fixed_version":"1.4.3-1","urgency":"low"},"bullseye":{"status":"resolved","repositories":{"bullseye":"1.4.9-1"},"fixed_version":"1.4.3-1","urgency":"low"},"forky":{"status":"resolved","repositories":{"forky":"1.4.9-1.1"},"fixed_version":"1.4.3-1","urgency":"low"},"sid":{"status":"resolved","repositories":{"sid":"1.4.9-1.1"},"fixed_version":"1.4.3-1","urgency":"low"},"trixie":{"status":"resolved","repositories":{"trixie":"1.4.9-1.1"},"fixed_version":"1.4.3-1","urgency":"low"}}}},"berkeley-abc":{"CVE-2025-45333":{"description":"berkeley-abc abc 1.1 contains a Null Pointer Dereference (NPD) vulnerability in the Abc_NtkCecFraigPart function of its data processing module, leading to unpredictable program behavior, causing segmentation faults, and program crashes.","scope":"local","releases":{"bookworm":{"status":"open","repositories":{"bookworm":"1.01+20221019git70cb339+dfsg-4"},"urgency":"unimportant"},"bullseye":{"status":"open","repositories":{"bullseye":"1.01+20191006git52a8ebb+dfsg-1"},"urgency":"unimportant"}}}},"bibtool":{"TEMP-0779573-6C7D15":{"debianbug":779573,"releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"2.68+ds-1"},"fixed_version":"2.57+ds-3","urgency":"not yet assigned"},"bullseye":{"status":"resolved","repositories":{"bullseye":"2.68+ds-1"},"fixed_version":"2.57+ds-3","urgency":"not yet assigned"},"forky":{"status":"resolved","repositories":{"forky":"2.68+ds-3"},"fixed_version":"2.57+ds-3","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"2.68+ds-3"},"fixed_version":"2.57+ds-3","urgency":"not yet assigned"},"trixie":{"status":"resolved","repositories":{"trixie":"2.68+ds-3"},"fixed_version":"2.57+ds-3","urgency":"not yet assigned"}}}},"bibutils":{"CVE-2018-10773":{"description":"NULL pointer deference in the addsn function in serialno.c in libbibcore.a in bibutils through 6.2 allows remote attackers to cause a denial of service (application crash), as demonstrated by copac2xml.","debianbug":898135,"scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"7.2-2"},"fixed_version":"6.10-2","urgency":"unimportant"},"bullseye":{"status":"resolved","repositories":{"bullseye":"6.10-2"},"fixed_version":"6.10-2","urgency":"unimportant"},"forky":{"status":"resolved","repositories":{"forky":"7.2-3"},"fixed_version":"6.10-2","urgency":"unimportant"},"sid":{"status":"resolved","repositories":{"sid":"7.2-3"},"fixed_version":"6.10-2","urgency":"unimportant"},"trixie":{"status":"resolved","repositories":{"trixie":"7.2-3"},"fixed_version":"6.10-2","urgency":"unimportant"}}},"CVE-2018-10774":{"description":"Read access violation in the isiin_keyword function in isiin.c in libbibutils.a in bibutils through 6.2 allows remote attackers to cause a denial of service (application crash), as demonstrated by isi2xml.","debianbug":898135,"scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"7.2-2"},"fixed_version":"6.10-2","urgency":"unimportant"},"bullseye":{"status":"resolved","repositories":{"bullseye":"6.10-2"},"fixed_version":"6.10-2","urgency":"unimportant"},"forky":{"status":"resolved","repositories":{"forky":"7.2-3"},"fixed_version":"6.10-2","urgency":"unimportant"},"sid":{"status":"resolved","repositories":{"sid":"7.2-3"},"fixed_version":"6.10-2","urgency":"unimportant"},"trixie":{"status":"resolved","repositories":{"trixie":"7.2-3"},"fixed_version":"6.10-2","urgency":"unimportant"}}},"CVE-2018-10775":{"description":"NULL pointer dereference in the _fields_add function in fields.c in libbibcore.a in bibutils through 6.2 allows remote attackers to cause a denial of service (application crash), as demonstrated by end2xml.","debianbug":898135,"scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"7.2-2"},"fixed_version":"6.10-2","urgency":"unimportant"},"bullseye":{"status":"resolved","repositories":{"bullseye":"6.10-2"},"fixed_version":"6.10-2","urgency":"unimportant"},"forky":{"status":"resolved","repositories":{"forky":"7.2-3"},"fixed_version":"6.10-2","urgency":"unimportant"},"sid":{"status":"resolved","repositories":{"sid":"7.2-3"},"fixed_version":"6.10-2","urgency":"unimportant"},"trixie":{"status":"resolved","repositories":{"trixie":"7.2-3"},"fixed_version":"6.10-2","urgency":"unimportant"}}}},"binaryen":{"CVE-2019-15758":{"description":"An issue was discovered in Binaryen 1.38.32. Missing validation rules in asmjs/asmangle.cpp can lead to an Assertion Failure at wasm/wasm.cpp in wasm::asmangle. A crafted input can cause denial-of-service, as demonstrated by wasm2js.","debianbug":936024,"scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"108-1"},"fixed_version":"89-1","urgency":"unimportant"},"bullseye":{"status":"resolved","repositories":{"bullseye":"99-3"},"fixed_version":"89-1","urgency":"unimportant"},"forky":{"status":"resolved","repositories":{"forky":"120-4"},"fixed_version":"89-1","urgency":"unimportant"},"sid":{"status":"resolved","repositories":{"sid":"120-4"},"fixed_version":"89-1","urgency":"unimportant"},"trixie":{"status":"resolved","repositories":{"trixie":"120-4"},"fixed_version":"89-1","urgency":"unimportant"}}},"CVE-2019-15759":{"description":"An issue was discovered in Binaryen 1.38.32. Two visitors in ir/ExpressionManipulator.cpp can lead to a NULL pointer dereference in wasm::LocalSet::finalize in wasm/wasm.cpp. A crafted input can cause segmentation faults, leading to denial-of-service, as demonstrated by wasm2js.","debianbug":936024,"scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"108-1"},"fixed_version":"89-1","urgency":"unimportant"},"bullseye":{"status":"resolved","repositories":{"bullseye":"99-3"},"fixed_version":"89-1","urgency":"unimportant"},"forky":{"status":"resolved","repositories":{"forky":"120-4"},"fixed_version":"89-1","urgency":"unimportant"},"sid":{"status":"resolved","repositories":{"sid":"120-4"},"fixed_version":"89-1","urgency":"unimportant"},"trixie":{"status":"resolved","repositories":{"trixie":"120-4"},"fixed_version":"89-1","urgency":"unimportant"}}},"CVE-2019-7151":{"description":"A NULL pointer dereference was discovered in wasm::Module::getFunctionOrNull in wasm/wasm.cpp in Binaryen 1.38.22. A crafted input can cause segmentation faults, leading to denial-of-service, as demonstrated by wasm-opt.","debianbug":920853,"scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"108-1"},"fixed_version":"66-1","urgency":"not yet assigned"},"bullseye":{"status":"resolved","repositories":{"bullseye":"99-3"},"fixed_version":"66-1","urgency":"not yet assigned"},"forky":{"status":"resolved","repositories":{"forky":"120-4"},"fixed_version":"66-1","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"120-4"},"fixed_version":"66-1","urgency":"not yet assigned"},"trixie":{"status":"resolved","repositories":{"trixie":"120-4"},"fixed_version":"66-1","urgency":"not yet assigned"}}},"CVE-2019-7152":{"description":"A heap-based buffer over-read was discovered in wasm::WasmBinaryBuilder::processFunctions() in wasm/wasm-binary.cpp (when calling wasm::WasmBinaryBuilder::getFunctionIndexName) in Binaryen 1.38.22. A crafted input can cause segmentation faults, leading to denial-of-service, as demonstrated by wasm-opt.","debianbug":920853,"scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"108-1"},"fixed_version":"66-1","urgency":"not yet assigned"},"bullseye":{"status":"resolved","repositories":{"bullseye":"99-3"},"fixed_version":"66-1","urgency":"not yet assigned"},"forky":{"status":"resolved","repositories":{"forky":"120-4"},"fixed_version":"66-1","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"120-4"},"fixed_version":"66-1","urgency":"not yet assigned"},"trixie":{"status":"resolved","repositories":{"trixie":"120-4"},"fixed_version":"66-1","urgency":"not yet assigned"}}},"CVE-2019-7153":{"description":"A NULL pointer dereference was discovered in wasm::WasmBinaryBuilder::processFunctions() in wasm/wasm-binary.cpp (when calling wasm::WasmBinaryBuilder::getFunctionIndexName) in Binaryen 1.38.22. A crafted input can cause segmentation faults, leading to denial-of-service, as demonstrated by wasm-opt.","debianbug":920853,"scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"108-1"},"fixed_version":"66-1","urgency":"not yet assigned"},"bullseye":{"status":"resolved","repositories":{"bullseye":"99-3"},"fixed_version":"66-1","urgency":"not yet assigned"},"forky":{"status":"resolved","repositories":{"forky":"120-4"},"fixed_version":"66-1","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"120-4"},"fixed_version":"66-1","urgency":"not yet assigned"},"trixie":{"status":"resolved","repositories":{"trixie":"120-4"},"fixed_version":"66-1","urgency":"not yet assigned"}}},"CVE-2019-7154":{"description":"The main function in tools/wasm2js.cpp in Binaryen 1.38.22 has a heap-based buffer overflow because Emscripten is misused, triggering an error in cashew::JSPrinter::printAst() in emscripten-optimizer/simple_ast.h. A crafted input can cause segmentation faults, leading to denial-of-service, as demonstrated by wasm2js.","debianbug":920853,"scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"108-1"},"fixed_version":"66-1","urgency":"not yet assigned"},"bullseye":{"status":"resolved","repositories":{"bullseye":"99-3"},"fixed_version":"66-1","urgency":"not yet assigned"},"forky":{"status":"resolved","repositories":{"forky":"120-4"},"fixed_version":"66-1","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"120-4"},"fixed_version":"66-1","urgency":"not yet assigned"},"trixie":{"status":"resolved","repositories":{"trixie":"120-4"},"fixed_version":"66-1","urgency":"not yet assigned"}}},"CVE-2019-7662":{"description":"An assertion failure was discovered in wasm::WasmBinaryBuilder::getType() in wasm-binary.cpp in Binaryen 1.38.22. This allows remote attackers to cause a denial of service (failed assertion and crash) via a crafted wasm file.","scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"108-1"},"fixed_version":"66-1","urgency":"not yet assigned"},"bullseye":{"status":"resolved","repositories":{"bullseye":"99-3"},"fixed_version":"66-1","urgency":"not yet assigned"},"forky":{"status":"resolved","repositories":{"forky":"120-4"},"fixed_version":"66-1","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"120-4"},"fixed_version":"66-1","urgency":"not yet assigned"},"trixie":{"status":"resolved","repositories":{"trixie":"120-4"},"fixed_version":"66-1","urgency":"not yet assigned"}}},"CVE-2019-7700":{"description":"A heap-based buffer over-read was discovered in wasm::WasmBinaryBuilder::visitCall in wasm-binary.cpp in Binaryen 1.38.22. A crafted wasm input can cause a segmentation fault, leading to denial-of-service, as demonstrated by wasm-merge.","scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"108-1"},"fixed_version":"64-1","urgency":"not yet assigned"},"bullseye":{"status":"resolved","repositories":{"bullseye":"99-3"},"fixed_version":"64-1","urgency":"not yet assigned"},"forky":{"status":"resolved","repositories":{"forky":"120-4"},"fixed_version":"64-1","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"120-4"},"fixed_version":"64-1","urgency":"not yet assigned"},"trixie":{"status":"resolved","repositories":{"trixie":"120-4"},"fixed_version":"64-1","urgency":"not yet assigned"}}},"CVE-2019-7701":{"description":"A heap-based buffer over-read was discovered in wasm::SExpressionParser::skipWhitespace() in wasm-s-parser.cpp in Binaryen 1.38.22. A crafted wasm input can cause a segmentation fault, leading to denial-of-service, as demonstrated by wasm2js.","scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"108-1"},"fixed_version":"64-1","urgency":"not yet assigned"},"bullseye":{"status":"resolved","repositories":{"bullseye":"99-3"},"fixed_version":"64-1","urgency":"not yet assigned"},"forky":{"status":"resolved","repositories":{"forky":"120-4"},"fixed_version":"64-1","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"120-4"},"fixed_version":"64-1","urgency":"not yet assigned"},"trixie":{"status":"resolved","repositories":{"trixie":"120-4"},"fixed_version":"64-1","urgency":"not yet assigned"}}},"CVE-2019-7702":{"description":"A NULL pointer dereference was discovered in wasm::SExpressionWasmBuilder::parseExpression in wasm-s-parser.cpp in Binaryen 1.38.22. A crafted wasm input can cause a segmentation fault, leading to denial-of-service, as demonstrated by wasm-as.","scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"108-1"},"fixed_version":"64-1","urgency":"not yet assigned"},"bullseye":{"status":"resolved","repositories":{"bullseye":"99-3"},"fixed_version":"64-1","urgency":"not yet assigned"},"forky":{"status":"resolved","repositories":{"forky":"120-4"},"fixed_version":"64-1","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"120-4"},"fixed_version":"64-1","urgency":"not yet assigned"},"trixie":{"status":"resolved","repositories":{"trixie":"120-4"},"fixed_version":"64-1","urgency":"not yet assigned"}}},"CVE-2019-7703":{"description":"In Binaryen 1.38.22, there is a use-after-free problem in wasm::WasmBinaryBuilder::visitCall in wasm-binary.cpp. Remote attackers could leverage this vulnerability to cause a denial-of-service via a wasm file, as demonstrated by wasm-merge.","scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"108-1"},"fixed_version":"64-1","urgency":"not yet assigned"},"bullseye":{"status":"resolved","repositories":{"bullseye":"99-3"},"fixed_version":"64-1","urgency":"not yet assigned"},"forky":{"status":"resolved","repositories":{"forky":"120-4"},"fixed_version":"64-1","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"120-4"},"fixed_version":"64-1","urgency":"not yet assigned"},"trixie":{"status":"resolved","repositories":{"trixie":"120-4"},"fixed_version":"64-1","urgency":"not yet assigned"}}},"CVE-2019-7704":{"description":"wasm::WasmBinaryBuilder::readUserSection in wasm-binary.cpp in Binaryen 1.38.22 triggers an attempt at excessive memory allocation, as demonstrated by wasm-merge and wasm-opt.","scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"108-1"},"fixed_version":"64-1","urgency":"not yet assigned"},"bullseye":{"status":"resolved","repositories":{"bullseye":"99-3"},"fixed_version":"64-1","urgency":"not yet assigned"},"forky":{"status":"resolved","repositories":{"forky":"120-4"},"fixed_version":"64-1","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"120-4"},"fixed_version":"64-1","urgency":"not yet assigned"},"trixie":{"status":"resolved","repositories":{"trixie":"120-4"},"fixed_version":"64-1","urgency":"not yet assigned"}}},"CVE-2020-18378":{"description":"A NULL pointer dereference was discovered in SExpressionWasmBuilder::makeBlock in wasm/wasm-s-parser.c in Binaryen 1.38.26. A crafted wasm input can cause a segmentation fault, leading to denial-of-service, as demonstrated by wasm-as.","scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"108-1"},"fixed_version":"68-1","urgency":"not yet assigned"},"bullseye":{"status":"resolved","repositories":{"bullseye":"99-3"},"fixed_version":"68-1","urgency":"not yet assigned"},"forky":{"status":"resolved","repositories":{"forky":"120-4"},"fixed_version":"68-1","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"120-4"},"fixed_version":"68-1","urgency":"not yet assigned"},"trixie":{"status":"resolved","repositories":{"trixie":"120-4"},"fixed_version":"68-1","urgency":"not yet assigned"}}},"CVE-2020-18382":{"description":"Heap-buffer-overflow in /src/wasm/wasm-binary.cpp in wasm::WasmBinaryBuilder::visitBlock(wasm::Block*) in Binaryen 1.38.26. A crafted wasm input can cause a segmentation fault, leading to denial-of-service, as demonstrated by wasm-opt.","scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"108-1"},"fixed_version":"68-1","urgency":"not yet assigned"},"bullseye":{"status":"resolved","repositories":{"bullseye":"99-3"},"fixed_version":"68-1","urgency":"not yet assigned"},"forky":{"status":"resolved","repositories":{"forky":"120-4"},"fixed_version":"68-1","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"120-4"},"fixed_version":"68-1","urgency":"not yet assigned"},"trixie":{"status":"resolved","repositories":{"trixie":"120-4"},"fixed_version":"68-1","urgency":"not yet assigned"}}},"CVE-2021-45290":{"description":"A Denial of Service vulnerability exits in Binaryen 103 due to an assertion abort in wasm::handle_unreachable.","scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"108-1"},"fixed_version":"104-1","urgency":"unimportant"},"bullseye":{"status":"open","repositories":{"bullseye":"99-3"},"urgency":"unimportant"},"forky":{"status":"resolved","repositories":{"forky":"120-4"},"fixed_version":"104-1","urgency":"unimportant"},"sid":{"status":"resolved","repositories":{"sid":"120-4"},"fixed_version":"104-1","urgency":"unimportant"},"trixie":{"status":"resolved","repositories":{"trixie":"120-4"},"fixed_version":"104-1","urgency":"unimportant"}}},"CVE-2021-45293":{"description":"A Denial of Service vulnerability exists in Binaryen 103 due to an Invalid memory address dereference in wasm::WasmBinaryBuilder::visitLet.","scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"108-1"},"fixed_version":"104-1","urgency":"unimportant"},"bullseye":{"status":"open","repositories":{"bullseye":"99-3"},"urgency":"unimportant"},"forky":{"status":"resolved","repositories":{"forky":"120-4"},"fixed_version":"104-1","urgency":"unimportant"},"sid":{"status":"resolved","repositories":{"sid":"120-4"},"fixed_version":"104-1","urgency":"unimportant"},"trixie":{"status":"resolved","repositories":{"trixie":"120-4"},"fixed_version":"104-1","urgency":"unimportant"}}},"CVE-2021-46048":{"description":"A Denial of Service vulnerability exists in Binaryen 104 due to an assertion abort in wasm::WasmBinaryBuilder::readFunctions.","scope":"local","releases":{"bookworm":{"status":"open","repositories":{"bookworm":"108-1"},"urgency":"unimportant"},"bullseye":{"status":"open","repositories":{"bullseye":"99-3"},"urgency":"unimportant"},"forky":{"status":"open","repositories":{"forky":"120-4"},"urgency":"unimportant"},"sid":{"status":"open","repositories":{"sid":"120-4"},"urgency":"unimportant"},"trixie":{"status":"open","repositories":{"trixie":"120-4"},"urgency":"unimportant"}}},"CVE-2021-46050":{"description":"A Stack Overflow vulnerability exists in Binaryen 103 via the printf_common function.","scope":"local","releases":{"bookworm":{"status":"open","repositories":{"bookworm":"108-1"},"urgency":"unimportant"},"bullseye":{"status":"open","repositories":{"bullseye":"99-3"},"urgency":"unimportant"},"forky":{"status":"open","repositories":{"forky":"120-4"},"urgency":"unimportant"},"sid":{"status":"open","repositories":{"sid":"120-4"},"urgency":"unimportant"},"trixie":{"status":"open","repositories":{"trixie":"120-4"},"urgency":"unimportant"}}},"CVE-2021-46052":{"description":"A Denial of Service vulnerability exists in Binaryen 104 due to an assertion abort in wasm::Tuple::validate.","scope":"local","releases":{"bookworm":{"status":"open","repositories":{"bookworm":"108-1"},"urgency":"unimportant"},"bullseye":{"status":"open","repositories":{"bullseye":"99-3"},"urgency":"unimportant"},"forky":{"status":"open","repositories":{"forky":"120-4"},"urgency":"unimportant"},"sid":{"status":"open","repositories":{"sid":"120-4"},"urgency":"unimportant"},"trixie":{"status":"open","repositories":{"trixie":"120-4"},"urgency":"unimportant"}}},"CVE-2021-46053":{"description":"A Denial of Service vulnerability exists in Binaryen 103. The program terminates with signal SIGKILL.","scope":"local","releases":{"bookworm":{"status":"open","repositories":{"bookworm":"108-1"},"urgency":"unimportant"},"bullseye":{"status":"open","repositories":{"bullseye":"99-3"},"urgency":"unimportant"},"forky":{"status":"open","repositories":{"forky":"120-4"},"urgency":"unimportant"},"sid":{"status":"open","repositories":{"sid":"120-4"},"urgency":"unimportant"},"trixie":{"status":"open","repositories":{"trixie":"120-4"},"urgency":"unimportant"}}},"CVE-2021-46054":{"description":"A Denial of Service vulnerability exists in Binaryen 104 due to an assertion abort in wasm::WasmBinaryBuilder::visitRethrow(wasm::Rethrow*).","scope":"local","releases":{"bookworm":{"status":"open","repositories":{"bookworm":"108-1"},"urgency":"unimportant"},"bullseye":{"status":"open","repositories":{"bullseye":"99-3"},"urgency":"unimportant"},"forky":{"status":"open","repositories":{"forky":"120-4"},"urgency":"unimportant"},"sid":{"status":"open","repositories":{"sid":"120-4"},"urgency":"unimportant"},"trixie":{"status":"open","repositories":{"trixie":"120-4"},"urgency":"unimportant"}}},"CVE-2021-46055":{"description":"A Denial of Service vulnerability exists in Binaryen 104 due to an assertion abort in wasm::WasmBinaryBuilder::visitRethrow(wasm::Rethrow*).","scope":"local","releases":{"bookworm":{"status":"open","repositories":{"bookworm":"108-1"},"urgency":"unimportant"},"bullseye":{"status":"open","repositories":{"bullseye":"99-3"},"urgency":"unimportant"},"forky":{"status":"open","repositories":{"forky":"120-4"},"urgency":"unimportant"},"sid":{"status":"open","repositories":{"sid":"120-4"},"urgency":"unimportant"},"trixie":{"status":"open","repositories":{"trixie":"120-4"},"urgency":"unimportant"}}},"CVE-2025-14956":{"description":"A vulnerability was determined in WebAssembly Binaryen up to 125. Affected by this issue is the function WasmBinaryReader::readExport of the file src/wasm/wasm-binary.cpp. This manipulation causes heap-based buffer overflow. It is possible to launch the attack on the local host. The exploit has been publicly disclosed and may be utilized. Patch name: 4f52bff8c4075b5630422f902dd92a0af2c9f398. It is recommended to apply a patch to fix this issue.","debianbug":1123745,"scope":"local","releases":{"bookworm":{"status":"open","repositories":{"bookworm":"108-1"},"urgency":"unimportant"},"bullseye":{"status":"open","repositories":{"bullseye":"99-3"},"urgency":"unimportant"},"forky":{"status":"open","repositories":{"forky":"120-4"},"urgency":"unimportant"},"sid":{"status":"open","repositories":{"sid":"120-4"},"urgency":"unimportant"},"trixie":{"status":"open","repositories":{"trixie":"120-4"},"urgency":"unimportant"}}},"CVE-2025-14957":{"description":"A vulnerability was identified in WebAssembly Binaryen up to 125. This affects the function IRBuilder::makeLocalGet/IRBuilder::makeLocalSet/IRBuilder::makeLocalTee of the file src/wasm/wasm-ir-builder.cpp of the component IRBuilder. Such manipulation of the argument Index leads to null pointer dereference. Local access is required to approach this attack. The exploit is publicly available and might be used. The name of the patch is 6fb2b917a79578ab44cf3b900a6da4c27251e0d4. Applying a patch is advised to resolve this issue.","debianbug":1123746,"scope":"local","releases":{"bookworm":{"status":"open","repositories":{"bookworm":"108-1"},"urgency":"unimportant"},"bullseye":{"status":"open","repositories":{"bullseye":"99-3"},"urgency":"unimportant"},"forky":{"status":"open","repositories":{"forky":"120-4"},"urgency":"unimportant"},"sid":{"status":"open","repositories":{"sid":"120-4"},"urgency":"unimportant"},"trixie":{"status":"open","repositories":{"trixie":"120-4"},"urgency":"unimportant"}}}},"bind9":{"CVE-2002-0029":{"description":"Buffer overflows in the DNS stub resolver library in ISC BIND 4.9.2 through 4.9.10, and other derived libraries such as BSD libc and GNU glibc, allow remote attackers to execute arbitrary code via DNS server responses that trigger the overflow in the (1) getnetbyname, or (2) getnetbyaddr functions, aka \"LIBRESOLV: buffer overrun\" and a different vulnerability than CVE-2002-0684.","scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"1:9.18.41-1~deb12u1","bookworm-security":"1:9.18.44-1~deb12u1"},"fixed_version":"0","urgency":"unimportant"},"bullseye":{"status":"resolved","repositories":{"bullseye":"1:9.16.50-1~deb11u2","bullseye-security":"1:9.16.50-1~deb11u4"},"fixed_version":"0","urgency":"unimportant"},"forky":{"status":"resolved","repositories":{"forky":"1:9.20.20-1"},"fixed_version":"0","urgency":"unimportant"},"sid":{"status":"resolved","repositories":{"sid":"1:9.20.20-1"},"fixed_version":"0","urgency":"unimportant"},"trixie":{"status":"resolved","repositories":{"trixie":"1:9.20.15-1~deb13u1","trixie-security":"1:9.20.18-1~deb13u1"},"fixed_version":"0","urgency":"unimportant"}}},"CVE-2002-1219":{"description":"Buffer overflow in named in BIND 4 versions 4.9.10 and earlier, and 8 versions 8.3.3 and earlier, allows remote attackers to execute arbitrary code via a certain DNS server response containing SIG resource records (RR).","scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"1:9.18.41-1~deb12u1","bookworm-security":"1:9.18.44-1~deb12u1"},"fixed_version":"0","urgency":"unimportant"},"bullseye":{"status":"resolved","repositories":{"bullseye":"1:9.16.50-1~deb11u2","bullseye-security":"1:9.16.50-1~deb11u4"},"fixed_version":"0","urgency":"unimportant"},"forky":{"status":"resolved","repositories":{"forky":"1:9.20.20-1"},"fixed_version":"0","urgency":"unimportant"},"sid":{"status":"resolved","repositories":{"sid":"1:9.20.20-1"},"fixed_version":"0","urgency":"unimportant"},"trixie":{"status":"resolved","repositories":{"trixie":"1:9.20.15-1~deb13u1","trixie-security":"1:9.20.18-1~deb13u1"},"fixed_version":"0","urgency":"unimportant"}}},"CVE-2002-1220":{"description":"BIND 8.3.x through 8.3.3 allows remote attackers to cause a denial of service (termination due to assertion failure) via a request for a subdomain that does not exist, with an OPT resource record with a large UDP payload size.","scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"1:9.18.41-1~deb12u1","bookworm-security":"1:9.18.44-1~deb12u1"},"fixed_version":"0","urgency":"unimportant"},"bullseye":{"status":"resolved","repositories":{"bullseye":"1:9.16.50-1~deb11u2","bullseye-security":"1:9.16.50-1~deb11u4"},"fixed_version":"0","urgency":"unimportant"},"forky":{"status":"resolved","repositories":{"forky":"1:9.20.20-1"},"fixed_version":"0","urgency":"unimportant"},"sid":{"status":"resolved","repositories":{"sid":"1:9.20.20-1"},"fixed_version":"0","urgency":"unimportant"},"trixie":{"status":"resolved","repositories":{"trixie":"1:9.20.15-1~deb13u1","trixie-security":"1:9.20.18-1~deb13u1"},"fixed_version":"0","urgency":"unimportant"}}},"CVE-2002-1221":{"description":"BIND 8.x through 8.3.3 allows remote attackers to cause a denial of service (crash) via SIG RR elements with invalid expiry times, which are removed from the internal BIND database and later cause a null dereference.","scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"1:9.18.41-1~deb12u1","bookworm-security":"1:9.18.44-1~deb12u1"},"fixed_version":"0","urgency":"unimportant"},"bullseye":{"status":"resolved","repositories":{"bullseye":"1:9.16.50-1~deb11u2","bullseye-security":"1:9.16.50-1~deb11u4"},"fixed_version":"0","urgency":"unimportant"},"forky":{"status":"resolved","repositories":{"forky":"1:9.20.20-1"},"fixed_version":"0","urgency":"unimportant"},"sid":{"status":"resolved","repositories":{"sid":"1:9.20.20-1"},"fixed_version":"0","urgency":"unimportant"},"trixie":{"status":"resolved","repositories":{"trixie":"1:9.20.15-1~deb13u1","trixie-security":"1:9.20.18-1~deb13u1"},"fixed_version":"0","urgency":"unimportant"}}},"CVE-2002-2211":{"description":"BIND 4 and BIND 8, when resolving recursive DNS queries for arbitrary hosts, allows remote attackers to conduct DNS cache poisoning via a birthday attack that uses a large number of open queries for the same resource record (RR) combined with spoofed responses, which increases the possibility of successfully spoofing a response in a way that is more efficient than brute force methods.","scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"1:9.18.41-1~deb12u1","bookworm-security":"1:9.18.44-1~deb12u1"},"fixed_version":"0","urgency":"unimportant"},"bullseye":{"status":"resolved","repositories":{"bullseye":"1:9.16.50-1~deb11u2","bullseye-security":"1:9.16.50-1~deb11u4"},"fixed_version":"0","urgency":"unimportant"},"forky":{"status":"resolved","repositories":{"forky":"1:9.20.20-1"},"fixed_version":"0","urgency":"unimportant"},"sid":{"status":"resolved","repositories":{"sid":"1:9.20.20-1"},"fixed_version":"0","urgency":"unimportant"},"trixie":{"status":"resolved","repositories":{"trixie":"1:9.20.15-1~deb13u1","trixie-security":"1:9.20.18-1~deb13u1"},"fixed_version":"0","urgency":"unimportant"}}},"CVE-2005-0034":{"description":"An \"incorrect assumption\" in the authvalidated validator function in BIND 9.3.0, when DNSSEC is enabled, allows remote attackers to cause a denial of service (named server exit) via crafted DNS packets that cause an internal consistency test (self-check) to fail.","scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"1:9.18.41-1~deb12u1","bookworm-security":"1:9.18.44-1~deb12u1"},"fixed_version":"1:9.3.1","urgency":"not yet assigned"},"bullseye":{"status":"resolved","repositories":{"bullseye":"1:9.16.50-1~deb11u2","bullseye-security":"1:9.16.50-1~deb11u4"},"fixed_version":"1:9.3.1","urgency":"not yet assigned"},"forky":{"status":"resolved","repositories":{"forky":"1:9.20.20-1"},"fixed_version":"1:9.3.1","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"1:9.20.20-1"},"fixed_version":"1:9.3.1","urgency":"not yet assigned"},"trixie":{"status":"resolved","repositories":{"trixie":"1:9.20.15-1~deb13u1","trixie-security":"1:9.20.18-1~deb13u1"},"fixed_version":"1:9.3.1","urgency":"not yet assigned"}}},"CVE-2005-0364":{"description":"Unknown vulnerability in BIND 9.2.0 in HP-UX B.11.00, B.11.11, and B.11.23 allows remote attackers to cause a denial of service.","scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"1:9.18.41-1~deb12u1","bookworm-security":"1:9.18.44-1~deb12u1"},"fixed_version":"0","urgency":"unimportant"},"bullseye":{"status":"resolved","repositories":{"bullseye":"1:9.16.50-1~deb11u2","bullseye-security":"1:9.16.50-1~deb11u4"},"fixed_version":"0","urgency":"unimportant"},"forky":{"status":"resolved","repositories":{"forky":"1:9.20.20-1"},"fixed_version":"0","urgency":"unimportant"},"sid":{"status":"resolved","repositories":{"sid":"1:9.20.20-1"},"fixed_version":"0","urgency":"unimportant"},"trixie":{"status":"resolved","repositories":{"trixie":"1:9.20.15-1~deb13u1","trixie-security":"1:9.20.18-1~deb13u1"},"fixed_version":"0","urgency":"unimportant"}}},"CVE-2006-0987":{"description":"The default configuration of ISC BIND before 9.4.1-P1, when configured as a caching name server, allows recursive queries and provides additional delegation information to arbitrary IP addresses, which allows remote attackers to cause a denial of service (traffic amplification) via DNS queries with spoofed source IP addresses.","debianbug":356266,"scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"1:9.18.41-1~deb12u1","bookworm-security":"1:9.18.44-1~deb12u1"},"fixed_version":"1:9.4.0-1","urgency":"unimportant"},"bullseye":{"status":"resolved","repositories":{"bullseye":"1:9.16.50-1~deb11u2","bullseye-security":"1:9.16.50-1~deb11u4"},"fixed_version":"1:9.4.0-1","urgency":"unimportant"},"forky":{"status":"resolved","repositories":{"forky":"1:9.20.20-1"},"fixed_version":"1:9.4.0-1","urgency":"unimportant"},"sid":{"status":"resolved","repositories":{"sid":"1:9.20.20-1"},"fixed_version":"1:9.4.0-1","urgency":"unimportant"},"trixie":{"status":"resolved","repositories":{"trixie":"1:9.20.15-1~deb13u1","trixie-security":"1:9.20.18-1~deb13u1"},"fixed_version":"1:9.4.0-1","urgency":"unimportant"}}},"CVE-2006-2073":{"description":"Unspecified vulnerability in ISC BIND allows remote attackers to cause a denial of service via a crafted DNS message with a \"broken\" TSIG, as demonstrated by the OUSPG PROTOS DNS test suite.","scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"1:9.18.41-1~deb12u1","bookworm-security":"1:9.18.44-1~deb12u1"},"fixed_version":"1:9.3.3-1","urgency":"low"},"bullseye":{"status":"resolved","repositories":{"bullseye":"1:9.16.50-1~deb11u2","bullseye-security":"1:9.16.50-1~deb11u4"},"fixed_version":"1:9.3.3-1","urgency":"low"},"forky":{"status":"resolved","repositories":{"forky":"1:9.20.20-1"},"fixed_version":"1:9.3.3-1","urgency":"low"},"sid":{"status":"resolved","repositories":{"sid":"1:9.20.20-1"},"fixed_version":"1:9.3.3-1","urgency":"low"},"trixie":{"status":"resolved","repositories":{"trixie":"1:9.20.15-1~deb13u1","trixie-security":"1:9.20.18-1~deb13u1"},"fixed_version":"1:9.3.3-1","urgency":"low"}}},"CVE-2006-4095":{"description":"BIND before 9.2.6-P1 and 9.3.x before 9.3.2-P1 allows remote attackers to cause a denial of service (crash) via certain SIG queries, which cause an assertion failure when multiple RRsets are returned.","debianbug":386237,"scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"1:9.18.41-1~deb12u1","bookworm-security":"1:9.18.44-1~deb12u1"},"fixed_version":"1:9.3.2-P1-1","urgency":"medium"},"bullseye":{"status":"resolved","repositories":{"bullseye":"1:9.16.50-1~deb11u2","bullseye-security":"1:9.16.50-1~deb11u4"},"fixed_version":"1:9.3.2-P1-1","urgency":"medium"},"forky":{"status":"resolved","repositories":{"forky":"1:9.20.20-1"},"fixed_version":"1:9.3.2-P1-1","urgency":"medium"},"sid":{"status":"resolved","repositories":{"sid":"1:9.20.20-1"},"fixed_version":"1:9.3.2-P1-1","urgency":"medium"},"trixie":{"status":"resolved","repositories":{"trixie":"1:9.20.15-1~deb13u1","trixie-security":"1:9.20.18-1~deb13u1"},"fixed_version":"1:9.3.2-P1-1","urgency":"medium"}}},"CVE-2006-4096":{"description":"BIND before 9.2.6-P1 and 9.3.x before 9.3.2-P1 allows remote attackers to cause a denial of service (crash) via a flood of recursive queries, which cause an INSIST failure when the response is received after the recursion queue is empty.","debianbug":386237,"scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"1:9.18.41-1~deb12u1","bookworm-security":"1:9.18.44-1~deb12u1"},"fixed_version":"1:9.3.2-P1-1","urgency":"medium"},"bullseye":{"status":"resolved","repositories":{"bullseye":"1:9.16.50-1~deb11u2","bullseye-security":"1:9.16.50-1~deb11u4"},"fixed_version":"1:9.3.2-P1-1","urgency":"medium"},"forky":{"status":"resolved","repositories":{"forky":"1:9.20.20-1"},"fixed_version":"1:9.3.2-P1-1","urgency":"medium"},"sid":{"status":"resolved","repositories":{"sid":"1:9.20.20-1"},"fixed_version":"1:9.3.2-P1-1","urgency":"medium"},"trixie":{"status":"resolved","repositories":{"trixie":"1:9.20.15-1~deb13u1","trixie-security":"1:9.20.18-1~deb13u1"},"fixed_version":"1:9.3.2-P1-1","urgency":"medium"}}},"CVE-2007-0493":{"description":"Use-after-free vulnerability in ISC BIND 9.3.0 up to 9.3.3, 9.4.0a1 up to 9.4.0a6, 9.4.0b1 up to 9.4.0b4, 9.4.0rc1, and 9.5.0a1 (Bind Forum only) allows remote attackers to cause a denial of service (named daemon crash) via unspecified vectors that cause named to \"dereference a freed fetch context.\"","debianbug":408432,"scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"1:9.18.41-1~deb12u1","bookworm-security":"1:9.18.44-1~deb12u1"},"fixed_version":"1:9.3.4-2","urgency":"medium"},"bullseye":{"status":"resolved","repositories":{"bullseye":"1:9.16.50-1~deb11u2","bullseye-security":"1:9.16.50-1~deb11u4"},"fixed_version":"1:9.3.4-2","urgency":"medium"},"forky":{"status":"resolved","repositories":{"forky":"1:9.20.20-1"},"fixed_version":"1:9.3.4-2","urgency":"medium"},"sid":{"status":"resolved","repositories":{"sid":"1:9.20.20-1"},"fixed_version":"1:9.3.4-2","urgency":"medium"},"trixie":{"status":"resolved","repositories":{"trixie":"1:9.20.15-1~deb13u1","trixie-security":"1:9.20.18-1~deb13u1"},"fixed_version":"1:9.3.4-2","urgency":"medium"}}},"CVE-2007-0494":{"description":"ISC BIND 9.0.x, 9.1.x, 9.2.0 up to 9.2.7, 9.3.0 up to 9.3.3, 9.4.0a1 up to 9.4.0a6, 9.4.0b1 up to 9.4.0b4, 9.4.0rc1, and 9.5.0a1 (Bind Forum only) allows remote attackers to cause a denial of service (exit) via a type * (ANY) DNS query response that contains multiple RRsets, which triggers an assertion error, aka the \"DNSSEC Validation\" vulnerability.","debianbug":408432,"scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"1:9.18.41-1~deb12u1","bookworm-security":"1:9.18.44-1~deb12u1"},"fixed_version":"1:9.3.4-2","urgency":"medium"},"bullseye":{"status":"resolved","repositories":{"bullseye":"1:9.16.50-1~deb11u2","bullseye-security":"1:9.16.50-1~deb11u4"},"fixed_version":"1:9.3.4-2","urgency":"medium"},"forky":{"status":"resolved","repositories":{"forky":"1:9.20.20-1"},"fixed_version":"1:9.3.4-2","urgency":"medium"},"sid":{"status":"resolved","repositories":{"sid":"1:9.20.20-1"},"fixed_version":"1:9.3.4-2","urgency":"medium"},"trixie":{"status":"resolved","repositories":{"trixie":"1:9.20.15-1~deb13u1","trixie-security":"1:9.20.18-1~deb13u1"},"fixed_version":"1:9.3.4-2","urgency":"medium"}}},"CVE-2007-2241":{"description":"Unspecified vulnerability in query.c in ISC BIND 9.4.0, and 9.5.0a1 through 9.5.0a3, when recursion is enabled, allows remote attackers to cause a denial of service (daemon exit) via a sequence of queries processed by the query_addsoa function.","scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"1:9.18.41-1~deb12u1","bookworm-security":"1:9.18.44-1~deb12u1"},"fixed_version":"1:9.4.1-1","urgency":"medium"},"bullseye":{"status":"resolved","repositories":{"bullseye":"1:9.16.50-1~deb11u2","bullseye-security":"1:9.16.50-1~deb11u4"},"fixed_version":"1:9.4.1-1","urgency":"medium"},"forky":{"status":"resolved","repositories":{"forky":"1:9.20.20-1"},"fixed_version":"1:9.4.1-1","urgency":"medium"},"sid":{"status":"resolved","repositories":{"sid":"1:9.20.20-1"},"fixed_version":"1:9.4.1-1","urgency":"medium"},"trixie":{"status":"resolved","repositories":{"trixie":"1:9.20.15-1~deb13u1","trixie-security":"1:9.20.18-1~deb13u1"},"fixed_version":"1:9.4.1-1","urgency":"medium"}}},"CVE-2007-2925":{"description":"The default access control lists (ACL) in ISC BIND 9.4.0, 9.4.1, and 9.5.0a1 through 9.5.0a5 do not set the allow-recursion and allow-query-cache ACLs, which allows remote attackers to make recursive queries and query the cache.","scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"1:9.18.41-1~deb12u1","bookworm-security":"1:9.18.44-1~deb12u1"},"fixed_version":"1:9.4.1-P1-1","urgency":"medium"},"bullseye":{"status":"resolved","repositories":{"bullseye":"1:9.16.50-1~deb11u2","bullseye-security":"1:9.16.50-1~deb11u4"},"fixed_version":"1:9.4.1-P1-1","urgency":"medium"},"forky":{"status":"resolved","repositories":{"forky":"1:9.20.20-1"},"fixed_version":"1:9.4.1-P1-1","urgency":"medium"},"sid":{"status":"resolved","repositories":{"sid":"1:9.20.20-1"},"fixed_version":"1:9.4.1-P1-1","urgency":"medium"},"trixie":{"status":"resolved","repositories":{"trixie":"1:9.20.15-1~deb13u1","trixie-security":"1:9.20.18-1~deb13u1"},"fixed_version":"1:9.4.1-P1-1","urgency":"medium"}}},"CVE-2007-2926":{"description":"ISC BIND 9 through 9.5.0a5 uses a weak random number generator during generation of DNS query ids when answering resolver questions or sending NOTIFY messages to slave name servers, which makes it easier for remote attackers to guess the next query id and perform DNS cache poisoning.","scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"1:9.18.41-1~deb12u1","bookworm-security":"1:9.18.44-1~deb12u1"},"fixed_version":"1:9.4.1-P1-1","urgency":"not yet assigned"},"bullseye":{"status":"resolved","repositories":{"bullseye":"1:9.16.50-1~deb11u2","bullseye-security":"1:9.16.50-1~deb11u4"},"fixed_version":"1:9.4.1-P1-1","urgency":"not yet assigned"},"forky":{"status":"resolved","repositories":{"forky":"1:9.20.20-1"},"fixed_version":"1:9.4.1-P1-1","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"1:9.20.20-1"},"fixed_version":"1:9.4.1-P1-1","urgency":"not yet assigned"},"trixie":{"status":"resolved","repositories":{"trixie":"1:9.20.15-1~deb13u1","trixie-security":"1:9.20.18-1~deb13u1"},"fixed_version":"1:9.4.1-P1-1","urgency":"not yet assigned"}}},"CVE-2007-6283":{"description":"Red Hat Enterprise Linux 5 and Fedora install the Bind /etc/rndc.key file with world-readable permissions, which allows local users to perform unauthorized named commands, such as causing a denial of service by stopping named.","scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"1:9.18.41-1~deb12u1","bookworm-security":"1:9.18.44-1~deb12u1"},"fixed_version":"0","urgency":"unimportant"},"bullseye":{"status":"resolved","repositories":{"bullseye":"1:9.16.50-1~deb11u2","bullseye-security":"1:9.16.50-1~deb11u4"},"fixed_version":"0","urgency":"unimportant"},"forky":{"status":"resolved","repositories":{"forky":"1:9.20.20-1"},"fixed_version":"0","urgency":"unimportant"},"sid":{"status":"resolved","repositories":{"sid":"1:9.20.20-1"},"fixed_version":"0","urgency":"unimportant"},"trixie":{"status":"resolved","repositories":{"trixie":"1:9.20.15-1~deb13u1","trixie-security":"1:9.20.18-1~deb13u1"},"fixed_version":"0","urgency":"unimportant"}}},"CVE-2008-0122":{"description":"Off-by-one error in the inet_network function in libbind in ISC BIND 9.4.2 and earlier, as used in libc in FreeBSD 6.2 through 7.0-PRERELEASE, allows context-dependent attackers to cause a denial of service (crash) and possibly execute arbitrary code via crafted input that triggers memory corruption.","scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"1:9.18.41-1~deb12u1","bookworm-security":"1:9.18.44-1~deb12u1"},"fixed_version":"0","urgency":"unimportant"},"bullseye":{"status":"resolved","repositories":{"bullseye":"1:9.16.50-1~deb11u2","bullseye-security":"1:9.16.50-1~deb11u4"},"fixed_version":"0","urgency":"unimportant"},"forky":{"status":"resolved","repositories":{"forky":"1:9.20.20-1"},"fixed_version":"0","urgency":"unimportant"},"sid":{"status":"resolved","repositories":{"sid":"1:9.20.20-1"},"fixed_version":"0","urgency":"unimportant"},"trixie":{"status":"resolved","repositories":{"trixie":"1:9.20.15-1~deb13u1","trixie-security":"1:9.20.18-1~deb13u1"},"fixed_version":"0","urgency":"unimportant"}}},"CVE-2008-1447":{"description":"The DNS protocol, as implemented in (1) BIND 8 and 9 before 9.5.0-P1, 9.4.2-P1, and 9.3.5-P1; (2) Microsoft DNS in Windows 2000 SP4, XP SP2 and SP3, and Server 2003 SP1 and SP2; and other implementations allow remote attackers to spoof DNS traffic via a birthday attack that uses in-bailiwick referrals to conduct cache poisoning against recursive resolvers, related to insufficient randomness of DNS transaction IDs and source ports, aka \"DNS Insufficient Socket Entropy Vulnerability\" or \"the Kaminsky bug.\"","scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"1:9.18.41-1~deb12u1","bookworm-security":"1:9.18.44-1~deb12u1"},"fixed_version":"1:9.5.0.dfsg-5","urgency":"high"},"bullseye":{"status":"resolved","repositories":{"bullseye":"1:9.16.50-1~deb11u2","bullseye-security":"1:9.16.50-1~deb11u4"},"fixed_version":"1:9.5.0.dfsg-5","urgency":"high"},"forky":{"status":"resolved","repositories":{"forky":"1:9.20.20-1"},"fixed_version":"1:9.5.0.dfsg-5","urgency":"high"},"sid":{"status":"resolved","repositories":{"sid":"1:9.20.20-1"},"fixed_version":"1:9.5.0.dfsg-5","urgency":"high"},"trixie":{"status":"resolved","repositories":{"trixie":"1:9.20.15-1~deb13u1","trixie-security":"1:9.20.18-1~deb13u1"},"fixed_version":"1:9.5.0.dfsg-5","urgency":"high"}}},"CVE-2008-4163":{"description":"Unspecified vulnerability in ISC BIND 9.3.5-P2-W1, 9.4.2-P2-W1, and 9.5.0-P2-W1 on Windows allows remote attackers to cause a denial of service (UDP client handler termination) via unknown vectors.","scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"1:9.18.41-1~deb12u1","bookworm-security":"1:9.18.44-1~deb12u1"},"fixed_version":"0","urgency":"unimportant"},"bullseye":{"status":"resolved","repositories":{"bullseye":"1:9.16.50-1~deb11u2","bullseye-security":"1:9.16.50-1~deb11u4"},"fixed_version":"0","urgency":"unimportant"},"forky":{"status":"resolved","repositories":{"forky":"1:9.20.20-1"},"fixed_version":"0","urgency":"unimportant"},"sid":{"status":"resolved","repositories":{"sid":"1:9.20.20-1"},"fixed_version":"0","urgency":"unimportant"},"trixie":{"status":"resolved","repositories":{"trixie":"1:9.20.15-1~deb13u1","trixie-security":"1:9.20.18-1~deb13u1"},"fixed_version":"0","urgency":"unimportant"}}},"CVE-2009-0025":{"description":"BIND 9.6.0, 9.5.1, 9.5.0, 9.4.3, and earlier does not properly check the return value from the OpenSSL DSA_verify function, which allows remote attackers to bypass validation of the certificate chain via a malformed SSL/TLS signature, a similar vulnerability to CVE-2008-5077.","debianbug":511936,"scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"1:9.18.41-1~deb12u1","bookworm-security":"1:9.18.44-1~deb12u1"},"fixed_version":"1:9.5.1.dfsg.P1-1","urgency":"low"},"bullseye":{"status":"resolved","repositories":{"bullseye":"1:9.16.50-1~deb11u2","bullseye-security":"1:9.16.50-1~deb11u4"},"fixed_version":"1:9.5.1.dfsg.P1-1","urgency":"low"},"forky":{"status":"resolved","repositories":{"forky":"1:9.20.20-1"},"fixed_version":"1:9.5.1.dfsg.P1-1","urgency":"low"},"sid":{"status":"resolved","repositories":{"sid":"1:9.20.20-1"},"fixed_version":"1:9.5.1.dfsg.P1-1","urgency":"low"},"trixie":{"status":"resolved","repositories":{"trixie":"1:9.20.15-1~deb13u1","trixie-security":"1:9.20.18-1~deb13u1"},"fixed_version":"1:9.5.1.dfsg.P1-1","urgency":"low"}}},"CVE-2009-0265":{"description":"Internet Systems Consortium (ISC) BIND 9.6.0 and earlier does not properly check the return value from the OpenSSL EVP_VerifyFinal function, which allows remote attackers to bypass validation of the certificate chain via a malformed SSL/TLS signature, a similar vulnerability to CVE-2008-5077 and CVE-2009-0025.","scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"1:9.18.41-1~deb12u1","bookworm-security":"1:9.18.44-1~deb12u1"},"fixed_version":"0","urgency":"unimportant"},"bullseye":{"status":"resolved","repositories":{"bullseye":"1:9.16.50-1~deb11u2","bullseye-security":"1:9.16.50-1~deb11u4"},"fixed_version":"0","urgency":"unimportant"},"forky":{"status":"resolved","repositories":{"forky":"1:9.20.20-1"},"fixed_version":"0","urgency":"unimportant"},"sid":{"status":"resolved","repositories":{"sid":"1:9.20.20-1"},"fixed_version":"0","urgency":"unimportant"},"trixie":{"status":"resolved","repositories":{"trixie":"1:9.20.15-1~deb13u1","trixie-security":"1:9.20.18-1~deb13u1"},"fixed_version":"0","urgency":"unimportant"}}},"CVE-2009-0696":{"description":"The dns_db_findrdataset function in db.c in named in ISC BIND 9.4 before 9.4.3-P3, 9.5 before 9.5.1-P3, and 9.6 before 9.6.1-P1, when configured as a master server, allows remote attackers to cause a denial of service (assertion failure and daemon exit) via an ANY record in the prerequisite section of a crafted dynamic update message.","debianbug":538975,"scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"1:9.18.41-1~deb12u1","bookworm-security":"1:9.18.44-1~deb12u1"},"fixed_version":"1:9.6.1.dfsg.P1-1","urgency":"high"},"bullseye":{"status":"resolved","repositories":{"bullseye":"1:9.16.50-1~deb11u2","bullseye-security":"1:9.16.50-1~deb11u4"},"fixed_version":"1:9.6.1.dfsg.P1-1","urgency":"high"},"forky":{"status":"resolved","repositories":{"forky":"1:9.20.20-1"},"fixed_version":"1:9.6.1.dfsg.P1-1","urgency":"high"},"sid":{"status":"resolved","repositories":{"sid":"1:9.20.20-1"},"fixed_version":"1:9.6.1.dfsg.P1-1","urgency":"high"},"trixie":{"status":"resolved","repositories":{"trixie":"1:9.20.15-1~deb13u1","trixie-security":"1:9.20.18-1~deb13u1"},"fixed_version":"1:9.6.1.dfsg.P1-1","urgency":"high"}}},"CVE-2009-4022":{"description":"Unspecified vulnerability in ISC BIND 9.0.x through 9.3.x, 9.4 before 9.4.3-P4, 9.5 before 9.5.2-P1, 9.6 before 9.6.1-P2, and 9.7 beta before 9.7.0b3, with DNSSEC validation enabled and checking disabled (CD), allows remote attackers to conduct DNS cache poisoning attacks by receiving a recursive client query and sending a response that contains an Additional section with crafted data, which is not properly handled when the response is processed \"at the same time as requesting DNSSEC records (DO),\" aka Bug 20438.","scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"1:9.18.41-1~deb12u1","bookworm-security":"1:9.18.44-1~deb12u1"},"fixed_version":"1:9.6.1.dfsg.P2-1","urgency":"medium"},"bullseye":{"status":"resolved","repositories":{"bullseye":"1:9.16.50-1~deb11u2","bullseye-security":"1:9.16.50-1~deb11u4"},"fixed_version":"1:9.6.1.dfsg.P2-1","urgency":"medium"},"forky":{"status":"resolved","repositories":{"forky":"1:9.20.20-1"},"fixed_version":"1:9.6.1.dfsg.P2-1","urgency":"medium"},"sid":{"status":"resolved","repositories":{"sid":"1:9.20.20-1"},"fixed_version":"1:9.6.1.dfsg.P2-1","urgency":"medium"},"trixie":{"status":"resolved","repositories":{"trixie":"1:9.20.15-1~deb13u1","trixie-security":"1:9.20.18-1~deb13u1"},"fixed_version":"1:9.6.1.dfsg.P2-1","urgency":"medium"}}},"CVE-2010-0097":{"description":"ISC BIND 9.0.x through 9.3.x, 9.4 before 9.4.3-P5, 9.5 before 9.5.2-P2, 9.6 before 9.6.1-P3, and 9.7.0 beta does not properly validate DNSSEC (1) NSEC and (2) NSEC3 records, which allows remote attackers to add the Authenticated Data (AD) flag to a forged NXDOMAIN response for an existing domain.","scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"1:9.18.41-1~deb12u1","bookworm-security":"1:9.18.44-1~deb12u1"},"fixed_version":"1:9.7.0.dfsg-1","urgency":"not yet assigned"},"bullseye":{"status":"resolved","repositories":{"bullseye":"1:9.16.50-1~deb11u2","bullseye-security":"1:9.16.50-1~deb11u4"},"fixed_version":"1:9.7.0.dfsg-1","urgency":"not yet assigned"},"forky":{"status":"resolved","repositories":{"forky":"1:9.20.20-1"},"fixed_version":"1:9.7.0.dfsg-1","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"1:9.20.20-1"},"fixed_version":"1:9.7.0.dfsg-1","urgency":"not yet assigned"},"trixie":{"status":"resolved","repositories":{"trixie":"1:9.20.15-1~deb13u1","trixie-security":"1:9.20.18-1~deb13u1"},"fixed_version":"1:9.7.0.dfsg-1","urgency":"not yet assigned"}}},"CVE-2010-0213":{"description":"BIND 9.7.1 and 9.7.1-P1, when a recursive validating server has a trust anchor that is configured statically or via DNSSEC Lookaside Validation (DLV), allows remote attackers to cause a denial of service (infinite loop) via a query for an RRSIG record whose answer is not in the cache, which causes BIND to repeatedly send RRSIG queries to the authoritative servers.","scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"1:9.18.41-1~deb12u1","bookworm-security":"1:9.18.44-1~deb12u1"},"fixed_version":"9.7.1.dfsg.P2","urgency":"not yet assigned"},"bullseye":{"status":"resolved","repositories":{"bullseye":"1:9.16.50-1~deb11u2","bullseye-security":"1:9.16.50-1~deb11u4"},"fixed_version":"9.7.1.dfsg.P2","urgency":"not yet assigned"},"forky":{"status":"resolved","repositories":{"forky":"1:9.20.20-1"},"fixed_version":"9.7.1.dfsg.P2","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"1:9.20.20-1"},"fixed_version":"9.7.1.dfsg.P2","urgency":"not yet assigned"},"trixie":{"status":"resolved","repositories":{"trixie":"1:9.20.15-1~deb13u1","trixie-security":"1:9.20.18-1~deb13u1"},"fixed_version":"9.7.1.dfsg.P2","urgency":"not yet assigned"}}},"CVE-2010-0218":{"description":"ISC BIND 9.7.2 through 9.7.2-P1 uses an incorrect ACL to restrict the ability of Recursion Desired (RD) queries to access the cache, which allows remote attackers to obtain potentially sensitive information via a DNS query.","scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"1:9.18.41-1~deb12u1","bookworm-security":"1:9.18.44-1~deb12u1"},"fixed_version":"0","urgency":"unimportant"},"bullseye":{"status":"resolved","repositories":{"bullseye":"1:9.16.50-1~deb11u2","bullseye-security":"1:9.16.50-1~deb11u4"},"fixed_version":"0","urgency":"unimportant"},"forky":{"status":"resolved","repositories":{"forky":"1:9.20.20-1"},"fixed_version":"0","urgency":"unimportant"},"sid":{"status":"resolved","repositories":{"sid":"1:9.20.20-1"},"fixed_version":"0","urgency":"unimportant"},"trixie":{"status":"resolved","repositories":{"trixie":"1:9.20.15-1~deb13u1","trixie-security":"1:9.20.18-1~deb13u1"},"fixed_version":"0","urgency":"unimportant"}}},"CVE-2010-0290":{"description":"Unspecified vulnerability in ISC BIND 9.0.x through 9.3.x, 9.4 before 9.4.3-P5, 9.5 before 9.5.2-P2, 9.6 before 9.6.1-P3, and 9.7.0 beta, with DNSSEC validation enabled and checking disabled (CD), allows remote attackers to conduct DNS cache poisoning attacks by receiving a recursive client query and sending a response that contains (1) CNAME or (2) DNAME records, which do not have the intended validation before caching, aka Bug 20737.  NOTE: this vulnerability exists because of an incomplete fix for CVE-2009-4022.","scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"1:9.18.41-1~deb12u1","bookworm-security":"1:9.18.44-1~deb12u1"},"fixed_version":"1:9.7.0.dfsg-1","urgency":"medium"},"bullseye":{"status":"resolved","repositories":{"bullseye":"1:9.16.50-1~deb11u2","bullseye-security":"1:9.16.50-1~deb11u4"},"fixed_version":"1:9.7.0.dfsg-1","urgency":"medium"},"forky":{"status":"resolved","repositories":{"forky":"1:9.20.20-1"},"fixed_version":"1:9.7.0.dfsg-1","urgency":"medium"},"sid":{"status":"resolved","repositories":{"sid":"1:9.20.20-1"},"fixed_version":"1:9.7.0.dfsg-1","urgency":"medium"},"trixie":{"status":"resolved","repositories":{"trixie":"1:9.20.15-1~deb13u1","trixie-security":"1:9.20.18-1~deb13u1"},"fixed_version":"1:9.7.0.dfsg-1","urgency":"medium"}}},"CVE-2010-0382":{"description":"ISC BIND 9.0.x through 9.3.x, 9.4 before 9.4.3-P5, 9.5 before 9.5.2-P2, 9.6 before 9.6.1-P3, and 9.7.0 beta handles out-of-bailiwick data accompanying a secure response without re-fetching from the original source, which allows remote attackers to have an unspecified impact via a crafted response, aka Bug 20819.  NOTE: this vulnerability exists because of a regression during the fix for CVE-2009-4022.","scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"1:9.18.41-1~deb12u1","bookworm-security":"1:9.18.44-1~deb12u1"},"fixed_version":"1:9.7.0.dfsg-1","urgency":"not yet assigned"},"bullseye":{"status":"resolved","repositories":{"bullseye":"1:9.16.50-1~deb11u2","bullseye-security":"1:9.16.50-1~deb11u4"},"fixed_version":"1:9.7.0.dfsg-1","urgency":"not yet assigned"},"forky":{"status":"resolved","repositories":{"forky":"1:9.20.20-1"},"fixed_version":"1:9.7.0.dfsg-1","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"1:9.20.20-1"},"fixed_version":"1:9.7.0.dfsg-1","urgency":"not yet assigned"},"trixie":{"status":"resolved","repositories":{"trixie":"1:9.20.15-1~deb13u1","trixie-security":"1:9.20.18-1~deb13u1"},"fixed_version":"1:9.7.0.dfsg-1","urgency":"not yet assigned"}}},"CVE-2010-3613":{"description":"named in ISC BIND 9.6.2 before 9.6.2-P3, 9.6-ESV before 9.6-ESV-R3, and 9.7.x before 9.7.2-P3 does not properly handle the combination of signed negative responses and corresponding RRSIG records in the cache, which allows remote attackers to cause a denial of service (daemon crash) via a query for cached data.","debianbug":605876,"scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"1:9.18.41-1~deb12u1","bookworm-security":"1:9.18.44-1~deb12u1"},"fixed_version":"1:9.7.2.dfsg.P3-1","urgency":"not yet assigned"},"bullseye":{"status":"resolved","repositories":{"bullseye":"1:9.16.50-1~deb11u2","bullseye-security":"1:9.16.50-1~deb11u4"},"fixed_version":"1:9.7.2.dfsg.P3-1","urgency":"not yet assigned"},"forky":{"status":"resolved","repositories":{"forky":"1:9.20.20-1"},"fixed_version":"1:9.7.2.dfsg.P3-1","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"1:9.20.20-1"},"fixed_version":"1:9.7.2.dfsg.P3-1","urgency":"not yet assigned"},"trixie":{"status":"resolved","repositories":{"trixie":"1:9.20.15-1~deb13u1","trixie-security":"1:9.20.18-1~deb13u1"},"fixed_version":"1:9.7.2.dfsg.P3-1","urgency":"not yet assigned"}}},"CVE-2010-3614":{"description":"named in ISC BIND 9.x before 9.6.2-P3, 9.7.x before 9.7.2-P3, 9.4-ESV before 9.4-ESV-R4, and 9.6-ESV before 9.6-ESV-R3 does not properly determine the security status of an NS RRset during a DNSKEY algorithm rollover, which might allow remote attackers to cause a denial of service (DNSSEC validation error) by triggering a rollover.","debianbug":605876,"scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"1:9.18.41-1~deb12u1","bookworm-security":"1:9.18.44-1~deb12u1"},"fixed_version":"1:9.7.2.dfsg.P3-1","urgency":"not yet assigned"},"bullseye":{"status":"resolved","repositories":{"bullseye":"1:9.16.50-1~deb11u2","bullseye-security":"1:9.16.50-1~deb11u4"},"fixed_version":"1:9.7.2.dfsg.P3-1","urgency":"not yet assigned"},"forky":{"status":"resolved","repositories":{"forky":"1:9.20.20-1"},"fixed_version":"1:9.7.2.dfsg.P3-1","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"1:9.20.20-1"},"fixed_version":"1:9.7.2.dfsg.P3-1","urgency":"not yet assigned"},"trixie":{"status":"resolved","repositories":{"trixie":"1:9.20.15-1~deb13u1","trixie-security":"1:9.20.18-1~deb13u1"},"fixed_version":"1:9.7.2.dfsg.P3-1","urgency":"not yet assigned"}}},"CVE-2010-3615":{"description":"named in ISC BIND 9.7.2-P2 does not check all intended locations for allow-query ACLs, which might allow remote attackers to make successful requests for private DNS records via the standard DNS query mechanism.","debianbug":605876,"scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"1:9.18.41-1~deb12u1","bookworm-security":"1:9.18.44-1~deb12u1"},"fixed_version":"1:9.7.2.dfsg.P3-1","urgency":"not yet assigned"},"bullseye":{"status":"resolved","repositories":{"bullseye":"1:9.16.50-1~deb11u2","bullseye-security":"1:9.16.50-1~deb11u4"},"fixed_version":"1:9.7.2.dfsg.P3-1","urgency":"not yet assigned"},"forky":{"status":"resolved","repositories":{"forky":"1:9.20.20-1"},"fixed_version":"1:9.7.2.dfsg.P3-1","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"1:9.20.20-1"},"fixed_version":"1:9.7.2.dfsg.P3-1","urgency":"not yet assigned"},"trixie":{"status":"resolved","repositories":{"trixie":"1:9.20.15-1~deb13u1","trixie-security":"1:9.20.18-1~deb13u1"},"fixed_version":"1:9.7.2.dfsg.P3-1","urgency":"not yet assigned"}}},"CVE-2010-3762":{"description":"ISC BIND before 9.7.2-P2, when DNSSEC validation is enabled, does not properly handle certain bad signatures if multiple trust anchors exist for a single zone, which allows remote attackers to cause a denial of service (daemon crash) via a DNS query.","debianbug":599515,"scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"1:9.18.41-1~deb12u1","bookworm-security":"1:9.18.44-1~deb12u1"},"fixed_version":"1:9.7.2.dfsg.P2-1","urgency":"not yet assigned"},"bullseye":{"status":"resolved","repositories":{"bullseye":"1:9.16.50-1~deb11u2","bullseye-security":"1:9.16.50-1~deb11u4"},"fixed_version":"1:9.7.2.dfsg.P2-1","urgency":"not yet assigned"},"forky":{"status":"resolved","repositories":{"forky":"1:9.20.20-1"},"fixed_version":"1:9.7.2.dfsg.P2-1","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"1:9.20.20-1"},"fixed_version":"1:9.7.2.dfsg.P2-1","urgency":"not yet assigned"},"trixie":{"status":"resolved","repositories":{"trixie":"1:9.20.15-1~deb13u1","trixie-security":"1:9.20.18-1~deb13u1"},"fixed_version":"1:9.7.2.dfsg.P2-1","urgency":"not yet assigned"}}},"CVE-2011-0414":{"description":"ISC BIND 9.7.1 through 9.7.2-P3, when configured as an authoritative server, allows remote attackers to cause a denial of service (deadlock and daemon hang) by sending a query at the time of (1) an IXFR transfer or (2) a DDNS update.","debianbug":601830,"scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"1:9.18.41-1~deb12u1","bookworm-security":"1:9.18.44-1~deb12u1"},"fixed_version":"1:9.7.3.dfsg-1","urgency":"not yet assigned"},"bullseye":{"status":"resolved","repositories":{"bullseye":"1:9.16.50-1~deb11u2","bullseye-security":"1:9.16.50-1~deb11u4"},"fixed_version":"1:9.7.3.dfsg-1","urgency":"not yet assigned"},"forky":{"status":"resolved","repositories":{"forky":"1:9.20.20-1"},"fixed_version":"1:9.7.3.dfsg-1","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"1:9.20.20-1"},"fixed_version":"1:9.7.3.dfsg-1","urgency":"not yet assigned"},"trixie":{"status":"resolved","repositories":{"trixie":"1:9.20.15-1~deb13u1","trixie-security":"1:9.20.18-1~deb13u1"},"fixed_version":"1:9.7.3.dfsg-1","urgency":"not yet assigned"}}},"CVE-2011-1907":{"description":"ISC BIND 9.8.x before 9.8.0-P1, when Response Policy Zones (RPZ) RRset replacement is enabled, allows remote attackers to cause a denial of service (assertion failure and daemon exit) via an RRSIG query.","scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"1:9.18.41-1~deb12u1","bookworm-security":"1:9.18.44-1~deb12u1"},"fixed_version":"1:9.8.1.dfsg.P1-1","urgency":"not yet assigned"},"bullseye":{"status":"resolved","repositories":{"bullseye":"1:9.16.50-1~deb11u2","bullseye-security":"1:9.16.50-1~deb11u4"},"fixed_version":"1:9.8.1.dfsg.P1-1","urgency":"not yet assigned"},"forky":{"status":"resolved","repositories":{"forky":"1:9.20.20-1"},"fixed_version":"1:9.8.1.dfsg.P1-1","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"1:9.20.20-1"},"fixed_version":"1:9.8.1.dfsg.P1-1","urgency":"not yet assigned"},"trixie":{"status":"resolved","repositories":{"trixie":"1:9.20.15-1~deb13u1","trixie-security":"1:9.20.18-1~deb13u1"},"fixed_version":"1:9.8.1.dfsg.P1-1","urgency":"not yet assigned"}}},"CVE-2011-1910":{"description":"Off-by-one error in named in ISC BIND 9.x before 9.7.3-P1, 9.8.x before 9.8.0-P2, 9.4-ESV before 9.4-ESV-R4-P1, and 9.6-ESV before 9.6-ESV-R4-P1 allows remote DNS servers to cause a denial of service (assertion failure and daemon exit) via a negative response containing large RRSIG RRsets.","scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"1:9.18.41-1~deb12u1","bookworm-security":"1:9.18.44-1~deb12u1"},"fixed_version":"1:9.8.1.dfsg-1","urgency":"high"},"bullseye":{"status":"resolved","repositories":{"bullseye":"1:9.16.50-1~deb11u2","bullseye-security":"1:9.16.50-1~deb11u4"},"fixed_version":"1:9.8.1.dfsg-1","urgency":"high"},"forky":{"status":"resolved","repositories":{"forky":"1:9.20.20-1"},"fixed_version":"1:9.8.1.dfsg-1","urgency":"high"},"sid":{"status":"resolved","repositories":{"sid":"1:9.20.20-1"},"fixed_version":"1:9.8.1.dfsg-1","urgency":"high"},"trixie":{"status":"resolved","repositories":{"trixie":"1:9.20.15-1~deb13u1","trixie-security":"1:9.20.18-1~deb13u1"},"fixed_version":"1:9.8.1.dfsg-1","urgency":"high"}}},"CVE-2011-2464":{"description":"Unspecified vulnerability in ISC BIND 9 9.6.x before 9.6-ESV-R4-P3, 9.7.x before 9.7.3-P3, and 9.8.x before 9.8.0-P4 allows remote attackers to cause a denial of service (named daemon crash) via a crafted UPDATE request.","scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"1:9.18.41-1~deb12u1","bookworm-security":"1:9.18.44-1~deb12u1"},"fixed_version":"1:9.8.1.dfsg-1","urgency":"high"},"bullseye":{"status":"resolved","repositories":{"bullseye":"1:9.16.50-1~deb11u2","bullseye-security":"1:9.16.50-1~deb11u4"},"fixed_version":"1:9.8.1.dfsg-1","urgency":"high"},"forky":{"status":"resolved","repositories":{"forky":"1:9.20.20-1"},"fixed_version":"1:9.8.1.dfsg-1","urgency":"high"},"sid":{"status":"resolved","repositories":{"sid":"1:9.20.20-1"},"fixed_version":"1:9.8.1.dfsg-1","urgency":"high"},"trixie":{"status":"resolved","repositories":{"trixie":"1:9.20.15-1~deb13u1","trixie-security":"1:9.20.18-1~deb13u1"},"fixed_version":"1:9.8.1.dfsg-1","urgency":"high"}}},"CVE-2011-2465":{"description":"Unspecified vulnerability in ISC BIND 9 9.8.0, 9.8.0-P1, 9.8.0-P2, and 9.8.1b1, when recursion is enabled and the Response Policy Zone (RPZ) contains DNAME or certain CNAME records, allows remote attackers to cause a denial of service (named daemon crash) via an unspecified query.","scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"1:9.18.41-1~deb12u1","bookworm-security":"1:9.18.44-1~deb12u1"},"fixed_version":"1:9.8.1.dfsg.P1-1","urgency":"not yet assigned"},"bullseye":{"status":"resolved","repositories":{"bullseye":"1:9.16.50-1~deb11u2","bullseye-security":"1:9.16.50-1~deb11u4"},"fixed_version":"1:9.8.1.dfsg.P1-1","urgency":"not yet assigned"},"forky":{"status":"resolved","repositories":{"forky":"1:9.20.20-1"},"fixed_version":"1:9.8.1.dfsg.P1-1","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"1:9.20.20-1"},"fixed_version":"1:9.8.1.dfsg.P1-1","urgency":"not yet assigned"},"trixie":{"status":"resolved","repositories":{"trixie":"1:9.20.15-1~deb13u1","trixie-security":"1:9.20.18-1~deb13u1"},"fixed_version":"1:9.8.1.dfsg.P1-1","urgency":"not yet assigned"}}},"CVE-2011-4313":{"description":"query.c in ISC BIND 9.0.x through 9.6.x, 9.4-ESV through 9.4-ESV-R5, 9.6-ESV through 9.6-ESV-R5, 9.7.0 through 9.7.4, 9.8.0 through 9.8.1, and 9.9.0a1 through 9.9.0b1 allows remote attackers to cause a denial of service (assertion failure and named exit) via unknown vectors related to recursive DNS queries, error logging, and the caching of an invalid record by the resolver.","debianbug":649099,"scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"1:9.18.41-1~deb12u1","bookworm-security":"1:9.18.44-1~deb12u1"},"fixed_version":"1:9.8.1.dfsg.P1-1","urgency":"high"},"bullseye":{"status":"resolved","repositories":{"bullseye":"1:9.16.50-1~deb11u2","bullseye-security":"1:9.16.50-1~deb11u4"},"fixed_version":"1:9.8.1.dfsg.P1-1","urgency":"high"},"forky":{"status":"resolved","repositories":{"forky":"1:9.20.20-1"},"fixed_version":"1:9.8.1.dfsg.P1-1","urgency":"high"},"sid":{"status":"resolved","repositories":{"sid":"1:9.20.20-1"},"fixed_version":"1:9.8.1.dfsg.P1-1","urgency":"high"},"trixie":{"status":"resolved","repositories":{"trixie":"1:9.20.15-1~deb13u1","trixie-security":"1:9.20.18-1~deb13u1"},"fixed_version":"1:9.8.1.dfsg.P1-1","urgency":"high"}}},"CVE-2012-1033":{"description":"The resolver in ISC BIND 9 through 9.8.1-P1 overwrites cached server names and TTL values in NS records during the processing of a response to an A record query, which allows remote attackers to trigger continued resolvability of revoked domain names via a \"ghost domain names\" attack.","scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"1:9.18.41-1~deb12u1","bookworm-security":"1:9.18.44-1~deb12u1"},"fixed_version":"1:9.8.1.dfsg.P1-4.1","urgency":"low"},"bullseye":{"status":"resolved","repositories":{"bullseye":"1:9.16.50-1~deb11u2","bullseye-security":"1:9.16.50-1~deb11u4"},"fixed_version":"1:9.8.1.dfsg.P1-4.1","urgency":"low"},"forky":{"status":"resolved","repositories":{"forky":"1:9.20.20-1"},"fixed_version":"1:9.8.1.dfsg.P1-4.1","urgency":"low"},"sid":{"status":"resolved","repositories":{"sid":"1:9.20.20-1"},"fixed_version":"1:9.8.1.dfsg.P1-4.1","urgency":"low"},"trixie":{"status":"resolved","repositories":{"trixie":"1:9.20.15-1~deb13u1","trixie-security":"1:9.20.18-1~deb13u1"},"fixed_version":"1:9.8.1.dfsg.P1-4.1","urgency":"low"}}},"CVE-2012-1667":{"description":"ISC BIND 9.x before 9.7.6-P1, 9.8.x before 9.8.3-P1, 9.9.x before 9.9.1-P1, and 9.4-ESV and 9.6-ESV before 9.6-ESV-R7-P1 does not properly handle resource records with a zero-length RDATA section, which allows remote DNS servers to cause a denial of service (daemon crash or data corruption) or obtain sensitive information from process memory via a crafted record.","scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"1:9.18.41-1~deb12u1","bookworm-security":"1:9.18.44-1~deb12u1"},"fixed_version":"1:9.8.1.dfsg.P1-4.1","urgency":"not yet assigned"},"bullseye":{"status":"resolved","repositories":{"bullseye":"1:9.16.50-1~deb11u2","bullseye-security":"1:9.16.50-1~deb11u4"},"fixed_version":"1:9.8.1.dfsg.P1-4.1","urgency":"not yet assigned"},"forky":{"status":"resolved","repositories":{"forky":"1:9.20.20-1"},"fixed_version":"1:9.8.1.dfsg.P1-4.1","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"1:9.20.20-1"},"fixed_version":"1:9.8.1.dfsg.P1-4.1","urgency":"not yet assigned"},"trixie":{"status":"resolved","repositories":{"trixie":"1:9.20.15-1~deb13u1","trixie-security":"1:9.20.18-1~deb13u1"},"fixed_version":"1:9.8.1.dfsg.P1-4.1","urgency":"not yet assigned"}}},"CVE-2012-3817":{"description":"ISC BIND 9.4.x, 9.5.x, 9.6.x, and 9.7.x before 9.7.6-P2; 9.8.x before 9.8.3-P2; 9.9.x before 9.9.1-P2; and 9.6-ESV before 9.6-ESV-R7-P2, when DNSSEC validation is enabled, does not properly initialize the failing-query cache, which allows remote attackers to cause a denial of service (assertion failure and daemon exit) by sending many queries.","debianbug":683259,"scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"1:9.18.41-1~deb12u1","bookworm-security":"1:9.18.44-1~deb12u1"},"fixed_version":"1:9.8.1.dfsg.P1-4.2","urgency":"not yet assigned"},"bullseye":{"status":"resolved","repositories":{"bullseye":"1:9.16.50-1~deb11u2","bullseye-security":"1:9.16.50-1~deb11u4"},"fixed_version":"1:9.8.1.dfsg.P1-4.2","urgency":"not yet assigned"},"forky":{"status":"resolved","repositories":{"forky":"1:9.20.20-1"},"fixed_version":"1:9.8.1.dfsg.P1-4.2","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"1:9.20.20-1"},"fixed_version":"1:9.8.1.dfsg.P1-4.2","urgency":"not yet assigned"},"trixie":{"status":"resolved","repositories":{"trixie":"1:9.20.15-1~deb13u1","trixie-security":"1:9.20.18-1~deb13u1"},"fixed_version":"1:9.8.1.dfsg.P1-4.2","urgency":"not yet assigned"}}},"CVE-2012-3868":{"description":"Race condition in the ns_client structure management in ISC BIND 9.9.x before 9.9.1-P2 allows remote attackers to cause a denial of service (memory consumption or process exit) via a large volume of TCP queries.","scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"1:9.18.41-1~deb12u1","bookworm-security":"1:9.18.44-1~deb12u1"},"fixed_version":"0","urgency":"unimportant"},"bullseye":{"status":"resolved","repositories":{"bullseye":"1:9.16.50-1~deb11u2","bullseye-security":"1:9.16.50-1~deb11u4"},"fixed_version":"0","urgency":"unimportant"},"forky":{"status":"resolved","repositories":{"forky":"1:9.20.20-1"},"fixed_version":"0","urgency":"unimportant"},"sid":{"status":"resolved","repositories":{"sid":"1:9.20.20-1"},"fixed_version":"0","urgency":"unimportant"},"trixie":{"status":"resolved","repositories":{"trixie":"1:9.20.15-1~deb13u1","trixie-security":"1:9.20.18-1~deb13u1"},"fixed_version":"0","urgency":"unimportant"}}},"CVE-2012-4244":{"description":"ISC BIND 9.x before 9.7.6-P3, 9.8.x before 9.8.3-P3, 9.9.x before 9.9.1-P3, and 9.4-ESV and 9.6-ESV before 9.6-ESV-R7-P3 allows remote attackers to cause a denial of service (assertion failure and named daemon exit) via a query for a long resource record.","debianbug":693015,"scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"1:9.18.41-1~deb12u1","bookworm-security":"1:9.18.44-1~deb12u1"},"fixed_version":"1:9.8.4.dfsg-1","urgency":"not yet assigned"},"bullseye":{"status":"resolved","repositories":{"bullseye":"1:9.16.50-1~deb11u2","bullseye-security":"1:9.16.50-1~deb11u4"},"fixed_version":"1:9.8.4.dfsg-1","urgency":"not yet assigned"},"forky":{"status":"resolved","repositories":{"forky":"1:9.20.20-1"},"fixed_version":"1:9.8.4.dfsg-1","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"1:9.20.20-1"},"fixed_version":"1:9.8.4.dfsg-1","urgency":"not yet assigned"},"trixie":{"status":"resolved","repositories":{"trixie":"1:9.20.15-1~deb13u1","trixie-security":"1:9.20.18-1~deb13u1"},"fixed_version":"1:9.8.4.dfsg-1","urgency":"not yet assigned"}}},"CVE-2012-5166":{"description":"ISC BIND 9.x before 9.7.6-P4, 9.8.x before 9.8.3-P4, 9.9.x before 9.9.1-P4, and 9.4-ESV and 9.6-ESV before 9.6-ESV-R7-P4 allows remote attackers to cause a denial of service (named daemon hang) via unspecified combinations of resource records.","debianbug":690118,"scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"1:9.18.41-1~deb12u1","bookworm-security":"1:9.18.44-1~deb12u1"},"fixed_version":"1:9.8.1.dfsg.P1-4.3","urgency":"not yet assigned"},"bullseye":{"status":"resolved","repositories":{"bullseye":"1:9.16.50-1~deb11u2","bullseye-security":"1:9.16.50-1~deb11u4"},"fixed_version":"1:9.8.1.dfsg.P1-4.3","urgency":"not yet assigned"},"forky":{"status":"resolved","repositories":{"forky":"1:9.20.20-1"},"fixed_version":"1:9.8.1.dfsg.P1-4.3","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"1:9.20.20-1"},"fixed_version":"1:9.8.1.dfsg.P1-4.3","urgency":"not yet assigned"},"trixie":{"status":"resolved","repositories":{"trixie":"1:9.20.15-1~deb13u1","trixie-security":"1:9.20.18-1~deb13u1"},"fixed_version":"1:9.8.1.dfsg.P1-4.3","urgency":"not yet assigned"}}},"CVE-2012-5688":{"description":"ISC BIND 9.8.x before 9.8.4-P1 and 9.9.x before 9.9.2-P1, when DNS64 is enabled, allows remote attackers to cause a denial of service (assertion failure and daemon exit) via a crafted query.","debianbug":695192,"scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"1:9.18.41-1~deb12u1","bookworm-security":"1:9.18.44-1~deb12u1"},"fixed_version":"1:9.8.4.dfsg.P1-1","urgency":"not yet assigned"},"bullseye":{"status":"resolved","repositories":{"bullseye":"1:9.16.50-1~deb11u2","bullseye-security":"1:9.16.50-1~deb11u4"},"fixed_version":"1:9.8.4.dfsg.P1-1","urgency":"not yet assigned"},"forky":{"status":"resolved","repositories":{"forky":"1:9.20.20-1"},"fixed_version":"1:9.8.4.dfsg.P1-1","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"1:9.20.20-1"},"fixed_version":"1:9.8.4.dfsg.P1-1","urgency":"not yet assigned"},"trixie":{"status":"resolved","repositories":{"trixie":"1:9.20.15-1~deb13u1","trixie-security":"1:9.20.18-1~deb13u1"},"fixed_version":"1:9.8.4.dfsg.P1-1","urgency":"not yet assigned"}}},"CVE-2012-5689":{"description":"ISC BIND 9.8.x through 9.8.4-P1 and 9.9.x through 9.9.2-P1, in certain configurations involving DNS64 with a Response Policy Zone that lacks an AAAA rewrite rule, allows remote attackers to cause a denial of service (assertion failure and named daemon exit) via a query for an AAAA record.","debianbug":699145,"scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"1:9.18.41-1~deb12u1","bookworm-security":"1:9.18.44-1~deb12u1"},"fixed_version":"1:9.8.4.dfsg.P1-6+nmu1","urgency":"not yet assigned"},"bullseye":{"status":"resolved","repositories":{"bullseye":"1:9.16.50-1~deb11u2","bullseye-security":"1:9.16.50-1~deb11u4"},"fixed_version":"1:9.8.4.dfsg.P1-6+nmu1","urgency":"not yet assigned"},"forky":{"status":"resolved","repositories":{"forky":"1:9.20.20-1"},"fixed_version":"1:9.8.4.dfsg.P1-6+nmu1","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"1:9.20.20-1"},"fixed_version":"1:9.8.4.dfsg.P1-6+nmu1","urgency":"not yet assigned"},"trixie":{"status":"resolved","repositories":{"trixie":"1:9.20.15-1~deb13u1","trixie-security":"1:9.20.18-1~deb13u1"},"fixed_version":"1:9.8.4.dfsg.P1-6+nmu1","urgency":"not yet assigned"}}},"CVE-2013-2266":{"description":"libdns in ISC BIND 9.7.x and 9.8.x before 9.8.4-P2, 9.8.5 before 9.8.5b2, 9.9.x before 9.9.2-P2, and 9.9.3 before 9.9.3b2 on UNIX platforms allows remote attackers to cause a denial of service (memory consumption) via a crafted regular expression, as demonstrated by a memory-exhaustion attack against a machine running a named process.","debianbug":704174,"scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"1:9.18.41-1~deb12u1","bookworm-security":"1:9.18.44-1~deb12u1"},"fixed_version":"1:9.8.4.dfsg.P1-6+nmu1","urgency":"not yet assigned"},"bullseye":{"status":"resolved","repositories":{"bullseye":"1:9.16.50-1~deb11u2","bullseye-security":"1:9.16.50-1~deb11u4"},"fixed_version":"1:9.8.4.dfsg.P1-6+nmu1","urgency":"not yet assigned"},"forky":{"status":"resolved","repositories":{"forky":"1:9.20.20-1"},"fixed_version":"1:9.8.4.dfsg.P1-6+nmu1","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"1:9.20.20-1"},"fixed_version":"1:9.8.4.dfsg.P1-6+nmu1","urgency":"not yet assigned"},"trixie":{"status":"resolved","repositories":{"trixie":"1:9.20.15-1~deb13u1","trixie-security":"1:9.20.18-1~deb13u1"},"fixed_version":"1:9.8.4.dfsg.P1-6+nmu1","urgency":"not yet assigned"}}},"CVE-2013-3919":{"description":"resolver.c in ISC BIND 9.8.5 before 9.8.5-P1, 9.9.3 before 9.9.3-P1, and 9.6-ESV-R9 before 9.6-ESV-R9-P1, when a recursive resolver is configured, allows remote attackers to cause a denial of service (assertion failure and named daemon exit) via a query for a record in a malformed zone.","scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"1:9.18.41-1~deb12u1","bookworm-security":"1:9.18.44-1~deb12u1"},"fixed_version":"0","urgency":"unimportant"},"bullseye":{"status":"resolved","repositories":{"bullseye":"1:9.16.50-1~deb11u2","bullseye-security":"1:9.16.50-1~deb11u4"},"fixed_version":"0","urgency":"unimportant"},"forky":{"status":"resolved","repositories":{"forky":"1:9.20.20-1"},"fixed_version":"0","urgency":"unimportant"},"sid":{"status":"resolved","repositories":{"sid":"1:9.20.20-1"},"fixed_version":"0","urgency":"unimportant"},"trixie":{"status":"resolved","repositories":{"trixie":"1:9.20.15-1~deb13u1","trixie-security":"1:9.20.18-1~deb13u1"},"fixed_version":"0","urgency":"unimportant"}}},"CVE-2013-4854":{"description":"The RFC 5011 implementation in rdata.c in ISC BIND 9.7.x and 9.8.x before 9.8.5-P2, 9.8.6b1, 9.9.x before 9.9.3-P2, and 9.9.4b1, and DNSco BIND 9.9.3-S1 before 9.9.3-S1-P1 and 9.9.4-S1b1, allows remote attackers to cause a denial of service (assertion failure and named daemon exit) via a query with a malformed RDATA section that is not properly handled during construction of a log message, as exploited in the wild in July 2013.","debianbug":717936,"scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"1:9.18.41-1~deb12u1","bookworm-security":"1:9.18.44-1~deb12u1"},"fixed_version":"1:9.8.4.dfsg.P1-6+nmu3","urgency":"not yet assigned"},"bullseye":{"status":"resolved","repositories":{"bullseye":"1:9.16.50-1~deb11u2","bullseye-security":"1:9.16.50-1~deb11u4"},"fixed_version":"1:9.8.4.dfsg.P1-6+nmu3","urgency":"not yet assigned"},"forky":{"status":"resolved","repositories":{"forky":"1:9.20.20-1"},"fixed_version":"1:9.8.4.dfsg.P1-6+nmu3","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"1:9.20.20-1"},"fixed_version":"1:9.8.4.dfsg.P1-6+nmu3","urgency":"not yet assigned"},"trixie":{"status":"resolved","repositories":{"trixie":"1:9.20.15-1~deb13u1","trixie-security":"1:9.20.18-1~deb13u1"},"fixed_version":"1:9.8.4.dfsg.P1-6+nmu3","urgency":"not yet assigned"}}},"CVE-2013-6230":{"description":"The Winsock WSAIoctl API in Microsoft Windows Server 2008, as used in ISC BIND 9.6-ESV before 9.6-ESV-R10-P1, 9.8 before 9.8.6-P1, 9.9 before 9.9.4-P1, 9.9.3-S1, 9.9.4-S1, and other products, does not properly support the SIO_GET_INTERFACE_LIST command for netmask 255.255.255.255, which allows remote attackers to bypass intended IP address restrictions by leveraging misinterpretation of this netmask as a 0.0.0.0 netmask.","scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"1:9.18.41-1~deb12u1","bookworm-security":"1:9.18.44-1~deb12u1"},"fixed_version":"0","urgency":"unimportant"},"bullseye":{"status":"resolved","repositories":{"bullseye":"1:9.16.50-1~deb11u2","bullseye-security":"1:9.16.50-1~deb11u4"},"fixed_version":"0","urgency":"unimportant"},"forky":{"status":"resolved","repositories":{"forky":"1:9.20.20-1"},"fixed_version":"0","urgency":"unimportant"},"sid":{"status":"resolved","repositories":{"sid":"1:9.20.20-1"},"fixed_version":"0","urgency":"unimportant"},"trixie":{"status":"resolved","repositories":{"trixie":"1:9.20.15-1~deb13u1","trixie-security":"1:9.20.18-1~deb13u1"},"fixed_version":"0","urgency":"unimportant"}}},"CVE-2014-0591":{"description":"The query_findclosestnsec3 function in query.c in named in ISC BIND 9.6, 9.7, and 9.8 before 9.8.6-P2 and 9.9 before 9.9.4-P2, and 9.6-ESV before 9.6-ESV-R10-P2, allows remote attackers to cause a denial of service (INSIST assertion failure and daemon exit) via a crafted DNS query to an authoritative nameserver that uses the NSEC3 signing feature.","debianbug":735190,"scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"1:9.18.41-1~deb12u1","bookworm-security":"1:9.18.44-1~deb12u1"},"fixed_version":"1:9.9.5.dfsg-2","urgency":"not yet assigned"},"bullseye":{"status":"resolved","repositories":{"bullseye":"1:9.16.50-1~deb11u2","bullseye-security":"1:9.16.50-1~deb11u4"},"fixed_version":"1:9.9.5.dfsg-2","urgency":"not yet assigned"},"forky":{"status":"resolved","repositories":{"forky":"1:9.20.20-1"},"fixed_version":"1:9.9.5.dfsg-2","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"1:9.20.20-1"},"fixed_version":"1:9.9.5.dfsg-2","urgency":"not yet assigned"},"trixie":{"status":"resolved","repositories":{"trixie":"1:9.20.15-1~deb13u1","trixie-security":"1:9.20.18-1~deb13u1"},"fixed_version":"1:9.9.5.dfsg-2","urgency":"not yet assigned"}}},"CVE-2014-3214":{"description":"The prefetch implementation in named in ISC BIND 9.10.0, when a recursive nameserver is enabled, allows remote attackers to cause a denial of service (REQUIRE assertion failure and daemon exit) via a DNS query that triggers a response with unspecified attributes.","scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"1:9.18.41-1~deb12u1","bookworm-security":"1:9.18.44-1~deb12u1"},"fixed_version":"0","urgency":"unimportant"},"bullseye":{"status":"resolved","repositories":{"bullseye":"1:9.16.50-1~deb11u2","bullseye-security":"1:9.16.50-1~deb11u4"},"fixed_version":"0","urgency":"unimportant"},"forky":{"status":"resolved","repositories":{"forky":"1:9.20.20-1"},"fixed_version":"0","urgency":"unimportant"},"sid":{"status":"resolved","repositories":{"sid":"1:9.20.20-1"},"fixed_version":"0","urgency":"unimportant"},"trixie":{"status":"resolved","repositories":{"trixie":"1:9.20.15-1~deb13u1","trixie-security":"1:9.20.18-1~deb13u1"},"fixed_version":"0","urgency":"unimportant"}}},"CVE-2014-3859":{"description":"libdns in ISC BIND 9.10.0 before P2 does not properly handle EDNS options, which allows remote attackers to cause a denial of service (REQUIRE assertion failure and daemon exit) via a crafted packet, as demonstrated by an attack against named, dig, or delv.","scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"1:9.18.41-1~deb12u1","bookworm-security":"1:9.18.44-1~deb12u1"},"fixed_version":"0","urgency":"unimportant"},"bullseye":{"status":"resolved","repositories":{"bullseye":"1:9.16.50-1~deb11u2","bullseye-security":"1:9.16.50-1~deb11u4"},"fixed_version":"0","urgency":"unimportant"},"forky":{"status":"resolved","repositories":{"forky":"1:9.20.20-1"},"fixed_version":"0","urgency":"unimportant"},"sid":{"status":"resolved","repositories":{"sid":"1:9.20.20-1"},"fixed_version":"0","urgency":"unimportant"},"trixie":{"status":"resolved","repositories":{"trixie":"1:9.20.15-1~deb13u1","trixie-security":"1:9.20.18-1~deb13u1"},"fixed_version":"0","urgency":"unimportant"}}},"CVE-2014-8500":{"description":"ISC BIND 9.0.x through 9.8.x, 9.9.0 through 9.9.6, and 9.10.0 through 9.10.1 does not limit delegation chaining, which allows remote attackers to cause a denial of service (memory consumption and named crash) via a large or infinite number of referrals.","debianbug":772610,"scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"1:9.18.41-1~deb12u1","bookworm-security":"1:9.18.44-1~deb12u1"},"fixed_version":"1:9.9.5.dfsg-7","urgency":"not yet assigned"},"bullseye":{"status":"resolved","repositories":{"bullseye":"1:9.16.50-1~deb11u2","bullseye-security":"1:9.16.50-1~deb11u4"},"fixed_version":"1:9.9.5.dfsg-7","urgency":"not yet assigned"},"forky":{"status":"resolved","repositories":{"forky":"1:9.20.20-1"},"fixed_version":"1:9.9.5.dfsg-7","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"1:9.20.20-1"},"fixed_version":"1:9.9.5.dfsg-7","urgency":"not yet assigned"},"trixie":{"status":"resolved","repositories":{"trixie":"1:9.20.15-1~deb13u1","trixie-security":"1:9.20.18-1~deb13u1"},"fixed_version":"1:9.9.5.dfsg-7","urgency":"not yet assigned"}}},"CVE-2014-8680":{"description":"The GeoIP functionality in ISC BIND 9.10.0 through 9.10.1 allows remote attackers to cause a denial of service (assertion failure and named exit) via vectors related to (1) the lack of GeoIP databases for both IPv4 and IPv6, or (2) IPv6 support with certain options.","scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"1:9.18.41-1~deb12u1","bookworm-security":"1:9.18.44-1~deb12u1"},"fixed_version":"0","urgency":"unimportant"},"bullseye":{"status":"resolved","repositories":{"bullseye":"1:9.16.50-1~deb11u2","bullseye-security":"1:9.16.50-1~deb11u4"},"fixed_version":"0","urgency":"unimportant"},"forky":{"status":"resolved","repositories":{"forky":"1:9.20.20-1"},"fixed_version":"0","urgency":"unimportant"},"sid":{"status":"resolved","repositories":{"sid":"1:9.20.20-1"},"fixed_version":"0","urgency":"unimportant"},"trixie":{"status":"resolved","repositories":{"trixie":"1:9.20.15-1~deb13u1","trixie-security":"1:9.20.18-1~deb13u1"},"fixed_version":"0","urgency":"unimportant"}}},"CVE-2015-1349":{"description":"named in ISC BIND 9.7.0 through 9.9.6 before 9.9.6-P2 and 9.10.x before 9.10.1-P2, when DNSSEC validation and the managed-keys feature are enabled, allows remote attackers to cause a denial of service (assertion failure and daemon exit, or daemon crash) by triggering an incorrect trust-anchor management scenario in which no key is ready for use.","debianbug":778733,"scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"1:9.18.41-1~deb12u1","bookworm-security":"1:9.18.44-1~deb12u1"},"fixed_version":"1:9.9.5.dfsg-9","urgency":"low"},"bullseye":{"status":"resolved","repositories":{"bullseye":"1:9.16.50-1~deb11u2","bullseye-security":"1:9.16.50-1~deb11u4"},"fixed_version":"1:9.9.5.dfsg-9","urgency":"low"},"forky":{"status":"resolved","repositories":{"forky":"1:9.20.20-1"},"fixed_version":"1:9.9.5.dfsg-9","urgency":"low"},"sid":{"status":"resolved","repositories":{"sid":"1:9.20.20-1"},"fixed_version":"1:9.9.5.dfsg-9","urgency":"low"},"trixie":{"status":"resolved","repositories":{"trixie":"1:9.20.15-1~deb13u1","trixie-security":"1:9.20.18-1~deb13u1"},"fixed_version":"1:9.9.5.dfsg-9","urgency":"low"}}},"CVE-2015-4620":{"description":"name.c in named in ISC BIND 9.7.x through 9.9.x before 9.9.7-P1 and 9.10.x before 9.10.2-P2, when configured as a recursive resolver with DNSSEC validation, allows remote attackers to cause a denial of service (REQUIRE assertion failure and daemon exit) by constructing crafted zone data and then making a query for a name in that zone.","debianbug":791715,"scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"1:9.18.41-1~deb12u1","bookworm-security":"1:9.18.44-1~deb12u1"},"fixed_version":"1:9.9.5.dfsg-10","urgency":"not yet assigned"},"bullseye":{"status":"resolved","repositories":{"bullseye":"1:9.16.50-1~deb11u2","bullseye-security":"1:9.16.50-1~deb11u4"},"fixed_version":"1:9.9.5.dfsg-10","urgency":"not yet assigned"},"forky":{"status":"resolved","repositories":{"forky":"1:9.20.20-1"},"fixed_version":"1:9.9.5.dfsg-10","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"1:9.20.20-1"},"fixed_version":"1:9.9.5.dfsg-10","urgency":"not yet assigned"},"trixie":{"status":"resolved","repositories":{"trixie":"1:9.20.15-1~deb13u1","trixie-security":"1:9.20.18-1~deb13u1"},"fixed_version":"1:9.9.5.dfsg-10","urgency":"not yet assigned"}}},"CVE-2015-5477":{"description":"named in ISC BIND 9.x before 9.9.7-P2 and 9.10.x before 9.10.2-P3 allows remote attackers to cause a denial of service (REQUIRE assertion failure and daemon exit) via TKEY queries.","debianbug":793903,"scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"1:9.18.41-1~deb12u1","bookworm-security":"1:9.18.44-1~deb12u1"},"fixed_version":"1:9.9.5.dfsg-11","urgency":"not yet assigned"},"bullseye":{"status":"resolved","repositories":{"bullseye":"1:9.16.50-1~deb11u2","bullseye-security":"1:9.16.50-1~deb11u4"},"fixed_version":"1:9.9.5.dfsg-11","urgency":"not yet assigned"},"forky":{"status":"resolved","repositories":{"forky":"1:9.20.20-1"},"fixed_version":"1:9.9.5.dfsg-11","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"1:9.20.20-1"},"fixed_version":"1:9.9.5.dfsg-11","urgency":"not yet assigned"},"trixie":{"status":"resolved","repositories":{"trixie":"1:9.20.15-1~deb13u1","trixie-security":"1:9.20.18-1~deb13u1"},"fixed_version":"1:9.9.5.dfsg-11","urgency":"not yet assigned"}}},"CVE-2015-5722":{"description":"buffer.c in named in ISC BIND 9.x before 9.9.7-P3 and 9.10.x before 9.10.2-P4 allows remote attackers to cause a denial of service (assertion failure and daemon exit) by creating a zone containing a malformed DNSSEC key and issuing a query for a name in that zone.","scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"1:9.18.41-1~deb12u1","bookworm-security":"1:9.18.44-1~deb12u1"},"fixed_version":"1:9.9.5.dfsg-12","urgency":"not yet assigned"},"bullseye":{"status":"resolved","repositories":{"bullseye":"1:9.16.50-1~deb11u2","bullseye-security":"1:9.16.50-1~deb11u4"},"fixed_version":"1:9.9.5.dfsg-12","urgency":"not yet assigned"},"forky":{"status":"resolved","repositories":{"forky":"1:9.20.20-1"},"fixed_version":"1:9.9.5.dfsg-12","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"1:9.20.20-1"},"fixed_version":"1:9.9.5.dfsg-12","urgency":"not yet assigned"},"trixie":{"status":"resolved","repositories":{"trixie":"1:9.20.15-1~deb13u1","trixie-security":"1:9.20.18-1~deb13u1"},"fixed_version":"1:9.9.5.dfsg-12","urgency":"not yet assigned"}}},"CVE-2015-5986":{"description":"openpgpkey_61.c in named in ISC BIND 9.9.7 before 9.9.7-P3 and 9.10.x before 9.10.2-P4 allows remote attackers to cause a denial of service (REQUIRE assertion failure and daemon exit) via a crafted DNS response.","scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"1:9.18.41-1~deb12u1","bookworm-security":"1:9.18.44-1~deb12u1"},"fixed_version":"0","urgency":"unimportant"},"bullseye":{"status":"resolved","repositories":{"bullseye":"1:9.16.50-1~deb11u2","bullseye-security":"1:9.16.50-1~deb11u4"},"fixed_version":"0","urgency":"unimportant"},"forky":{"status":"resolved","repositories":{"forky":"1:9.20.20-1"},"fixed_version":"0","urgency":"unimportant"},"sid":{"status":"resolved","repositories":{"sid":"1:9.20.20-1"},"fixed_version":"0","urgency":"unimportant"},"trixie":{"status":"resolved","repositories":{"trixie":"1:9.20.15-1~deb13u1","trixie-security":"1:9.20.18-1~deb13u1"},"fixed_version":"0","urgency":"unimportant"}}},"CVE-2015-8000":{"description":"db.c in named in ISC BIND 9.x before 9.9.8-P2 and 9.10.x before 9.10.3-P2 allows remote attackers to cause a denial of service (REQUIRE assertion failure and daemon exit) via a malformed class attribute.","debianbug":808081,"scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"1:9.18.41-1~deb12u1","bookworm-security":"1:9.18.44-1~deb12u1"},"fixed_version":"1:9.9.5.dfsg-12.1","urgency":"not yet assigned"},"bullseye":{"status":"resolved","repositories":{"bullseye":"1:9.16.50-1~deb11u2","bullseye-security":"1:9.16.50-1~deb11u4"},"fixed_version":"1:9.9.5.dfsg-12.1","urgency":"not yet assigned"},"forky":{"status":"resolved","repositories":{"forky":"1:9.20.20-1"},"fixed_version":"1:9.9.5.dfsg-12.1","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"1:9.20.20-1"},"fixed_version":"1:9.9.5.dfsg-12.1","urgency":"not yet assigned"},"trixie":{"status":"resolved","repositories":{"trixie":"1:9.20.15-1~deb13u1","trixie-security":"1:9.20.18-1~deb13u1"},"fixed_version":"1:9.9.5.dfsg-12.1","urgency":"not yet assigned"}}},"CVE-2015-8461":{"description":"Race condition in resolver.c in named in ISC BIND 9.9.8 before 9.9.8-P2 and 9.10.3 before 9.10.3-P2 allows remote attackers to cause a denial of service (INSIST assertion failure and daemon exit) via unspecified vectors.","scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"1:9.18.41-1~deb12u1","bookworm-security":"1:9.18.44-1~deb12u1"},"fixed_version":"0","urgency":"unimportant"},"bullseye":{"status":"resolved","repositories":{"bullseye":"1:9.16.50-1~deb11u2","bullseye-security":"1:9.16.50-1~deb11u4"},"fixed_version":"0","urgency":"unimportant"},"forky":{"status":"resolved","repositories":{"forky":"1:9.20.20-1"},"fixed_version":"0","urgency":"unimportant"},"sid":{"status":"resolved","repositories":{"sid":"1:9.20.20-1"},"fixed_version":"0","urgency":"unimportant"},"trixie":{"status":"resolved","repositories":{"trixie":"1:9.20.15-1~deb13u1","trixie-security":"1:9.20.18-1~deb13u1"},"fixed_version":"0","urgency":"unimportant"}}},"CVE-2015-8704":{"description":"apl_42.c in ISC BIND 9.x before 9.9.8-P3, 9.9.x, and 9.10.x before 9.10.3-P3 allows remote authenticated users to cause a denial of service (INSIST assertion failure and daemon exit) via a malformed Address Prefix List (APL) record.","debianbug":812077,"scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"1:9.18.41-1~deb12u1","bookworm-security":"1:9.18.44-1~deb12u1"},"fixed_version":"1:9.10.3.dfsg.P4-6","urgency":"not yet assigned"},"bullseye":{"status":"resolved","repositories":{"bullseye":"1:9.16.50-1~deb11u2","bullseye-security":"1:9.16.50-1~deb11u4"},"fixed_version":"1:9.10.3.dfsg.P4-6","urgency":"not yet assigned"},"forky":{"status":"resolved","repositories":{"forky":"1:9.20.20-1"},"fixed_version":"1:9.10.3.dfsg.P4-6","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"1:9.20.20-1"},"fixed_version":"1:9.10.3.dfsg.P4-6","urgency":"not yet assigned"},"trixie":{"status":"resolved","repositories":{"trixie":"1:9.20.15-1~deb13u1","trixie-security":"1:9.20.18-1~deb13u1"},"fixed_version":"1:9.10.3.dfsg.P4-6","urgency":"not yet assigned"}}},"CVE-2015-8705":{"description":"buffer.c in named in ISC BIND 9.10.x before 9.10.3-P3, when debug logging is enabled, allows remote attackers to cause a denial of service (REQUIRE assertion failure and daemon exit, or daemon crash) or possibly have unspecified other impact via (1) OPT data or (2) an ECS option.","scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"1:9.18.41-1~deb12u1","bookworm-security":"1:9.18.44-1~deb12u1"},"fixed_version":"0","urgency":"unimportant"},"bullseye":{"status":"resolved","repositories":{"bullseye":"1:9.16.50-1~deb11u2","bullseye-security":"1:9.16.50-1~deb11u4"},"fixed_version":"0","urgency":"unimportant"},"forky":{"status":"resolved","repositories":{"forky":"1:9.20.20-1"},"fixed_version":"0","urgency":"unimportant"},"sid":{"status":"resolved","repositories":{"sid":"1:9.20.20-1"},"fixed_version":"0","urgency":"unimportant"},"trixie":{"status":"resolved","repositories":{"trixie":"1:9.20.15-1~deb13u1","trixie-security":"1:9.20.18-1~deb13u1"},"fixed_version":"0","urgency":"unimportant"}}},"CVE-2016-1284":{"description":"rdataset.c in ISC BIND 9 Supported Preview Edition 9.9.8-S before 9.9.8-S5, when nxdomain-redirect is enabled, allows remote attackers to cause a denial of service (REQUIRE assertion failure and daemon exit) via crafted flag values in a query.","scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"1:9.18.41-1~deb12u1","bookworm-security":"1:9.18.44-1~deb12u1"},"fixed_version":"0","urgency":"unimportant"},"bullseye":{"status":"resolved","repositories":{"bullseye":"1:9.16.50-1~deb11u2","bullseye-security":"1:9.16.50-1~deb11u4"},"fixed_version":"0","urgency":"unimportant"},"forky":{"status":"resolved","repositories":{"forky":"1:9.20.20-1"},"fixed_version":"0","urgency":"unimportant"},"sid":{"status":"resolved","repositories":{"sid":"1:9.20.20-1"},"fixed_version":"0","urgency":"unimportant"},"trixie":{"status":"resolved","repositories":{"trixie":"1:9.20.15-1~deb13u1","trixie-security":"1:9.20.18-1~deb13u1"},"fixed_version":"0","urgency":"unimportant"}}},"CVE-2016-1285":{"description":"named in ISC BIND 9.x before 9.9.8-P4 and 9.10.x before 9.10.3-P4 does not properly handle DNAME records when parsing fetch reply messages, which allows remote attackers to cause a denial of service (assertion failure and daemon exit) via a malformed packet to the rndc (aka control channel) interface, related to alist.c and sexpr.c.","scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"1:9.18.41-1~deb12u1","bookworm-security":"1:9.18.44-1~deb12u1"},"fixed_version":"1:9.10.3.dfsg.P4-6","urgency":"not yet assigned"},"bullseye":{"status":"resolved","repositories":{"bullseye":"1:9.16.50-1~deb11u2","bullseye-security":"1:9.16.50-1~deb11u4"},"fixed_version":"1:9.10.3.dfsg.P4-6","urgency":"not yet assigned"},"forky":{"status":"resolved","repositories":{"forky":"1:9.20.20-1"},"fixed_version":"1:9.10.3.dfsg.P4-6","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"1:9.20.20-1"},"fixed_version":"1:9.10.3.dfsg.P4-6","urgency":"not yet assigned"},"trixie":{"status":"resolved","repositories":{"trixie":"1:9.20.15-1~deb13u1","trixie-security":"1:9.20.18-1~deb13u1"},"fixed_version":"1:9.10.3.dfsg.P4-6","urgency":"not yet assigned"}}},"CVE-2016-1286":{"description":"named in ISC BIND 9.x before 9.9.8-P4 and 9.10.x before 9.10.3-P4 allows remote attackers to cause a denial of service (assertion failure and daemon exit) via a crafted signature record for a DNAME record, related to db.c and resolver.c.","scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"1:9.18.41-1~deb12u1","bookworm-security":"1:9.18.44-1~deb12u1"},"fixed_version":"1:9.10.3.dfsg.P4-6","urgency":"not yet assigned"},"bullseye":{"status":"resolved","repositories":{"bullseye":"1:9.16.50-1~deb11u2","bullseye-security":"1:9.16.50-1~deb11u4"},"fixed_version":"1:9.10.3.dfsg.P4-6","urgency":"not yet assigned"},"forky":{"status":"resolved","repositories":{"forky":"1:9.20.20-1"},"fixed_version":"1:9.10.3.dfsg.P4-6","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"1:9.20.20-1"},"fixed_version":"1:9.10.3.dfsg.P4-6","urgency":"not yet assigned"},"trixie":{"status":"resolved","repositories":{"trixie":"1:9.20.15-1~deb13u1","trixie-security":"1:9.20.18-1~deb13u1"},"fixed_version":"1:9.10.3.dfsg.P4-6","urgency":"not yet assigned"}}},"CVE-2016-2088":{"description":"resolver.c in named in ISC BIND 9.10.x before 9.10.3-P4, when DNS cookies are enabled, allows remote attackers to cause a denial of service (INSIST assertion failure and daemon exit) via a malformed packet with more than one cookie option.","scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"1:9.18.41-1~deb12u1","bookworm-security":"1:9.18.44-1~deb12u1"},"fixed_version":"0","urgency":"unimportant"},"bullseye":{"status":"resolved","repositories":{"bullseye":"1:9.16.50-1~deb11u2","bullseye-security":"1:9.16.50-1~deb11u4"},"fixed_version":"0","urgency":"unimportant"},"forky":{"status":"resolved","repositories":{"forky":"1:9.20.20-1"},"fixed_version":"0","urgency":"unimportant"},"sid":{"status":"resolved","repositories":{"sid":"1:9.20.20-1"},"fixed_version":"0","urgency":"unimportant"},"trixie":{"status":"resolved","repositories":{"trixie":"1:9.20.15-1~deb13u1","trixie-security":"1:9.20.18-1~deb13u1"},"fixed_version":"0","urgency":"unimportant"}}},"CVE-2016-2775":{"description":"ISC BIND 9.x before 9.9.9-P2, 9.10.x before 9.10.4-P2, and 9.11.x before 9.11.0b2, when lwresd or the named lwres option is enabled, allows remote attackers to cause a denial of service (daemon crash) via a long request that uses the lightweight resolver protocol.","debianbug":831796,"scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"1:9.18.41-1~deb12u1","bookworm-security":"1:9.18.44-1~deb12u1"},"fixed_version":"1:9.10.3.dfsg.P4-11","urgency":"not yet assigned"},"bullseye":{"status":"resolved","repositories":{"bullseye":"1:9.16.50-1~deb11u2","bullseye-security":"1:9.16.50-1~deb11u4"},"fixed_version":"1:9.10.3.dfsg.P4-11","urgency":"not yet assigned"},"forky":{"status":"resolved","repositories":{"forky":"1:9.20.20-1"},"fixed_version":"1:9.10.3.dfsg.P4-11","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"1:9.20.20-1"},"fixed_version":"1:9.10.3.dfsg.P4-11","urgency":"not yet assigned"},"trixie":{"status":"resolved","repositories":{"trixie":"1:9.20.15-1~deb13u1","trixie-security":"1:9.20.18-1~deb13u1"},"fixed_version":"1:9.10.3.dfsg.P4-11","urgency":"not yet assigned"}}},"CVE-2016-2776":{"description":"buffer.c in named in ISC BIND 9 before 9.9.9-P3, 9.10.x before 9.10.4-P3, and 9.11.x before 9.11.0rc3 does not properly construct responses, which allows remote attackers to cause a denial of service (assertion failure and daemon exit) via a crafted query.","debianbug":839010,"scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"1:9.18.41-1~deb12u1","bookworm-security":"1:9.18.44-1~deb12u1"},"fixed_version":"1:9.10.3.dfsg.P4-11","urgency":"not yet assigned"},"bullseye":{"status":"resolved","repositories":{"bullseye":"1:9.16.50-1~deb11u2","bullseye-security":"1:9.16.50-1~deb11u4"},"fixed_version":"1:9.10.3.dfsg.P4-11","urgency":"not yet assigned"},"forky":{"status":"resolved","repositories":{"forky":"1:9.20.20-1"},"fixed_version":"1:9.10.3.dfsg.P4-11","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"1:9.20.20-1"},"fixed_version":"1:9.10.3.dfsg.P4-11","urgency":"not yet assigned"},"trixie":{"status":"resolved","repositories":{"trixie":"1:9.20.15-1~deb13u1","trixie-security":"1:9.20.18-1~deb13u1"},"fixed_version":"1:9.10.3.dfsg.P4-11","urgency":"not yet assigned"}}},"CVE-2016-2848":{"description":"ISC BIND 9.1.0 through 9.8.4-P2 and 9.9.0 through 9.9.2-P2 allows remote attackers to cause a denial of service (assertion failure and daemon exit) via malformed options data in an OPT resource record.","debianbug":839051,"scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"1:9.18.41-1~deb12u1","bookworm-security":"1:9.18.44-1~deb12u1"},"fixed_version":"1:9.9.3.dfsg.P2-1","urgency":"not yet assigned"},"bullseye":{"status":"resolved","repositories":{"bullseye":"1:9.16.50-1~deb11u2","bullseye-security":"1:9.16.50-1~deb11u4"},"fixed_version":"1:9.9.3.dfsg.P2-1","urgency":"not yet assigned"},"forky":{"status":"resolved","repositories":{"forky":"1:9.20.20-1"},"fixed_version":"1:9.9.3.dfsg.P2-1","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"1:9.20.20-1"},"fixed_version":"1:9.9.3.dfsg.P2-1","urgency":"not yet assigned"},"trixie":{"status":"resolved","repositories":{"trixie":"1:9.20.15-1~deb13u1","trixie-security":"1:9.20.18-1~deb13u1"},"fixed_version":"1:9.9.3.dfsg.P2-1","urgency":"not yet assigned"}}},"CVE-2016-6170":{"description":"ISC BIND through 9.9.9-P1, 9.10.x through 9.10.4-P1, and 9.11.x through 9.11.0b1 allows primary DNS servers to cause a denial of service (secondary DNS server crash) via a large AXFR response, and possibly allows IXFR servers to cause a denial of service (IXFR client crash) via a large IXFR response and allows remote authenticated users to cause a denial of service (primary DNS server crash) via a large UPDATE message.","debianbug":830810,"scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"1:9.18.41-1~deb12u1","bookworm-security":"1:9.18.44-1~deb12u1"},"fixed_version":"1:9.10.6+dfsg-1","urgency":"unimportant"},"bullseye":{"status":"resolved","repositories":{"bullseye":"1:9.16.50-1~deb11u2","bullseye-security":"1:9.16.50-1~deb11u4"},"fixed_version":"1:9.10.6+dfsg-1","urgency":"unimportant"},"forky":{"status":"resolved","repositories":{"forky":"1:9.20.20-1"},"fixed_version":"1:9.10.6+dfsg-1","urgency":"unimportant"},"sid":{"status":"resolved","repositories":{"sid":"1:9.20.20-1"},"fixed_version":"1:9.10.6+dfsg-1","urgency":"unimportant"},"trixie":{"status":"resolved","repositories":{"trixie":"1:9.20.15-1~deb13u1","trixie-security":"1:9.20.18-1~deb13u1"},"fixed_version":"1:9.10.6+dfsg-1","urgency":"unimportant"}}},"CVE-2016-8864":{"description":"named in ISC BIND 9.x before 9.9.9-P4, 9.10.x before 9.10.4-P4, and 9.11.x before 9.11.0-P1 allows remote attackers to cause a denial of service (assertion failure and daemon exit) via a DNAME record in the answer section of a response to a recursive query, related to db.c and resolver.c.","debianbug":842858,"scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"1:9.18.41-1~deb12u1","bookworm-security":"1:9.18.44-1~deb12u1"},"fixed_version":"1:9.10.3.dfsg.P4-11","urgency":"not yet assigned"},"bullseye":{"status":"resolved","repositories":{"bullseye":"1:9.16.50-1~deb11u2","bullseye-security":"1:9.16.50-1~deb11u4"},"fixed_version":"1:9.10.3.dfsg.P4-11","urgency":"not yet assigned"},"forky":{"status":"resolved","repositories":{"forky":"1:9.20.20-1"},"fixed_version":"1:9.10.3.dfsg.P4-11","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"1:9.20.20-1"},"fixed_version":"1:9.10.3.dfsg.P4-11","urgency":"not yet assigned"},"trixie":{"status":"resolved","repositories":{"trixie":"1:9.20.15-1~deb13u1","trixie-security":"1:9.20.18-1~deb13u1"},"fixed_version":"1:9.10.3.dfsg.P4-11","urgency":"not yet assigned"}}},"CVE-2016-9131":{"description":"named in ISC BIND 9.x before 9.9.9-P5, 9.10.x before 9.10.4-P5, and 9.11.x before 9.11.0-P2 allows remote attackers to cause a denial of service (assertion failure and daemon exit) via a malformed response to an RTYPE ANY query.","debianbug":851065,"scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"1:9.18.41-1~deb12u1","bookworm-security":"1:9.18.44-1~deb12u1"},"fixed_version":"1:9.10.3.dfsg.P4-11","urgency":"not yet assigned"},"bullseye":{"status":"resolved","repositories":{"bullseye":"1:9.16.50-1~deb11u2","bullseye-security":"1:9.16.50-1~deb11u4"},"fixed_version":"1:9.10.3.dfsg.P4-11","urgency":"not yet assigned"},"forky":{"status":"resolved","repositories":{"forky":"1:9.20.20-1"},"fixed_version":"1:9.10.3.dfsg.P4-11","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"1:9.20.20-1"},"fixed_version":"1:9.10.3.dfsg.P4-11","urgency":"not yet assigned"},"trixie":{"status":"resolved","repositories":{"trixie":"1:9.20.15-1~deb13u1","trixie-security":"1:9.20.18-1~deb13u1"},"fixed_version":"1:9.10.3.dfsg.P4-11","urgency":"not yet assigned"}}},"CVE-2016-9147":{"description":"named in ISC BIND 9.9.9-P4, 9.9.9-S6, 9.10.4-P4, and 9.11.0-P1 allows remote attackers to cause a denial of service (assertion failure and daemon exit) via a response containing an inconsistency among the DNSSEC-related RRsets.","debianbug":851063,"scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"1:9.18.41-1~deb12u1","bookworm-security":"1:9.18.44-1~deb12u1"},"fixed_version":"1:9.10.3.dfsg.P4-11","urgency":"not yet assigned"},"bullseye":{"status":"resolved","repositories":{"bullseye":"1:9.16.50-1~deb11u2","bullseye-security":"1:9.16.50-1~deb11u4"},"fixed_version":"1:9.10.3.dfsg.P4-11","urgency":"not yet assigned"},"forky":{"status":"resolved","repositories":{"forky":"1:9.20.20-1"},"fixed_version":"1:9.10.3.dfsg.P4-11","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"1:9.20.20-1"},"fixed_version":"1:9.10.3.dfsg.P4-11","urgency":"not yet assigned"},"trixie":{"status":"resolved","repositories":{"trixie":"1:9.20.15-1~deb13u1","trixie-security":"1:9.20.18-1~deb13u1"},"fixed_version":"1:9.10.3.dfsg.P4-11","urgency":"not yet assigned"}}},"CVE-2016-9444":{"description":"named in ISC BIND 9.x before 9.9.9-P5, 9.10.x before 9.10.4-P5, and 9.11.x before 9.11.0-P2 allows remote attackers to cause a denial of service (assertion failure and daemon exit) via a crafted DS resource record in an answer.","debianbug":851062,"scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"1:9.18.41-1~deb12u1","bookworm-security":"1:9.18.44-1~deb12u1"},"fixed_version":"1:9.10.3.dfsg.P4-11","urgency":"not yet assigned"},"bullseye":{"status":"resolved","repositories":{"bullseye":"1:9.16.50-1~deb11u2","bullseye-security":"1:9.16.50-1~deb11u4"},"fixed_version":"1:9.10.3.dfsg.P4-11","urgency":"not yet assigned"},"forky":{"status":"resolved","repositories":{"forky":"1:9.20.20-1"},"fixed_version":"1:9.10.3.dfsg.P4-11","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"1:9.20.20-1"},"fixed_version":"1:9.10.3.dfsg.P4-11","urgency":"not yet assigned"},"trixie":{"status":"resolved","repositories":{"trixie":"1:9.20.15-1~deb13u1","trixie-security":"1:9.20.18-1~deb13u1"},"fixed_version":"1:9.10.3.dfsg.P4-11","urgency":"not yet assigned"}}},"CVE-2016-9778":{"description":"An error in handling certain queries can cause an assertion failure when a server is using the nxdomain-redirect feature to cover a zone for which it is also providing authoritative service. A vulnerable server could be intentionally stopped by an attacker if it was using a configuration that met the criteria for the vulnerability and if the attacker could cause it to accept a query that possessed the required attributes. Please note: This vulnerability affects the \"nxdomain-redirect\" feature, which is one of two methods of handling NXDOMAIN redirection, and is only available in certain versions of BIND. Redirection using zones of type \"redirect\" is not affected by this vulnerability. Affects BIND 9.9.8-S1 -> 9.9.8-S3, 9.9.9-S1 -> 9.9.9-S6, 9.11.0-9.11.0-P1.","scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"1:9.18.41-1~deb12u1","bookworm-security":"1:9.18.44-1~deb12u1"},"fixed_version":"0","urgency":"unimportant"},"bullseye":{"status":"resolved","repositories":{"bullseye":"1:9.16.50-1~deb11u2","bullseye-security":"1:9.16.50-1~deb11u4"},"fixed_version":"0","urgency":"unimportant"},"forky":{"status":"resolved","repositories":{"forky":"1:9.20.20-1"},"fixed_version":"0","urgency":"unimportant"},"sid":{"status":"resolved","repositories":{"sid":"1:9.20.20-1"},"fixed_version":"0","urgency":"unimportant"},"trixie":{"status":"resolved","repositories":{"trixie":"1:9.20.15-1~deb13u1","trixie-security":"1:9.20.18-1~deb13u1"},"fixed_version":"0","urgency":"unimportant"}}},"CVE-2017-3135":{"description":"Under some conditions when using both DNS64 and RPZ to rewrite query responses, query processing can resume in an inconsistent state leading to either an INSIST assertion failure or an attempt to read through a NULL pointer. Affects BIND 9.8.8, 9.9.3-S1 -> 9.9.9-S7, 9.9.3 -> 9.9.9-P5, 9.9.10b1, 9.10.0 -> 9.10.4-P5, 9.10.5b1, 9.11.0 -> 9.11.0-P2, 9.11.1b1.","debianbug":855520,"scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"1:9.18.41-1~deb12u1","bookworm-security":"1:9.18.44-1~deb12u1"},"fixed_version":"1:9.10.3.dfsg.P4-12","urgency":"not yet assigned"},"bullseye":{"status":"resolved","repositories":{"bullseye":"1:9.16.50-1~deb11u2","bullseye-security":"1:9.16.50-1~deb11u4"},"fixed_version":"1:9.10.3.dfsg.P4-12","urgency":"not yet assigned"},"forky":{"status":"resolved","repositories":{"forky":"1:9.20.20-1"},"fixed_version":"1:9.10.3.dfsg.P4-12","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"1:9.20.20-1"},"fixed_version":"1:9.10.3.dfsg.P4-12","urgency":"not yet assigned"},"trixie":{"status":"resolved","repositories":{"trixie":"1:9.20.15-1~deb13u1","trixie-security":"1:9.20.18-1~deb13u1"},"fixed_version":"1:9.10.3.dfsg.P4-12","urgency":"not yet assigned"}}},"CVE-2017-3136":{"description":"A query with a specific set of characteristics could cause a server using DNS64 to encounter an assertion failure and terminate. An attacker could deliberately construct a query, enabling denial-of-service against a server if it was configured to use the DNS64 feature and other preconditions were met. Affects BIND 9.8.0 -> 9.8.8-P1, 9.9.0 -> 9.9.9-P6, 9.9.10b1->9.9.10rc1, 9.10.0 -> 9.10.4-P6, 9.10.5b1->9.10.5rc1, 9.11.0 -> 9.11.0-P3, 9.11.1b1->9.11.1rc1, 9.9.3-S1 -> 9.9.9-S8.","debianbug":860224,"scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"1:9.18.41-1~deb12u1","bookworm-security":"1:9.18.44-1~deb12u1"},"fixed_version":"1:9.10.3.dfsg.P4-12.3","urgency":"not yet assigned"},"bullseye":{"status":"resolved","repositories":{"bullseye":"1:9.16.50-1~deb11u2","bullseye-security":"1:9.16.50-1~deb11u4"},"fixed_version":"1:9.10.3.dfsg.P4-12.3","urgency":"not yet assigned"},"forky":{"status":"resolved","repositories":{"forky":"1:9.20.20-1"},"fixed_version":"1:9.10.3.dfsg.P4-12.3","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"1:9.20.20-1"},"fixed_version":"1:9.10.3.dfsg.P4-12.3","urgency":"not yet assigned"},"trixie":{"status":"resolved","repositories":{"trixie":"1:9.20.15-1~deb13u1","trixie-security":"1:9.20.18-1~deb13u1"},"fixed_version":"1:9.10.3.dfsg.P4-12.3","urgency":"not yet assigned"}}},"CVE-2017-3137":{"description":"Mistaken assumptions about the ordering of records in the answer section of a response containing CNAME or DNAME resource records could lead to a situation in which named would exit with an assertion failure when processing a response in which records occurred in an unusual order. Affects BIND 9.9.9-P6, 9.9.10b1->9.9.10rc1, 9.10.4-P6, 9.10.5b1->9.10.5rc1, 9.11.0-P3, 9.11.1b1->9.11.1rc1, and 9.9.9-S8.","debianbug":860225,"scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"1:9.18.41-1~deb12u1","bookworm-security":"1:9.18.44-1~deb12u1"},"fixed_version":"1:9.10.3.dfsg.P4-12.3","urgency":"not yet assigned"},"bullseye":{"status":"resolved","repositories":{"bullseye":"1:9.16.50-1~deb11u2","bullseye-security":"1:9.16.50-1~deb11u4"},"fixed_version":"1:9.10.3.dfsg.P4-12.3","urgency":"not yet assigned"},"forky":{"status":"resolved","repositories":{"forky":"1:9.20.20-1"},"fixed_version":"1:9.10.3.dfsg.P4-12.3","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"1:9.20.20-1"},"fixed_version":"1:9.10.3.dfsg.P4-12.3","urgency":"not yet assigned"},"trixie":{"status":"resolved","repositories":{"trixie":"1:9.20.15-1~deb13u1","trixie-security":"1:9.20.18-1~deb13u1"},"fixed_version":"1:9.10.3.dfsg.P4-12.3","urgency":"not yet assigned"}}},"CVE-2017-3138":{"description":"named contains a feature which allows operators to issue commands to a running server by communicating with the server process over a control channel, using a utility program such as rndc. A regression introduced in a recent feature change has created a situation under which some versions of named can be caused to exit with a REQUIRE assertion failure if they are sent a null command string. Affects BIND 9.9.9->9.9.9-P7, 9.9.10b1->9.9.10rc2, 9.10.4->9.10.4-P7, 9.10.5b1->9.10.5rc2, 9.11.0->9.11.0-P4, 9.11.1b1->9.11.1rc2, 9.9.9-S1->9.9.9-S9.","debianbug":860226,"scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"1:9.18.41-1~deb12u1","bookworm-security":"1:9.18.44-1~deb12u1"},"fixed_version":"1:9.10.3.dfsg.P4-12.3","urgency":"not yet assigned"},"bullseye":{"status":"resolved","repositories":{"bullseye":"1:9.16.50-1~deb11u2","bullseye-security":"1:9.16.50-1~deb11u4"},"fixed_version":"1:9.10.3.dfsg.P4-12.3","urgency":"not yet assigned"},"forky":{"status":"resolved","repositories":{"forky":"1:9.20.20-1"},"fixed_version":"1:9.10.3.dfsg.P4-12.3","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"1:9.20.20-1"},"fixed_version":"1:9.10.3.dfsg.P4-12.3","urgency":"not yet assigned"},"trixie":{"status":"resolved","repositories":{"trixie":"1:9.20.15-1~deb13u1","trixie-security":"1:9.20.18-1~deb13u1"},"fixed_version":"1:9.10.3.dfsg.P4-12.3","urgency":"not yet assigned"}}},"CVE-2017-3139":{"description":"A denial of service flaw was found in the way BIND handled DNSSEC validation. A remote attacker could use this flaw to make named exit unexpectedly with an assertion failure via a specially crafted DNS response.","scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"1:9.18.41-1~deb12u1","bookworm-security":"1:9.18.44-1~deb12u1"},"fixed_version":"0","urgency":"unimportant"},"bullseye":{"status":"resolved","repositories":{"bullseye":"1:9.16.50-1~deb11u2","bullseye-security":"1:9.16.50-1~deb11u4"},"fixed_version":"0","urgency":"unimportant"},"forky":{"status":"resolved","repositories":{"forky":"1:9.20.20-1"},"fixed_version":"0","urgency":"unimportant"},"sid":{"status":"resolved","repositories":{"sid":"1:9.20.20-1"},"fixed_version":"0","urgency":"unimportant"},"trixie":{"status":"resolved","repositories":{"trixie":"1:9.20.15-1~deb13u1","trixie-security":"1:9.20.18-1~deb13u1"},"fixed_version":"0","urgency":"unimportant"}}},"CVE-2017-3140":{"description":"If named is configured to use Response Policy Zones (RPZ) an error processing some rule types can lead to a condition where BIND will endlessly loop while handling a query. Affects BIND 9.9.10, 9.10.5, 9.11.0->9.11.1, 9.9.10-S1, 9.10.5-S1.","scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"1:9.18.41-1~deb12u1","bookworm-security":"1:9.18.44-1~deb12u1"},"fixed_version":"0","urgency":"unimportant"},"bullseye":{"status":"resolved","repositories":{"bullseye":"1:9.16.50-1~deb11u2","bullseye-security":"1:9.16.50-1~deb11u4"},"fixed_version":"0","urgency":"unimportant"},"forky":{"status":"resolved","repositories":{"forky":"1:9.20.20-1"},"fixed_version":"0","urgency":"unimportant"},"sid":{"status":"resolved","repositories":{"sid":"1:9.20.20-1"},"fixed_version":"0","urgency":"unimportant"},"trixie":{"status":"resolved","repositories":{"trixie":"1:9.20.15-1~deb13u1","trixie-security":"1:9.20.18-1~deb13u1"},"fixed_version":"0","urgency":"unimportant"}}},"CVE-2017-3141":{"description":"The BIND installer on Windows uses an unquoted service path which can enable a local user to achieve privilege escalation if the host file system permissions allow this. Affects BIND 9.2.6-P2->9.2.9, 9.3.2-P1->9.3.6, 9.4.0->9.8.8, 9.9.0->9.9.10, 9.10.0->9.10.5, 9.11.0->9.11.1, 9.9.3-S1->9.9.10-S1, 9.10.5-S1.","scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"1:9.18.41-1~deb12u1","bookworm-security":"1:9.18.44-1~deb12u1"},"fixed_version":"0","urgency":"unimportant"},"bullseye":{"status":"resolved","repositories":{"bullseye":"1:9.16.50-1~deb11u2","bullseye-security":"1:9.16.50-1~deb11u4"},"fixed_version":"0","urgency":"unimportant"},"forky":{"status":"resolved","repositories":{"forky":"1:9.20.20-1"},"fixed_version":"0","urgency":"unimportant"},"sid":{"status":"resolved","repositories":{"sid":"1:9.20.20-1"},"fixed_version":"0","urgency":"unimportant"},"trixie":{"status":"resolved","repositories":{"trixie":"1:9.20.15-1~deb13u1","trixie-security":"1:9.20.18-1~deb13u1"},"fixed_version":"0","urgency":"unimportant"}}},"CVE-2017-3142":{"description":"An attacker who is able to send and receive messages to an authoritative DNS server and who has knowledge of a valid TSIG key name may be able to circumvent TSIG authentication of AXFR requests via a carefully constructed request packet. A server that relies solely on TSIG keys for protection with no other ACL protection could be manipulated into: providing an AXFR of a zone to an unauthorized recipient or accepting bogus NOTIFY packets. Affects BIND 9.4.0->9.8.8, 9.9.0->9.9.10-P1, 9.10.0->9.10.5-P1, 9.11.0->9.11.1-P1, 9.9.3-S1->9.9.10-S2, 9.10.5-S1->9.10.5-S2.","debianbug":866564,"scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"1:9.18.41-1~deb12u1","bookworm-security":"1:9.18.44-1~deb12u1"},"fixed_version":"1:9.10.3.dfsg.P4-12.4","urgency":"not yet assigned"},"bullseye":{"status":"resolved","repositories":{"bullseye":"1:9.16.50-1~deb11u2","bullseye-security":"1:9.16.50-1~deb11u4"},"fixed_version":"1:9.10.3.dfsg.P4-12.4","urgency":"not yet assigned"},"forky":{"status":"resolved","repositories":{"forky":"1:9.20.20-1"},"fixed_version":"1:9.10.3.dfsg.P4-12.4","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"1:9.20.20-1"},"fixed_version":"1:9.10.3.dfsg.P4-12.4","urgency":"not yet assigned"},"trixie":{"status":"resolved","repositories":{"trixie":"1:9.20.15-1~deb13u1","trixie-security":"1:9.20.18-1~deb13u1"},"fixed_version":"1:9.10.3.dfsg.P4-12.4","urgency":"not yet assigned"}}},"CVE-2017-3143":{"description":"An attacker who is able to send and receive messages to an authoritative DNS server and who has knowledge of a valid TSIG key name for the zone and service being targeted may be able to manipulate BIND into accepting an unauthorized dynamic update. Affects BIND 9.4.0->9.8.8, 9.9.0->9.9.10-P1, 9.10.0->9.10.5-P1, 9.11.0->9.11.1-P1, 9.9.3-S1->9.9.10-S2, 9.10.5-S1->9.10.5-S2.","debianbug":866564,"scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"1:9.18.41-1~deb12u1","bookworm-security":"1:9.18.44-1~deb12u1"},"fixed_version":"1:9.10.3.dfsg.P4-12.4","urgency":"not yet assigned"},"bullseye":{"status":"resolved","repositories":{"bullseye":"1:9.16.50-1~deb11u2","bullseye-security":"1:9.16.50-1~deb11u4"},"fixed_version":"1:9.10.3.dfsg.P4-12.4","urgency":"not yet assigned"},"forky":{"status":"resolved","repositories":{"forky":"1:9.20.20-1"},"fixed_version":"1:9.10.3.dfsg.P4-12.4","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"1:9.20.20-1"},"fixed_version":"1:9.10.3.dfsg.P4-12.4","urgency":"not yet assigned"},"trixie":{"status":"resolved","repositories":{"trixie":"1:9.20.15-1~deb13u1","trixie-security":"1:9.20.18-1~deb13u1"},"fixed_version":"1:9.10.3.dfsg.P4-12.4","urgency":"not yet assigned"}}},"CVE-2017-3145":{"description":"BIND was improperly sequencing cleanup operations on upstream recursion fetch contexts, leading in some cases to a use-after-free error that can trigger an assertion failure and crash in named. Affects BIND 9.0.0 to 9.8.x, 9.9.0 to 9.9.11, 9.10.0 to 9.10.6, 9.11.0 to 9.11.2, 9.9.3-S1 to 9.9.11-S1, 9.10.5-S1 to 9.10.6-S1, 9.12.0a1 to 9.12.0rc1.","scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"1:9.18.41-1~deb12u1","bookworm-security":"1:9.18.44-1~deb12u1"},"fixed_version":"1:9.11.2.P1-1","urgency":"not yet assigned"},"bullseye":{"status":"resolved","repositories":{"bullseye":"1:9.16.50-1~deb11u2","bullseye-security":"1:9.16.50-1~deb11u4"},"fixed_version":"1:9.11.2.P1-1","urgency":"not yet assigned"},"forky":{"status":"resolved","repositories":{"forky":"1:9.20.20-1"},"fixed_version":"1:9.11.2.P1-1","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"1:9.20.20-1"},"fixed_version":"1:9.11.2.P1-1","urgency":"not yet assigned"},"trixie":{"status":"resolved","repositories":{"trixie":"1:9.20.15-1~deb13u1","trixie-security":"1:9.20.18-1~deb13u1"},"fixed_version":"1:9.11.2.P1-1","urgency":"not yet assigned"}}},"CVE-2018-5734":{"description":"While handling a particular type of malformed packet BIND erroneously selects a SERVFAIL rcode instead of a FORMERR rcode. If the receiving view has the SERVFAIL cache feature enabled, this can trigger an assertion failure in badcache.c when the request doesn't contain all of the expected information. Affects BIND 9.10.5-S1 to 9.10.5-S4, 9.10.6-S1, 9.10.6-S2.","scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"1:9.18.41-1~deb12u1","bookworm-security":"1:9.18.44-1~deb12u1"},"fixed_version":"0","urgency":"unimportant"},"bullseye":{"status":"resolved","repositories":{"bullseye":"1:9.16.50-1~deb11u2","bullseye-security":"1:9.16.50-1~deb11u4"},"fixed_version":"0","urgency":"unimportant"},"forky":{"status":"resolved","repositories":{"forky":"1:9.20.20-1"},"fixed_version":"0","urgency":"unimportant"},"sid":{"status":"resolved","repositories":{"sid":"1:9.20.20-1"},"fixed_version":"0","urgency":"unimportant"},"trixie":{"status":"resolved","repositories":{"trixie":"1:9.20.15-1~deb13u1","trixie-security":"1:9.20.18-1~deb13u1"},"fixed_version":"0","urgency":"unimportant"}}},"CVE-2018-5735":{"description":"The Debian backport of the fix for CVE-2017-3137 leads to assertion failure in validator.c:1858; Affects Debian versions 9.9.5.dfsg-9+deb8u15; 9.9.5.dfsg-9+deb8u18; 9.10.3.dfsg.P4-12.3+deb9u5; 9.11.5.P4+dfsg-5.1 No ISC releases are affected. Other packages from other distributions who did similar backports for the fix for 2017-3137 may also be affected.","debianbug":889285,"scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"1:9.18.41-1~deb12u1","bookworm-security":"1:9.18.44-1~deb12u1"},"fixed_version":"1:9.9.3.dfsg.P2-1","urgency":"not yet assigned"},"bullseye":{"status":"resolved","repositories":{"bullseye":"1:9.16.50-1~deb11u2","bullseye-security":"1:9.16.50-1~deb11u4"},"fixed_version":"1:9.9.3.dfsg.P2-1","urgency":"not yet assigned"},"forky":{"status":"resolved","repositories":{"forky":"1:9.20.20-1"},"fixed_version":"1:9.9.3.dfsg.P2-1","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"1:9.20.20-1"},"fixed_version":"1:9.9.3.dfsg.P2-1","urgency":"not yet assigned"},"trixie":{"status":"resolved","repositories":{"trixie":"1:9.20.15-1~deb13u1","trixie-security":"1:9.20.18-1~deb13u1"},"fixed_version":"1:9.9.3.dfsg.P2-1","urgency":"not yet assigned"}}},"CVE-2018-5736":{"description":"An error in zone database reference counting can lead to an assertion failure if a server which is running an affected version of BIND attempts several transfers of a slave zone in quick succession. This defect could be deliberately exercised by an attacker who is permitted to cause a vulnerable server to initiate zone transfers (for example: by sending valid NOTIFY messages), causing the named process to exit after failing the assertion test. Affects BIND 9.12.0 and 9.12.1.","scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"1:9.18.41-1~deb12u1","bookworm-security":"1:9.18.44-1~deb12u1"},"fixed_version":"0","urgency":"unimportant"},"bullseye":{"status":"resolved","repositories":{"bullseye":"1:9.16.50-1~deb11u2","bullseye-security":"1:9.16.50-1~deb11u4"},"fixed_version":"0","urgency":"unimportant"},"forky":{"status":"resolved","repositories":{"forky":"1:9.20.20-1"},"fixed_version":"0","urgency":"unimportant"},"sid":{"status":"resolved","repositories":{"sid":"1:9.20.20-1"},"fixed_version":"0","urgency":"unimportant"},"trixie":{"status":"resolved","repositories":{"trixie":"1:9.20.15-1~deb13u1","trixie-security":"1:9.20.18-1~deb13u1"},"fixed_version":"0","urgency":"unimportant"}}},"CVE-2018-5737":{"description":"A problem with the implementation of the new serve-stale feature in BIND 9.12 can lead to an assertion failure in rbtdb.c, even when stale-answer-enable is off. Additionally, problematic interaction between the serve-stale feature and NSEC aggressive negative caching can in some cases cause undesirable behavior from named, such as a recursion loop or excessive logging. Deliberate exploitation of this condition could cause operational problems depending on the particular manifestation -- either degradation or denial of service. Affects BIND 9.12.0 and 9.12.1.","scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"1:9.18.41-1~deb12u1","bookworm-security":"1:9.18.44-1~deb12u1"},"fixed_version":"0","urgency":"unimportant"},"bullseye":{"status":"resolved","repositories":{"bullseye":"1:9.16.50-1~deb11u2","bullseye-security":"1:9.16.50-1~deb11u4"},"fixed_version":"0","urgency":"unimportant"},"forky":{"status":"resolved","repositories":{"forky":"1:9.20.20-1"},"fixed_version":"0","urgency":"unimportant"},"sid":{"status":"resolved","repositories":{"sid":"1:9.20.20-1"},"fixed_version":"0","urgency":"unimportant"},"trixie":{"status":"resolved","repositories":{"trixie":"1:9.20.15-1~deb13u1","trixie-security":"1:9.20.18-1~deb13u1"},"fixed_version":"0","urgency":"unimportant"}}},"CVE-2018-5738":{"description":"Change #4777 (introduced in October 2017) introduced an unforeseen issue in releases which were issued after that date, affecting which clients are permitted to make recursive queries to a BIND nameserver. The intended (and documented) behavior is that if an operator has not specified a value for the \"allow-recursion\" setting, it SHOULD default to one of the following: none, if \"recursion no;\" is set in named.conf; a value inherited from the \"allow-query-cache\" or \"allow-query\" settings IF \"recursion yes;\" (the default for that setting) AND match lists are explicitly set for \"allow-query-cache\" or \"allow-query\" (see the BIND9 Administrative Reference Manual section 6.2 for more details); or the intended default of \"allow-recursion {localhost; localnets;};\" if \"recursion yes;\" is in effect and no values are explicitly set for \"allow-query-cache\" or \"allow-query\". However, because of the regression introduced by change #4777, it is possible when \"recursion yes;\" is in effect and no match list values are provided for \"allow-query-cache\" or \"allow-query\" for the setting of \"allow-recursion\" to inherit a setting of all hosts from the \"allow-query\" setting default, improperly permitting recursion to all clients. Affects BIND 9.9.12, 9.10.7, 9.11.3, 9.12.0->9.12.1-P2, the development release 9.13.0, and also releases 9.9.12-S1, 9.10.7-S1, 9.11.3-S1, and 9.11.3-S2 from BIND 9 Supported Preview Edition.","debianbug":901483,"scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"1:9.18.41-1~deb12u1","bookworm-security":"1:9.18.44-1~deb12u1"},"fixed_version":"1:9.11.3+dfsg-2","urgency":"not yet assigned"},"bullseye":{"status":"resolved","repositories":{"bullseye":"1:9.16.50-1~deb11u2","bullseye-security":"1:9.16.50-1~deb11u4"},"fixed_version":"1:9.11.3+dfsg-2","urgency":"not yet assigned"},"forky":{"status":"resolved","repositories":{"forky":"1:9.20.20-1"},"fixed_version":"1:9.11.3+dfsg-2","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"1:9.20.20-1"},"fixed_version":"1:9.11.3+dfsg-2","urgency":"not yet assigned"},"trixie":{"status":"resolved","repositories":{"trixie":"1:9.20.15-1~deb13u1","trixie-security":"1:9.20.18-1~deb13u1"},"fixed_version":"1:9.11.3+dfsg-2","urgency":"not yet assigned"}}},"CVE-2018-5740":{"description":"\"deny-answer-aliases\" is a little-used feature intended to help recursive server operators protect end users against DNS rebinding attacks, a potential method of circumventing the security model used by client browsers. However, a defect in this feature makes it easy, when the feature is in use, to experience an assertion failure in name.c. Affects BIND 9.7.0->9.8.8, 9.9.0->9.9.13, 9.10.0->9.10.8, 9.11.0->9.11.4, 9.12.0->9.12.2, 9.13.0->9.13.2.","debianbug":905743,"scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"1:9.18.41-1~deb12u1","bookworm-security":"1:9.18.44-1~deb12u1"},"fixed_version":"1:9.11.4.P1+dfsg-1","urgency":"not yet assigned"},"bullseye":{"status":"resolved","repositories":{"bullseye":"1:9.16.50-1~deb11u2","bullseye-security":"1:9.16.50-1~deb11u4"},"fixed_version":"1:9.11.4.P1+dfsg-1","urgency":"not yet assigned"},"forky":{"status":"resolved","repositories":{"forky":"1:9.20.20-1"},"fixed_version":"1:9.11.4.P1+dfsg-1","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"1:9.20.20-1"},"fixed_version":"1:9.11.4.P1+dfsg-1","urgency":"not yet assigned"},"trixie":{"status":"resolved","repositories":{"trixie":"1:9.20.15-1~deb13u1","trixie-security":"1:9.20.18-1~deb13u1"},"fixed_version":"1:9.11.4.P1+dfsg-1","urgency":"not yet assigned"}}},"CVE-2018-5741":{"description":"To provide fine-grained controls over the ability to use Dynamic DNS (DDNS) to update records in a zone, BIND 9 provides a feature called update-policy. Various rules can be configured to limit the types of updates that can be performed by a client, depending on the key used when sending the update request. Unfortunately, some rule types were not initially documented, and when documentation for them was added to the Administrator Reference Manual (ARM) in change #3112, the language that was added to the ARM at that time incorrectly described the behavior of two rule types, krb5-subdomain and ms-subdomain. This incorrect documentation could mislead operators into believing that policies they had configured were more restrictive than they actually were. This affects BIND versions prior to BIND 9.11.5 and BIND 9.12.3.","debianbug":908595,"scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"1:9.18.41-1~deb12u1","bookworm-security":"1:9.18.44-1~deb12u1"},"fixed_version":"1:9.11.5+dfsg-1","urgency":"unimportant"},"bullseye":{"status":"resolved","repositories":{"bullseye":"1:9.16.50-1~deb11u2","bullseye-security":"1:9.16.50-1~deb11u4"},"fixed_version":"1:9.11.5+dfsg-1","urgency":"unimportant"},"forky":{"status":"resolved","repositories":{"forky":"1:9.20.20-1"},"fixed_version":"1:9.11.5+dfsg-1","urgency":"unimportant"},"sid":{"status":"resolved","repositories":{"sid":"1:9.20.20-1"},"fixed_version":"1:9.11.5+dfsg-1","urgency":"unimportant"},"trixie":{"status":"resolved","repositories":{"trixie":"1:9.20.15-1~deb13u1","trixie-security":"1:9.20.18-1~deb13u1"},"fixed_version":"1:9.11.5+dfsg-1","urgency":"unimportant"}}},"CVE-2018-5742":{"description":"While backporting a feature for a newer branch of BIND9, RedHat introduced a path leading to an assertion failure in buffer.c:420. Affects RedHat versions bind-9.9.4-65.el7 -> bind-9.9.4-72.el7. No ISC releases are affected. Other packages from other distributions who made the same error may also be affected.","scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"1:9.18.41-1~deb12u1","bookworm-security":"1:9.18.44-1~deb12u1"},"fixed_version":"0","urgency":"unimportant"},"bullseye":{"status":"resolved","repositories":{"bullseye":"1:9.16.50-1~deb11u2","bullseye-security":"1:9.16.50-1~deb11u4"},"fixed_version":"0","urgency":"unimportant"},"forky":{"status":"resolved","repositories":{"forky":"1:9.20.20-1"},"fixed_version":"0","urgency":"unimportant"},"sid":{"status":"resolved","repositories":{"sid":"1:9.20.20-1"},"fixed_version":"0","urgency":"unimportant"},"trixie":{"status":"resolved","repositories":{"trixie":"1:9.20.15-1~deb13u1","trixie-security":"1:9.20.18-1~deb13u1"},"fixed_version":"0","urgency":"unimportant"}}},"CVE-2018-5743":{"description":"By design, BIND is intended to limit the number of TCP clients that can be connected at any given time. The number of allowed connections is a tunable parameter which, if unset, defaults to a conservative value for most servers. Unfortunately, the code which was intended to limit the number of simultaneous connections contained an error which could be exploited to grow the number of simultaneous connections beyond this limit. Versions affected: BIND 9.9.0 -> 9.10.8-P1, 9.11.0 -> 9.11.6, 9.12.0 -> 9.12.4, 9.14.0. BIND 9 Supported Preview Edition versions 9.9.3-S1 -> 9.11.5-S3, and 9.11.5-S5. Versions 9.13.0 -> 9.13.7 of the 9.13 development branch are also affected. Versions prior to BIND 9.9.0 have not been evaluated for vulnerability to CVE-2018-5743.","debianbug":927932,"scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"1:9.18.41-1~deb12u1","bookworm-security":"1:9.18.44-1~deb12u1"},"fixed_version":"1:9.11.5.P4+dfsg-4","urgency":"not yet assigned"},"bullseye":{"status":"resolved","repositories":{"bullseye":"1:9.16.50-1~deb11u2","bullseye-security":"1:9.16.50-1~deb11u4"},"fixed_version":"1:9.11.5.P4+dfsg-4","urgency":"not yet assigned"},"forky":{"status":"resolved","repositories":{"forky":"1:9.20.20-1"},"fixed_version":"1:9.11.5.P4+dfsg-4","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"1:9.20.20-1"},"fixed_version":"1:9.11.5.P4+dfsg-4","urgency":"not yet assigned"},"trixie":{"status":"resolved","repositories":{"trixie":"1:9.20.15-1~deb13u1","trixie-security":"1:9.20.18-1~deb13u1"},"fixed_version":"1:9.11.5.P4+dfsg-4","urgency":"not yet assigned"}}},"CVE-2018-5744":{"description":"A failure to free memory can occur when processing messages having a specific combination of EDNS options. Versions affected are: BIND 9.10.7 -> 9.10.8-P1, 9.11.3 -> 9.11.5-P1, 9.12.0 -> 9.12.3-P1, and versions 9.10.7-S1 -> 9.11.5-S3 of BIND 9 Supported Preview Edition. Versions 9.13.0 -> 9.13.6 of the 9.13 development branch are also affected.","debianbug":922953,"scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"1:9.18.41-1~deb12u1","bookworm-security":"1:9.18.44-1~deb12u1"},"fixed_version":"1:9.11.5.P4+dfsg-1","urgency":"not yet assigned"},"bullseye":{"status":"resolved","repositories":{"bullseye":"1:9.16.50-1~deb11u2","bullseye-security":"1:9.16.50-1~deb11u4"},"fixed_version":"1:9.11.5.P4+dfsg-1","urgency":"not yet assigned"},"forky":{"status":"resolved","repositories":{"forky":"1:9.20.20-1"},"fixed_version":"1:9.11.5.P4+dfsg-1","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"1:9.20.20-1"},"fixed_version":"1:9.11.5.P4+dfsg-1","urgency":"not yet assigned"},"trixie":{"status":"resolved","repositories":{"trixie":"1:9.20.15-1~deb13u1","trixie-security":"1:9.20.18-1~deb13u1"},"fixed_version":"1:9.11.5.P4+dfsg-1","urgency":"not yet assigned"}}},"CVE-2018-5745":{"description":"\"managed-keys\" is a feature which allows a BIND resolver to automatically maintain the keys used by trust anchors which operators configure for use in DNSSEC validation. Due to an error in the managed-keys feature it is possible for a BIND server which uses managed-keys to exit due to an assertion failure if, during key rollover, a trust anchor's keys are replaced with keys which use an unsupported algorithm. Versions affected: BIND 9.9.0 -> 9.10.8-P1, 9.11.0 -> 9.11.5-P1, 9.12.0 -> 9.12.3-P1, and versions 9.9.3-S1 -> 9.11.5-S3 of BIND 9 Supported Preview Edition. Versions 9.13.0 -> 9.13.6 of the 9.13 development branch are also affected. Versions prior to BIND 9.9.0 have not been evaluated for vulnerability to CVE-2018-5745.","debianbug":922954,"scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"1:9.18.41-1~deb12u1","bookworm-security":"1:9.18.44-1~deb12u1"},"fixed_version":"1:9.11.5.P4+dfsg-1","urgency":"low"},"bullseye":{"status":"resolved","repositories":{"bullseye":"1:9.16.50-1~deb11u2","bullseye-security":"1:9.16.50-1~deb11u4"},"fixed_version":"1:9.11.5.P4+dfsg-1","urgency":"low"},"forky":{"status":"resolved","repositories":{"forky":"1:9.20.20-1"},"fixed_version":"1:9.11.5.P4+dfsg-1","urgency":"low"},"sid":{"status":"resolved","repositories":{"sid":"1:9.20.20-1"},"fixed_version":"1:9.11.5.P4+dfsg-1","urgency":"low"},"trixie":{"status":"resolved","repositories":{"trixie":"1:9.20.15-1~deb13u1","trixie-security":"1:9.20.18-1~deb13u1"},"fixed_version":"1:9.11.5.P4+dfsg-1","urgency":"low"}}},"CVE-2019-6465":{"description":"Controls for zone transfers may not be properly applied to Dynamically Loadable Zones (DLZs) if the zones are writable Versions affected: BIND 9.9.0 -> 9.10.8-P1, 9.11.0 -> 9.11.5-P2, 9.12.0 -> 9.12.3-P2, and versions 9.9.3-S1 -> 9.11.5-S3 of BIND 9 Supported Preview Edition. Versions 9.13.0 -> 9.13.6 of the 9.13 development branch are also affected. Versions prior to BIND 9.9.0 have not been evaluated for vulnerability to CVE-2019-6465.","debianbug":922955,"scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"1:9.18.41-1~deb12u1","bookworm-security":"1:9.18.44-1~deb12u1"},"fixed_version":"1:9.11.5.P4+dfsg-1","urgency":"low"},"bullseye":{"status":"resolved","repositories":{"bullseye":"1:9.16.50-1~deb11u2","bullseye-security":"1:9.16.50-1~deb11u4"},"fixed_version":"1:9.11.5.P4+dfsg-1","urgency":"low"},"forky":{"status":"resolved","repositories":{"forky":"1:9.20.20-1"},"fixed_version":"1:9.11.5.P4+dfsg-1","urgency":"low"},"sid":{"status":"resolved","repositories":{"sid":"1:9.20.20-1"},"fixed_version":"1:9.11.5.P4+dfsg-1","urgency":"low"},"trixie":{"status":"resolved","repositories":{"trixie":"1:9.20.15-1~deb13u1","trixie-security":"1:9.20.18-1~deb13u1"},"fixed_version":"1:9.11.5.P4+dfsg-1","urgency":"low"}}},"CVE-2019-6467":{"description":"A programming error in the nxdomain-redirect feature can cause an assertion failure in query.c if the alternate namespace used by nxdomain-redirect is a descendant of a zone that is served locally. The most likely scenario where this might occur is if the server, in addition to performing NXDOMAIN redirection for recursive clients, is also serving a local copy of the root zone or using mirroring to provide the root zone, although other configurations are also possible. Versions affected: BIND 9.12.0-> 9.12.4, 9.14.0. Also affects all releases in the 9.13 development branch.","scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"1:9.18.41-1~deb12u1","bookworm-security":"1:9.18.44-1~deb12u1"},"fixed_version":"0","urgency":"unimportant"},"bullseye":{"status":"resolved","repositories":{"bullseye":"1:9.16.50-1~deb11u2","bullseye-security":"1:9.16.50-1~deb11u4"},"fixed_version":"0","urgency":"unimportant"},"forky":{"status":"resolved","repositories":{"forky":"1:9.20.20-1"},"fixed_version":"0","urgency":"unimportant"},"sid":{"status":"resolved","repositories":{"sid":"1:9.20.20-1"},"fixed_version":"0","urgency":"unimportant"},"trixie":{"status":"resolved","repositories":{"trixie":"1:9.20.15-1~deb13u1","trixie-security":"1:9.20.18-1~deb13u1"},"fixed_version":"0","urgency":"unimportant"}}},"CVE-2019-6468":{"description":"In BIND Supported Preview Edition, an error in the nxdomain-redirect feature can occur in versions which support EDNS Client Subnet (ECS) features. In those versions which have ECS support, enabling nxdomain-redirect is likely to lead to BIND exiting due to assertion failure. Versions affected: BIND Supported Preview Edition version 9.10.5-S1 -> 9.11.5-S5. ONLY BIND Supported Preview Edition releases are affected.","scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"1:9.18.41-1~deb12u1","bookworm-security":"1:9.18.44-1~deb12u1"},"fixed_version":"0","urgency":"unimportant"},"bullseye":{"status":"resolved","repositories":{"bullseye":"1:9.16.50-1~deb11u2","bullseye-security":"1:9.16.50-1~deb11u4"},"fixed_version":"0","urgency":"unimportant"},"forky":{"status":"resolved","repositories":{"forky":"1:9.20.20-1"},"fixed_version":"0","urgency":"unimportant"},"sid":{"status":"resolved","repositories":{"sid":"1:9.20.20-1"},"fixed_version":"0","urgency":"unimportant"},"trixie":{"status":"resolved","repositories":{"trixie":"1:9.20.15-1~deb13u1","trixie-security":"1:9.20.18-1~deb13u1"},"fixed_version":"0","urgency":"unimportant"}}},"CVE-2019-6469":{"description":"An error in the EDNS Client Subnet (ECS) feature for recursive resolvers can cause BIND to exit with an assertion failure when processing a response that has malformed RRSIGs. Versions affected: BIND 9.10.5-S1 -> 9.11.6-S1 of BIND 9 Supported Preview Edition.","scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"1:9.18.41-1~deb12u1","bookworm-security":"1:9.18.44-1~deb12u1"},"fixed_version":"0","urgency":"unimportant"},"bullseye":{"status":"resolved","repositories":{"bullseye":"1:9.16.50-1~deb11u2","bullseye-security":"1:9.16.50-1~deb11u4"},"fixed_version":"0","urgency":"unimportant"},"forky":{"status":"resolved","repositories":{"forky":"1:9.20.20-1"},"fixed_version":"0","urgency":"unimportant"},"sid":{"status":"resolved","repositories":{"sid":"1:9.20.20-1"},"fixed_version":"0","urgency":"unimportant"},"trixie":{"status":"resolved","repositories":{"trixie":"1:9.20.15-1~deb13u1","trixie-security":"1:9.20.18-1~deb13u1"},"fixed_version":"0","urgency":"unimportant"}}},"CVE-2019-6471":{"description":"A race condition which may occur when discarding malformed packets can result in BIND exiting due to a REQUIRE assertion failure in dispatch.c. Versions affected: BIND 9.11.0 -> 9.11.7, 9.12.0 -> 9.12.4-P1, 9.14.0 -> 9.14.2. Also all releases of the BIND 9.13 development branch and version 9.15.0 of the BIND 9.15 development branch and BIND Supported Preview Edition versions 9.11.3-S1 -> 9.11.7-S1.","debianbug":930746,"scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"1:9.18.41-1~deb12u1","bookworm-security":"1:9.18.44-1~deb12u1"},"fixed_version":"1:9.11.5.P4+dfsg-5.1","urgency":"not yet assigned"},"bullseye":{"status":"resolved","repositories":{"bullseye":"1:9.16.50-1~deb11u2","bullseye-security":"1:9.16.50-1~deb11u4"},"fixed_version":"1:9.11.5.P4+dfsg-5.1","urgency":"not yet assigned"},"forky":{"status":"resolved","repositories":{"forky":"1:9.20.20-1"},"fixed_version":"1:9.11.5.P4+dfsg-5.1","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"1:9.20.20-1"},"fixed_version":"1:9.11.5.P4+dfsg-5.1","urgency":"not yet assigned"},"trixie":{"status":"resolved","repositories":{"trixie":"1:9.20.15-1~deb13u1","trixie-security":"1:9.20.18-1~deb13u1"},"fixed_version":"1:9.11.5.P4+dfsg-5.1","urgency":"not yet assigned"}}},"CVE-2019-6475":{"description":"Mirror zones are a BIND feature allowing recursive servers to pre-cache zone data provided by other servers. A mirror zone is similar to a zone of type secondary, except that its data is subject to DNSSEC validation before being used in answers, as if it had been looked up via traditional recursion, and when mirror zone data cannot be validated, BIND falls back to using traditional recursion instead of the mirror zone. However, an error in the validity checks for the incoming zone data can allow an on-path attacker to replace zone data that was validated with a configured trust anchor with forged data of the attacker's choosing. The mirror zone feature is most often used to serve a local copy of the root zone. If an attacker was able to insert themselves into the network path between a recursive server using a mirror zone and a root name server, this vulnerability could then be used to cause the recursive server to accept a copy of falsified root zone data. This affects BIND versions 9.14.0 up to 9.14.6, and 9.15.0 up to 9.15.4.","scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"1:9.18.41-1~deb12u1","bookworm-security":"1:9.18.44-1~deb12u1"},"fixed_version":"0","urgency":"unimportant"},"bullseye":{"status":"resolved","repositories":{"bullseye":"1:9.16.50-1~deb11u2","bullseye-security":"1:9.16.50-1~deb11u4"},"fixed_version":"0","urgency":"unimportant"},"forky":{"status":"resolved","repositories":{"forky":"1:9.20.20-1"},"fixed_version":"0","urgency":"unimportant"},"sid":{"status":"resolved","repositories":{"sid":"1:9.20.20-1"},"fixed_version":"0","urgency":"unimportant"},"trixie":{"status":"resolved","repositories":{"trixie":"1:9.20.15-1~deb13u1","trixie-security":"1:9.20.18-1~deb13u1"},"fixed_version":"0","urgency":"unimportant"}}},"CVE-2019-6476":{"description":"A defect in code added to support QNAME minimization can cause named to exit with an assertion failure if a forwarder returns a referral rather than resolving the query. This affects BIND versions 9.14.0 up to 9.14.6, and 9.15.0 up to 9.15.4.","scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"1:9.18.41-1~deb12u1","bookworm-security":"1:9.18.44-1~deb12u1"},"fixed_version":"0","urgency":"unimportant"},"bullseye":{"status":"resolved","repositories":{"bullseye":"1:9.16.50-1~deb11u2","bullseye-security":"1:9.16.50-1~deb11u4"},"fixed_version":"0","urgency":"unimportant"},"forky":{"status":"resolved","repositories":{"forky":"1:9.20.20-1"},"fixed_version":"0","urgency":"unimportant"},"sid":{"status":"resolved","repositories":{"sid":"1:9.20.20-1"},"fixed_version":"0","urgency":"unimportant"},"trixie":{"status":"resolved","repositories":{"trixie":"1:9.20.15-1~deb13u1","trixie-security":"1:9.20.18-1~deb13u1"},"fixed_version":"0","urgency":"unimportant"}}},"CVE-2019-6477":{"description":"With pipelining enabled each incoming query on a TCP connection requires a similar resource allocation to a query received via UDP or via TCP without pipelining enabled. A client using a TCP-pipelined connection to a server could consume more resources than the server has been provisioned to handle. When a TCP connection with a large number of pipelined queries is closed, the load on the server releasing these multiple resources can cause it to become unresponsive, even for queries that can be answered authoritatively or from cache. (This is most likely to be perceived as an intermittent server problem).","debianbug":945171,"scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"1:9.18.41-1~deb12u1","bookworm-security":"1:9.18.44-1~deb12u1"},"fixed_version":"1:9.11.14+dfsg-1","urgency":"not yet assigned"},"bullseye":{"status":"resolved","repositories":{"bullseye":"1:9.16.50-1~deb11u2","bullseye-security":"1:9.16.50-1~deb11u4"},"fixed_version":"1:9.11.14+dfsg-1","urgency":"not yet assigned"},"forky":{"status":"resolved","repositories":{"forky":"1:9.20.20-1"},"fixed_version":"1:9.11.14+dfsg-1","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"1:9.20.20-1"},"fixed_version":"1:9.11.14+dfsg-1","urgency":"not yet assigned"},"trixie":{"status":"resolved","repositories":{"trixie":"1:9.20.15-1~deb13u1","trixie-security":"1:9.20.18-1~deb13u1"},"fixed_version":"1:9.11.14+dfsg-1","urgency":"not yet assigned"}}},"CVE-2020-8616":{"description":"A malicious actor who intentionally exploits this lack of effective limitation on the number of fetches performed when processing referrals can, through the use of specially crafted referrals, cause a recursing server to issue a very large number of fetches in an attempt to process the referral. This has at least two potential effects: The performance of the recursing server can potentially be degraded by the additional work required to perform these fetches, and The attacker can exploit this behavior to use the recursing server as a reflector in a reflection attack with a high amplification factor.","debianbug":961939,"scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"1:9.18.41-1~deb12u1","bookworm-security":"1:9.18.44-1~deb12u1"},"fixed_version":"1:9.16.3-1","urgency":"not yet assigned"},"bullseye":{"status":"resolved","repositories":{"bullseye":"1:9.16.50-1~deb11u2","bullseye-security":"1:9.16.50-1~deb11u4"},"fixed_version":"1:9.16.3-1","urgency":"not yet assigned"},"forky":{"status":"resolved","repositories":{"forky":"1:9.20.20-1"},"fixed_version":"1:9.16.3-1","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"1:9.20.20-1"},"fixed_version":"1:9.16.3-1","urgency":"not yet assigned"},"trixie":{"status":"resolved","repositories":{"trixie":"1:9.20.15-1~deb13u1","trixie-security":"1:9.20.18-1~deb13u1"},"fixed_version":"1:9.16.3-1","urgency":"not yet assigned"}}},"CVE-2020-8617":{"description":"Using a specially-crafted message, an attacker may potentially cause a BIND server to reach an inconsistent state if the attacker knows (or successfully guesses) the name of a TSIG key used by the server. Since BIND, by default, configures a local session key even on servers whose configuration does not otherwise make use of it, almost all current BIND servers are vulnerable. In releases of BIND dating from March 2018 and after, an assertion check in tsig.c detects this inconsistent state and deliberately exits. Prior to the introduction of the check the server would continue operating in an inconsistent state, with potentially harmful results.","debianbug":961939,"scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"1:9.18.41-1~deb12u1","bookworm-security":"1:9.18.44-1~deb12u1"},"fixed_version":"1:9.16.3-1","urgency":"not yet assigned"},"bullseye":{"status":"resolved","repositories":{"bullseye":"1:9.16.50-1~deb11u2","bullseye-security":"1:9.16.50-1~deb11u4"},"fixed_version":"1:9.16.3-1","urgency":"not yet assigned"},"forky":{"status":"resolved","repositories":{"forky":"1:9.20.20-1"},"fixed_version":"1:9.16.3-1","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"1:9.20.20-1"},"fixed_version":"1:9.16.3-1","urgency":"not yet assigned"},"trixie":{"status":"resolved","repositories":{"trixie":"1:9.20.15-1~deb13u1","trixie-security":"1:9.20.18-1~deb13u1"},"fixed_version":"1:9.16.3-1","urgency":"not yet assigned"}}},"CVE-2020-8618":{"description":"An attacker who is permitted to send zone data to a server via zone transfer can exploit this to intentionally trigger the assertion failure with a specially constructed zone, denying service to clients.","scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"1:9.18.41-1~deb12u1","bookworm-security":"1:9.18.44-1~deb12u1"},"fixed_version":"1:9.16.4-1","urgency":"not yet assigned"},"bullseye":{"status":"resolved","repositories":{"bullseye":"1:9.16.50-1~deb11u2","bullseye-security":"1:9.16.50-1~deb11u4"},"fixed_version":"1:9.16.4-1","urgency":"not yet assigned"},"forky":{"status":"resolved","repositories":{"forky":"1:9.20.20-1"},"fixed_version":"1:9.16.4-1","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"1:9.20.20-1"},"fixed_version":"1:9.16.4-1","urgency":"not yet assigned"},"trixie":{"status":"resolved","repositories":{"trixie":"1:9.20.15-1~deb13u1","trixie-security":"1:9.20.18-1~deb13u1"},"fixed_version":"1:9.16.4-1","urgency":"not yet assigned"}}},"CVE-2020-8619":{"description":"In ISC BIND9 versions BIND 9.11.14 -> 9.11.19, BIND 9.14.9 -> 9.14.12, BIND 9.16.0 -> 9.16.3, BIND Supported Preview Edition 9.11.14-S1 -> 9.11.19-S1: Unless a nameserver is providing authoritative service for one or more zones and at least one zone contains an empty non-terminal entry containing an asterisk (\"*\") character, this defect cannot be encountered. A would-be attacker who is allowed to change zone content could theoretically introduce such a record in order to exploit this condition to cause denial of service, though we consider the use of this vector unlikely because any such attack would require a significant privilege level and be easily traceable.","scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"1:9.18.41-1~deb12u1","bookworm-security":"1:9.18.44-1~deb12u1"},"fixed_version":"1:9.16.4-1","urgency":"not yet assigned"},"bullseye":{"status":"resolved","repositories":{"bullseye":"1:9.16.50-1~deb11u2","bullseye-security":"1:9.16.50-1~deb11u4"},"fixed_version":"1:9.16.4-1","urgency":"not yet assigned"},"forky":{"status":"resolved","repositories":{"forky":"1:9.20.20-1"},"fixed_version":"1:9.16.4-1","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"1:9.20.20-1"},"fixed_version":"1:9.16.4-1","urgency":"not yet assigned"},"trixie":{"status":"resolved","repositories":{"trixie":"1:9.20.15-1~deb13u1","trixie-security":"1:9.20.18-1~deb13u1"},"fixed_version":"1:9.16.4-1","urgency":"not yet assigned"}}},"CVE-2020-8620":{"description":"In BIND 9.15.6 -> 9.16.5, 9.17.0 -> 9.17.3, An attacker who can establish a TCP connection with the server and send data on that connection can exploit this to trigger the assertion failure, causing the server to exit.","scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"1:9.18.41-1~deb12u1","bookworm-security":"1:9.18.44-1~deb12u1"},"fixed_version":"1:9.16.6-1","urgency":"not yet assigned"},"bullseye":{"status":"resolved","repositories":{"bullseye":"1:9.16.50-1~deb11u2","bullseye-security":"1:9.16.50-1~deb11u4"},"fixed_version":"1:9.16.6-1","urgency":"not yet assigned"},"forky":{"status":"resolved","repositories":{"forky":"1:9.20.20-1"},"fixed_version":"1:9.16.6-1","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"1:9.20.20-1"},"fixed_version":"1:9.16.6-1","urgency":"not yet assigned"},"trixie":{"status":"resolved","repositories":{"trixie":"1:9.20.15-1~deb13u1","trixie-security":"1:9.20.18-1~deb13u1"},"fixed_version":"1:9.16.6-1","urgency":"not yet assigned"}}},"CVE-2020-8621":{"description":"In BIND 9.14.0 -> 9.16.5, 9.17.0 -> 9.17.3, If a server is configured with both QNAME minimization and 'forward first' then an attacker who can send queries to it may be able to trigger the condition that will cause the server to crash. Servers that 'forward only' are not affected.","scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"1:9.18.41-1~deb12u1","bookworm-security":"1:9.18.44-1~deb12u1"},"fixed_version":"1:9.16.6-1","urgency":"not yet assigned"},"bullseye":{"status":"resolved","repositories":{"bullseye":"1:9.16.50-1~deb11u2","bullseye-security":"1:9.16.50-1~deb11u4"},"fixed_version":"1:9.16.6-1","urgency":"not yet assigned"},"forky":{"status":"resolved","repositories":{"forky":"1:9.20.20-1"},"fixed_version":"1:9.16.6-1","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"1:9.20.20-1"},"fixed_version":"1:9.16.6-1","urgency":"not yet assigned"},"trixie":{"status":"resolved","repositories":{"trixie":"1:9.20.15-1~deb13u1","trixie-security":"1:9.20.18-1~deb13u1"},"fixed_version":"1:9.16.6-1","urgency":"not yet assigned"}}},"CVE-2020-8622":{"description":"In BIND 9.0.0 -> 9.11.21, 9.12.0 -> 9.16.5, 9.17.0 -> 9.17.3, also affects 9.9.3-S1 -> 9.11.21-S1 of the BIND 9 Supported Preview Edition, An attacker on the network path for a TSIG-signed request, or operating the server receiving the TSIG-signed request, could send a truncated response to that request, triggering an assertion failure, causing the server to exit. Alternately, an off-path attacker would have to correctly guess when a TSIG-signed request was sent, along with other characteristics of the packet and message, and spoof a truncated response to trigger an assertion failure, causing the server to exit.","scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"1:9.18.41-1~deb12u1","bookworm-security":"1:9.18.44-1~deb12u1"},"fixed_version":"1:9.16.6-1","urgency":"not yet assigned"},"bullseye":{"status":"resolved","repositories":{"bullseye":"1:9.16.50-1~deb11u2","bullseye-security":"1:9.16.50-1~deb11u4"},"fixed_version":"1:9.16.6-1","urgency":"not yet assigned"},"forky":{"status":"resolved","repositories":{"forky":"1:9.20.20-1"},"fixed_version":"1:9.16.6-1","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"1:9.20.20-1"},"fixed_version":"1:9.16.6-1","urgency":"not yet assigned"},"trixie":{"status":"resolved","repositories":{"trixie":"1:9.20.15-1~deb13u1","trixie-security":"1:9.20.18-1~deb13u1"},"fixed_version":"1:9.16.6-1","urgency":"not yet assigned"}}},"CVE-2020-8623":{"description":"In BIND 9.10.0 -> 9.11.21, 9.12.0 -> 9.16.5, 9.17.0 -> 9.17.3, also affects 9.10.5-S1 -> 9.11.21-S1 of the BIND 9 Supported Preview Edition, An attacker that can reach a vulnerable system with a specially crafted query packet can trigger a crash. To be vulnerable, the system must: * be running BIND that was built with \"--enable-native-pkcs11\" * be signing one or more zones with an RSA key * be able to receive queries from a possible attacker","scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"1:9.18.41-1~deb12u1","bookworm-security":"1:9.18.44-1~deb12u1"},"fixed_version":"1:9.16.6-1","urgency":"not yet assigned"},"bullseye":{"status":"resolved","repositories":{"bullseye":"1:9.16.50-1~deb11u2","bullseye-security":"1:9.16.50-1~deb11u4"},"fixed_version":"1:9.16.6-1","urgency":"not yet assigned"},"forky":{"status":"resolved","repositories":{"forky":"1:9.20.20-1"},"fixed_version":"1:9.16.6-1","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"1:9.20.20-1"},"fixed_version":"1:9.16.6-1","urgency":"not yet assigned"},"trixie":{"status":"resolved","repositories":{"trixie":"1:9.20.15-1~deb13u1","trixie-security":"1:9.20.18-1~deb13u1"},"fixed_version":"1:9.16.6-1","urgency":"not yet assigned"}}},"CVE-2020-8624":{"description":"In BIND 9.9.12 -> 9.9.13, 9.10.7 -> 9.10.8, 9.11.3 -> 9.11.21, 9.12.1 -> 9.16.5, 9.17.0 -> 9.17.3, also affects 9.9.12-S1 -> 9.9.13-S1, 9.11.3-S1 -> 9.11.21-S1 of the BIND 9 Supported Preview Edition, An attacker who has been granted privileges to change a specific subset of the zone's content could abuse these unintended additional privileges to update other contents of the zone.","debianbug":966497,"scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"1:9.18.41-1~deb12u1","bookworm-security":"1:9.18.44-1~deb12u1"},"fixed_version":"1:9.16.6-1","urgency":"not yet assigned"},"bullseye":{"status":"resolved","repositories":{"bullseye":"1:9.16.50-1~deb11u2","bullseye-security":"1:9.16.50-1~deb11u4"},"fixed_version":"1:9.16.6-1","urgency":"not yet assigned"},"forky":{"status":"resolved","repositories":{"forky":"1:9.20.20-1"},"fixed_version":"1:9.16.6-1","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"1:9.20.20-1"},"fixed_version":"1:9.16.6-1","urgency":"not yet assigned"},"trixie":{"status":"resolved","repositories":{"trixie":"1:9.20.15-1~deb13u1","trixie-security":"1:9.20.18-1~deb13u1"},"fixed_version":"1:9.16.6-1","urgency":"not yet assigned"}}},"CVE-2020-8625":{"description":"BIND servers are vulnerable if they are running an affected version and are configured to use GSS-TSIG features. In a configuration which uses BIND's default settings the vulnerable code path is not exposed, but a server can be rendered vulnerable by explicitly setting valid values for the tkey-gssapi-keytab or tkey-gssapi-credentialconfiguration options. Although the default configuration is not vulnerable, GSS-TSIG is frequently used in networks where BIND is integrated with Samba, as well as in mixed-server environments that combine BIND servers with Active Directory domain controllers. The most likely outcome of a successful exploitation of the vulnerability is a crash of the named process. However, remote code execution, while unproven, is theoretically possible. Affects: BIND 9.5.0 -> 9.11.27, 9.12.0 -> 9.16.11, and versions BIND 9.11.3-S1 -> 9.11.27-S1 and 9.16.8-S1 -> 9.16.11-S1 of BIND Supported Preview Edition. Also release versions 9.17.0 -> 9.17.1 of the BIND 9.17 development branch","debianbug":983004,"scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"1:9.18.41-1~deb12u1","bookworm-security":"1:9.18.44-1~deb12u1"},"fixed_version":"1:9.16.12-1","urgency":"not yet assigned"},"bullseye":{"status":"resolved","repositories":{"bullseye":"1:9.16.50-1~deb11u2","bullseye-security":"1:9.16.50-1~deb11u4"},"fixed_version":"1:9.16.12-1","urgency":"not yet assigned"},"forky":{"status":"resolved","repositories":{"forky":"1:9.20.20-1"},"fixed_version":"1:9.16.12-1","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"1:9.20.20-1"},"fixed_version":"1:9.16.12-1","urgency":"not yet assigned"},"trixie":{"status":"resolved","repositories":{"trixie":"1:9.20.15-1~deb13u1","trixie-security":"1:9.20.18-1~deb13u1"},"fixed_version":"1:9.16.12-1","urgency":"not yet assigned"}}},"CVE-2021-25214":{"description":"In BIND 9.8.5 -> 9.8.8, 9.9.3 -> 9.11.29, 9.12.0 -> 9.16.13, and versions BIND 9.9.3-S1 -> 9.11.29-S1 and 9.16.8-S1 -> 9.16.13-S1 of BIND 9 Supported Preview Edition, as well as release versions 9.17.0 -> 9.17.11 of the BIND 9.17 development branch, when a vulnerable version of named receives a malformed IXFR triggering the flaw described above, the named process will terminate due to a failed assertion the next time the transferred secondary zone is refreshed.","debianbug":987741,"scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"1:9.18.41-1~deb12u1","bookworm-security":"1:9.18.44-1~deb12u1"},"fixed_version":"1:9.16.15-1","urgency":"not yet assigned"},"bullseye":{"status":"resolved","repositories":{"bullseye":"1:9.16.50-1~deb11u2","bullseye-security":"1:9.16.50-1~deb11u4"},"fixed_version":"1:9.16.15-1","urgency":"not yet assigned"},"forky":{"status":"resolved","repositories":{"forky":"1:9.20.20-1"},"fixed_version":"1:9.16.15-1","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"1:9.20.20-1"},"fixed_version":"1:9.16.15-1","urgency":"not yet assigned"},"trixie":{"status":"resolved","repositories":{"trixie":"1:9.20.15-1~deb13u1","trixie-security":"1:9.20.18-1~deb13u1"},"fixed_version":"1:9.16.15-1","urgency":"not yet assigned"}}},"CVE-2021-25215":{"description":"In BIND 9.0.0 -> 9.11.29, 9.12.0 -> 9.16.13, and versions BIND 9.9.3-S1 -> 9.11.29-S1 and 9.16.8-S1 -> 9.16.13-S1 of BIND Supported Preview Edition, as well as release versions 9.17.0 -> 9.17.11 of the BIND 9.17 development branch, when a vulnerable version of named receives a query for a record triggering the flaw described above, the named process will terminate due to a failed assertion check. The vulnerability affects all currently maintained BIND 9 branches (9.11, 9.11-S, 9.16, 9.16-S, 9.17) as well as all other versions of BIND 9.","debianbug":987742,"scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"1:9.18.41-1~deb12u1","bookworm-security":"1:9.18.44-1~deb12u1"},"fixed_version":"1:9.16.15-1","urgency":"not yet assigned"},"bullseye":{"status":"resolved","repositories":{"bullseye":"1:9.16.50-1~deb11u2","bullseye-security":"1:9.16.50-1~deb11u4"},"fixed_version":"1:9.16.15-1","urgency":"not yet assigned"},"forky":{"status":"resolved","repositories":{"forky":"1:9.20.20-1"},"fixed_version":"1:9.16.15-1","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"1:9.20.20-1"},"fixed_version":"1:9.16.15-1","urgency":"not yet assigned"},"trixie":{"status":"resolved","repositories":{"trixie":"1:9.20.15-1~deb13u1","trixie-security":"1:9.20.18-1~deb13u1"},"fixed_version":"1:9.16.15-1","urgency":"not yet assigned"}}},"CVE-2021-25216":{"description":"In BIND 9.5.0 -> 9.11.29, 9.12.0 -> 9.16.13, and versions BIND 9.11.3-S1 -> 9.11.29-S1 and 9.16.8-S1 -> 9.16.13-S1 of BIND Supported Preview Edition, as well as release versions 9.17.0 -> 9.17.1 of the BIND 9.17 development branch, BIND servers are vulnerable if they are running an affected version and are configured to use GSS-TSIG features. In a configuration which uses BIND's default settings the vulnerable code path is not exposed, but a server can be rendered vulnerable by explicitly setting values for the tkey-gssapi-keytab or tkey-gssapi-credential configuration options. Although the default configuration is not vulnerable, GSS-TSIG is frequently used in networks where BIND is integrated with Samba, as well as in mixed-server environments that combine BIND servers with Active Directory domain controllers. For servers that meet these conditions, the ISC SPNEGO implementation is vulnerable to various attacks, depending on the CPU architecture for which BIND was built: For named binaries compiled for 64-bit platforms, this flaw can be used to trigger a buffer over-read, leading to a server crash. For named binaries compiled for 32-bit platforms, this flaw can be used to trigger a server crash due to a buffer overflow and possibly also to achieve remote code execution. We have determined that standard SPNEGO implementations are available in the MIT and Heimdal Kerberos libraries, which support a broad range of operating systems, rendering the ISC implementation unnecessary and obsolete. Therefore, to reduce the attack surface for BIND users, we will be removing the ISC SPNEGO implementation in the April releases of BIND 9.11 and 9.16 (it had already been dropped from BIND 9.17). We would not normally remove something from a stable ESV (Extended Support Version) of BIND, but since system libraries can replace the ISC SPNEGO implementation, we have made an exception in this case for reasons of stability and security.","debianbug":987743,"scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"1:9.18.41-1~deb12u1","bookworm-security":"1:9.18.44-1~deb12u1"},"fixed_version":"1:9.16.15-1","urgency":"not yet assigned"},"bullseye":{"status":"resolved","repositories":{"bullseye":"1:9.16.50-1~deb11u2","bullseye-security":"1:9.16.50-1~deb11u4"},"fixed_version":"1:9.16.15-1","urgency":"not yet assigned"},"forky":{"status":"resolved","repositories":{"forky":"1:9.20.20-1"},"fixed_version":"1:9.16.15-1","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"1:9.20.20-1"},"fixed_version":"1:9.16.15-1","urgency":"not yet assigned"},"trixie":{"status":"resolved","repositories":{"trixie":"1:9.20.15-1~deb13u1","trixie-security":"1:9.20.18-1~deb13u1"},"fixed_version":"1:9.16.15-1","urgency":"not yet assigned"}}},"CVE-2021-25218":{"description":"In BIND 9.16.19, 9.17.16. Also, version 9.16.19-S1 of BIND Supported Preview Edition When a vulnerable version of named receives a query under the circumstances described above, the named process will terminate due to a failed assertion check. The vulnerability affects only BIND 9 releases 9.16.19, 9.17.16, and release 9.16.19-S1 of the BIND Supported Preview Edition.","scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"1:9.18.41-1~deb12u1","bookworm-security":"1:9.18.44-1~deb12u1"},"fixed_version":"0","urgency":"unimportant"},"bullseye":{"status":"resolved","repositories":{"bullseye":"1:9.16.50-1~deb11u2","bullseye-security":"1:9.16.50-1~deb11u4"},"fixed_version":"0","urgency":"unimportant"},"forky":{"status":"resolved","repositories":{"forky":"1:9.20.20-1"},"fixed_version":"0","urgency":"unimportant"},"sid":{"status":"resolved","repositories":{"sid":"1:9.20.20-1"},"fixed_version":"0","urgency":"unimportant"},"trixie":{"status":"resolved","repositories":{"trixie":"1:9.20.15-1~deb13u1","trixie-security":"1:9.20.18-1~deb13u1"},"fixed_version":"0","urgency":"unimportant"}}},"CVE-2021-25219":{"description":"In BIND 9.3.0 -> 9.11.35, 9.12.0 -> 9.16.21, and versions 9.9.3-S1 -> 9.11.35-S1 and 9.16.8-S1 -> 9.16.21-S1 of BIND Supported Preview Edition, as well as release versions 9.17.0 -> 9.17.18 of the BIND 9.17 development branch, exploitation of broken authoritative servers using a flaw in response processing can cause degradation in BIND resolver performance. The way the lame cache is currently designed makes it possible for its internal data structures to grow almost infinitely, which may cause significant delays in client query processing.","scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"1:9.18.41-1~deb12u1","bookworm-security":"1:9.18.44-1~deb12u1"},"fixed_version":"1:9.17.19-1","urgency":"not yet assigned"},"bullseye":{"status":"resolved","repositories":{"bullseye":"1:9.16.50-1~deb11u2","bullseye-security":"1:9.16.50-1~deb11u4"},"fixed_version":"1:9.16.22-1~deb11u1","urgency":"not yet assigned"},"forky":{"status":"resolved","repositories":{"forky":"1:9.20.20-1"},"fixed_version":"1:9.17.19-1","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"1:9.20.20-1"},"fixed_version":"1:9.17.19-1","urgency":"not yet assigned"},"trixie":{"status":"resolved","repositories":{"trixie":"1:9.20.15-1~deb13u1","trixie-security":"1:9.20.18-1~deb13u1"},"fixed_version":"1:9.17.19-1","urgency":"not yet assigned"}}},"CVE-2021-25220":{"description":"BIND 9.11.0 -> 9.11.36 9.12.0 -> 9.16.26 9.17.0 -> 9.18.0 BIND Supported Preview Editions: 9.11.4-S1 -> 9.11.36-S1 9.16.8-S1 -> 9.16.26-S1 Versions of BIND 9 earlier than those shown - back to 9.1.0, including Supported Preview Editions - are also believed to be affected but have not been tested as they are EOL. The cache could become poisoned with incorrect records leading to queries being made to the wrong servers, which might also result in false information being returned to clients.","scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"1:9.18.41-1~deb12u1","bookworm-security":"1:9.18.44-1~deb12u1"},"fixed_version":"1:9.18.1-1","urgency":"not yet assigned"},"bullseye":{"status":"resolved","repositories":{"bullseye":"1:9.16.50-1~deb11u2","bullseye-security":"1:9.16.50-1~deb11u4"},"fixed_version":"1:9.16.27-1~deb11u1","urgency":"not yet assigned"},"forky":{"status":"resolved","repositories":{"forky":"1:9.20.20-1"},"fixed_version":"1:9.18.1-1","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"1:9.20.20-1"},"fixed_version":"1:9.18.1-1","urgency":"not yet assigned"},"trixie":{"status":"resolved","repositories":{"trixie":"1:9.20.15-1~deb13u1","trixie-security":"1:9.20.18-1~deb13u1"},"fixed_version":"1:9.18.1-1","urgency":"not yet assigned"}}},"CVE-2022-0396":{"description":"BIND 9.16.11 -> 9.16.26, 9.17.0 -> 9.18.0 and versions 9.16.11-S1 -> 9.16.26-S1 of the BIND Supported Preview Edition. Specifically crafted TCP streams can cause connections to BIND to remain in CLOSE_WAIT status for an indefinite period of time, even after the client has terminated the connection.","scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"1:9.18.41-1~deb12u1","bookworm-security":"1:9.18.44-1~deb12u1"},"fixed_version":"1:9.18.1-1","urgency":"not yet assigned"},"bullseye":{"status":"resolved","repositories":{"bullseye":"1:9.16.50-1~deb11u2","bullseye-security":"1:9.16.50-1~deb11u4"},"fixed_version":"1:9.16.27-1~deb11u1","urgency":"not yet assigned"},"forky":{"status":"resolved","repositories":{"forky":"1:9.20.20-1"},"fixed_version":"1:9.18.1-1","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"1:9.20.20-1"},"fixed_version":"1:9.18.1-1","urgency":"not yet assigned"},"trixie":{"status":"resolved","repositories":{"trixie":"1:9.20.15-1~deb13u1","trixie-security":"1:9.20.18-1~deb13u1"},"fixed_version":"1:9.18.1-1","urgency":"not yet assigned"}}},"CVE-2022-0635":{"description":"Versions affected: BIND 9.18.0 When a vulnerable version of named receives a series of specific queries, the named process will eventually terminate due to a failed assertion check.","scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"1:9.18.41-1~deb12u1","bookworm-security":"1:9.18.44-1~deb12u1"},"fixed_version":"1:9.18.1-1","urgency":"not yet assigned"},"bullseye":{"status":"resolved","repositories":{"bullseye":"1:9.16.50-1~deb11u2","bullseye-security":"1:9.16.50-1~deb11u4"},"fixed_version":"0","urgency":"unimportant"},"forky":{"status":"resolved","repositories":{"forky":"1:9.20.20-1"},"fixed_version":"1:9.18.1-1","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"1:9.20.20-1"},"fixed_version":"1:9.18.1-1","urgency":"not yet assigned"},"trixie":{"status":"resolved","repositories":{"trixie":"1:9.20.15-1~deb13u1","trixie-security":"1:9.20.18-1~deb13u1"},"fixed_version":"1:9.18.1-1","urgency":"not yet assigned"}}},"CVE-2022-0667":{"description":"When the vulnerability is triggered the BIND process will exit. BIND 9.18.0","scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"1:9.18.41-1~deb12u1","bookworm-security":"1:9.18.44-1~deb12u1"},"fixed_version":"1:9.18.1-1","urgency":"not yet assigned"},"bullseye":{"status":"resolved","repositories":{"bullseye":"1:9.16.50-1~deb11u2","bullseye-security":"1:9.16.50-1~deb11u4"},"fixed_version":"0","urgency":"unimportant"},"forky":{"status":"resolved","repositories":{"forky":"1:9.20.20-1"},"fixed_version":"1:9.18.1-1","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"1:9.20.20-1"},"fixed_version":"1:9.18.1-1","urgency":"not yet assigned"},"trixie":{"status":"resolved","repositories":{"trixie":"1:9.20.15-1~deb13u1","trixie-security":"1:9.20.18-1~deb13u1"},"fixed_version":"1:9.18.1-1","urgency":"not yet assigned"}}},"CVE-2022-1183":{"description":"On vulnerable configurations, the named daemon may, in some circumstances, terminate with an assertion failure. Vulnerable configurations are those that include a reference to http within the listen-on statements in their named.conf. TLS is used by both DNS over TLS (DoT) and DNS over HTTPS (DoH), but configurations using DoT alone are unaffected. Affects BIND 9.18.0 -> 9.18.2 and version 9.19.0 of the BIND 9.19 development branch.","scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"1:9.18.41-1~deb12u1","bookworm-security":"1:9.18.44-1~deb12u1"},"fixed_version":"1:9.18.3-1","urgency":"not yet assigned"},"bullseye":{"status":"resolved","repositories":{"bullseye":"1:9.16.50-1~deb11u2","bullseye-security":"1:9.16.50-1~deb11u4"},"fixed_version":"0","urgency":"unimportant"},"forky":{"status":"resolved","repositories":{"forky":"1:9.20.20-1"},"fixed_version":"1:9.18.3-1","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"1:9.20.20-1"},"fixed_version":"1:9.18.3-1","urgency":"not yet assigned"},"trixie":{"status":"resolved","repositories":{"trixie":"1:9.20.15-1~deb13u1","trixie-security":"1:9.20.18-1~deb13u1"},"fixed_version":"1:9.18.3-1","urgency":"not yet assigned"}}},"CVE-2022-2795":{"description":"By flooding the target resolver with queries exploiting this flaw an attacker can significantly impair the resolver's performance, effectively denying legitimate clients access to the DNS resolution service.","scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"1:9.18.41-1~deb12u1","bookworm-security":"1:9.18.44-1~deb12u1"},"fixed_version":"1:9.18.7-1","urgency":"not yet assigned"},"bullseye":{"status":"resolved","repositories":{"bullseye":"1:9.16.50-1~deb11u2","bullseye-security":"1:9.16.50-1~deb11u4"},"fixed_version":"1:9.16.33-1~deb11u1","urgency":"not yet assigned"},"forky":{"status":"resolved","repositories":{"forky":"1:9.20.20-1"},"fixed_version":"1:9.18.7-1","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"1:9.20.20-1"},"fixed_version":"1:9.18.7-1","urgency":"not yet assigned"},"trixie":{"status":"resolved","repositories":{"trixie":"1:9.20.15-1~deb13u1","trixie-security":"1:9.20.18-1~deb13u1"},"fixed_version":"1:9.18.7-1","urgency":"not yet assigned"}}},"CVE-2022-2881":{"description":"The underlying bug might cause read past end of the buffer and either read memory it should not read, or crash the process.","scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"1:9.18.41-1~deb12u1","bookworm-security":"1:9.18.44-1~deb12u1"},"fixed_version":"1:9.18.7-1","urgency":"not yet assigned"},"bullseye":{"status":"open","repositories":{"bullseye":"1:9.16.50-1~deb11u2","bullseye-security":"1:9.16.50-1~deb11u4"},"urgency":"not yet assigned","nodsa":"Flawed code present in 9.16 but masked by the way the httpd objects are reset between messages","nodsa_reason":"ignored"},"forky":{"status":"resolved","repositories":{"forky":"1:9.20.20-1"},"fixed_version":"1:9.18.7-1","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"1:9.20.20-1"},"fixed_version":"1:9.18.7-1","urgency":"not yet assigned"},"trixie":{"status":"resolved","repositories":{"trixie":"1:9.20.15-1~deb13u1","trixie-security":"1:9.20.18-1~deb13u1"},"fixed_version":"1:9.18.7-1","urgency":"not yet assigned"}}},"CVE-2022-2906":{"description":"An attacker can leverage this flaw to gradually erode available memory to the point where named crashes for lack of resources. Upon restart the attacker would have to begin again, but nevertheless there is the potential to deny service.","scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"1:9.18.41-1~deb12u1","bookworm-security":"1:9.18.44-1~deb12u1"},"fixed_version":"1:9.18.7-1","urgency":"not yet assigned"},"bullseye":{"status":"resolved","repositories":{"bullseye":"1:9.16.50-1~deb11u2","bullseye-security":"1:9.16.50-1~deb11u4"},"fixed_version":"0","urgency":"unimportant"},"forky":{"status":"resolved","repositories":{"forky":"1:9.20.20-1"},"fixed_version":"1:9.18.7-1","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"1:9.20.20-1"},"fixed_version":"1:9.18.7-1","urgency":"not yet assigned"},"trixie":{"status":"resolved","repositories":{"trixie":"1:9.20.15-1~deb13u1","trixie-security":"1:9.20.18-1~deb13u1"},"fixed_version":"1:9.18.7-1","urgency":"not yet assigned"}}},"CVE-2022-3080":{"description":"By sending specific queries to the resolver, an attacker can cause named to crash.","scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"1:9.18.41-1~deb12u1","bookworm-security":"1:9.18.44-1~deb12u1"},"fixed_version":"1:9.18.7-1","urgency":"not yet assigned"},"bullseye":{"status":"resolved","repositories":{"bullseye":"1:9.16.50-1~deb11u2","bullseye-security":"1:9.16.50-1~deb11u4"},"fixed_version":"1:9.16.33-1~deb11u1","urgency":"not yet assigned"},"forky":{"status":"resolved","repositories":{"forky":"1:9.20.20-1"},"fixed_version":"1:9.18.7-1","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"1:9.20.20-1"},"fixed_version":"1:9.18.7-1","urgency":"not yet assigned"},"trixie":{"status":"resolved","repositories":{"trixie":"1:9.20.15-1~deb13u1","trixie-security":"1:9.20.18-1~deb13u1"},"fixed_version":"1:9.18.7-1","urgency":"not yet assigned"}}},"CVE-2022-3094":{"description":"Sending a flood of dynamic DNS updates may cause `named` to allocate large amounts of memory. This, in turn, may cause `named` to exit due to a lack of free memory. We are not aware of any cases where this has been exploited.  Memory is allocated prior to the checking of access permissions (ACLs) and is retained during the processing of a dynamic update from a client whose access credentials are accepted. Memory allocated to clients that are not permitted to send updates is released immediately upon rejection. The scope of this vulnerability is limited therefore to trusted clients who are permitted to make dynamic zone changes.  If a dynamic update is REFUSED, memory will be released again very quickly. Therefore it is only likely to be possible to degrade or stop `named` by sending a flood of unaccepted dynamic updates comparable in magnitude to a query flood intended to achieve the same detrimental outcome.  BIND 9.11 and earlier branches are also affected, but through exhaustion of internal resources rather than memory constraints. This may reduce performance but should not be a significant problem for most servers. Therefore we don't intend to address this for BIND versions prior to BIND 9.16. This issue affects BIND 9 versions 9.16.0 through 9.16.36, 9.18.0 through 9.18.10, 9.19.0 through 9.19.8, and 9.16.8-S1 through 9.16.36-S1.","scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"1:9.18.41-1~deb12u1","bookworm-security":"1:9.18.44-1~deb12u1"},"fixed_version":"1:9.18.11-1","urgency":"not yet assigned"},"bullseye":{"status":"resolved","repositories":{"bullseye":"1:9.16.50-1~deb11u2","bullseye-security":"1:9.16.50-1~deb11u4"},"fixed_version":"1:9.16.37-1~deb11u1","urgency":"not yet assigned"},"forky":{"status":"resolved","repositories":{"forky":"1:9.20.20-1"},"fixed_version":"1:9.18.11-1","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"1:9.20.20-1"},"fixed_version":"1:9.18.11-1","urgency":"not yet assigned"},"trixie":{"status":"resolved","repositories":{"trixie":"1:9.20.15-1~deb13u1","trixie-security":"1:9.20.18-1~deb13u1"},"fixed_version":"1:9.18.11-1","urgency":"not yet assigned"}}},"CVE-2022-3488":{"description":"Processing of repeated responses to the same query, where both responses contain ECS pseudo-options, but where the first is broken in some way, can cause BIND to exit with an assertion failure.  'Broken' in this context is anything that would cause the resolver to reject the query response, such as a mismatch between query and answer name. This issue affects BIND 9 versions 9.11.4-S1 through 9.11.37-S1 and 9.16.8-S1 through 9.16.36-S1.","scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"1:9.18.41-1~deb12u1","bookworm-security":"1:9.18.44-1~deb12u1"},"fixed_version":"0","urgency":"unimportant"},"bullseye":{"status":"resolved","repositories":{"bullseye":"1:9.16.50-1~deb11u2","bullseye-security":"1:9.16.50-1~deb11u4"},"fixed_version":"0","urgency":"unimportant"},"forky":{"status":"resolved","repositories":{"forky":"1:9.20.20-1"},"fixed_version":"0","urgency":"unimportant"},"sid":{"status":"resolved","repositories":{"sid":"1:9.20.20-1"},"fixed_version":"0","urgency":"unimportant"},"trixie":{"status":"resolved","repositories":{"trixie":"1:9.20.15-1~deb13u1","trixie-security":"1:9.20.18-1~deb13u1"},"fixed_version":"0","urgency":"unimportant"}}},"CVE-2022-3736":{"description":"BIND 9 resolver can crash when stale cache and stale answers are enabled, option `stale-answer-client-timeout` is set to a positive integer, and the resolver receives an RRSIG query. This issue affects BIND 9 versions 9.16.12 through 9.16.36, 9.18.0 through 9.18.10, 9.19.0 through 9.19.8, and 9.16.12-S1 through 9.16.36-S1.","scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"1:9.18.41-1~deb12u1","bookworm-security":"1:9.18.44-1~deb12u1"},"fixed_version":"1:9.18.11-1","urgency":"not yet assigned"},"bullseye":{"status":"resolved","repositories":{"bullseye":"1:9.16.50-1~deb11u2","bullseye-security":"1:9.16.50-1~deb11u4"},"fixed_version":"1:9.16.37-1~deb11u1","urgency":"not yet assigned"},"forky":{"status":"resolved","repositories":{"forky":"1:9.20.20-1"},"fixed_version":"1:9.18.11-1","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"1:9.20.20-1"},"fixed_version":"1:9.18.11-1","urgency":"not yet assigned"},"trixie":{"status":"resolved","repositories":{"trixie":"1:9.20.15-1~deb13u1","trixie-security":"1:9.20.18-1~deb13u1"},"fixed_version":"1:9.18.11-1","urgency":"not yet assigned"}}},"CVE-2022-38177":{"description":"By spoofing the target resolver with responses that have a malformed ECDSA signature, an attacker can trigger a small memory leak. It is possible to gradually erode available memory to the point where named crashes for lack of resources.","scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"1:9.18.41-1~deb12u1","bookworm-security":"1:9.18.44-1~deb12u1"},"fixed_version":"1:9.17.20-1","urgency":"not yet assigned"},"bullseye":{"status":"resolved","repositories":{"bullseye":"1:9.16.50-1~deb11u2","bullseye-security":"1:9.16.50-1~deb11u4"},"fixed_version":"1:9.16.33-1~deb11u1","urgency":"not yet assigned"},"forky":{"status":"resolved","repositories":{"forky":"1:9.20.20-1"},"fixed_version":"1:9.17.20-1","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"1:9.20.20-1"},"fixed_version":"1:9.17.20-1","urgency":"not yet assigned"},"trixie":{"status":"resolved","repositories":{"trixie":"1:9.20.15-1~deb13u1","trixie-security":"1:9.20.18-1~deb13u1"},"fixed_version":"1:9.17.20-1","urgency":"not yet assigned"}}},"CVE-2022-38178":{"description":"By spoofing the target resolver with responses that have a malformed EdDSA signature, an attacker can trigger a small memory leak. It is possible to gradually erode available memory to the point where named crashes for lack of resources.","scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"1:9.18.41-1~deb12u1","bookworm-security":"1:9.18.44-1~deb12u1"},"fixed_version":"1:9.18.7-1","urgency":"not yet assigned"},"bullseye":{"status":"resolved","repositories":{"bullseye":"1:9.16.50-1~deb11u2","bullseye-security":"1:9.16.50-1~deb11u4"},"fixed_version":"1:9.16.33-1~deb11u1","urgency":"not yet assigned"},"forky":{"status":"resolved","repositories":{"forky":"1:9.20.20-1"},"fixed_version":"1:9.18.7-1","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"1:9.20.20-1"},"fixed_version":"1:9.18.7-1","urgency":"not yet assigned"},"trixie":{"status":"resolved","repositories":{"trixie":"1:9.20.15-1~deb13u1","trixie-security":"1:9.20.18-1~deb13u1"},"fixed_version":"1:9.18.7-1","urgency":"not yet assigned"}}},"CVE-2022-3924":{"description":"This issue can affect BIND 9 resolvers with `stale-answer-enable yes;` that also make use of the option `stale-answer-client-timeout`, configured with a value greater than zero.  If the resolver receives many queries that require recursion, there will be a corresponding increase in the number of clients that are waiting for recursion to complete. If there are sufficient clients already waiting when a new client query is received so that it is necessary to SERVFAIL the longest waiting client (see BIND 9 ARM `recursive-clients` limit and soft quota), then it is possible for a race to occur between providing a stale answer to this older client and sending an early timeout SERVFAIL, which may cause an assertion failure. This issue affects BIND 9 versions 9.16.12 through 9.16.36, 9.18.0 through 9.18.10, 9.19.0 through 9.19.8, and 9.16.12-S1 through 9.16.36-S1.","scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"1:9.18.41-1~deb12u1","bookworm-security":"1:9.18.44-1~deb12u1"},"fixed_version":"1:9.18.11-1","urgency":"not yet assigned"},"bullseye":{"status":"resolved","repositories":{"bullseye":"1:9.16.50-1~deb11u2","bullseye-security":"1:9.16.50-1~deb11u4"},"fixed_version":"1:9.16.37-1~deb11u1","urgency":"not yet assigned"},"forky":{"status":"resolved","repositories":{"forky":"1:9.20.20-1"},"fixed_version":"1:9.18.11-1","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"1:9.20.20-1"},"fixed_version":"1:9.18.11-1","urgency":"not yet assigned"},"trixie":{"status":"resolved","repositories":{"trixie":"1:9.20.15-1~deb13u1","trixie-security":"1:9.20.18-1~deb13u1"},"fixed_version":"1:9.18.11-1","urgency":"not yet assigned"}}},"CVE-2023-2828":{"description":"Every `named` instance configured to run as a recursive resolver maintains a cache database holding the responses to the queries it has recently sent to authoritative servers. The size limit for that cache database can be configured using the `max-cache-size` statement in the configuration file; it defaults to 90% of the total amount of memory available on the host. When the size of the cache reaches 7/8 of the configured limit, a cache-cleaning algorithm starts to remove expired and/or least-recently used RRsets from the cache, to keep memory use below the configured limit.  It has been discovered that the effectiveness of the cache-cleaning algorithm used in `named` can be severely diminished by querying the resolver for specific RRsets in a certain order, effectively allowing the configured `max-cache-size` limit to be significantly exceeded. This issue affects BIND 9 versions 9.11.0 through 9.16.41, 9.18.0 through 9.18.15, 9.19.0 through 9.19.13, 9.11.3-S1 through 9.16.41-S1, and 9.18.11-S1 through 9.18.15-S1.","scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"1:9.18.41-1~deb12u1","bookworm-security":"1:9.18.44-1~deb12u1"},"fixed_version":"1:9.18.16-1~deb12u1","urgency":"not yet assigned"},"bullseye":{"status":"resolved","repositories":{"bullseye":"1:9.16.50-1~deb11u2","bullseye-security":"1:9.16.50-1~deb11u4"},"fixed_version":"1:9.16.42-1~deb11u1","urgency":"not yet assigned"},"forky":{"status":"resolved","repositories":{"forky":"1:9.20.20-1"},"fixed_version":"1:9.18.16-1","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"1:9.20.20-1"},"fixed_version":"1:9.18.16-1","urgency":"not yet assigned"},"trixie":{"status":"resolved","repositories":{"trixie":"1:9.20.15-1~deb13u1","trixie-security":"1:9.20.18-1~deb13u1"},"fixed_version":"1:9.18.16-1","urgency":"not yet assigned"}}},"CVE-2023-2829":{"description":"A `named` instance configured to run as a DNSSEC-validating recursive resolver with the Aggressive Use of DNSSEC-Validated Cache (RFC 8198) option (`synth-from-dnssec`) enabled can be remotely terminated using a zone with a malformed NSEC record. This issue affects BIND 9 versions 9.16.8-S1 through 9.16.41-S1 and 9.18.11-S1 through 9.18.15-S1.","scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"1:9.18.41-1~deb12u1","bookworm-security":"1:9.18.44-1~deb12u1"},"fixed_version":"0","urgency":"unimportant"},"bullseye":{"status":"resolved","repositories":{"bullseye":"1:9.16.50-1~deb11u2","bullseye-security":"1:9.16.50-1~deb11u4"},"fixed_version":"0","urgency":"unimportant"},"forky":{"status":"resolved","repositories":{"forky":"1:9.20.20-1"},"fixed_version":"0","urgency":"unimportant"},"sid":{"status":"resolved","repositories":{"sid":"1:9.20.20-1"},"fixed_version":"0","urgency":"unimportant"},"trixie":{"status":"resolved","repositories":{"trixie":"1:9.20.15-1~deb13u1","trixie-security":"1:9.20.18-1~deb13u1"},"fixed_version":"0","urgency":"unimportant"}}},"CVE-2023-2911":{"description":"If the `recursive-clients` quota is reached on a BIND 9 resolver configured with both `stale-answer-enable yes;` and `stale-answer-client-timeout 0;`, a sequence of serve-stale-related lookups could cause `named` to loop and terminate unexpectedly due to a stack overflow. This issue affects BIND 9 versions 9.16.33 through 9.16.41, 9.18.7 through 9.18.15, 9.16.33-S1 through 9.16.41-S1, and 9.18.11-S1 through 9.18.15-S1.","scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"1:9.18.41-1~deb12u1","bookworm-security":"1:9.18.44-1~deb12u1"},"fixed_version":"1:9.18.16-1~deb12u1","urgency":"not yet assigned"},"bullseye":{"status":"resolved","repositories":{"bullseye":"1:9.16.50-1~deb11u2","bullseye-security":"1:9.16.50-1~deb11u4"},"fixed_version":"1:9.16.42-1~deb11u1","urgency":"not yet assigned"},"forky":{"status":"resolved","repositories":{"forky":"1:9.20.20-1"},"fixed_version":"1:9.18.16-1","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"1:9.20.20-1"},"fixed_version":"1:9.18.16-1","urgency":"not yet assigned"},"trixie":{"status":"resolved","repositories":{"trixie":"1:9.20.15-1~deb13u1","trixie-security":"1:9.20.18-1~deb13u1"},"fixed_version":"1:9.18.16-1","urgency":"not yet assigned"}}},"CVE-2023-3341":{"description":"The code that processes control channel messages sent to `named` calls certain functions recursively during packet parsing. Recursion depth is only limited by the maximum accepted packet size; depending on the environment, this may cause the packet-parsing code to run out of available stack memory, causing `named` to terminate unexpectedly. Since each incoming control channel message is fully parsed before its contents are authenticated, exploiting this flaw does not require the attacker to hold a valid RNDC key; only network access to the control channel's configured TCP port is necessary. This issue affects BIND 9 versions 9.2.0 through 9.16.43, 9.18.0 through 9.18.18, 9.19.0 through 9.19.16, 9.9.3-S1 through 9.16.43-S1, and 9.18.0-S1 through 9.18.18-S1.","debianbug":1052416,"scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"1:9.18.41-1~deb12u1","bookworm-security":"1:9.18.44-1~deb12u1"},"fixed_version":"1:9.18.19-1~deb12u1","urgency":"not yet assigned"},"bullseye":{"status":"resolved","repositories":{"bullseye":"1:9.16.50-1~deb11u2","bullseye-security":"1:9.16.50-1~deb11u4"},"fixed_version":"1:9.16.44-1~deb11u1","urgency":"not yet assigned"},"forky":{"status":"resolved","repositories":{"forky":"1:9.20.20-1"},"fixed_version":"1:9.19.17-1","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"1:9.20.20-1"},"fixed_version":"1:9.19.17-1","urgency":"not yet assigned"},"trixie":{"status":"resolved","repositories":{"trixie":"1:9.20.15-1~deb13u1","trixie-security":"1:9.20.18-1~deb13u1"},"fixed_version":"1:9.19.17-1","urgency":"not yet assigned"}}},"CVE-2023-4236":{"description":"A flaw in the networking code handling DNS-over-TLS queries may cause `named` to terminate unexpectedly due to an assertion failure. This happens when internal data structures are incorrectly reused under significant DNS-over-TLS query load. This issue affects BIND 9 versions 9.18.0 through 9.18.18 and 9.18.11-S1 through 9.18.18-S1.","debianbug":1052417,"scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"1:9.18.41-1~deb12u1","bookworm-security":"1:9.18.44-1~deb12u1"},"fixed_version":"1:9.18.19-1~deb12u1","urgency":"not yet assigned"},"bullseye":{"status":"resolved","repositories":{"bullseye":"1:9.16.50-1~deb11u2","bullseye-security":"1:9.16.50-1~deb11u4"},"fixed_version":"0","urgency":"unimportant"},"forky":{"status":"resolved","repositories":{"forky":"1:9.20.20-1"},"fixed_version":"1:9.19.17-1","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"1:9.20.20-1"},"fixed_version":"1:9.19.17-1","urgency":"not yet assigned"},"trixie":{"status":"resolved","repositories":{"trixie":"1:9.20.15-1~deb13u1","trixie-security":"1:9.20.18-1~deb13u1"},"fixed_version":"1:9.19.17-1","urgency":"not yet assigned"}}},"CVE-2023-4408":{"description":"The DNS message parsing code in `named` includes a section whose computational complexity is overly high. It does not cause problems for typical DNS traffic, but crafted queries and responses may cause excessive CPU load on the affected `named` instance by exploiting this flaw. This issue affects both authoritative servers and recursive resolvers. This issue affects BIND 9 versions 9.0.0 through 9.16.45, 9.18.0 through 9.18.21, 9.19.0 through 9.19.19, 9.9.3-S1 through 9.11.37-S1, 9.16.8-S1 through 9.16.45-S1, and 9.18.11-S1 through 9.18.21-S1.","scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"1:9.18.41-1~deb12u1","bookworm-security":"1:9.18.44-1~deb12u1"},"fixed_version":"1:9.18.24-1","urgency":"not yet assigned"},"bullseye":{"status":"resolved","repositories":{"bullseye":"1:9.16.50-1~deb11u2","bullseye-security":"1:9.16.50-1~deb11u4"},"fixed_version":"1:9.16.48-1","urgency":"not yet assigned"},"forky":{"status":"resolved","repositories":{"forky":"1:9.20.20-1"},"fixed_version":"1:9.19.21-1","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"1:9.20.20-1"},"fixed_version":"1:9.19.21-1","urgency":"not yet assigned"},"trixie":{"status":"resolved","repositories":{"trixie":"1:9.20.15-1~deb13u1","trixie-security":"1:9.20.18-1~deb13u1"},"fixed_version":"1:9.19.21-1","urgency":"not yet assigned"}}},"CVE-2023-50387":{"description":"Certain DNSSEC aspects of the DNS protocol (in RFC 4033, 4034, 4035, 6840, and related RFCs) allow remote attackers to cause a denial of service (CPU consumption) via one or more DNSSEC responses, aka the \"KeyTrap\" issue. One of the concerns is that, when there is a zone with many DNSKEY and RRSIG records, the protocol specification implies that an algorithm must evaluate all combinations of DNSKEY and RRSIG records.","scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"1:9.18.41-1~deb12u1","bookworm-security":"1:9.18.44-1~deb12u1"},"fixed_version":"1:9.18.24-1","urgency":"not yet assigned"},"bullseye":{"status":"resolved","repositories":{"bullseye":"1:9.16.50-1~deb11u2","bullseye-security":"1:9.16.50-1~deb11u4"},"fixed_version":"1:9.16.48-1","urgency":"not yet assigned"},"forky":{"status":"resolved","repositories":{"forky":"1:9.20.20-1"},"fixed_version":"1:9.19.21-1","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"1:9.20.20-1"},"fixed_version":"1:9.19.21-1","urgency":"not yet assigned"},"trixie":{"status":"resolved","repositories":{"trixie":"1:9.20.15-1~deb13u1","trixie-security":"1:9.20.18-1~deb13u1"},"fixed_version":"1:9.19.21-1","urgency":"not yet assigned"}}},"CVE-2023-50868":{"description":"The Closest Encloser Proof aspect of the DNS protocol (in RFC 5155 when RFC 9276 guidance is skipped) allows remote attackers to cause a denial of service (CPU consumption for SHA-1 computations) via DNSSEC responses in a random subdomain attack, aka the \"NSEC3\" issue. The RFC 5155 specification implies that an algorithm must perform thousands of iterations of a hash function in certain situations.","scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"1:9.18.41-1~deb12u1","bookworm-security":"1:9.18.44-1~deb12u1"},"fixed_version":"1:9.18.24-1","urgency":"not yet assigned"},"bullseye":{"status":"resolved","repositories":{"bullseye":"1:9.16.50-1~deb11u2","bullseye-security":"1:9.16.50-1~deb11u4"},"fixed_version":"1:9.16.48-1","urgency":"not yet assigned"},"forky":{"status":"resolved","repositories":{"forky":"1:9.20.20-1"},"fixed_version":"1:9.19.21-1","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"1:9.20.20-1"},"fixed_version":"1:9.19.21-1","urgency":"not yet assigned"},"trixie":{"status":"resolved","repositories":{"trixie":"1:9.20.15-1~deb13u1","trixie-security":"1:9.20.18-1~deb13u1"},"fixed_version":"1:9.19.21-1","urgency":"not yet assigned"}}},"CVE-2023-5517":{"description":"A flaw in query-handling code can cause `named` to exit prematurely with an assertion failure when:    - `nxdomain-redirect <domain>;` is configured, and   - the resolver receives a PTR query for an RFC 1918 address that would normally result in an authoritative NXDOMAIN response. This issue affects BIND 9 versions 9.12.0 through 9.16.45, 9.18.0 through 9.18.21, 9.19.0 through 9.19.19, 9.16.8-S1 through 9.16.45-S1, and 9.18.11-S1 through 9.18.21-S1.","scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"1:9.18.41-1~deb12u1","bookworm-security":"1:9.18.44-1~deb12u1"},"fixed_version":"1:9.18.24-1","urgency":"not yet assigned"},"bullseye":{"status":"resolved","repositories":{"bullseye":"1:9.16.50-1~deb11u2","bullseye-security":"1:9.16.50-1~deb11u4"},"fixed_version":"1:9.16.48-1","urgency":"not yet assigned"},"forky":{"status":"resolved","repositories":{"forky":"1:9.20.20-1"},"fixed_version":"1:9.19.21-1","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"1:9.20.20-1"},"fixed_version":"1:9.19.21-1","urgency":"not yet assigned"},"trixie":{"status":"resolved","repositories":{"trixie":"1:9.20.15-1~deb13u1","trixie-security":"1:9.20.18-1~deb13u1"},"fixed_version":"1:9.19.21-1","urgency":"not yet assigned"}}},"CVE-2023-5679":{"description":"A bad interaction between DNS64 and serve-stale may cause `named` to crash with an assertion failure during recursive resolution, when both of these features are enabled. This issue affects BIND 9 versions 9.16.12 through 9.16.45, 9.18.0 through 9.18.21, 9.19.0 through 9.19.19, 9.16.12-S1 through 9.16.45-S1, and 9.18.11-S1 through 9.18.21-S1.","scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"1:9.18.41-1~deb12u1","bookworm-security":"1:9.18.44-1~deb12u1"},"fixed_version":"1:9.18.24-1","urgency":"not yet assigned"},"bullseye":{"status":"resolved","repositories":{"bullseye":"1:9.16.50-1~deb11u2","bullseye-security":"1:9.16.50-1~deb11u4"},"fixed_version":"1:9.16.48-1","urgency":"not yet assigned"},"forky":{"status":"resolved","repositories":{"forky":"1:9.20.20-1"},"fixed_version":"1:9.19.21-1","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"1:9.20.20-1"},"fixed_version":"1:9.19.21-1","urgency":"not yet assigned"},"trixie":{"status":"resolved","repositories":{"trixie":"1:9.20.15-1~deb13u1","trixie-security":"1:9.20.18-1~deb13u1"},"fixed_version":"1:9.19.21-1","urgency":"not yet assigned"}}},"CVE-2023-5680":{"description":"If a resolver cache has a very large number of ECS records stored for the same name, the process of cleaning the cache database node for this name can significantly impair query performance.  This issue affects BIND 9 versions 9.11.3-S1 through 9.11.37-S1, 9.16.8-S1 through 9.16.45-S1, and 9.18.11-S1 through 9.18.21-S1.","scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"1:9.18.41-1~deb12u1","bookworm-security":"1:9.18.44-1~deb12u1"},"fixed_version":"0","urgency":"unimportant"},"bullseye":{"status":"resolved","repositories":{"bullseye":"1:9.16.50-1~deb11u2","bullseye-security":"1:9.16.50-1~deb11u4"},"fixed_version":"0","urgency":"unimportant"},"forky":{"status":"resolved","repositories":{"forky":"1:9.20.20-1"},"fixed_version":"0","urgency":"unimportant"},"sid":{"status":"resolved","repositories":{"sid":"1:9.20.20-1"},"fixed_version":"0","urgency":"unimportant"},"trixie":{"status":"resolved","repositories":{"trixie":"1:9.20.15-1~deb13u1","trixie-security":"1:9.20.18-1~deb13u1"},"fixed_version":"0","urgency":"unimportant"}}},"CVE-2023-6516":{"description":"To keep its cache database efficient, `named` running as a recursive resolver occasionally attempts to clean up the database. It uses several methods, including some that are asynchronous: a small chunk of memory pointing to the cache element that can be cleaned up is first allocated and then queued for later processing. It was discovered that if the resolver is continuously processing query patterns triggering this type of cache-database maintenance, `named` may not be able to handle the cleanup events in a timely manner. This in turn enables the list of queued cleanup events to grow infinitely large over time, allowing the configured `max-cache-size` limit to be significantly exceeded. This issue affects BIND 9 versions 9.16.0 through 9.16.45 and 9.16.8-S1 through 9.16.45-S1.","scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"1:9.18.41-1~deb12u1","bookworm-security":"1:9.18.44-1~deb12u1"},"fixed_version":"1:9.17.19-1","urgency":"not yet assigned"},"bullseye":{"status":"resolved","repositories":{"bullseye":"1:9.16.50-1~deb11u2","bullseye-security":"1:9.16.50-1~deb11u4"},"fixed_version":"1:9.16.48-1","urgency":"not yet assigned"},"forky":{"status":"resolved","repositories":{"forky":"1:9.20.20-1"},"fixed_version":"1:9.17.19-1","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"1:9.20.20-1"},"fixed_version":"1:9.17.19-1","urgency":"not yet assigned"},"trixie":{"status":"resolved","repositories":{"trixie":"1:9.20.15-1~deb13u1","trixie-security":"1:9.20.18-1~deb13u1"},"fixed_version":"1:9.17.19-1","urgency":"not yet assigned"}}},"CVE-2024-0760":{"description":"A malicious client can send many DNS messages over TCP, potentially causing the server to become unstable while the attack is in progress. The server may recover after the attack ceases. Use of ACLs will not mitigate the attack.  This issue affects BIND 9 versions 9.18.1 through 9.18.27, 9.19.0 through 9.19.24, and 9.18.11-S1 through 9.18.27-S1.","scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"1:9.18.41-1~deb12u1","bookworm-security":"1:9.18.44-1~deb12u1"},"fixed_version":"1:9.18.28-1~deb12u1","urgency":"not yet assigned"},"bullseye":{"status":"resolved","repositories":{"bullseye":"1:9.16.50-1~deb11u2","bullseye-security":"1:9.16.50-1~deb11u4"},"fixed_version":"0","urgency":"unimportant"},"forky":{"status":"resolved","repositories":{"forky":"1:9.20.20-1"},"fixed_version":"1:9.20.0-1","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"1:9.20.20-1"},"fixed_version":"1:9.20.0-1","urgency":"not yet assigned"},"trixie":{"status":"resolved","repositories":{"trixie":"1:9.20.15-1~deb13u1","trixie-security":"1:9.20.18-1~deb13u1"},"fixed_version":"1:9.20.0-1","urgency":"not yet assigned"}}},"CVE-2024-11187":{"description":"It is possible to construct a zone such that some queries to it will generate responses containing numerous records in the Additional section. An attacker sending many such queries can cause either the authoritative server itself or an independent resolver to use disproportionate resources processing the queries. Zones will usually need to have been deliberately crafted to attack this exposure. This issue affects BIND 9 versions 9.11.0 through 9.11.37, 9.16.0 through 9.16.50, 9.18.0 through 9.18.32, 9.20.0 through 9.20.4, 9.21.0 through 9.21.3, 9.11.3-S1 through 9.11.37-S1, 9.16.8-S1 through 9.16.50-S1, and 9.18.11-S1 through 9.18.32-S1.","debianbug":1094735,"scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"1:9.18.41-1~deb12u1","bookworm-security":"1:9.18.44-1~deb12u1"},"fixed_version":"1:9.18.33-1~deb12u2","urgency":"not yet assigned"},"bullseye":{"status":"resolved","repositories":{"bullseye":"1:9.16.50-1~deb11u2","bullseye-security":"1:9.16.50-1~deb11u4"},"fixed_version":"1:9.16.50-1~deb11u3","urgency":"not yet assigned"},"forky":{"status":"resolved","repositories":{"forky":"1:9.20.20-1"},"fixed_version":"1:9.20.5-1","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"1:9.20.20-1"},"fixed_version":"1:9.20.5-1","urgency":"not yet assigned"},"trixie":{"status":"resolved","repositories":{"trixie":"1:9.20.15-1~deb13u1","trixie-security":"1:9.20.18-1~deb13u1"},"fixed_version":"1:9.20.5-1","urgency":"not yet assigned"}}},"CVE-2024-12705":{"description":"Clients using DNS-over-HTTPS (DoH) can exhaust a DNS resolver's CPU and/or memory by flooding it with crafted valid or invalid HTTP/2 traffic. This issue affects BIND 9 versions 9.18.0 through 9.18.32, 9.20.0 through 9.20.4, 9.21.0 through 9.21.3, and 9.18.11-S1 through 9.18.32-S1.","debianbug":1094735,"scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"1:9.18.41-1~deb12u1","bookworm-security":"1:9.18.44-1~deb12u1"},"fixed_version":"1:9.18.33-1~deb12u2","urgency":"not yet assigned"},"bullseye":{"status":"resolved","repositories":{"bullseye":"1:9.16.50-1~deb11u2","bullseye-security":"1:9.16.50-1~deb11u4"},"fixed_version":"0","urgency":"unimportant"},"forky":{"status":"resolved","repositories":{"forky":"1:9.20.20-1"},"fixed_version":"1:9.20.5-1","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"1:9.20.20-1"},"fixed_version":"1:9.20.5-1","urgency":"not yet assigned"},"trixie":{"status":"resolved","repositories":{"trixie":"1:9.20.15-1~deb13u1","trixie-security":"1:9.20.18-1~deb13u1"},"fixed_version":"1:9.20.5-1","urgency":"not yet assigned"}}},"CVE-2024-1737":{"description":"Resolver caches and authoritative zone databases that hold significant numbers of RRs for the same hostname (of any RTYPE) can suffer from degraded performance as content is being added or updated, and also when handling client queries for this name. This issue affects BIND 9 versions 9.11.0 through 9.11.37, 9.16.0 through 9.16.50, 9.18.0 through 9.18.27, 9.19.0 through 9.19.24, 9.11.4-S1 through 9.11.37-S1, 9.16.8-S1 through 9.16.50-S1, and 9.18.11-S1 through 9.18.27-S1.","scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"1:9.18.41-1~deb12u1","bookworm-security":"1:9.18.44-1~deb12u1"},"fixed_version":"1:9.18.28-1~deb12u1","urgency":"not yet assigned"},"bullseye":{"status":"resolved","repositories":{"bullseye":"1:9.16.50-1~deb11u2","bullseye-security":"1:9.16.50-1~deb11u4"},"fixed_version":"1:9.16.50-1~deb11u1","urgency":"not yet assigned"},"forky":{"status":"resolved","repositories":{"forky":"1:9.20.20-1"},"fixed_version":"1:9.20.0-1","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"1:9.20.20-1"},"fixed_version":"1:9.20.0-1","urgency":"not yet assigned"},"trixie":{"status":"resolved","repositories":{"trixie":"1:9.20.15-1~deb13u1","trixie-security":"1:9.20.18-1~deb13u1"},"fixed_version":"1:9.20.0-1","urgency":"not yet assigned"}}},"CVE-2024-1975":{"description":"If a server hosts a zone containing a \"KEY\" Resource Record, or a resolver DNSSEC-validates a \"KEY\" Resource Record from a DNSSEC-signed domain in cache, a client can exhaust resolver CPU resources by sending a stream of SIG(0) signed requests. This issue affects BIND 9 versions 9.0.0 through 9.11.37, 9.16.0 through 9.16.50, 9.18.0 through 9.18.27, 9.19.0 through 9.19.24, 9.9.3-S1 through 9.11.37-S1, 9.16.8-S1 through 9.16.49-S1, and 9.18.11-S1 through 9.18.27-S1.","scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"1:9.18.41-1~deb12u1","bookworm-security":"1:9.18.44-1~deb12u1"},"fixed_version":"1:9.18.28-1~deb12u1","urgency":"not yet assigned"},"bullseye":{"status":"resolved","repositories":{"bullseye":"1:9.16.50-1~deb11u2","bullseye-security":"1:9.16.50-1~deb11u4"},"fixed_version":"1:9.16.50-1~deb11u1","urgency":"not yet assigned"},"forky":{"status":"resolved","repositories":{"forky":"1:9.20.20-1"},"fixed_version":"1:9.20.0-1","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"1:9.20.20-1"},"fixed_version":"1:9.20.0-1","urgency":"not yet assigned"},"trixie":{"status":"resolved","repositories":{"trixie":"1:9.20.15-1~deb13u1","trixie-security":"1:9.20.18-1~deb13u1"},"fixed_version":"1:9.20.0-1","urgency":"not yet assigned"}}},"CVE-2024-4076":{"description":"Client queries that trigger serving stale data and that also require lookups in local authoritative zone data may result in an assertion failure. This issue affects BIND 9 versions 9.16.13 through 9.16.50, 9.18.0 through 9.18.27, 9.19.0 through 9.19.24, 9.11.33-S1 through 9.11.37-S1, 9.16.13-S1 through 9.16.50-S1, and 9.18.11-S1 through 9.18.27-S1.","scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"1:9.18.41-1~deb12u1","bookworm-security":"1:9.18.44-1~deb12u1"},"fixed_version":"1:9.18.28-1~deb12u1","urgency":"not yet assigned"},"bullseye":{"status":"resolved","repositories":{"bullseye":"1:9.16.50-1~deb11u2","bullseye-security":"1:9.16.50-1~deb11u4"},"fixed_version":"1:9.16.50-1~deb11u1","urgency":"not yet assigned"},"forky":{"status":"resolved","repositories":{"forky":"1:9.20.20-1"},"fixed_version":"1:9.20.0-1","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"1:9.20.20-1"},"fixed_version":"1:9.20.0-1","urgency":"not yet assigned"},"trixie":{"status":"resolved","repositories":{"trixie":"1:9.20.15-1~deb13u1","trixie-security":"1:9.20.18-1~deb13u1"},"fixed_version":"1:9.20.0-1","urgency":"not yet assigned"}}},"CVE-2025-13878":{"description":"Malformed BRID/HHIT records can cause `named` to terminate unexpectedly. This issue affects BIND 9 versions 9.18.40 through 9.18.43, 9.20.13 through 9.20.17, 9.21.12 through 9.21.16, 9.18.40-S1 through 9.18.43-S1, and 9.20.13-S1 through 9.20.17-S1.","scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"1:9.18.41-1~deb12u1","bookworm-security":"1:9.18.44-1~deb12u1"},"fixed_version":"1:9.18.44-1~deb12u1","urgency":"not yet assigned"},"bullseye":{"status":"resolved","repositories":{"bullseye":"1:9.16.50-1~deb11u2","bullseye-security":"1:9.16.50-1~deb11u4"},"fixed_version":"0","urgency":"unimportant"},"forky":{"status":"resolved","repositories":{"forky":"1:9.20.20-1"},"fixed_version":"1:9.20.18-1","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"1:9.20.20-1"},"fixed_version":"1:9.20.18-1","urgency":"not yet assigned"},"trixie":{"status":"resolved","repositories":{"trixie":"1:9.20.15-1~deb13u1","trixie-security":"1:9.20.18-1~deb13u1"},"fixed_version":"1:9.20.18-1~deb13u1","urgency":"not yet assigned"}}},"CVE-2025-40775":{"description":"When an incoming DNS protocol message includes a Transaction Signature (TSIG), BIND always checks it.  If the TSIG contains an invalid value in the algorithm field, BIND immediately aborts with an assertion failure. This issue affects BIND 9 versions 9.20.0 through 9.20.8 and 9.21.0 through 9.21.7.","scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"1:9.18.41-1~deb12u1","bookworm-security":"1:9.18.44-1~deb12u1"},"fixed_version":"0","urgency":"unimportant"},"bullseye":{"status":"resolved","repositories":{"bullseye":"1:9.16.50-1~deb11u2","bullseye-security":"1:9.16.50-1~deb11u4"},"fixed_version":"0","urgency":"unimportant"},"forky":{"status":"resolved","repositories":{"forky":"1:9.20.20-1"},"fixed_version":"1:9.20.9-1","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"1:9.20.20-1"},"fixed_version":"1:9.20.9-1","urgency":"not yet assigned"},"trixie":{"status":"resolved","repositories":{"trixie":"1:9.20.15-1~deb13u1","trixie-security":"1:9.20.18-1~deb13u1"},"fixed_version":"1:9.20.9-1","urgency":"not yet assigned"}}},"CVE-2025-40776":{"description":"A `named` caching resolver that is configured to send ECS (EDNS Client Subnet) options may be vulnerable to a cache-poisoning attack. This issue affects BIND 9 versions 9.11.3-S1 through 9.16.50-S1, 9.18.11-S1 through 9.18.37-S1, and 9.20.9-S1 through 9.20.10-S1.","scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"1:9.18.41-1~deb12u1","bookworm-security":"1:9.18.44-1~deb12u1"},"fixed_version":"0","urgency":"unimportant"},"bullseye":{"status":"resolved","repositories":{"bullseye":"1:9.16.50-1~deb11u2","bullseye-security":"1:9.16.50-1~deb11u4"},"fixed_version":"0","urgency":"unimportant"},"forky":{"status":"resolved","repositories":{"forky":"1:9.20.20-1"},"fixed_version":"0","urgency":"unimportant"},"sid":{"status":"resolved","repositories":{"sid":"1:9.20.20-1"},"fixed_version":"0","urgency":"unimportant"},"trixie":{"status":"resolved","repositories":{"trixie":"1:9.20.15-1~deb13u1","trixie-security":"1:9.20.18-1~deb13u1"},"fixed_version":"0","urgency":"unimportant"}}},"CVE-2025-40777":{"description":"If a `named` caching resolver is configured with `serve-stale-enable` `yes`, and with `stale-answer-client-timeout` set to `0` (the only allowable value other than `disabled`), and if the resolver, in the process of resolving a query, encounters a CNAME chain involving a specific combination of cached or authoritative records, the daemon will abort with an assertion failure. This issue affects BIND 9 versions 9.20.0 through 9.20.10, 9.21.0 through 9.21.9, and 9.20.9-S1 through 9.20.10-S1.","scope":"local","releases":{"bookworm":{"status":"open","repositories":{"bookworm":"1:9.18.41-1~deb12u1","bookworm-security":"1:9.18.44-1~deb12u1"},"urgency":"not yet assigned","nodsa":"9.18 is affected, but no patches are currently available for the open source version","nodsa_reason":"postponed"},"bullseye":{"status":"open","repositories":{"bullseye":"1:9.16.50-1~deb11u2","bullseye-security":"1:9.16.50-1~deb11u4"},"urgency":"not yet assigned","nodsa":"Minor issue","nodsa_reason":"postponed"},"forky":{"status":"resolved","repositories":{"forky":"1:9.20.20-1"},"fixed_version":"1:9.20.11-1","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"1:9.20.20-1"},"fixed_version":"1:9.20.11-1","urgency":"not yet assigned"},"trixie":{"status":"resolved","repositories":{"trixie":"1:9.20.15-1~deb13u1","trixie-security":"1:9.20.18-1~deb13u1"},"fixed_version":"1:9.20.11-1","urgency":"not yet assigned"}}},"CVE-2025-40778":{"description":"Under certain circumstances, BIND is too lenient when accepting records from answers, allowing an attacker to inject forged data into the cache. This issue affects BIND 9 versions 9.11.0 through 9.16.50, 9.18.0 through 9.18.39, 9.20.0 through 9.20.13, 9.21.0 through 9.21.12, 9.11.3-S1 through 9.16.50-S1, 9.18.11-S1 through 9.18.39-S1, and 9.20.9-S1 through 9.20.13-S1.","scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"1:9.18.41-1~deb12u1","bookworm-security":"1:9.18.44-1~deb12u1"},"fixed_version":"1:9.18.41-1~deb12u1","urgency":"not yet assigned"},"bullseye":{"status":"resolved","repositories":{"bullseye":"1:9.16.50-1~deb11u2","bullseye-security":"1:9.16.50-1~deb11u4"},"fixed_version":"1:9.16.50-1~deb11u4","urgency":"not yet assigned"},"forky":{"status":"resolved","repositories":{"forky":"1:9.20.20-1"},"fixed_version":"1:9.20.15-1","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"1:9.20.20-1"},"fixed_version":"1:9.20.15-1","urgency":"not yet assigned"},"trixie":{"status":"resolved","repositories":{"trixie":"1:9.20.15-1~deb13u1","trixie-security":"1:9.20.18-1~deb13u1"},"fixed_version":"1:9.20.15-1~deb13u1","urgency":"not yet assigned"}}},"CVE-2025-40780":{"description":"In specific circumstances, due to a weakness in the Pseudo Random Number Generator (PRNG) that is used, it is possible for an attacker to predict the source port and query ID that BIND will use. This issue affects BIND 9 versions 9.16.0 through 9.16.50, 9.18.0 through 9.18.39, 9.20.0 through 9.20.13, 9.21.0 through 9.21.12, 9.16.8-S1 through 9.16.50-S1, 9.18.11-S1 through 9.18.39-S1, and 9.20.9-S1 through 9.20.13-S1.","scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"1:9.18.41-1~deb12u1","bookworm-security":"1:9.18.44-1~deb12u1"},"fixed_version":"1:9.18.41-1~deb12u1","urgency":"not yet assigned"},"bullseye":{"status":"resolved","repositories":{"bullseye":"1:9.16.50-1~deb11u2","bullseye-security":"1:9.16.50-1~deb11u4"},"fixed_version":"1:9.16.50-1~deb11u4","urgency":"not yet assigned"},"forky":{"status":"resolved","repositories":{"forky":"1:9.20.20-1"},"fixed_version":"1:9.20.15-1","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"1:9.20.20-1"},"fixed_version":"1:9.20.15-1","urgency":"not yet assigned"},"trixie":{"status":"resolved","repositories":{"trixie":"1:9.20.15-1~deb13u1","trixie-security":"1:9.20.18-1~deb13u1"},"fixed_version":"1:9.20.15-1~deb13u1","urgency":"not yet assigned"}}},"CVE-2025-8677":{"description":"Querying for records within a specially crafted zone containing certain malformed DNSKEY records can lead to CPU exhaustion. This issue affects BIND 9 versions 9.18.0 through 9.18.39, 9.20.0 through 9.20.13, 9.21.0 through 9.21.12, 9.18.11-S1 through 9.18.39-S1, and 9.20.9-S1 through 9.20.13-S1.","scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"1:9.18.41-1~deb12u1","bookworm-security":"1:9.18.44-1~deb12u1"},"fixed_version":"1:9.18.41-1~deb12u1","urgency":"not yet assigned"},"bullseye":{"status":"resolved","repositories":{"bullseye":"1:9.16.50-1~deb11u2","bullseye-security":"1:9.16.50-1~deb11u4"},"fixed_version":"1:9.16.50-1~deb11u4","urgency":"not yet assigned"},"forky":{"status":"resolved","repositories":{"forky":"1:9.20.20-1"},"fixed_version":"1:9.20.15-1","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"1:9.20.20-1"},"fixed_version":"1:9.20.15-1","urgency":"not yet assigned"},"trixie":{"status":"resolved","repositories":{"trixie":"1:9.20.15-1~deb13u1","trixie-security":"1:9.20.18-1~deb13u1"},"fixed_version":"1:9.20.15-1~deb13u1","urgency":"not yet assigned"}}}},"binpac":{"CVE-2014-9586":{"releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"0.59.0-1"},"fixed_version":"0.43-1","urgency":"not yet assigned"},"bullseye":{"status":"resolved","repositories":{"bullseye":"0.56.0-1"},"fixed_version":"0.43-1","urgency":"not yet assigned"},"forky":{"status":"resolved","repositories":{"forky":"0.59.0-1"},"fixed_version":"0.43-1","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"0.59.0-1"},"fixed_version":"0.43-1","urgency":"not yet assigned"},"trixie":{"status":"resolved","repositories":{"trixie":"0.59.0-1"},"fixed_version":"0.43-1","urgency":"not yet assigned"}}}},"binutils":{"CVE-2005-4807":{"description":"Stack-based buffer overflow in the as_bad function in messages.c in the GNU as (gas) assembler in Free Software Foundation GNU Binutils before 20050721 allows attackers to execute arbitrary code via a .c file with crafted inline assembly code.","scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"2.40-2"},"fixed_version":"2.17-1","urgency":"low"},"bullseye":{"status":"resolved","repositories":{"bullseye":"2.35.2-2"},"fixed_version":"2.17-1","urgency":"low"},"forky":{"status":"resolved","repositories":{"forky":"2.46-3"},"fixed_version":"2.17-1","urgency":"low"},"sid":{"status":"resolved","repositories":{"sid":"2.46-3"},"fixed_version":"2.17-1","urgency":"low"},"trixie":{"status":"resolved","repositories":{"trixie":"2.44-3"},"fixed_version":"2.17-1","urgency":"low"}}},"CVE-2005-4808":{"description":"Buffer overflow in reset_vars in config/tc-crx.c in the GNU as (gas) assembler in Free Software Foundation GNU Binutils before 20050714 allows user-assisted attackers to have an unknown impact via a crafted .s file.","scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"2.40-2"},"fixed_version":"2.17-1","urgency":"low"},"bullseye":{"status":"resolved","repositories":{"bullseye":"2.35.2-2"},"fixed_version":"2.17-1","urgency":"low"},"forky":{"status":"resolved","repositories":{"forky":"2.46-3"},"fixed_version":"2.17-1","urgency":"low"},"sid":{"status":"resolved","repositories":{"sid":"2.46-3"},"fixed_version":"2.17-1","urgency":"low"},"trixie":{"status":"resolved","repositories":{"trixie":"2.44-3"},"fixed_version":"2.17-1","urgency":"low"}}},"CVE-2006-0646":{"description":"ld in SUSE Linux 9.1 through 10.0, and SLES 9, in certain circumstances when linking binaries, can leave an empty RPATH or RUNPATH, which allows local attackers to execute arbitrary code as other users via by running an ld-linked application from the current directory, which could contain an attacker-controlled library file.","scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"2.40-2"},"fixed_version":"0","urgency":"unimportant"},"bullseye":{"status":"resolved","repositories":{"bullseye":"2.35.2-2"},"fixed_version":"0","urgency":"unimportant"},"forky":{"status":"resolved","repositories":{"forky":"2.46-3"},"fixed_version":"0","urgency":"unimportant"},"sid":{"status":"resolved","repositories":{"sid":"2.46-3"},"fixed_version":"0","urgency":"unimportant"},"trixie":{"status":"resolved","repositories":{"trixie":"2.44-3"},"fixed_version":"0","urgency":"unimportant"}}},"CVE-2006-2362":{"description":"Buffer overflow in getsym in tekhex.c in libbfd in Free Software Foundation GNU Binutils before 20060423, as used by GNU strings, allows context-dependent attackers to cause a denial of service (application crash) and possibly execute arbitrary code via a file with a crafted Tektronix Hex Format (TekHex) record in which the length character is not a valid hexadecimal character.","debianbug":368237,"scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"2.40-2"},"fixed_version":"2.17-1","urgency":"low"},"bullseye":{"status":"resolved","repositories":{"bullseye":"2.35.2-2"},"fixed_version":"2.17-1","urgency":"low"},"forky":{"status":"resolved","repositories":{"forky":"2.46-3"},"fixed_version":"2.17-1","urgency":"low"},"sid":{"status":"resolved","repositories":{"sid":"2.46-3"},"fixed_version":"2.17-1","urgency":"low"},"trixie":{"status":"resolved","repositories":{"trixie":"2.44-3"},"fixed_version":"2.17-1","urgency":"low"}}},"CVE-2008-2310":{"description":"Format string vulnerability in c++filt in Apple Mac OS X 10.5 before 10.5.4 allows user-assisted attackers to execute arbitrary code or cause a denial of service (application crash) via a crafted string in (1) C++ or (2) Java source code.","scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"2.40-2"},"fixed_version":"2.18.1~cvs20080103-1","urgency":"low"},"bullseye":{"status":"resolved","repositories":{"bullseye":"2.35.2-2"},"fixed_version":"2.18.1~cvs20080103-1","urgency":"low"},"forky":{"status":"resolved","repositories":{"forky":"2.46-3"},"fixed_version":"2.18.1~cvs20080103-1","urgency":"low"},"sid":{"status":"resolved","repositories":{"sid":"2.46-3"},"fixed_version":"2.18.1~cvs20080103-1","urgency":"low"},"trixie":{"status":"resolved","repositories":{"trixie":"2.44-3"},"fixed_version":"2.18.1~cvs20080103-1","urgency":"low"}}},"CVE-2012-3509":{"description":"Multiple integer overflows in the (1) _objalloc_alloc function in objalloc.c and (2) objalloc_alloc macro in include/objalloc.h in GNU libiberty, as used by binutils 2.22, allow remote attackers to cause a denial of service (crash) via vectors related to the \"addition of CHUNK_HEADER_SIZE to the length,\" which triggers a heap-based buffer overflow.","debianbug":688951,"scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"2.40-2"},"fixed_version":"2.22-8","urgency":"low"},"bullseye":{"status":"resolved","repositories":{"bullseye":"2.35.2-2"},"fixed_version":"2.22-8","urgency":"low"},"forky":{"status":"resolved","repositories":{"forky":"2.46-3"},"fixed_version":"2.22-8","urgency":"low"},"sid":{"status":"resolved","repositories":{"sid":"2.46-3"},"fixed_version":"2.22-8","urgency":"low"},"trixie":{"status":"resolved","repositories":{"trixie":"2.44-3"},"fixed_version":"2.22-8","urgency":"low"}}},"CVE-2014-8484":{"description":"The srec_scan function in bfd/srec.c in libdbfd in GNU binutils before 2.25 allows remote attackers to cause a denial of service (out-of-bounds read) via a small S-record.","scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"2.40-2"},"fixed_version":"2.24.51.20140903-1","urgency":"not yet assigned"},"bullseye":{"status":"resolved","repositories":{"bullseye":"2.35.2-2"},"fixed_version":"2.24.51.20140903-1","urgency":"not yet assigned"},"forky":{"status":"resolved","repositories":{"forky":"2.46-3"},"fixed_version":"2.24.51.20140903-1","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"2.46-3"},"fixed_version":"2.24.51.20140903-1","urgency":"not yet assigned"},"trixie":{"status":"resolved","repositories":{"trixie":"2.44-3"},"fixed_version":"2.24.51.20140903-1","urgency":"not yet assigned"}}},"CVE-2014-8485":{"description":"The setup_group function in bfd/elf.c in libbfd in GNU binutils 2.24 and earlier allows remote attackers to cause a denial of service (crash) and possibly execute arbitrary code via crafted section group headers in an ELF file.","scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"2.40-2"},"fixed_version":"2.24.90.20141104-1","urgency":"not yet assigned"},"bullseye":{"status":"resolved","repositories":{"bullseye":"2.35.2-2"},"fixed_version":"2.24.90.20141104-1","urgency":"not yet assigned"},"forky":{"status":"resolved","repositories":{"forky":"2.46-3"},"fixed_version":"2.24.90.20141104-1","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"2.46-3"},"fixed_version":"2.24.90.20141104-1","urgency":"not yet assigned"},"trixie":{"status":"resolved","repositories":{"trixie":"2.44-3"},"fixed_version":"2.24.90.20141104-1","urgency":"not yet assigned"}}},"CVE-2014-8501":{"description":"The _bfd_XXi_swap_aouthdr_in function in bfd/peXXigen.c in GNU binutils 2.24 and earlier allows remote attackers to cause a denial of service (out-of-bounds write) and possibly have other unspecified impact via a crafted NumberOfRvaAndSizes field in the AOUT header in a PE executable.","scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"2.40-2"},"fixed_version":"2.24.90.20141104-1","urgency":"not yet assigned"},"bullseye":{"status":"resolved","repositories":{"bullseye":"2.35.2-2"},"fixed_version":"2.24.90.20141104-1","urgency":"not yet assigned"},"forky":{"status":"resolved","repositories":{"forky":"2.46-3"},"fixed_version":"2.24.90.20141104-1","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"2.46-3"},"fixed_version":"2.24.90.20141104-1","urgency":"not yet assigned"},"trixie":{"status":"resolved","repositories":{"trixie":"2.44-3"},"fixed_version":"2.24.90.20141104-1","urgency":"not yet assigned"}}},"CVE-2014-8502":{"description":"Heap-based buffer overflow in the pe_print_edata function in bfd/peXXigen.c in GNU binutils 2.24 and earlier allows remote attackers to cause a denial of service (crash) and possibly have other unspecified impact via a truncated export table in a PE file.","scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"2.40-2"},"fixed_version":"2.24.90.20141104-1","urgency":"not yet assigned"},"bullseye":{"status":"resolved","repositories":{"bullseye":"2.35.2-2"},"fixed_version":"2.24.90.20141104-1","urgency":"not yet assigned"},"forky":{"status":"resolved","repositories":{"forky":"2.46-3"},"fixed_version":"2.24.90.20141104-1","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"2.46-3"},"fixed_version":"2.24.90.20141104-1","urgency":"not yet assigned"},"trixie":{"status":"resolved","repositories":{"trixie":"2.44-3"},"fixed_version":"2.24.90.20141104-1","urgency":"not yet assigned"}}},"CVE-2014-8503":{"description":"Stack-based buffer overflow in the ihex_scan function in bfd/ihex.c in GNU binutils 2.24 and earlier allows remote attackers to cause a denial of service (crash) and possibly have other unspecified impact via a crafted ihex file.","scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"2.40-2"},"fixed_version":"2.24.90.20141104-1","urgency":"not yet assigned"},"bullseye":{"status":"resolved","repositories":{"bullseye":"2.35.2-2"},"fixed_version":"2.24.90.20141104-1","urgency":"not yet assigned"},"forky":{"status":"resolved","repositories":{"forky":"2.46-3"},"fixed_version":"2.24.90.20141104-1","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"2.46-3"},"fixed_version":"2.24.90.20141104-1","urgency":"not yet assigned"},"trixie":{"status":"resolved","repositories":{"trixie":"2.44-3"},"fixed_version":"2.24.90.20141104-1","urgency":"not yet assigned"}}},"CVE-2014-8504":{"description":"Stack-based buffer overflow in the srec_scan function in bfd/srec.c in GNU binutils 2.24 and earlier allows remote attackers to cause a denial of service (crash) and possibly have other unspecified impact via a crafted file.","scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"2.40-2"},"fixed_version":"2.24.90.20141104-1","urgency":"not yet assigned"},"bullseye":{"status":"resolved","repositories":{"bullseye":"2.35.2-2"},"fixed_version":"2.24.90.20141104-1","urgency":"not yet assigned"},"forky":{"status":"resolved","repositories":{"forky":"2.46-3"},"fixed_version":"2.24.90.20141104-1","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"2.46-3"},"fixed_version":"2.24.90.20141104-1","urgency":"not yet assigned"},"trixie":{"status":"resolved","repositories":{"trixie":"2.44-3"},"fixed_version":"2.24.90.20141104-1","urgency":"not yet assigned"}}},"CVE-2014-8737":{"description":"Multiple directory traversal vulnerabilities in GNU binutils 2.24 and earlier allow local users to delete arbitrary files via a .. (dot dot) or full path name in an archive to (1) strip or (2) objcopy or create arbitrary files via (3) a .. (dot dot) or full path name in an archive to ar.","scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"2.40-2"},"fixed_version":"2.24.90.20141124-1","urgency":"not yet assigned"},"bullseye":{"status":"resolved","repositories":{"bullseye":"2.35.2-2"},"fixed_version":"2.24.90.20141124-1","urgency":"not yet assigned"},"forky":{"status":"resolved","repositories":{"forky":"2.46-3"},"fixed_version":"2.24.90.20141124-1","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"2.46-3"},"fixed_version":"2.24.90.20141124-1","urgency":"not yet assigned"},"trixie":{"status":"resolved","repositories":{"trixie":"2.44-3"},"fixed_version":"2.24.90.20141124-1","urgency":"not yet assigned"}}},"CVE-2014-8738":{"description":"The _bfd_slurp_extended_name_table function in bfd/archive.c in GNU binutils 2.24 and earlier allows remote attackers to cause a denial of service (invalid write, segmentation fault, and crash) via a crafted extended name table in an archive.","scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"2.40-2"},"fixed_version":"2.24.90.20141124-1","urgency":"not yet assigned"},"bullseye":{"status":"resolved","repositories":{"bullseye":"2.35.2-2"},"fixed_version":"2.24.90.20141124-1","urgency":"not yet assigned"},"forky":{"status":"resolved","repositories":{"forky":"2.46-3"},"fixed_version":"2.24.90.20141124-1","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"2.46-3"},"fixed_version":"2.24.90.20141124-1","urgency":"not yet assigned"},"trixie":{"status":"resolved","repositories":{"trixie":"2.44-3"},"fixed_version":"2.24.90.20141124-1","urgency":"not yet assigned"}}},"CVE-2014-9939":{"description":"ihex.c in GNU Binutils before 2.26 contains a stack buffer overflow when printing bad bytes in Intel Hex objects.","scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"2.40-2"},"fixed_version":"2.25.90.20151125-1","urgency":"not yet assigned"},"bullseye":{"status":"resolved","repositories":{"bullseye":"2.35.2-2"},"fixed_version":"2.25.90.20151125-1","urgency":"not yet assigned"},"forky":{"status":"resolved","repositories":{"forky":"2.46-3"},"fixed_version":"2.25.90.20151125-1","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"2.46-3"},"fixed_version":"2.25.90.20151125-1","urgency":"not yet assigned"},"trixie":{"status":"resolved","repositories":{"trixie":"2.44-3"},"fixed_version":"2.25.90.20151125-1","urgency":"not yet assigned"}}},"CVE-2016-2226":{"description":"Integer overflow in the string_appends function in cplus-dem.c in libiberty allows remote attackers to execute arbitrary code via a crafted executable, which triggers a buffer overflow.","scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"2.40-2"},"fixed_version":"2.27.51.20161102-1","urgency":"low"},"bullseye":{"status":"resolved","repositories":{"bullseye":"2.35.2-2"},"fixed_version":"2.27.51.20161102-1","urgency":"low"},"forky":{"status":"resolved","repositories":{"forky":"2.46-3"},"fixed_version":"2.27.51.20161102-1","urgency":"low"},"sid":{"status":"resolved","repositories":{"sid":"2.46-3"},"fixed_version":"2.27.51.20161102-1","urgency":"low"},"trixie":{"status":"resolved","repositories":{"trixie":"2.44-3"},"fixed_version":"2.27.51.20161102-1","urgency":"low"}}},"CVE-2016-4487":{"description":"Use-after-free vulnerability in libiberty allows remote attackers to cause a denial of service (segmentation fault and crash) via a crafted binary, related to \"btypevec.\"","scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"2.40-2"},"fixed_version":"2.27.51.20161102-1","urgency":"low"},"bullseye":{"status":"resolved","repositories":{"bullseye":"2.35.2-2"},"fixed_version":"2.27.51.20161102-1","urgency":"low"},"forky":{"status":"resolved","repositories":{"forky":"2.46-3"},"fixed_version":"2.27.51.20161102-1","urgency":"low"},"sid":{"status":"resolved","repositories":{"sid":"2.46-3"},"fixed_version":"2.27.51.20161102-1","urgency":"low"},"trixie":{"status":"resolved","repositories":{"trixie":"2.44-3"},"fixed_version":"2.27.51.20161102-1","urgency":"low"}}},"CVE-2016-4488":{"description":"Use-after-free vulnerability in libiberty allows remote attackers to cause a denial of service (segmentation fault and crash) via a crafted binary, related to \"ktypevec.\"","scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"2.40-2"},"fixed_version":"2.27.51.20161102-1","urgency":"low"},"bullseye":{"status":"resolved","repositories":{"bullseye":"2.35.2-2"},"fixed_version":"2.27.51.20161102-1","urgency":"low"},"forky":{"status":"resolved","repositories":{"forky":"2.46-3"},"fixed_version":"2.27.51.20161102-1","urgency":"low"},"sid":{"status":"resolved","repositories":{"sid":"2.46-3"},"fixed_version":"2.27.51.20161102-1","urgency":"low"},"trixie":{"status":"resolved","repositories":{"trixie":"2.44-3"},"fixed_version":"2.27.51.20161102-1","urgency":"low"}}},"CVE-2016-4489":{"description":"Integer overflow in the gnu_special function in libiberty allows remote attackers to cause a denial of service (segmentation fault and crash) via a crafted binary, related to the \"demangling of virtual tables.\"","scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"2.40-2"},"fixed_version":"2.27.51.20161102-1","urgency":"low"},"bullseye":{"status":"resolved","repositories":{"bullseye":"2.35.2-2"},"fixed_version":"2.27.51.20161102-1","urgency":"low"},"forky":{"status":"resolved","repositories":{"forky":"2.46-3"},"fixed_version":"2.27.51.20161102-1","urgency":"low"},"sid":{"status":"resolved","repositories":{"sid":"2.46-3"},"fixed_version":"2.27.51.20161102-1","urgency":"low"},"trixie":{"status":"resolved","repositories":{"trixie":"2.44-3"},"fixed_version":"2.27.51.20161102-1","urgency":"low"}}},"CVE-2016-4490":{"description":"Integer overflow in cp-demangle.c in libiberty allows remote attackers to cause a denial of service (segmentation fault and crash) via a crafted binary, related to inconsistent use of the long and int types for lengths.","scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"2.40-2"},"fixed_version":"2.27.51.20161102-1","urgency":"low"},"bullseye":{"status":"resolved","repositories":{"bullseye":"2.35.2-2"},"fixed_version":"2.27.51.20161102-1","urgency":"low"},"forky":{"status":"resolved","repositories":{"forky":"2.46-3"},"fixed_version":"2.27.51.20161102-1","urgency":"low"},"sid":{"status":"resolved","repositories":{"sid":"2.46-3"},"fixed_version":"2.27.51.20161102-1","urgency":"low"},"trixie":{"status":"resolved","repositories":{"trixie":"2.44-3"},"fixed_version":"2.27.51.20161102-1","urgency":"low"}}},"CVE-2016-4491":{"description":"The d_print_comp function in cp-demangle.c in libiberty allows remote attackers to cause a denial of service (segmentation fault and crash) via a crafted binary, which triggers infinite recursion and a buffer overflow, related to a node having \"itself as ancestor more than once.\"","scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"2.40-2"},"fixed_version":"2.28-3","urgency":"low"},"bullseye":{"status":"resolved","repositories":{"bullseye":"2.35.2-2"},"fixed_version":"2.28-3","urgency":"low"},"forky":{"status":"resolved","repositories":{"forky":"2.46-3"},"fixed_version":"2.28-3","urgency":"low"},"sid":{"status":"resolved","repositories":{"sid":"2.46-3"},"fixed_version":"2.28-3","urgency":"low"},"trixie":{"status":"resolved","repositories":{"trixie":"2.44-3"},"fixed_version":"2.28-3","urgency":"low"}}},"CVE-2016-4492":{"description":"Buffer overflow in the do_type function in cplus-dem.c in libiberty allows remote attackers to cause a denial of service (segmentation fault and crash) via a crafted binary.","scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"2.40-2"},"fixed_version":"2.27.51.20161102-1","urgency":"low"},"bullseye":{"status":"resolved","repositories":{"bullseye":"2.35.2-2"},"fixed_version":"2.27.51.20161102-1","urgency":"low"},"forky":{"status":"resolved","repositories":{"forky":"2.46-3"},"fixed_version":"2.27.51.20161102-1","urgency":"low"},"sid":{"status":"resolved","repositories":{"sid":"2.46-3"},"fixed_version":"2.27.51.20161102-1","urgency":"low"},"trixie":{"status":"resolved","repositories":{"trixie":"2.44-3"},"fixed_version":"2.27.51.20161102-1","urgency":"low"}}},"CVE-2016-4493":{"description":"The demangle_template_value_parm and do_hpacc_template_literal functions in cplus-dem.c in libiberty allow remote attackers to cause a denial of service (out-of-bounds read and crash) via a crafted binary.","scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"2.40-2"},"fixed_version":"2.27.51.20161102-1","urgency":"low"},"bullseye":{"status":"resolved","repositories":{"bullseye":"2.35.2-2"},"fixed_version":"2.27.51.20161102-1","urgency":"low"},"forky":{"status":"resolved","repositories":{"forky":"2.46-3"},"fixed_version":"2.27.51.20161102-1","urgency":"low"},"sid":{"status":"resolved","repositories":{"sid":"2.46-3"},"fixed_version":"2.27.51.20161102-1","urgency":"low"},"trixie":{"status":"resolved","repositories":{"trixie":"2.44-3"},"fixed_version":"2.27.51.20161102-1","urgency":"low"}}},"CVE-2016-6131":{"description":"The demangler in GNU Libiberty allows remote attackers to cause a denial of service (infinite loop, stack overflow, and crash) via a cycle in the references of remembered mangled types.","scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"2.40-2"},"fixed_version":"2.27.51.20161102-1","urgency":"low"},"bullseye":{"status":"resolved","repositories":{"bullseye":"2.35.2-2"},"fixed_version":"2.27.51.20161102-1","urgency":"low"},"forky":{"status":"resolved","repositories":{"forky":"2.46-3"},"fixed_version":"2.27.51.20161102-1","urgency":"low"},"sid":{"status":"resolved","repositories":{"sid":"2.46-3"},"fixed_version":"2.27.51.20161102-1","urgency":"low"},"trixie":{"status":"resolved","repositories":{"trixie":"2.44-3"},"fixed_version":"2.27.51.20161102-1","urgency":"low"}}},"CVE-2017-12448":{"description":"The bfd_cache_close function in bfd/cache.c in the Binary File Descriptor (BFD) library (aka libbfd), as distributed in GNU Binutils 2.29 and earlier, allows remote attackers to cause a heap use after free and possibly achieve code execution via a crafted nested archive file. This issue occurs because incorrect functions are called during an attempt to release memory. The issue can be addressed by better input validation in the bfd_generic_archive_p function in bfd/archive.c.","scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"2.40-2"},"fixed_version":"2.29-9","urgency":"not yet assigned"},"bullseye":{"status":"resolved","repositories":{"bullseye":"2.35.2-2"},"fixed_version":"2.29-9","urgency":"not yet assigned"},"forky":{"status":"resolved","repositories":{"forky":"2.46-3"},"fixed_version":"2.29-9","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"2.46-3"},"fixed_version":"2.29-9","urgency":"not yet assigned"},"trixie":{"status":"resolved","repositories":{"trixie":"2.44-3"},"fixed_version":"2.29-9","urgency":"not yet assigned"}}},"CVE-2017-12449":{"description":"The _bfd_vms_save_sized_string function in vms-misc.c in the Binary File Descriptor (BFD) library (aka libbfd), as distributed in GNU Binutils 2.29 and earlier, allows remote attackers to cause an out of bounds heap read via a crafted vms file.","scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"2.40-2"},"fixed_version":"2.29-8","urgency":"not yet assigned"},"bullseye":{"status":"resolved","repositories":{"bullseye":"2.35.2-2"},"fixed_version":"2.29-8","urgency":"not yet assigned"},"forky":{"status":"resolved","repositories":{"forky":"2.46-3"},"fixed_version":"2.29-8","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"2.46-3"},"fixed_version":"2.29-8","urgency":"not yet assigned"},"trixie":{"status":"resolved","repositories":{"trixie":"2.44-3"},"fixed_version":"2.29-8","urgency":"not yet assigned"}}},"CVE-2017-12450":{"description":"The alpha_vms_object_p function in bfd/vms-alpha.c in the Binary File Descriptor (BFD) library (aka libbfd), as distributed in GNU Binutils 2.29 and earlier, allows remote attackers to cause an out of bounds heap write and possibly achieve code execution via a crafted vms alpha file.","scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"2.40-2"},"fixed_version":"2.29-9","urgency":"not yet assigned"},"bullseye":{"status":"resolved","repositories":{"bullseye":"2.35.2-2"},"fixed_version":"2.29-9","urgency":"not yet assigned"},"forky":{"status":"resolved","repositories":{"forky":"2.46-3"},"fixed_version":"2.29-9","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"2.46-3"},"fixed_version":"2.29-9","urgency":"not yet assigned"},"trixie":{"status":"resolved","repositories":{"trixie":"2.44-3"},"fixed_version":"2.29-9","urgency":"not yet assigned"}}},"CVE-2017-12451":{"description":"The _bfd_xcoff_read_ar_hdr function in bfd/coff-rs6000.c and bfd/coff64-rs6000.c in the Binary File Descriptor (BFD) library (aka libbfd), as distributed in GNU Binutils 2.29 and earlier, allows remote attackers to cause an out of bounds stack read via a crafted COFF image file.","scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"2.40-2"},"fixed_version":"2.29-9","urgency":"not yet assigned"},"bullseye":{"status":"resolved","repositories":{"bullseye":"2.35.2-2"},"fixed_version":"2.29-9","urgency":"not yet assigned"},"forky":{"status":"resolved","repositories":{"forky":"2.46-3"},"fixed_version":"2.29-9","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"2.46-3"},"fixed_version":"2.29-9","urgency":"not yet assigned"},"trixie":{"status":"resolved","repositories":{"trixie":"2.44-3"},"fixed_version":"2.29-9","urgency":"not yet assigned"}}},"CVE-2017-12452":{"description":"The bfd_mach_o_i386_canonicalize_one_reloc function in bfd/mach-o-i386.c in the Binary File Descriptor (BFD) library (aka libbfd), as distributed in GNU Binutils 2.29 and earlier, allows remote attackers to cause an out of bounds heap read via a crafted mach-o file.","scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"2.40-2"},"fixed_version":"2.29-9","urgency":"not yet assigned"},"bullseye":{"status":"resolved","repositories":{"bullseye":"2.35.2-2"},"fixed_version":"2.29-9","urgency":"not yet assigned"},"forky":{"status":"resolved","repositories":{"forky":"2.46-3"},"fixed_version":"2.29-9","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"2.46-3"},"fixed_version":"2.29-9","urgency":"not yet assigned"},"trixie":{"status":"resolved","repositories":{"trixie":"2.44-3"},"fixed_version":"2.29-9","urgency":"not yet assigned"}}},"CVE-2017-12453":{"description":"The _bfd_vms_slurp_eeom function in libbfd.c in the Binary File Descriptor (BFD) library (aka libbfd), as distributed in GNU Binutils 2.29 and earlier, allows remote attackers to cause an out of bounds heap read via a crafted vms alpha file.","scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"2.40-2"},"fixed_version":"2.29-9","urgency":"not yet assigned"},"bullseye":{"status":"resolved","repositories":{"bullseye":"2.35.2-2"},"fixed_version":"2.29-9","urgency":"not yet assigned"},"forky":{"status":"resolved","repositories":{"forky":"2.46-3"},"fixed_version":"2.29-9","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"2.46-3"},"fixed_version":"2.29-9","urgency":"not yet assigned"},"trixie":{"status":"resolved","repositories":{"trixie":"2.44-3"},"fixed_version":"2.29-9","urgency":"not yet assigned"}}},"CVE-2017-12454":{"description":"The _bfd_vms_slurp_egsd function in bfd/vms-alpha.c in the Binary File Descriptor (BFD) library (aka libbfd), as distributed in GNU Binutils 2.29 and earlier, allows remote attackers to cause an arbitrary memory read via a crafted vms alpha file.","scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"2.40-2"},"fixed_version":"2.29-9","urgency":"not yet assigned"},"bullseye":{"status":"resolved","repositories":{"bullseye":"2.35.2-2"},"fixed_version":"2.29-9","urgency":"not yet assigned"},"forky":{"status":"resolved","repositories":{"forky":"2.46-3"},"fixed_version":"2.29-9","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"2.46-3"},"fixed_version":"2.29-9","urgency":"not yet assigned"},"trixie":{"status":"resolved","repositories":{"trixie":"2.44-3"},"fixed_version":"2.29-9","urgency":"not yet assigned"}}},"CVE-2017-12455":{"description":"The evax_bfd_print_emh function in vms-alpha.c in the Binary File Descriptor (BFD) library (aka libbfd), as distributed in GNU Binutils 2.29 and earlier, allows remote attackers to cause an out of bounds heap read via a crafted vms alpha file.","scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"2.40-2"},"fixed_version":"2.29-8","urgency":"not yet assigned"},"bullseye":{"status":"resolved","repositories":{"bullseye":"2.35.2-2"},"fixed_version":"2.29-8","urgency":"not yet assigned"},"forky":{"status":"resolved","repositories":{"forky":"2.46-3"},"fixed_version":"2.29-8","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"2.46-3"},"fixed_version":"2.29-8","urgency":"not yet assigned"},"trixie":{"status":"resolved","repositories":{"trixie":"2.44-3"},"fixed_version":"2.29-8","urgency":"not yet assigned"}}},"CVE-2017-12456":{"description":"The read_symbol_stabs_debugging_info function in rddbg.c in GNU Binutils 2.29 and earlier allows remote attackers to cause an out of bounds heap read via a crafted binary file.","scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"2.40-2"},"fixed_version":"2.29-9","urgency":"not yet assigned"},"bullseye":{"status":"resolved","repositories":{"bullseye":"2.35.2-2"},"fixed_version":"2.29-9","urgency":"not yet assigned"},"forky":{"status":"resolved","repositories":{"forky":"2.46-3"},"fixed_version":"2.29-9","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"2.46-3"},"fixed_version":"2.29-9","urgency":"not yet assigned"},"trixie":{"status":"resolved","repositories":{"trixie":"2.44-3"},"fixed_version":"2.29-9","urgency":"not yet assigned"}}},"CVE-2017-12457":{"description":"The bfd_make_section_with_flags function in section.c in the Binary File Descriptor (BFD) library (aka libbfd), as distributed in GNU Binutils 2.29 and earlier, allows remote attackers to cause a NULL dereference via a crafted file.","scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"2.40-2"},"fixed_version":"2.29-8","urgency":"not yet assigned"},"bullseye":{"status":"resolved","repositories":{"bullseye":"2.35.2-2"},"fixed_version":"2.29-8","urgency":"not yet assigned"},"forky":{"status":"resolved","repositories":{"forky":"2.46-3"},"fixed_version":"2.29-8","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"2.46-3"},"fixed_version":"2.29-8","urgency":"not yet assigned"},"trixie":{"status":"resolved","repositories":{"trixie":"2.44-3"},"fixed_version":"2.29-8","urgency":"not yet assigned"}}},"CVE-2017-12458":{"description":"The nlm_swap_auxiliary_headers_in function in bfd/nlmcode.h in the Binary File Descriptor (BFD) library (aka libbfd), as distributed in GNU Binutils 2.29 and earlier, allows remote attackers to cause an out of bounds heap read via a crafted nlm file.","scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"2.40-2"},"fixed_version":"2.29-8","urgency":"not yet assigned"},"bullseye":{"status":"resolved","repositories":{"bullseye":"2.35.2-2"},"fixed_version":"2.29-8","urgency":"not yet assigned"},"forky":{"status":"resolved","repositories":{"forky":"2.46-3"},"fixed_version":"2.29-8","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"2.46-3"},"fixed_version":"2.29-8","urgency":"not yet assigned"},"trixie":{"status":"resolved","repositories":{"trixie":"2.44-3"},"fixed_version":"2.29-8","urgency":"not yet assigned"}}},"CVE-2017-12459":{"description":"The bfd_mach_o_read_symtab_strtab function in bfd/mach-o.c in the Binary File Descriptor (BFD) library (aka libbfd), as distributed in GNU Binutils 2.29 and earlier, allows remote attackers to cause an out of bounds heap write and possibly achieve code execution via a crafted mach-o file.","scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"2.40-2"},"fixed_version":"2.29-8","urgency":"not yet assigned"},"bullseye":{"status":"resolved","repositories":{"bullseye":"2.35.2-2"},"fixed_version":"2.29-8","urgency":"not yet assigned"},"forky":{"status":"resolved","repositories":{"forky":"2.46-3"},"fixed_version":"2.29-8","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"2.46-3"},"fixed_version":"2.29-8","urgency":"not yet assigned"},"trixie":{"status":"resolved","repositories":{"trixie":"2.44-3"},"fixed_version":"2.29-8","urgency":"not yet assigned"}}},"CVE-2017-12799":{"description":"The elf_read_notesfunction in bfd/elf.c in GNU Binutils 2.29 allows remote attackers to cause a denial of service (buffer overflow and application crash) or possibly have unspecified other impact via a crafted binary file.","scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"2.40-2"},"fixed_version":"2.29-9","urgency":"not yet assigned"},"bullseye":{"status":"resolved","repositories":{"bullseye":"2.35.2-2"},"fixed_version":"2.29-9","urgency":"not yet assigned"},"forky":{"status":"resolved","repositories":{"forky":"2.46-3"},"fixed_version":"2.29-9","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"2.46-3"},"fixed_version":"2.29-9","urgency":"not yet assigned"},"trixie":{"status":"resolved","repositories":{"trixie":"2.44-3"},"fixed_version":"2.29-9","urgency":"not yet assigned"}}},"CVE-2017-12967":{"description":"The getsym function in tekhex.c in the Binary File Descriptor (BFD) library (aka libbfd), as distributed in GNU Binutils 2.29, allows remote attackers to cause a denial of service (stack-based buffer over-read and application crash) via a malformed tekhex binary.","scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"2.40-2"},"fixed_version":"2.29-5","urgency":"not yet assigned"},"bullseye":{"status":"resolved","repositories":{"bullseye":"2.35.2-2"},"fixed_version":"2.29-5","urgency":"not yet assigned"},"forky":{"status":"resolved","repositories":{"forky":"2.46-3"},"fixed_version":"2.29-5","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"2.46-3"},"fixed_version":"2.29-5","urgency":"not yet assigned"},"trixie":{"status":"resolved","repositories":{"trixie":"2.44-3"},"fixed_version":"2.29-5","urgency":"not yet assigned"}}},"CVE-2017-13710":{"description":"The setup_group function in elf.c in the Binary File Descriptor (BFD) library (aka libbfd), as distributed in GNU Binutils 2.29, allows remote attackers to cause a denial of service (NULL pointer dereference and application crash) via a group section that is too small.","scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"2.40-2"},"fixed_version":"2.29-9","urgency":"not yet assigned"},"bullseye":{"status":"resolved","repositories":{"bullseye":"2.35.2-2"},"fixed_version":"2.29-9","urgency":"not yet assigned"},"forky":{"status":"resolved","repositories":{"forky":"2.46-3"},"fixed_version":"2.29-9","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"2.46-3"},"fixed_version":"2.29-9","urgency":"not yet assigned"},"trixie":{"status":"resolved","repositories":{"trixie":"2.44-3"},"fixed_version":"2.29-9","urgency":"not yet assigned"}}},"CVE-2017-13716":{"description":"The C++ symbol demangler routine in cplus-dem.c in libiberty, as distributed in GNU Binutils 2.29, allows remote attackers to cause a denial of service (excessive memory allocation and application crash) via a crafted file, as demonstrated by a call from the Binary File Descriptor (BFD) library (aka libbfd).","scope":"local","releases":{"bookworm":{"status":"open","repositories":{"bookworm":"2.40-2"},"urgency":"unimportant"},"bullseye":{"status":"open","repositories":{"bullseye":"2.35.2-2"},"urgency":"unimportant"},"forky":{"status":"open","repositories":{"forky":"2.46-3"},"urgency":"unimportant"},"sid":{"status":"open","repositories":{"sid":"2.46-3"},"urgency":"unimportant"},"trixie":{"status":"open","repositories":{"trixie":"2.44-3"},"urgency":"unimportant"}}},"CVE-2017-13757":{"description":"The Binary File Descriptor (BFD) library (aka libbfd), as distributed in GNU Binutils 2.29, does not validate the PLT section size, which allows remote attackers to cause a denial of service (heap-based buffer over-read and application crash) via a crafted ELF file, related to elf_i386_get_synthetic_symtab in elf32-i386.c and elf_x86_64_get_synthetic_symtab in elf64-x86-64.c.","scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"2.40-2"},"fixed_version":"2.29-10","urgency":"not yet assigned"},"bullseye":{"status":"resolved","repositories":{"bullseye":"2.35.2-2"},"fixed_version":"2.29-10","urgency":"not yet assigned"},"forky":{"status":"resolved","repositories":{"forky":"2.46-3"},"fixed_version":"2.29-10","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"2.46-3"},"fixed_version":"2.29-10","urgency":"not yet assigned"},"trixie":{"status":"resolved","repositories":{"trixie":"2.44-3"},"fixed_version":"2.29-10","urgency":"not yet assigned"}}},"CVE-2017-14128":{"description":"The decode_line_info function in dwarf2.c in the Binary File Descriptor (BFD) library (aka libbfd), as distributed in GNU Binutils 2.29, allows remote attackers to cause a denial of service (read_1_byte heap-based buffer over-read and application crash) via a crafted ELF file.","scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"2.40-2"},"fixed_version":"2.29-9","urgency":"low"},"bullseye":{"status":"resolved","repositories":{"bullseye":"2.35.2-2"},"fixed_version":"2.29-9","urgency":"low"},"forky":{"status":"resolved","repositories":{"forky":"2.46-3"},"fixed_version":"2.29-9","urgency":"low"},"sid":{"status":"resolved","repositories":{"sid":"2.46-3"},"fixed_version":"2.29-9","urgency":"low"},"trixie":{"status":"resolved","repositories":{"trixie":"2.44-3"},"fixed_version":"2.29-9","urgency":"low"}}},"CVE-2017-14129":{"description":"The read_section function in dwarf2.c in the Binary File Descriptor (BFD) library (aka libbfd), as distributed in GNU Binutils 2.29, allows remote attackers to cause a denial of service (parse_comp_unit heap-based buffer over-read and application crash) via a crafted ELF file.","scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"2.40-2"},"fixed_version":"2.29-10","urgency":"low"},"bullseye":{"status":"resolved","repositories":{"bullseye":"2.35.2-2"},"fixed_version":"2.29-10","urgency":"low"},"forky":{"status":"resolved","repositories":{"forky":"2.46-3"},"fixed_version":"2.29-10","urgency":"low"},"sid":{"status":"resolved","repositories":{"sid":"2.46-3"},"fixed_version":"2.29-10","urgency":"low"},"trixie":{"status":"resolved","repositories":{"trixie":"2.44-3"},"fixed_version":"2.29-10","urgency":"low"}}},"CVE-2017-14130":{"description":"The _bfd_elf_parse_attributes function in elf-attrs.c in the Binary File Descriptor (BFD) library (aka libbfd), as distributed in GNU Binutils 2.29, allows remote attackers to cause a denial of service (_bfd_elf_attr_strdup heap-based buffer over-read and application crash) via a crafted ELF file.","scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"2.40-2"},"fixed_version":"2.29-9","urgency":"low"},"bullseye":{"status":"resolved","repositories":{"bullseye":"2.35.2-2"},"fixed_version":"2.29-9","urgency":"low"},"forky":{"status":"resolved","repositories":{"forky":"2.46-3"},"fixed_version":"2.29-9","urgency":"low"},"sid":{"status":"resolved","repositories":{"sid":"2.46-3"},"fixed_version":"2.29-9","urgency":"low"},"trixie":{"status":"resolved","repositories":{"trixie":"2.44-3"},"fixed_version":"2.29-9","urgency":"low"}}},"CVE-2017-14333":{"description":"The process_version_sections function in readelf.c in GNU Binutils 2.29 allows attackers to cause a denial of service (Integer Overflow, and hang because of a time-consuming loop) or possibly have unspecified other impact via a crafted binary file with invalid values of ent.vn_next, during \"readelf -a\" execution.","scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"2.40-2"},"fixed_version":"2.29-9","urgency":"not yet assigned"},"bullseye":{"status":"resolved","repositories":{"bullseye":"2.35.2-2"},"fixed_version":"2.29-9","urgency":"not yet assigned"},"forky":{"status":"resolved","repositories":{"forky":"2.46-3"},"fixed_version":"2.29-9","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"2.46-3"},"fixed_version":"2.29-9","urgency":"not yet assigned"},"trixie":{"status":"resolved","repositories":{"trixie":"2.44-3"},"fixed_version":"2.29-9","urgency":"not yet assigned"}}},"CVE-2017-14529":{"description":"The pe_print_idata function in peXXigen.c in the Binary File Descriptor (BFD) library (aka libbfd), as distributed in GNU Binutils 2.29, mishandles HintName vector entries, which allows remote attackers to cause a denial of service (heap-based buffer over-read and application crash) via a crafted PE file, related to the bfd_getl16 function.","scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"2.40-2"},"fixed_version":"2.29-10","urgency":"not yet assigned"},"bullseye":{"status":"resolved","repositories":{"bullseye":"2.35.2-2"},"fixed_version":"2.29-10","urgency":"not yet assigned"},"forky":{"status":"resolved","repositories":{"forky":"2.46-3"},"fixed_version":"2.29-10","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"2.46-3"},"fixed_version":"2.29-10","urgency":"not yet assigned"},"trixie":{"status":"resolved","repositories":{"trixie":"2.44-3"},"fixed_version":"2.29-10","urgency":"not yet assigned"}}},"CVE-2017-14729":{"description":"The *_get_synthetic_symtab functions in the Binary File Descriptor (BFD) library (aka libbfd), as distributed in GNU Binutils 2.29, do not ensure a unique PLT entry for a symbol, which allows remote attackers to cause a denial of service (heap-based buffer overflow and application crash) or possibly have unspecified other impact via a crafted ELF file, related to elf32-i386.c and elf64-x86-64.c.","scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"2.40-2"},"fixed_version":"2.29.1-2","urgency":"not yet assigned"},"bullseye":{"status":"resolved","repositories":{"bullseye":"2.35.2-2"},"fixed_version":"2.29.1-2","urgency":"not yet assigned"},"forky":{"status":"resolved","repositories":{"forky":"2.46-3"},"fixed_version":"2.29.1-2","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"2.46-3"},"fixed_version":"2.29.1-2","urgency":"not yet assigned"},"trixie":{"status":"resolved","repositories":{"trixie":"2.44-3"},"fixed_version":"2.29.1-2","urgency":"not yet assigned"}}},"CVE-2017-14745":{"description":"The *_get_synthetic_symtab functions in the Binary File Descriptor (BFD) library (aka libbfd), as distributed in GNU Binutils 2.29, interpret a -1 value as a sorting count instead of an error flag, which allows remote attackers to cause a denial of service (integer overflow and application crash) or possibly have unspecified other impact via a crafted ELF file, related to elf32-i386.c and elf64-x86-64.c.","scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"2.40-2"},"fixed_version":"2.29-11","urgency":"not yet assigned"},"bullseye":{"status":"resolved","repositories":{"bullseye":"2.35.2-2"},"fixed_version":"2.29-11","urgency":"not yet assigned"},"forky":{"status":"resolved","repositories":{"forky":"2.46-3"},"fixed_version":"2.29-11","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"2.46-3"},"fixed_version":"2.29-11","urgency":"not yet assigned"},"trixie":{"status":"resolved","repositories":{"trixie":"2.44-3"},"fixed_version":"2.29-11","urgency":"not yet assigned"}}},"CVE-2017-14930":{"description":"Memory leak in decode_line_info in dwarf2.c in the Binary File Descriptor (BFD) library (aka libbfd), as distributed in GNU Binutils 2.29, allows remote attackers to cause a denial of service (memory consumption) via a crafted ELF file.","scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"2.40-2"},"fixed_version":"2.29.90.20180122-1","urgency":"low"},"bullseye":{"status":"resolved","repositories":{"bullseye":"2.35.2-2"},"fixed_version":"2.29.90.20180122-1","urgency":"low"},"forky":{"status":"resolved","repositories":{"forky":"2.46-3"},"fixed_version":"2.29.90.20180122-1","urgency":"low"},"sid":{"status":"resolved","repositories":{"sid":"2.46-3"},"fixed_version":"2.29.90.20180122-1","urgency":"low"},"trixie":{"status":"resolved","repositories":{"trixie":"2.44-3"},"fixed_version":"2.29.90.20180122-1","urgency":"low"}}},"CVE-2017-14932":{"description":"decode_line_info in dwarf2.c in the Binary File Descriptor (BFD) library (aka libbfd), as distributed in GNU Binutils 2.29, allows remote attackers to cause a denial of service (infinite loop) via a crafted ELF file.","scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"2.40-2"},"fixed_version":"2.29.90.20180122-1","urgency":"low"},"bullseye":{"status":"resolved","repositories":{"bullseye":"2.35.2-2"},"fixed_version":"2.29.90.20180122-1","urgency":"low"},"forky":{"status":"resolved","repositories":{"forky":"2.46-3"},"fixed_version":"2.29.90.20180122-1","urgency":"low"},"sid":{"status":"resolved","repositories":{"sid":"2.46-3"},"fixed_version":"2.29.90.20180122-1","urgency":"low"},"trixie":{"status":"resolved","repositories":{"trixie":"2.44-3"},"fixed_version":"2.29.90.20180122-1","urgency":"low"}}},"CVE-2017-14933":{"description":"read_formatted_entries in dwarf2.c in the Binary File Descriptor (BFD) library (aka libbfd), as distributed in GNU Binutils 2.29, allows remote attackers to cause a denial of service (infinite loop) via a crafted ELF file.","scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"2.40-2"},"fixed_version":"2.29.90.20180122-1","urgency":"low"},"bullseye":{"status":"resolved","repositories":{"bullseye":"2.35.2-2"},"fixed_version":"2.29.90.20180122-1","urgency":"low"},"forky":{"status":"resolved","repositories":{"forky":"2.46-3"},"fixed_version":"2.29.90.20180122-1","urgency":"low"},"sid":{"status":"resolved","repositories":{"sid":"2.46-3"},"fixed_version":"2.29.90.20180122-1","urgency":"low"},"trixie":{"status":"resolved","repositories":{"trixie":"2.44-3"},"fixed_version":"2.29.90.20180122-1","urgency":"low"}}},"CVE-2017-14934":{"description":"process_debug_info in dwarf.c in the Binary File Descriptor (BFD) library (aka libbfd), as distributed in GNU Binutils 2.29, allows remote attackers to cause a denial of service (infinite loop) via a crafted ELF file that contains a negative size value in a CU structure.","scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"2.40-2"},"fixed_version":"2.29.90.20180122-1","urgency":"low"},"bullseye":{"status":"resolved","repositories":{"bullseye":"2.35.2-2"},"fixed_version":"2.29.90.20180122-1","urgency":"low"},"forky":{"status":"resolved","repositories":{"forky":"2.46-3"},"fixed_version":"2.29.90.20180122-1","urgency":"low"},"sid":{"status":"resolved","repositories":{"sid":"2.46-3"},"fixed_version":"2.29.90.20180122-1","urgency":"low"},"trixie":{"status":"resolved","repositories":{"trixie":"2.44-3"},"fixed_version":"2.29.90.20180122-1","urgency":"low"}}},"CVE-2017-14938":{"description":"_bfd_elf_slurp_version_tables in elf.c in the Binary File Descriptor (BFD) library (aka libbfd), as distributed in GNU Binutils 2.29, allows remote attackers to cause a denial of service (excessive memory allocation and application crash) via a crafted ELF file.","scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"2.40-2"},"fixed_version":"2.29.90.20180122-1","urgency":"low"},"bullseye":{"status":"resolved","repositories":{"bullseye":"2.35.2-2"},"fixed_version":"2.29.90.20180122-1","urgency":"low"},"forky":{"status":"resolved","repositories":{"forky":"2.46-3"},"fixed_version":"2.29.90.20180122-1","urgency":"low"},"sid":{"status":"resolved","repositories":{"sid":"2.46-3"},"fixed_version":"2.29.90.20180122-1","urgency":"low"},"trixie":{"status":"resolved","repositories":{"trixie":"2.44-3"},"fixed_version":"2.29.90.20180122-1","urgency":"low"}}},"CVE-2017-14939":{"description":"decode_line_info in dwarf2.c in the Binary File Descriptor (BFD) library (aka libbfd), as distributed in GNU Binutils 2.29, mishandles a length calculation, which allows remote attackers to cause a denial of service (heap-based buffer over-read and application crash) via a crafted ELF file, related to read_1_byte.","scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"2.40-2"},"fixed_version":"2.29.90.20180122-1","urgency":"low"},"bullseye":{"status":"resolved","repositories":{"bullseye":"2.35.2-2"},"fixed_version":"2.29.90.20180122-1","urgency":"low"},"forky":{"status":"resolved","repositories":{"forky":"2.46-3"},"fixed_version":"2.29.90.20180122-1","urgency":"low"},"sid":{"status":"resolved","repositories":{"sid":"2.46-3"},"fixed_version":"2.29.90.20180122-1","urgency":"low"},"trixie":{"status":"resolved","repositories":{"trixie":"2.44-3"},"fixed_version":"2.29.90.20180122-1","urgency":"low"}}},"CVE-2017-14940":{"description":"scan_unit_for_symbols in dwarf2.c in the Binary File Descriptor (BFD) library (aka libbfd), as distributed in GNU Binutils 2.29, allows remote attackers to cause a denial of service (NULL pointer dereference and application crash) via a crafted ELF file.","scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"2.40-2"},"fixed_version":"2.29.90.20180122-1","urgency":"low"},"bullseye":{"status":"resolved","repositories":{"bullseye":"2.35.2-2"},"fixed_version":"2.29.90.20180122-1","urgency":"low"},"forky":{"status":"resolved","repositories":{"forky":"2.46-3"},"fixed_version":"2.29.90.20180122-1","urgency":"low"},"sid":{"status":"resolved","repositories":{"sid":"2.46-3"},"fixed_version":"2.29.90.20180122-1","urgency":"low"},"trixie":{"status":"resolved","repositories":{"trixie":"2.44-3"},"fixed_version":"2.29.90.20180122-1","urgency":"low"}}},"CVE-2017-14974":{"description":"The *_get_synthetic_symtab functions in the Binary File Descriptor (BFD) library (aka libbfd), as distributed in GNU Binutils 2.29, mishandle the failure of a certain canonicalization step, which allows remote attackers to cause a denial of service (NULL pointer dereference and application crash) via a crafted ELF file, related to elf32-i386.c and elf64-x86-64.c.","scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"2.40-2"},"fixed_version":"2.29.1-2","urgency":"not yet assigned"},"bullseye":{"status":"resolved","repositories":{"bullseye":"2.35.2-2"},"fixed_version":"2.29.1-2","urgency":"not yet assigned"},"forky":{"status":"resolved","repositories":{"forky":"2.46-3"},"fixed_version":"2.29.1-2","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"2.46-3"},"fixed_version":"2.29.1-2","urgency":"not yet assigned"},"trixie":{"status":"resolved","repositories":{"trixie":"2.44-3"},"fixed_version":"2.29.1-2","urgency":"not yet assigned"}}},"CVE-2017-15020":{"description":"dwarf1.c in the Binary File Descriptor (BFD) library (aka libbfd), as distributed in GNU Binutils 2.29, mishandles pointers, which allows remote attackers to cause a denial of service (application crash) or possibly have unspecified other impact via a crafted ELF file, related to parse_die and parse_line_table, as demonstrated by a parse_die heap-based buffer over-read.","scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"2.40-2"},"fixed_version":"2.29.90.20180122-1","urgency":"low"},"bullseye":{"status":"resolved","repositories":{"bullseye":"2.35.2-2"},"fixed_version":"2.29.90.20180122-1","urgency":"low"},"forky":{"status":"resolved","repositories":{"forky":"2.46-3"},"fixed_version":"2.29.90.20180122-1","urgency":"low"},"sid":{"status":"resolved","repositories":{"sid":"2.46-3"},"fixed_version":"2.29.90.20180122-1","urgency":"low"},"trixie":{"status":"resolved","repositories":{"trixie":"2.44-3"},"fixed_version":"2.29.90.20180122-1","urgency":"low"}}},"CVE-2017-15021":{"description":"bfd_get_debug_link_info_1 in opncls.c in the Binary File Descriptor (BFD) library (aka libbfd), as distributed in GNU Binutils 2.29, allows remote attackers to cause a denial of service (heap-based buffer over-read and application crash) via a crafted ELF file, related to bfd_getl32.","scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"2.40-2"},"fixed_version":"2.29.90.20180122-1","urgency":"low"},"bullseye":{"status":"resolved","repositories":{"bullseye":"2.35.2-2"},"fixed_version":"2.29.90.20180122-1","urgency":"low"},"forky":{"status":"resolved","repositories":{"forky":"2.46-3"},"fixed_version":"2.29.90.20180122-1","urgency":"low"},"sid":{"status":"resolved","repositories":{"sid":"2.46-3"},"fixed_version":"2.29.90.20180122-1","urgency":"low"},"trixie":{"status":"resolved","repositories":{"trixie":"2.44-3"},"fixed_version":"2.29.90.20180122-1","urgency":"low"}}},"CVE-2017-15022":{"description":"dwarf2.c in the Binary File Descriptor (BFD) library (aka libbfd), as distributed in GNU Binutils 2.29, does not validate the DW_AT_name data type, which allows remote attackers to cause a denial of service (bfd_hash_hash NULL pointer dereference, or out-of-bounds access, and application crash) via a crafted ELF file, related to scan_unit_for_symbols and parse_comp_unit.","scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"2.40-2"},"fixed_version":"2.29.90.20180122-1","urgency":"low"},"bullseye":{"status":"resolved","repositories":{"bullseye":"2.35.2-2"},"fixed_version":"2.29.90.20180122-1","urgency":"low"},"forky":{"status":"resolved","repositories":{"forky":"2.46-3"},"fixed_version":"2.29.90.20180122-1","urgency":"low"},"sid":{"status":"resolved","repositories":{"sid":"2.46-3"},"fixed_version":"2.29.90.20180122-1","urgency":"low"},"trixie":{"status":"resolved","repositories":{"trixie":"2.44-3"},"fixed_version":"2.29.90.20180122-1","urgency":"low"}}},"CVE-2017-15023":{"description":"read_formatted_entries in dwarf2.c in the Binary File Descriptor (BFD) library (aka libbfd), as distributed in GNU Binutils 2.29, does not properly validate the format count, which allows remote attackers to cause a denial of service (NULL pointer dereference and application crash) via a crafted ELF file, related to concat_filename.","scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"2.40-2"},"fixed_version":"2.29.90.20180122-1","urgency":"low"},"bullseye":{"status":"resolved","repositories":{"bullseye":"2.35.2-2"},"fixed_version":"2.29.90.20180122-1","urgency":"low"},"forky":{"status":"resolved","repositories":{"forky":"2.46-3"},"fixed_version":"2.29.90.20180122-1","urgency":"low"},"sid":{"status":"resolved","repositories":{"sid":"2.46-3"},"fixed_version":"2.29.90.20180122-1","urgency":"low"},"trixie":{"status":"resolved","repositories":{"trixie":"2.44-3"},"fixed_version":"2.29.90.20180122-1","urgency":"low"}}},"CVE-2017-15024":{"description":"find_abstract_instance_name in dwarf2.c in the Binary File Descriptor (BFD) library (aka libbfd), as distributed in GNU Binutils 2.29, allows remote attackers to cause a denial of service (infinite recursion and application crash) via a crafted ELF file.","scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"2.40-2"},"fixed_version":"2.29.90.20180122-1","urgency":"low"},"bullseye":{"status":"resolved","repositories":{"bullseye":"2.35.2-2"},"fixed_version":"2.29.90.20180122-1","urgency":"low"},"forky":{"status":"resolved","repositories":{"forky":"2.46-3"},"fixed_version":"2.29.90.20180122-1","urgency":"low"},"sid":{"status":"resolved","repositories":{"sid":"2.46-3"},"fixed_version":"2.29.90.20180122-1","urgency":"low"},"trixie":{"status":"resolved","repositories":{"trixie":"2.44-3"},"fixed_version":"2.29.90.20180122-1","urgency":"low"}}},"CVE-2017-15025":{"description":"decode_line_info in dwarf2.c in the Binary File Descriptor (BFD) library (aka libbfd), as distributed in GNU Binutils 2.29, allows remote attackers to cause a denial of service (divide-by-zero error and application crash) via a crafted ELF file.","scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"2.40-2"},"fixed_version":"2.29.90.20180122-1","urgency":"low"},"bullseye":{"status":"resolved","repositories":{"bullseye":"2.35.2-2"},"fixed_version":"2.29.90.20180122-1","urgency":"low"},"forky":{"status":"resolved","repositories":{"forky":"2.46-3"},"fixed_version":"2.29.90.20180122-1","urgency":"low"},"sid":{"status":"resolved","repositories":{"sid":"2.46-3"},"fixed_version":"2.29.90.20180122-1","urgency":"low"},"trixie":{"status":"resolved","repositories":{"trixie":"2.44-3"},"fixed_version":"2.29.90.20180122-1","urgency":"low"}}},"CVE-2017-15225":{"description":"_bfd_dwarf2_cleanup_debug_info in dwarf2.c in the Binary File Descriptor (BFD) library (aka libbfd), as distributed in GNU Binutils 2.29, allows remote attackers to cause a denial of service (memory leak) via a crafted ELF file.","scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"2.40-2"},"fixed_version":"2.29.90.20180122-1","urgency":"low"},"bullseye":{"status":"resolved","repositories":{"bullseye":"2.35.2-2"},"fixed_version":"2.29.90.20180122-1","urgency":"low"},"forky":{"status":"resolved","repositories":{"forky":"2.46-3"},"fixed_version":"2.29.90.20180122-1","urgency":"low"},"sid":{"status":"resolved","repositories":{"sid":"2.46-3"},"fixed_version":"2.29.90.20180122-1","urgency":"low"},"trixie":{"status":"resolved","repositories":{"trixie":"2.44-3"},"fixed_version":"2.29.90.20180122-1","urgency":"low"}}},"CVE-2017-15938":{"description":"dwarf2.c in the Binary File Descriptor (BFD) library (aka libbfd), as distributed in GNU Binutils 2.29, miscalculates DW_FORM_ref_addr die refs in the case of a relocatable object file, which allows remote attackers to cause a denial of service (find_abstract_instance_name invalid memory read, segmentation fault, and application crash).","scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"2.40-2"},"fixed_version":"2.29.90.20180122-1","urgency":"low"},"bullseye":{"status":"resolved","repositories":{"bullseye":"2.35.2-2"},"fixed_version":"2.29.90.20180122-1","urgency":"low"},"forky":{"status":"resolved","repositories":{"forky":"2.46-3"},"fixed_version":"2.29.90.20180122-1","urgency":"low"},"sid":{"status":"resolved","repositories":{"sid":"2.46-3"},"fixed_version":"2.29.90.20180122-1","urgency":"low"},"trixie":{"status":"resolved","repositories":{"trixie":"2.44-3"},"fixed_version":"2.29.90.20180122-1","urgency":"low"}}},"CVE-2017-15939":{"description":"dwarf2.c in the Binary File Descriptor (BFD) library (aka libbfd), as distributed in GNU Binutils 2.29, mishandles NULL files in a .debug_line file table, which allows remote attackers to cause a denial of service (NULL pointer dereference and application crash) via a crafted ELF file, related to concat_filename. NOTE: this issue is caused by an incomplete fix for CVE-2017-15023.","scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"2.40-2"},"fixed_version":"0","urgency":"unimportant"},"bullseye":{"status":"resolved","repositories":{"bullseye":"2.35.2-2"},"fixed_version":"0","urgency":"unimportant"},"forky":{"status":"resolved","repositories":{"forky":"2.46-3"},"fixed_version":"0","urgency":"unimportant"},"sid":{"status":"resolved","repositories":{"sid":"2.46-3"},"fixed_version":"0","urgency":"unimportant"},"trixie":{"status":"resolved","repositories":{"trixie":"2.44-3"},"fixed_version":"0","urgency":"unimportant"}}},"CVE-2017-15996":{"description":"elfcomm.c in readelf in GNU Binutils 2.29 allows remote attackers to cause a denial of service (excessive memory allocation) or possibly have unspecified other impact via a crafted ELF file that triggers a \"buffer overflow on fuzzed archive header,\" related to an uninitialized variable, an improper conditional jump, and the get_archive_member_name, process_archive_index_and_symbols, and setup_archive functions.","scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"2.40-2"},"fixed_version":"2.29.90.20180122-1","urgency":"low"},"bullseye":{"status":"resolved","repositories":{"bullseye":"2.35.2-2"},"fixed_version":"2.29.90.20180122-1","urgency":"low"},"forky":{"status":"resolved","repositories":{"forky":"2.46-3"},"fixed_version":"2.29.90.20180122-1","urgency":"low"},"sid":{"status":"resolved","repositories":{"sid":"2.46-3"},"fixed_version":"2.29.90.20180122-1","urgency":"low"},"trixie":{"status":"resolved","repositories":{"trixie":"2.44-3"},"fixed_version":"2.29.90.20180122-1","urgency":"low"}}},"CVE-2017-16826":{"description":"The coff_slurp_line_table function in coffcode.h in the Binary File Descriptor (BFD) library (aka libbfd), as distributed in GNU Binutils 2.29.1, allows remote attackers to cause a denial of service (invalid memory access and application crash) or possibly have unspecified other impact via a crafted PE file.","scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"2.40-2"},"fixed_version":"2.29.90.20180122-1","urgency":"low"},"bullseye":{"status":"resolved","repositories":{"bullseye":"2.35.2-2"},"fixed_version":"2.29.90.20180122-1","urgency":"low"},"forky":{"status":"resolved","repositories":{"forky":"2.46-3"},"fixed_version":"2.29.90.20180122-1","urgency":"low"},"sid":{"status":"resolved","repositories":{"sid":"2.46-3"},"fixed_version":"2.29.90.20180122-1","urgency":"low"},"trixie":{"status":"resolved","repositories":{"trixie":"2.44-3"},"fixed_version":"2.29.90.20180122-1","urgency":"low"}}},"CVE-2017-16827":{"description":"The aout_get_external_symbols function in aoutx.h in the Binary File Descriptor (BFD) library (aka libbfd), as distributed in GNU Binutils 2.29.1, allows remote attackers to cause a denial of service (slurp_symtab invalid free and application crash) or possibly have unspecified other impact via a crafted ELF file.","scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"2.40-2"},"fixed_version":"2.29.90.20180122-1","urgency":"low"},"bullseye":{"status":"resolved","repositories":{"bullseye":"2.35.2-2"},"fixed_version":"2.29.90.20180122-1","urgency":"low"},"forky":{"status":"resolved","repositories":{"forky":"2.46-3"},"fixed_version":"2.29.90.20180122-1","urgency":"low"},"sid":{"status":"resolved","repositories":{"sid":"2.46-3"},"fixed_version":"2.29.90.20180122-1","urgency":"low"},"trixie":{"status":"resolved","repositories":{"trixie":"2.44-3"},"fixed_version":"2.29.90.20180122-1","urgency":"low"}}},"CVE-2017-16828":{"description":"The display_debug_frames function in dwarf.c in GNU Binutils 2.29.1 allows remote attackers to cause a denial of service (integer overflow and heap-based buffer over-read, and application crash) or possibly have unspecified other impact via a crafted ELF file, related to print_debug_frame.","scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"2.40-2"},"fixed_version":"2.29.90.20180122-1","urgency":"low"},"bullseye":{"status":"resolved","repositories":{"bullseye":"2.35.2-2"},"fixed_version":"2.29.90.20180122-1","urgency":"low"},"forky":{"status":"resolved","repositories":{"forky":"2.46-3"},"fixed_version":"2.29.90.20180122-1","urgency":"low"},"sid":{"status":"resolved","repositories":{"sid":"2.46-3"},"fixed_version":"2.29.90.20180122-1","urgency":"low"},"trixie":{"status":"resolved","repositories":{"trixie":"2.44-3"},"fixed_version":"2.29.90.20180122-1","urgency":"low"}}},"CVE-2017-16829":{"description":"The _bfd_elf_parse_gnu_properties function in elf-properties.c in the Binary File Descriptor (BFD) library (aka libbfd), as distributed in GNU Binutils 2.29.1, does not prevent negative pointers, which allows remote attackers to cause a denial of service (out-of-bounds read and application crash) or possibly have unspecified other impact via a crafted ELF file.","scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"2.40-2"},"fixed_version":"2.29.90.20180122-1","urgency":"low"},"bullseye":{"status":"resolved","repositories":{"bullseye":"2.35.2-2"},"fixed_version":"2.29.90.20180122-1","urgency":"low"},"forky":{"status":"resolved","repositories":{"forky":"2.46-3"},"fixed_version":"2.29.90.20180122-1","urgency":"low"},"sid":{"status":"resolved","repositories":{"sid":"2.46-3"},"fixed_version":"2.29.90.20180122-1","urgency":"low"},"trixie":{"status":"resolved","repositories":{"trixie":"2.44-3"},"fixed_version":"2.29.90.20180122-1","urgency":"low"}}},"CVE-2017-16830":{"description":"The print_gnu_property_note function in readelf.c in GNU Binutils 2.29.1 does not have integer-overflow protection on 32-bit platforms, which allows remote attackers to cause a denial of service (segmentation violation and application crash) or possibly have unspecified other impact via a crafted ELF file.","scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"2.40-2"},"fixed_version":"2.29.90.20180122-1","urgency":"low"},"bullseye":{"status":"resolved","repositories":{"bullseye":"2.35.2-2"},"fixed_version":"2.29.90.20180122-1","urgency":"low"},"forky":{"status":"resolved","repositories":{"forky":"2.46-3"},"fixed_version":"2.29.90.20180122-1","urgency":"low"},"sid":{"status":"resolved","repositories":{"sid":"2.46-3"},"fixed_version":"2.29.90.20180122-1","urgency":"low"},"trixie":{"status":"resolved","repositories":{"trixie":"2.44-3"},"fixed_version":"2.29.90.20180122-1","urgency":"low"}}},"CVE-2017-16831":{"description":"coffgen.c in the Binary File Descriptor (BFD) library (aka libbfd), as distributed in GNU Binutils 2.29.1, does not validate the symbol count, which allows remote attackers to cause a denial of service (integer overflow and application crash, or excessive memory allocation) or possibly have unspecified other impact via a crafted PE file.","scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"2.40-2"},"fixed_version":"2.29.90.20180122-1","urgency":"low"},"bullseye":{"status":"resolved","repositories":{"bullseye":"2.35.2-2"},"fixed_version":"2.29.90.20180122-1","urgency":"low"},"forky":{"status":"resolved","repositories":{"forky":"2.46-3"},"fixed_version":"2.29.90.20180122-1","urgency":"low"},"sid":{"status":"resolved","repositories":{"sid":"2.46-3"},"fixed_version":"2.29.90.20180122-1","urgency":"low"},"trixie":{"status":"resolved","repositories":{"trixie":"2.44-3"},"fixed_version":"2.29.90.20180122-1","urgency":"low"}}},"CVE-2017-16832":{"description":"The pe_bfd_read_buildid function in peicode.h in the Binary File Descriptor (BFD) library (aka libbfd), as distributed in GNU Binutils 2.29.1, does not validate size and offset values in the data dictionary, which allows remote attackers to cause a denial of service (segmentation violation and application crash) or possibly have unspecified other impact via a crafted PE file.","scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"2.40-2"},"fixed_version":"2.29.90.20180122-1","urgency":"low"},"bullseye":{"status":"resolved","repositories":{"bullseye":"2.35.2-2"},"fixed_version":"2.29.90.20180122-1","urgency":"low"},"forky":{"status":"resolved","repositories":{"forky":"2.46-3"},"fixed_version":"2.29.90.20180122-1","urgency":"low"},"sid":{"status":"resolved","repositories":{"sid":"2.46-3"},"fixed_version":"2.29.90.20180122-1","urgency":"low"},"trixie":{"status":"resolved","repositories":{"trixie":"2.44-3"},"fixed_version":"2.29.90.20180122-1","urgency":"low"}}},"CVE-2017-17080":{"description":"elf.c in the Binary File Descriptor (BFD) library (aka libbfd), as distributed in GNU Binutils 2.29.1, does not validate sizes of core notes, which allows remote attackers to cause a denial of service (bfd_getl32 heap-based buffer over-read and application crash) via a crafted object file, related to elfcore_grok_netbsd_procinfo, elfcore_grok_openbsd_procinfo, and elfcore_grok_nto_status.","scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"2.40-2"},"fixed_version":"2.29.90.20180122-1","urgency":"low"},"bullseye":{"status":"resolved","repositories":{"bullseye":"2.35.2-2"},"fixed_version":"2.29.90.20180122-1","urgency":"low"},"forky":{"status":"resolved","repositories":{"forky":"2.46-3"},"fixed_version":"2.29.90.20180122-1","urgency":"low"},"sid":{"status":"resolved","repositories":{"sid":"2.46-3"},"fixed_version":"2.29.90.20180122-1","urgency":"low"},"trixie":{"status":"resolved","repositories":{"trixie":"2.44-3"},"fixed_version":"2.29.90.20180122-1","urgency":"low"}}},"CVE-2017-17121":{"description":"The Binary File Descriptor (BFD) library (aka libbfd), as distributed in GNU Binutils 2.29.1, allows remote attackers to cause a denial of service (memory access violation) or possibly have unspecified other impact via a COFF binary in which a relocation refers to a location after the end of the to-be-relocated section.","scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"2.40-2"},"fixed_version":"2.29.90.20180122-1","urgency":"low"},"bullseye":{"status":"resolved","repositories":{"bullseye":"2.35.2-2"},"fixed_version":"2.29.90.20180122-1","urgency":"low"},"forky":{"status":"resolved","repositories":{"forky":"2.46-3"},"fixed_version":"2.29.90.20180122-1","urgency":"low"},"sid":{"status":"resolved","repositories":{"sid":"2.46-3"},"fixed_version":"2.29.90.20180122-1","urgency":"low"},"trixie":{"status":"resolved","repositories":{"trixie":"2.44-3"},"fixed_version":"2.29.90.20180122-1","urgency":"low"}}},"CVE-2017-17122":{"description":"The dump_relocs_in_section function in objdump.c in GNU Binutils 2.29.1 does not check for reloc count integer overflows, which allows remote attackers to cause a denial of service (excessive memory allocation, or heap-based buffer overflow and application crash) or possibly have unspecified other impact via a crafted PE file.","scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"2.40-2"},"fixed_version":"2.29.90.20180122-1","urgency":"low"},"bullseye":{"status":"resolved","repositories":{"bullseye":"2.35.2-2"},"fixed_version":"2.29.90.20180122-1","urgency":"low"},"forky":{"status":"resolved","repositories":{"forky":"2.46-3"},"fixed_version":"2.29.90.20180122-1","urgency":"low"},"sid":{"status":"resolved","repositories":{"sid":"2.46-3"},"fixed_version":"2.29.90.20180122-1","urgency":"low"},"trixie":{"status":"resolved","repositories":{"trixie":"2.44-3"},"fixed_version":"2.29.90.20180122-1","urgency":"low"}}},"CVE-2017-17123":{"description":"The coff_slurp_reloc_table function in coffcode.h in the Binary File Descriptor (BFD) library (aka libbfd), as distributed in GNU Binutils 2.29.1, allows remote attackers to cause a denial of service (NULL pointer dereference and application crash) via a crafted COFF based file.","scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"2.40-2"},"fixed_version":"2.29.90.20180122-1","urgency":"low"},"bullseye":{"status":"resolved","repositories":{"bullseye":"2.35.2-2"},"fixed_version":"2.29.90.20180122-1","urgency":"low"},"forky":{"status":"resolved","repositories":{"forky":"2.46-3"},"fixed_version":"2.29.90.20180122-1","urgency":"low"},"sid":{"status":"resolved","repositories":{"sid":"2.46-3"},"fixed_version":"2.29.90.20180122-1","urgency":"low"},"trixie":{"status":"resolved","repositories":{"trixie":"2.44-3"},"fixed_version":"2.29.90.20180122-1","urgency":"low"}}},"CVE-2017-17124":{"description":"The _bfd_coff_read_string_table function in coffgen.c in the Binary File Descriptor (BFD) library (aka libbfd), as distributed in GNU Binutils 2.29.1, does not properly validate the size of the external string table, which allows remote attackers to cause a denial of service (excessive memory consumption, or heap-based buffer overflow and application crash) or possibly have unspecified other impact via a crafted COFF binary.","scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"2.40-2"},"fixed_version":"2.29.90.20180122-1","urgency":"low"},"bullseye":{"status":"resolved","repositories":{"bullseye":"2.35.2-2"},"fixed_version":"2.29.90.20180122-1","urgency":"low"},"forky":{"status":"resolved","repositories":{"forky":"2.46-3"},"fixed_version":"2.29.90.20180122-1","urgency":"low"},"sid":{"status":"resolved","repositories":{"sid":"2.46-3"},"fixed_version":"2.29.90.20180122-1","urgency":"low"},"trixie":{"status":"resolved","repositories":{"trixie":"2.44-3"},"fixed_version":"2.29.90.20180122-1","urgency":"low"}}},"CVE-2017-17125":{"description":"nm.c and objdump.c in GNU Binutils 2.29.1 mishandle certain global symbols, which allows remote attackers to cause a denial of service (_bfd_elf_get_symbol_version_string buffer over-read and application crash) or possibly have unspecified other impact via a crafted ELF file.","scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"2.40-2"},"fixed_version":"2.29.90.20180122-1","urgency":"low"},"bullseye":{"status":"resolved","repositories":{"bullseye":"2.35.2-2"},"fixed_version":"2.29.90.20180122-1","urgency":"low"},"forky":{"status":"resolved","repositories":{"forky":"2.46-3"},"fixed_version":"2.29.90.20180122-1","urgency":"low"},"sid":{"status":"resolved","repositories":{"sid":"2.46-3"},"fixed_version":"2.29.90.20180122-1","urgency":"low"},"trixie":{"status":"resolved","repositories":{"trixie":"2.44-3"},"fixed_version":"2.29.90.20180122-1","urgency":"low"}}},"CVE-2017-17126":{"description":"The load_debug_section function in readelf.c in GNU Binutils 2.29.1 allows remote attackers to cause a denial of service (invalid memory access and application crash) or possibly have unspecified other impact via an ELF file that lacks section headers.","scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"2.40-2"},"fixed_version":"2.29.90.20180122-1","urgency":"low"},"bullseye":{"status":"resolved","repositories":{"bullseye":"2.35.2-2"},"fixed_version":"2.29.90.20180122-1","urgency":"low"},"forky":{"status":"resolved","repositories":{"forky":"2.46-3"},"fixed_version":"2.29.90.20180122-1","urgency":"low"},"sid":{"status":"resolved","repositories":{"sid":"2.46-3"},"fixed_version":"2.29.90.20180122-1","urgency":"low"},"trixie":{"status":"resolved","repositories":{"trixie":"2.44-3"},"fixed_version":"2.29.90.20180122-1","urgency":"low"}}},"CVE-2017-6965":{"description":"readelf in GNU Binutils 2.28 writes to illegal addresses while processing corrupt input files containing symbol-difference relocations, leading to a heap-based buffer overflow.","debianbug":858264,"scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"2.40-2"},"fixed_version":"2.28-3","urgency":"not yet assigned"},"bullseye":{"status":"resolved","repositories":{"bullseye":"2.35.2-2"},"fixed_version":"2.28-3","urgency":"not yet assigned"},"forky":{"status":"resolved","repositories":{"forky":"2.46-3"},"fixed_version":"2.28-3","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"2.46-3"},"fixed_version":"2.28-3","urgency":"not yet assigned"},"trixie":{"status":"resolved","repositories":{"trixie":"2.44-3"},"fixed_version":"2.28-3","urgency":"not yet assigned"}}},"CVE-2017-6966":{"description":"readelf in GNU Binutils 2.28 has a use-after-free (specifically read-after-free) error while processing multiple, relocated sections in an MSP430 binary. This is caused by mishandling of an invalid symbol index, and mishandling of state across invocations.","debianbug":858263,"scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"2.40-2"},"fixed_version":"2.28-3","urgency":"not yet assigned"},"bullseye":{"status":"resolved","repositories":{"bullseye":"2.35.2-2"},"fixed_version":"2.28-3","urgency":"not yet assigned"},"forky":{"status":"resolved","repositories":{"forky":"2.46-3"},"fixed_version":"2.28-3","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"2.46-3"},"fixed_version":"2.28-3","urgency":"not yet assigned"},"trixie":{"status":"resolved","repositories":{"trixie":"2.44-3"},"fixed_version":"2.28-3","urgency":"not yet assigned"}}},"CVE-2017-6969":{"description":"readelf in GNU Binutils 2.28 is vulnerable to a heap-based buffer over-read while processing corrupt RL78 binaries. The vulnerability can trigger program crashes. It may lead to an information leak as well.","debianbug":858256,"scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"2.40-2"},"fixed_version":"2.28-3","urgency":"not yet assigned"},"bullseye":{"status":"resolved","repositories":{"bullseye":"2.35.2-2"},"fixed_version":"2.28-3","urgency":"not yet assigned"},"forky":{"status":"resolved","repositories":{"forky":"2.46-3"},"fixed_version":"2.28-3","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"2.46-3"},"fixed_version":"2.28-3","urgency":"not yet assigned"},"trixie":{"status":"resolved","repositories":{"trixie":"2.44-3"},"fixed_version":"2.28-3","urgency":"not yet assigned"}}},"CVE-2017-7209":{"description":"The dump_section_as_bytes function in readelf in GNU Binutils 2.28 accesses a NULL pointer while reading section contents in a corrupt binary, leading to a program crash.","debianbug":858323,"scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"2.40-2"},"fixed_version":"2.28-3","urgency":"low"},"bullseye":{"status":"resolved","repositories":{"bullseye":"2.35.2-2"},"fixed_version":"2.28-3","urgency":"low"},"forky":{"status":"resolved","repositories":{"forky":"2.46-3"},"fixed_version":"2.28-3","urgency":"low"},"sid":{"status":"resolved","repositories":{"sid":"2.46-3"},"fixed_version":"2.28-3","urgency":"low"},"trixie":{"status":"resolved","repositories":{"trixie":"2.44-3"},"fixed_version":"2.28-3","urgency":"low"}}},"CVE-2017-7210":{"description":"objdump in GNU Binutils 2.28 is vulnerable to multiple heap-based buffer over-reads (of size 1 and size 8) while handling corrupt STABS enum type strings in a crafted object file, leading to program crash.","debianbug":858324,"scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"2.40-2"},"fixed_version":"2.28-3","urgency":"low"},"bullseye":{"status":"resolved","repositories":{"bullseye":"2.35.2-2"},"fixed_version":"2.28-3","urgency":"low"},"forky":{"status":"resolved","repositories":{"forky":"2.46-3"},"fixed_version":"2.28-3","urgency":"low"},"sid":{"status":"resolved","repositories":{"sid":"2.46-3"},"fixed_version":"2.28-3","urgency":"low"},"trixie":{"status":"resolved","repositories":{"trixie":"2.44-3"},"fixed_version":"2.28-3","urgency":"low"}}},"CVE-2017-7223":{"description":"GNU assembler in GNU Binutils 2.28 is vulnerable to a global buffer overflow (of size 1) while attempting to unget an EOF character from the input stream, potentially leading to a program crash.","scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"2.40-2"},"fixed_version":"2.27.51.20161212-1","urgency":"not yet assigned"},"bullseye":{"status":"resolved","repositories":{"bullseye":"2.35.2-2"},"fixed_version":"2.27.51.20161212-1","urgency":"not yet assigned"},"forky":{"status":"resolved","repositories":{"forky":"2.46-3"},"fixed_version":"2.27.51.20161212-1","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"2.46-3"},"fixed_version":"2.27.51.20161212-1","urgency":"not yet assigned"},"trixie":{"status":"resolved","repositories":{"trixie":"2.44-3"},"fixed_version":"2.27.51.20161212-1","urgency":"not yet assigned"}}},"CVE-2017-7224":{"description":"The find_nearest_line function in objdump in GNU Binutils 2.28 is vulnerable to an invalid write (of size 1) while disassembling a corrupt binary that contains an empty function name, leading to a program crash.","scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"2.40-2"},"fixed_version":"2.27.51.20161201-1","urgency":"not yet assigned"},"bullseye":{"status":"resolved","repositories":{"bullseye":"2.35.2-2"},"fixed_version":"2.27.51.20161201-1","urgency":"not yet assigned"},"forky":{"status":"resolved","repositories":{"forky":"2.46-3"},"fixed_version":"2.27.51.20161201-1","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"2.46-3"},"fixed_version":"2.27.51.20161201-1","urgency":"not yet assigned"},"trixie":{"status":"resolved","repositories":{"trixie":"2.44-3"},"fixed_version":"2.27.51.20161201-1","urgency":"not yet assigned"}}},"CVE-2017-7225":{"description":"The find_nearest_line function in addr2line in GNU Binutils 2.28 does not handle the case where the main file name and the directory name are both empty, triggering a NULL pointer dereference and an invalid write, and leading to a program crash.","scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"2.40-2"},"fixed_version":"2.27.51.20161201-1","urgency":"not yet assigned"},"bullseye":{"status":"resolved","repositories":{"bullseye":"2.35.2-2"},"fixed_version":"2.27.51.20161201-1","urgency":"not yet assigned"},"forky":{"status":"resolved","repositories":{"forky":"2.46-3"},"fixed_version":"2.27.51.20161201-1","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"2.46-3"},"fixed_version":"2.27.51.20161201-1","urgency":"not yet assigned"},"trixie":{"status":"resolved","repositories":{"trixie":"2.44-3"},"fixed_version":"2.27.51.20161201-1","urgency":"not yet assigned"}}},"CVE-2017-7226":{"description":"The pe_ILF_object_p function in the Binary File Descriptor (BFD) library (aka libbfd), as distributed in GNU Binutils 2.28, is vulnerable to a heap-based buffer over-read of size 4049 because it uses the strlen function instead of strnlen, leading to program crashes in several utilities such as addr2line, size, and strings. It could lead to information disclosure as well.","scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"2.40-2"},"fixed_version":"2.27.51.20161212-1","urgency":"not yet assigned"},"bullseye":{"status":"resolved","repositories":{"bullseye":"2.35.2-2"},"fixed_version":"2.27.51.20161212-1","urgency":"not yet assigned"},"forky":{"status":"resolved","repositories":{"forky":"2.46-3"},"fixed_version":"2.27.51.20161212-1","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"2.46-3"},"fixed_version":"2.27.51.20161212-1","urgency":"not yet assigned"},"trixie":{"status":"resolved","repositories":{"trixie":"2.44-3"},"fixed_version":"2.27.51.20161212-1","urgency":"not yet assigned"}}},"CVE-2017-7227":{"description":"GNU linker (ld) in GNU Binutils 2.28 is vulnerable to a heap-based buffer overflow while processing a bogus input script, leading to a program crash. This relates to lack of '\\0' termination of a name field in ldlex.l.","scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"2.40-2"},"fixed_version":"2.27.51.20161212-1","urgency":"not yet assigned"},"bullseye":{"status":"resolved","repositories":{"bullseye":"2.35.2-2"},"fixed_version":"2.27.51.20161212-1","urgency":"not yet assigned"},"forky":{"status":"resolved","repositories":{"forky":"2.46-3"},"fixed_version":"2.27.51.20161212-1","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"2.46-3"},"fixed_version":"2.27.51.20161212-1","urgency":"not yet assigned"},"trixie":{"status":"resolved","repositories":{"trixie":"2.44-3"},"fixed_version":"2.27.51.20161212-1","urgency":"not yet assigned"}}},"CVE-2017-7299":{"description":"The Binary File Descriptor (BFD) library (aka libbfd), as distributed in GNU Binutils 2.28, has an invalid read (of size 8) because the code to emit relocs (bfd_elf_final_link function in bfd/elflink.c) does not check the format of the input file before trying to read the ELF reloc section header. The vulnerability leads to a GNU linker (ld) program crash.","scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"2.40-2"},"fixed_version":"2.27.51.20161220-1","urgency":"not yet assigned"},"bullseye":{"status":"resolved","repositories":{"bullseye":"2.35.2-2"},"fixed_version":"2.27.51.20161220-1","urgency":"not yet assigned"},"forky":{"status":"resolved","repositories":{"forky":"2.46-3"},"fixed_version":"2.27.51.20161220-1","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"2.46-3"},"fixed_version":"2.27.51.20161220-1","urgency":"not yet assigned"},"trixie":{"status":"resolved","repositories":{"trixie":"2.44-3"},"fixed_version":"2.27.51.20161220-1","urgency":"not yet assigned"}}},"CVE-2017-7300":{"description":"The Binary File Descriptor (BFD) library (aka libbfd), as distributed in GNU Binutils 2.28, has an aout_link_add_symbols function in bfd/aoutx.h that is vulnerable to a heap-based buffer over-read (off-by-one) because of an incomplete check for invalid string offsets while loading symbols, leading to a GNU linker (ld) program crash.","scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"2.40-2"},"fixed_version":"2.27.51.20161212-1","urgency":"not yet assigned"},"bullseye":{"status":"resolved","repositories":{"bullseye":"2.35.2-2"},"fixed_version":"2.27.51.20161212-1","urgency":"not yet assigned"},"forky":{"status":"resolved","repositories":{"forky":"2.46-3"},"fixed_version":"2.27.51.20161212-1","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"2.46-3"},"fixed_version":"2.27.51.20161212-1","urgency":"not yet assigned"},"trixie":{"status":"resolved","repositories":{"trixie":"2.44-3"},"fixed_version":"2.27.51.20161212-1","urgency":"not yet assigned"}}},"CVE-2017-7301":{"description":"The Binary File Descriptor (BFD) library (aka libbfd), as distributed in GNU Binutils 2.28, has an aout_link_add_symbols function in bfd/aoutx.h that has an off-by-one vulnerability because it does not carefully check the string offset. The vulnerability could lead to a GNU linker (ld) program crash.","scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"2.40-2"},"fixed_version":"2.27.51.20161212-1","urgency":"not yet assigned"},"bullseye":{"status":"resolved","repositories":{"bullseye":"2.35.2-2"},"fixed_version":"2.27.51.20161212-1","urgency":"not yet assigned"},"forky":{"status":"resolved","repositories":{"forky":"2.46-3"},"fixed_version":"2.27.51.20161212-1","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"2.46-3"},"fixed_version":"2.27.51.20161212-1","urgency":"not yet assigned"},"trixie":{"status":"resolved","repositories":{"trixie":"2.44-3"},"fixed_version":"2.27.51.20161212-1","urgency":"not yet assigned"}}},"CVE-2017-7302":{"description":"The Binary File Descriptor (BFD) library (aka libbfd), as distributed in GNU Binutils 2.28, has a swap_std_reloc_out function in bfd/aoutx.h that is vulnerable to an invalid read (of size 4) because of missing checks for relocs that could not be recognised. This vulnerability causes Binutils utilities like strip to crash.","scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"2.40-2"},"fixed_version":"2.27.51.20161212-1","urgency":"not yet assigned"},"bullseye":{"status":"resolved","repositories":{"bullseye":"2.35.2-2"},"fixed_version":"2.27.51.20161212-1","urgency":"not yet assigned"},"forky":{"status":"resolved","repositories":{"forky":"2.46-3"},"fixed_version":"2.27.51.20161212-1","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"2.46-3"},"fixed_version":"2.27.51.20161212-1","urgency":"not yet assigned"},"trixie":{"status":"resolved","repositories":{"trixie":"2.44-3"},"fixed_version":"2.27.51.20161212-1","urgency":"not yet assigned"}}},"CVE-2017-7303":{"description":"The Binary File Descriptor (BFD) library (aka libbfd), as distributed in GNU Binutils 2.28, is vulnerable to an invalid read (of size 4) because of missing a check (in the find_link function) for null headers before attempting to match them. This vulnerability causes Binutils utilities like strip to crash.","scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"2.40-2"},"fixed_version":"2.27.51.20161212-1","urgency":"not yet assigned"},"bullseye":{"status":"resolved","repositories":{"bullseye":"2.35.2-2"},"fixed_version":"2.27.51.20161212-1","urgency":"not yet assigned"},"forky":{"status":"resolved","repositories":{"forky":"2.46-3"},"fixed_version":"2.27.51.20161212-1","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"2.46-3"},"fixed_version":"2.27.51.20161212-1","urgency":"not yet assigned"},"trixie":{"status":"resolved","repositories":{"trixie":"2.44-3"},"fixed_version":"2.27.51.20161212-1","urgency":"not yet assigned"}}},"CVE-2017-7304":{"description":"The Binary File Descriptor (BFD) library (aka libbfd), as distributed in GNU Binutils 2.28, is vulnerable to an invalid read (of size 8) because of missing a check (in the copy_special_section_fields function) for an invalid sh_link field before attempting to follow it. This vulnerability causes Binutils utilities like strip to crash.","scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"2.40-2"},"fixed_version":"2.27.51.20161212-1","urgency":"not yet assigned"},"bullseye":{"status":"resolved","repositories":{"bullseye":"2.35.2-2"},"fixed_version":"2.27.51.20161212-1","urgency":"not yet assigned"},"forky":{"status":"resolved","repositories":{"forky":"2.46-3"},"fixed_version":"2.27.51.20161212-1","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"2.46-3"},"fixed_version":"2.27.51.20161212-1","urgency":"not yet assigned"},"trixie":{"status":"resolved","repositories":{"trixie":"2.44-3"},"fixed_version":"2.27.51.20161212-1","urgency":"not yet assigned"}}},"CVE-2017-7614":{"description":"elflink.c in the Binary File Descriptor (BFD) library (aka libbfd), as distributed in GNU Binutils 2.28, has a \"member access within null pointer\" undefined behavior issue, which might allow remote attackers to cause a denial of service (application crash) or possibly have unspecified other impact via an \"int main() {return 0;}\" program.","debianbug":859989,"scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"2.40-2"},"fixed_version":"2.28-4","urgency":"low"},"bullseye":{"status":"resolved","repositories":{"bullseye":"2.35.2-2"},"fixed_version":"2.28-4","urgency":"low"},"forky":{"status":"resolved","repositories":{"forky":"2.46-3"},"fixed_version":"2.28-4","urgency":"low"},"sid":{"status":"resolved","repositories":{"sid":"2.46-3"},"fixed_version":"2.28-4","urgency":"low"},"trixie":{"status":"resolved","repositories":{"trixie":"2.44-3"},"fixed_version":"2.28-4","urgency":"low"}}},"CVE-2017-8392":{"description":"The Binary File Descriptor (BFD) library (aka libbfd), as distributed in GNU Binutils 2.28, is vulnerable to an invalid read of size 8 because of missing a check to determine whether symbols are NULL in the _bfd_dwarf2_find_nearest_line function. This vulnerability causes programs that conduct an analysis of binary programs using the libbfd library, such as objdump, to crash.","scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"2.40-2"},"fixed_version":"0","urgency":"unimportant"},"bullseye":{"status":"resolved","repositories":{"bullseye":"2.35.2-2"},"fixed_version":"0","urgency":"unimportant"},"forky":{"status":"resolved","repositories":{"forky":"2.46-3"},"fixed_version":"0","urgency":"unimportant"},"sid":{"status":"resolved","repositories":{"sid":"2.46-3"},"fixed_version":"0","urgency":"unimportant"},"trixie":{"status":"resolved","repositories":{"trixie":"2.44-3"},"fixed_version":"0","urgency":"unimportant"}}},"CVE-2017-8393":{"description":"The Binary File Descriptor (BFD) library (aka libbfd), as distributed in GNU Binutils 2.28, is vulnerable to a global buffer over-read error because of an assumption made by code that runs for objcopy and strip, that SHT_REL/SHR_RELA sections are always named starting with a .rel/.rela prefix. This vulnerability causes programs that conduct an analysis of binary programs using the libbfd library, such as objcopy and strip, to crash.","scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"2.40-2"},"fixed_version":"2.28-5","urgency":"not yet assigned"},"bullseye":{"status":"resolved","repositories":{"bullseye":"2.35.2-2"},"fixed_version":"2.28-5","urgency":"not yet assigned"},"forky":{"status":"resolved","repositories":{"forky":"2.46-3"},"fixed_version":"2.28-5","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"2.46-3"},"fixed_version":"2.28-5","urgency":"not yet assigned"},"trixie":{"status":"resolved","repositories":{"trixie":"2.44-3"},"fixed_version":"2.28-5","urgency":"not yet assigned"}}},"CVE-2017-8394":{"description":"The Binary File Descriptor (BFD) library (aka libbfd), as distributed in GNU Binutils 2.28, is vulnerable to an invalid read of size 4 due to NULL pointer dereferencing of _bfd_elf_large_com_section. This vulnerability causes programs that conduct an analysis of binary programs using the libbfd library, such as objcopy, to crash.","scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"2.40-2"},"fixed_version":"2.28-5","urgency":"not yet assigned"},"bullseye":{"status":"resolved","repositories":{"bullseye":"2.35.2-2"},"fixed_version":"2.28-5","urgency":"not yet assigned"},"forky":{"status":"resolved","repositories":{"forky":"2.46-3"},"fixed_version":"2.28-5","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"2.46-3"},"fixed_version":"2.28-5","urgency":"not yet assigned"},"trixie":{"status":"resolved","repositories":{"trixie":"2.44-3"},"fixed_version":"2.28-5","urgency":"not yet assigned"}}},"CVE-2017-8395":{"description":"The Binary File Descriptor (BFD) library (aka libbfd), as distributed in GNU Binutils 2.28, is vulnerable to an invalid write of size 8 because of missing a malloc() return-value check to see if memory had actually been allocated in the _bfd_generic_get_section_contents function. This vulnerability causes programs that conduct an analysis of binary programs using the libbfd library, such as objcopy, to crash.","scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"2.40-2"},"fixed_version":"2.28-5","urgency":"not yet assigned"},"bullseye":{"status":"resolved","repositories":{"bullseye":"2.35.2-2"},"fixed_version":"2.28-5","urgency":"not yet assigned"},"forky":{"status":"resolved","repositories":{"forky":"2.46-3"},"fixed_version":"2.28-5","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"2.46-3"},"fixed_version":"2.28-5","urgency":"not yet assigned"},"trixie":{"status":"resolved","repositories":{"trixie":"2.44-3"},"fixed_version":"2.28-5","urgency":"not yet assigned"}}},"CVE-2017-8396":{"description":"The Binary File Descriptor (BFD) library (aka libbfd), as distributed in GNU Binutils 2.28, is vulnerable to an invalid read of size 1 because the existing reloc offset range tests didn't catch small negative offsets less than the size of the reloc field. This vulnerability causes programs that conduct an analysis of binary programs using the libbfd library, such as objdump, to crash.","scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"2.40-2"},"fixed_version":"2.28-5","urgency":"not yet assigned"},"bullseye":{"status":"resolved","repositories":{"bullseye":"2.35.2-2"},"fixed_version":"2.28-5","urgency":"not yet assigned"},"forky":{"status":"resolved","repositories":{"forky":"2.46-3"},"fixed_version":"2.28-5","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"2.46-3"},"fixed_version":"2.28-5","urgency":"not yet assigned"},"trixie":{"status":"resolved","repositories":{"trixie":"2.44-3"},"fixed_version":"2.28-5","urgency":"not yet assigned"}}},"CVE-2017-8397":{"description":"The Binary File Descriptor (BFD) library (aka libbfd), as distributed in GNU Binutils 2.28, is vulnerable to an invalid read of size 1 and an invalid write of size 1 during processing of a corrupt binary containing reloc(s) with negative addresses. This vulnerability causes programs that conduct an analysis of binary programs using the libbfd library, such as objdump, to crash.","scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"2.40-2"},"fixed_version":"2.28-5","urgency":"not yet assigned"},"bullseye":{"status":"resolved","repositories":{"bullseye":"2.35.2-2"},"fixed_version":"2.28-5","urgency":"not yet assigned"},"forky":{"status":"resolved","repositories":{"forky":"2.46-3"},"fixed_version":"2.28-5","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"2.46-3"},"fixed_version":"2.28-5","urgency":"not yet assigned"},"trixie":{"status":"resolved","repositories":{"trixie":"2.44-3"},"fixed_version":"2.28-5","urgency":"not yet assigned"}}},"CVE-2017-8398":{"description":"dwarf.c in GNU Binutils 2.28 is vulnerable to an invalid read of size 1 during dumping of debug information from a corrupt binary. This vulnerability causes programs that conduct an analysis of binary programs, such as objdump and readelf, to crash.","scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"2.40-2"},"fixed_version":"2.28-5","urgency":"not yet assigned"},"bullseye":{"status":"resolved","repositories":{"bullseye":"2.35.2-2"},"fixed_version":"2.28-5","urgency":"not yet assigned"},"forky":{"status":"resolved","repositories":{"forky":"2.46-3"},"fixed_version":"2.28-5","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"2.46-3"},"fixed_version":"2.28-5","urgency":"not yet assigned"},"trixie":{"status":"resolved","repositories":{"trixie":"2.44-3"},"fixed_version":"2.28-5","urgency":"not yet assigned"}}},"CVE-2017-8421":{"description":"The function coff_set_alignment_hook in coffcode.h in Binary File Descriptor (BFD) library (aka libbfd), as distributed in GNU Binutils 2.28, has a memory leak vulnerability which can cause memory exhaustion in objdump via a crafted PE file. Additional validation in dump_relocs_in_section in objdump.c can resolve this.","scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"2.40-2"},"fixed_version":"2.28-5","urgency":"not yet assigned"},"bullseye":{"status":"resolved","repositories":{"bullseye":"2.35.2-2"},"fixed_version":"2.28-5","urgency":"not yet assigned"},"forky":{"status":"resolved","repositories":{"forky":"2.46-3"},"fixed_version":"2.28-5","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"2.46-3"},"fixed_version":"2.28-5","urgency":"not yet assigned"},"trixie":{"status":"resolved","repositories":{"trixie":"2.44-3"},"fixed_version":"2.28-5","urgency":"not yet assigned"}}},"CVE-2017-9038":{"description":"GNU Binutils 2.28 allows remote attackers to cause a denial of service (heap-based buffer over-read and application crash) via a crafted ELF file, related to the byte_get_little_endian function in elfcomm.c, the get_unwind_section_word function in readelf.c, and ARM unwind information that contains invalid word offsets.","debianbug":863674,"scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"2.40-2"},"fixed_version":"2.28-6","urgency":"low"},"bullseye":{"status":"resolved","repositories":{"bullseye":"2.35.2-2"},"fixed_version":"2.28-6","urgency":"low"},"forky":{"status":"resolved","repositories":{"forky":"2.46-3"},"fixed_version":"2.28-6","urgency":"low"},"sid":{"status":"resolved","repositories":{"sid":"2.46-3"},"fixed_version":"2.28-6","urgency":"low"},"trixie":{"status":"resolved","repositories":{"trixie":"2.44-3"},"fixed_version":"2.28-6","urgency":"low"}}},"CVE-2017-9039":{"description":"GNU Binutils 2.28 allows remote attackers to cause a denial of service (memory consumption) via a crafted ELF file with many program headers, related to the get_program_headers function in readelf.c.","debianbug":863674,"scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"2.40-2"},"fixed_version":"2.28-6","urgency":"low"},"bullseye":{"status":"resolved","repositories":{"bullseye":"2.35.2-2"},"fixed_version":"2.28-6","urgency":"low"},"forky":{"status":"resolved","repositories":{"forky":"2.46-3"},"fixed_version":"2.28-6","urgency":"low"},"sid":{"status":"resolved","repositories":{"sid":"2.46-3"},"fixed_version":"2.28-6","urgency":"low"},"trixie":{"status":"resolved","repositories":{"trixie":"2.44-3"},"fixed_version":"2.28-6","urgency":"low"}}},"CVE-2017-9040":{"description":"GNU Binutils 2017-04-03 allows remote attackers to cause a denial of service (NULL pointer dereference and application crash), related to the process_mips_specific function in readelf.c, via a crafted ELF file that triggers a large memory-allocation attempt.","debianbug":863674,"scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"2.40-2"},"fixed_version":"2.29-1","urgency":"low"},"bullseye":{"status":"resolved","repositories":{"bullseye":"2.35.2-2"},"fixed_version":"2.29-1","urgency":"low"},"forky":{"status":"resolved","repositories":{"forky":"2.46-3"},"fixed_version":"2.29-1","urgency":"low"},"sid":{"status":"resolved","repositories":{"sid":"2.46-3"},"fixed_version":"2.29-1","urgency":"low"},"trixie":{"status":"resolved","repositories":{"trixie":"2.44-3"},"fixed_version":"2.29-1","urgency":"low"}}},"CVE-2017-9041":{"description":"GNU Binutils 2.28 allows remote attackers to cause a denial of service (heap-based buffer over-read and application crash) via a crafted ELF file, related to MIPS GOT mishandling in the process_mips_specific function in readelf.c.","debianbug":863674,"scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"2.40-2"},"fixed_version":"2.28-6","urgency":"low"},"bullseye":{"status":"resolved","repositories":{"bullseye":"2.35.2-2"},"fixed_version":"2.28-6","urgency":"low"},"forky":{"status":"resolved","repositories":{"forky":"2.46-3"},"fixed_version":"2.28-6","urgency":"low"},"sid":{"status":"resolved","repositories":{"sid":"2.46-3"},"fixed_version":"2.28-6","urgency":"low"},"trixie":{"status":"resolved","repositories":{"trixie":"2.44-3"},"fixed_version":"2.28-6","urgency":"low"}}},"CVE-2017-9042":{"description":"readelf.c in GNU Binutils 2017-04-12 has a \"cannot be represented in type long\" issue, which might allow remote attackers to cause a denial of service (application crash) or possibly have unspecified other impact via a crafted ELF file.","debianbug":863674,"scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"2.40-2"},"fixed_version":"2.29-1","urgency":"low"},"bullseye":{"status":"resolved","repositories":{"bullseye":"2.35.2-2"},"fixed_version":"2.29-1","urgency":"low"},"forky":{"status":"resolved","repositories":{"forky":"2.46-3"},"fixed_version":"2.29-1","urgency":"low"},"sid":{"status":"resolved","repositories":{"sid":"2.46-3"},"fixed_version":"2.29-1","urgency":"low"},"trixie":{"status":"resolved","repositories":{"trixie":"2.44-3"},"fixed_version":"2.29-1","urgency":"low"}}},"CVE-2017-9043":{"description":"readelf.c in GNU Binutils 2017-04-12 has a \"shift exponent too large for type unsigned long\" issue, which might allow remote attackers to cause a denial of service (application crash) or possibly have unspecified other impact via a crafted ELF file.","debianbug":863674,"scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"2.40-2"},"fixed_version":"2.29-1","urgency":"low"},"bullseye":{"status":"resolved","repositories":{"bullseye":"2.35.2-2"},"fixed_version":"2.29-1","urgency":"low"},"forky":{"status":"resolved","repositories":{"forky":"2.46-3"},"fixed_version":"2.29-1","urgency":"low"},"sid":{"status":"resolved","repositories":{"sid":"2.46-3"},"fixed_version":"2.29-1","urgency":"low"},"trixie":{"status":"resolved","repositories":{"trixie":"2.44-3"},"fixed_version":"2.29-1","urgency":"low"}}},"CVE-2017-9044":{"description":"The print_symbol_for_build_attribute function in readelf.c in GNU Binutils 2017-04-12 allows remote attackers to cause a denial of service (invalid read and SEGV) via a crafted ELF file.","scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"2.40-2"},"fixed_version":"2.29-1","urgency":"low"},"bullseye":{"status":"resolved","repositories":{"bullseye":"2.35.2-2"},"fixed_version":"2.29-1","urgency":"low"},"forky":{"status":"resolved","repositories":{"forky":"2.46-3"},"fixed_version":"2.29-1","urgency":"low"},"sid":{"status":"resolved","repositories":{"sid":"2.46-3"},"fixed_version":"2.29-1","urgency":"low"},"trixie":{"status":"resolved","repositories":{"trixie":"2.44-3"},"fixed_version":"2.29-1","urgency":"low"}}},"CVE-2017-9742":{"description":"The score_opcodes function in opcodes/score7-dis.c in GNU Binutils 2.28 allows remote attackers to cause a denial of service (buffer overflow and application crash) or possibly have unspecified other impact via a crafted binary file, as demonstrated by mishandling of this file during \"objdump -D\" execution.","scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"2.40-2"},"fixed_version":"2.29-1","urgency":"low"},"bullseye":{"status":"resolved","repositories":{"bullseye":"2.35.2-2"},"fixed_version":"2.29-1","urgency":"low"},"forky":{"status":"resolved","repositories":{"forky":"2.46-3"},"fixed_version":"2.29-1","urgency":"low"},"sid":{"status":"resolved","repositories":{"sid":"2.46-3"},"fixed_version":"2.29-1","urgency":"low"},"trixie":{"status":"resolved","repositories":{"trixie":"2.44-3"},"fixed_version":"2.29-1","urgency":"low"}}},"CVE-2017-9743":{"description":"The print_insn_score32 function in opcodes/score7-dis.c:552 in GNU Binutils 2.28 allows remote attackers to cause a denial of service (buffer overflow and application crash) or possibly have unspecified other impact via a crafted binary file, as demonstrated by mishandling of this file during \"objdump -D\" execution.","scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"2.40-2"},"fixed_version":"2.29-1","urgency":"low"},"bullseye":{"status":"resolved","repositories":{"bullseye":"2.35.2-2"},"fixed_version":"2.29-1","urgency":"low"},"forky":{"status":"resolved","repositories":{"forky":"2.46-3"},"fixed_version":"2.29-1","urgency":"low"},"sid":{"status":"resolved","repositories":{"sid":"2.46-3"},"fixed_version":"2.29-1","urgency":"low"},"trixie":{"status":"resolved","repositories":{"trixie":"2.44-3"},"fixed_version":"2.29-1","urgency":"low"}}},"CVE-2017-9744":{"description":"The sh_elf_set_mach_from_flags function in bfd/elf32-sh.c in the Binary File Descriptor (BFD) library (aka libbfd), as distributed in GNU Binutils 2.28, allows remote attackers to cause a denial of service (buffer overflow and application crash) or possibly have unspecified other impact via a crafted binary file, as demonstrated by mishandling of this file during \"objdump -D\" execution.","scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"2.40-2"},"fixed_version":"2.29-1","urgency":"low"},"bullseye":{"status":"resolved","repositories":{"bullseye":"2.35.2-2"},"fixed_version":"2.29-1","urgency":"low"},"forky":{"status":"resolved","repositories":{"forky":"2.46-3"},"fixed_version":"2.29-1","urgency":"low"},"sid":{"status":"resolved","repositories":{"sid":"2.46-3"},"fixed_version":"2.29-1","urgency":"low"},"trixie":{"status":"resolved","repositories":{"trixie":"2.44-3"},"fixed_version":"2.29-1","urgency":"low"}}},"CVE-2017-9745":{"description":"The _bfd_vms_slurp_etir function in bfd/vms-alpha.c in the Binary File Descriptor (BFD) library (aka libbfd), as distributed in GNU Binutils 2.28, allows remote attackers to cause a denial of service (buffer overflow and application crash) or possibly have unspecified other impact via a crafted binary file, as demonstrated by mishandling of this file during \"objdump -D\" execution.","scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"2.40-2"},"fixed_version":"2.29-1","urgency":"low"},"bullseye":{"status":"resolved","repositories":{"bullseye":"2.35.2-2"},"fixed_version":"2.29-1","urgency":"low"},"forky":{"status":"resolved","repositories":{"forky":"2.46-3"},"fixed_version":"2.29-1","urgency":"low"},"sid":{"status":"resolved","repositories":{"sid":"2.46-3"},"fixed_version":"2.29-1","urgency":"low"},"trixie":{"status":"resolved","repositories":{"trixie":"2.44-3"},"fixed_version":"2.29-1","urgency":"low"}}},"CVE-2017-9746":{"description":"The disassemble_bytes function in objdump.c in GNU Binutils 2.28 allows remote attackers to cause a denial of service (buffer overflow and application crash) or possibly have unspecified other impact via a crafted binary file, as demonstrated by mishandling of rae insns printing for this file during \"objdump -D\" execution.","scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"2.40-2"},"fixed_version":"2.29-1","urgency":"low"},"bullseye":{"status":"resolved","repositories":{"bullseye":"2.35.2-2"},"fixed_version":"2.29-1","urgency":"low"},"forky":{"status":"resolved","repositories":{"forky":"2.46-3"},"fixed_version":"2.29-1","urgency":"low"},"sid":{"status":"resolved","repositories":{"sid":"2.46-3"},"fixed_version":"2.29-1","urgency":"low"},"trixie":{"status":"resolved","repositories":{"trixie":"2.44-3"},"fixed_version":"2.29-1","urgency":"low"}}},"CVE-2017-9747":{"description":"The ieee_archive_p function in bfd/ieee.c in the Binary File Descriptor (BFD) library (aka libbfd), as distributed in GNU Binutils 2.28, might allow remote attackers to cause a denial of service (buffer overflow and application crash) or possibly have unspecified other impact via a crafted binary file, as demonstrated by mishandling of this file during \"objdump -D\" execution. NOTE: this may be related to a compiler bug.","scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"2.40-2"},"fixed_version":"2.29-1","urgency":"low"},"bullseye":{"status":"resolved","repositories":{"bullseye":"2.35.2-2"},"fixed_version":"2.29-1","urgency":"low"},"forky":{"status":"resolved","repositories":{"forky":"2.46-3"},"fixed_version":"2.29-1","urgency":"low"},"sid":{"status":"resolved","repositories":{"sid":"2.46-3"},"fixed_version":"2.29-1","urgency":"low"},"trixie":{"status":"resolved","repositories":{"trixie":"2.44-3"},"fixed_version":"2.29-1","urgency":"low"}}},"CVE-2017-9748":{"description":"The ieee_object_p function in bfd/ieee.c in the Binary File Descriptor (BFD) library (aka libbfd), as distributed in GNU Binutils 2.28, might allow remote attackers to cause a denial of service (buffer overflow and application crash) or possibly have unspecified other impact via a crafted binary file, as demonstrated by mishandling of this file during \"objdump -D\" execution. NOTE: this may be related to a compiler bug.","scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"2.40-2"},"fixed_version":"2.29-1","urgency":"low"},"bullseye":{"status":"resolved","repositories":{"bullseye":"2.35.2-2"},"fixed_version":"2.29-1","urgency":"low"},"forky":{"status":"resolved","repositories":{"forky":"2.46-3"},"fixed_version":"2.29-1","urgency":"low"},"sid":{"status":"resolved","repositories":{"sid":"2.46-3"},"fixed_version":"2.29-1","urgency":"low"},"trixie":{"status":"resolved","repositories":{"trixie":"2.44-3"},"fixed_version":"2.29-1","urgency":"low"}}},"CVE-2017-9749":{"description":"The *regs* macros in opcodes/bfin-dis.c in GNU Binutils 2.28 allow remote attackers to cause a denial of service (buffer overflow and application crash) or possibly have unspecified other impact via a crafted binary file, as demonstrated by mishandling of this file during \"objdump -D\" execution.","scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"2.40-2"},"fixed_version":"2.29-1","urgency":"low"},"bullseye":{"status":"resolved","repositories":{"bullseye":"2.35.2-2"},"fixed_version":"2.29-1","urgency":"low"},"forky":{"status":"resolved","repositories":{"forky":"2.46-3"},"fixed_version":"2.29-1","urgency":"low"},"sid":{"status":"resolved","repositories":{"sid":"2.46-3"},"fixed_version":"2.29-1","urgency":"low"},"trixie":{"status":"resolved","repositories":{"trixie":"2.44-3"},"fixed_version":"2.29-1","urgency":"low"}}},"CVE-2017-9750":{"description":"opcodes/rx-decode.opc in GNU Binutils 2.28 lacks bounds checks for certain scale arrays, which allows remote attackers to cause a denial of service (buffer overflow and application crash) or possibly have unspecified other impact via a crafted binary file, as demonstrated by mishandling of this file during \"objdump -D\" execution.","scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"2.40-2"},"fixed_version":"2.29-1","urgency":"low"},"bullseye":{"status":"resolved","repositories":{"bullseye":"2.35.2-2"},"fixed_version":"2.29-1","urgency":"low"},"forky":{"status":"resolved","repositories":{"forky":"2.46-3"},"fixed_version":"2.29-1","urgency":"low"},"sid":{"status":"resolved","repositories":{"sid":"2.46-3"},"fixed_version":"2.29-1","urgency":"low"},"trixie":{"status":"resolved","repositories":{"trixie":"2.44-3"},"fixed_version":"2.29-1","urgency":"low"}}},"CVE-2017-9751":{"description":"opcodes/rl78-decode.opc in GNU Binutils 2.28 has an unbounded GETBYTE macro, which allows remote attackers to cause a denial of service (buffer overflow and application crash) or possibly have unspecified other impact via a crafted binary file, as demonstrated by mishandling of this file during \"objdump -D\" execution.","scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"2.40-2"},"fixed_version":"2.29-1","urgency":"low"},"bullseye":{"status":"resolved","repositories":{"bullseye":"2.35.2-2"},"fixed_version":"2.29-1","urgency":"low"},"forky":{"status":"resolved","repositories":{"forky":"2.46-3"},"fixed_version":"2.29-1","urgency":"low"},"sid":{"status":"resolved","repositories":{"sid":"2.46-3"},"fixed_version":"2.29-1","urgency":"low"},"trixie":{"status":"resolved","repositories":{"trixie":"2.44-3"},"fixed_version":"2.29-1","urgency":"low"}}},"CVE-2017-9752":{"description":"bfd/vms-alpha.c in the Binary File Descriptor (BFD) library (aka libbfd), as distributed in GNU Binutils 2.28, allows remote attackers to cause a denial of service (buffer overflow and application crash) or possibly have unspecified other impact via a crafted binary file, as demonstrated by mishandling of this file in the _bfd_vms_get_value and _bfd_vms_slurp_etir functions during \"objdump -D\" execution.","scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"2.40-2"},"fixed_version":"2.29-1","urgency":"low"},"bullseye":{"status":"resolved","repositories":{"bullseye":"2.35.2-2"},"fixed_version":"2.29-1","urgency":"low"},"forky":{"status":"resolved","repositories":{"forky":"2.46-3"},"fixed_version":"2.29-1","urgency":"low"},"sid":{"status":"resolved","repositories":{"sid":"2.46-3"},"fixed_version":"2.29-1","urgency":"low"},"trixie":{"status":"resolved","repositories":{"trixie":"2.44-3"},"fixed_version":"2.29-1","urgency":"low"}}},"CVE-2017-9753":{"description":"The versados_mkobject function in bfd/versados.c in the Binary File Descriptor (BFD) library (aka libbfd), as distributed in GNU Binutils 2.28, does not initialize a certain data structure, which allows remote attackers to cause a denial of service (buffer overflow and application crash) or possibly have unspecified other impact via a crafted binary file, as demonstrated by mishandling of this file during \"objdump -D\" execution.","scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"2.40-2"},"fixed_version":"2.29-1","urgency":"low"},"bullseye":{"status":"resolved","repositories":{"bullseye":"2.35.2-2"},"fixed_version":"2.29-1","urgency":"low"},"forky":{"status":"resolved","repositories":{"forky":"2.46-3"},"fixed_version":"2.29-1","urgency":"low"},"sid":{"status":"resolved","repositories":{"sid":"2.46-3"},"fixed_version":"2.29-1","urgency":"low"},"trixie":{"status":"resolved","repositories":{"trixie":"2.44-3"},"fixed_version":"2.29-1","urgency":"low"}}},"CVE-2017-9754":{"description":"The process_otr function in bfd/versados.c in the Binary File Descriptor (BFD) library (aka libbfd), as distributed in GNU Binutils 2.28, does not validate a certain offset, which allows remote attackers to cause a denial of service (buffer overflow and application crash) or possibly have unspecified other impact via a crafted binary file, as demonstrated by mishandling of this file during \"objdump -D\" execution.","scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"2.40-2"},"fixed_version":"2.29-1","urgency":"low"},"bullseye":{"status":"resolved","repositories":{"bullseye":"2.35.2-2"},"fixed_version":"2.29-1","urgency":"low"},"forky":{"status":"resolved","repositories":{"forky":"2.46-3"},"fixed_version":"2.29-1","urgency":"low"},"sid":{"status":"resolved","repositories":{"sid":"2.46-3"},"fixed_version":"2.29-1","urgency":"low"},"trixie":{"status":"resolved","repositories":{"trixie":"2.44-3"},"fixed_version":"2.29-1","urgency":"low"}}},"CVE-2017-9755":{"description":"opcodes/i386-dis.c in GNU Binutils 2.28 does not consider the number of registers for bnd mode, which allows remote attackers to cause a denial of service (buffer overflow and application crash) or possibly have unspecified other impact via a crafted binary file, as demonstrated by mishandling of this file during \"objdump -D\" execution.","scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"2.40-2"},"fixed_version":"2.29-1","urgency":"low"},"bullseye":{"status":"resolved","repositories":{"bullseye":"2.35.2-2"},"fixed_version":"2.29-1","urgency":"low"},"forky":{"status":"resolved","repositories":{"forky":"2.46-3"},"fixed_version":"2.29-1","urgency":"low"},"sid":{"status":"resolved","repositories":{"sid":"2.46-3"},"fixed_version":"2.29-1","urgency":"low"},"trixie":{"status":"resolved","repositories":{"trixie":"2.44-3"},"fixed_version":"2.29-1","urgency":"low"}}},"CVE-2017-9756":{"description":"The aarch64_ext_ldst_reglist function in opcodes/aarch64-dis.c in GNU Binutils 2.28 allows remote attackers to cause a denial of service (buffer overflow and application crash) or possibly have unspecified other impact via a crafted binary file, as demonstrated by mishandling of this file during \"objdump -D\" execution.","scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"2.40-2"},"fixed_version":"2.29-1","urgency":"low"},"bullseye":{"status":"resolved","repositories":{"bullseye":"2.35.2-2"},"fixed_version":"2.29-1","urgency":"low"},"forky":{"status":"resolved","repositories":{"forky":"2.46-3"},"fixed_version":"2.29-1","urgency":"low"},"sid":{"status":"resolved","repositories":{"sid":"2.46-3"},"fixed_version":"2.29-1","urgency":"low"},"trixie":{"status":"resolved","repositories":{"trixie":"2.44-3"},"fixed_version":"2.29-1","urgency":"low"}}},"CVE-2017-9954":{"description":"The getvalue function in tekhex.c in the Binary File Descriptor (BFD) library (aka libbfd), as distributed in GNU Binutils 2.28, allows remote attackers to cause a denial of service (stack-based buffer over-read and application crash) via a crafted tekhex file, as demonstrated by mishandling within the nm program.","scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"2.40-2"},"fixed_version":"2.29-1","urgency":"not yet assigned"},"bullseye":{"status":"resolved","repositories":{"bullseye":"2.35.2-2"},"fixed_version":"2.29-1","urgency":"not yet assigned"},"forky":{"status":"resolved","repositories":{"forky":"2.46-3"},"fixed_version":"2.29-1","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"2.46-3"},"fixed_version":"2.29-1","urgency":"not yet assigned"},"trixie":{"status":"resolved","repositories":{"trixie":"2.44-3"},"fixed_version":"2.29-1","urgency":"not yet assigned"}}},"CVE-2017-9955":{"description":"The get_build_id function in opncls.c in the Binary File Descriptor (BFD) library (aka libbfd), as distributed in GNU Binutils 2.28, allows remote attackers to cause a denial of service (heap-based buffer over-read and application crash) via a crafted file in which a certain size field is larger than a corresponding data field, as demonstrated by mishandling within the objdump program.","scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"2.40-2"},"fixed_version":"2.29-1","urgency":"not yet assigned"},"bullseye":{"status":"resolved","repositories":{"bullseye":"2.35.2-2"},"fixed_version":"2.29-1","urgency":"not yet assigned"},"forky":{"status":"resolved","repositories":{"forky":"2.46-3"},"fixed_version":"2.29-1","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"2.46-3"},"fixed_version":"2.29-1","urgency":"not yet assigned"},"trixie":{"status":"resolved","repositories":{"trixie":"2.44-3"},"fixed_version":"2.29-1","urgency":"not yet assigned"}}},"CVE-2018-1000876":{"description":"binutils version 2.32 and earlier contains a Integer Overflow vulnerability in objdump, bfd_get_dynamic_reloc_upper_bound,bfd_canonicalize_dynamic_reloc that can result in Integer overflow trigger heap overflow. Successful exploitation allows execution of arbitrary code.. This attack appear to be exploitable via Local. This vulnerability appears to have been fixed in after commit 3a551c7a1b80fca579461774860574eabfd7f18f.","scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"2.40-2"},"fixed_version":"2.32.51.20190707-1","urgency":"unimportant"},"bullseye":{"status":"resolved","repositories":{"bullseye":"2.35.2-2"},"fixed_version":"2.32.51.20190707-1","urgency":"unimportant"},"forky":{"status":"resolved","repositories":{"forky":"2.46-3"},"fixed_version":"2.32.51.20190707-1","urgency":"unimportant"},"sid":{"status":"resolved","repositories":{"sid":"2.46-3"},"fixed_version":"2.32.51.20190707-1","urgency":"unimportant"},"trixie":{"status":"resolved","repositories":{"trixie":"2.44-3"},"fixed_version":"2.32.51.20190707-1","urgency":"unimportant"}}},"CVE-2018-10372":{"description":"process_cu_tu_index in dwarf.c in GNU Binutils 2.30 allows remote attackers to cause a denial of service (heap-based buffer over-read and application crash) via a crafted binary file, as demonstrated by readelf.","scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"2.40-2"},"fixed_version":"2.30.90.20180627-1","urgency":"not yet assigned"},"bullseye":{"status":"resolved","repositories":{"bullseye":"2.35.2-2"},"fixed_version":"2.30.90.20180627-1","urgency":"not yet assigned"},"forky":{"status":"resolved","repositories":{"forky":"2.46-3"},"fixed_version":"2.30.90.20180627-1","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"2.46-3"},"fixed_version":"2.30.90.20180627-1","urgency":"not yet assigned"},"trixie":{"status":"resolved","repositories":{"trixie":"2.44-3"},"fixed_version":"2.30.90.20180627-1","urgency":"not yet assigned"}}},"CVE-2018-10373":{"description":"concat_filename in dwarf2.c in the Binary File Descriptor (BFD) library (aka libbfd), as distributed in GNU Binutils 2.30, allows remote attackers to cause a denial of service (NULL pointer dereference and application crash) via a crafted binary file, as demonstrated by nm-new.","scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"2.40-2"},"fixed_version":"2.30.90.20180627-1","urgency":"not yet assigned"},"bullseye":{"status":"resolved","repositories":{"bullseye":"2.35.2-2"},"fixed_version":"2.30.90.20180627-1","urgency":"not yet assigned"},"forky":{"status":"resolved","repositories":{"forky":"2.46-3"},"fixed_version":"2.30.90.20180627-1","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"2.46-3"},"fixed_version":"2.30.90.20180627-1","urgency":"not yet assigned"},"trixie":{"status":"resolved","repositories":{"trixie":"2.44-3"},"fixed_version":"2.30.90.20180627-1","urgency":"not yet assigned"}}},"CVE-2018-10534":{"description":"The _bfd_XX_bfd_copy_private_bfd_data_common function in peXXigen.c in the Binary File Descriptor (BFD) library (aka libbfd), as distributed in GNU Binutils 2.30, processes a negative Data Directory size with an unbounded loop that increases the value of (external_IMAGE_DEBUG_DIRECTORY) *edd so that the address exceeds its own memory region, resulting in an out-of-bounds memory write, as demonstrated by objcopy copying private info with _bfd_pex64_bfd_copy_private_bfd_data_common in pex64igen.c.","scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"2.40-2"},"fixed_version":"2.30.90.20180627-1","urgency":"not yet assigned"},"bullseye":{"status":"resolved","repositories":{"bullseye":"2.35.2-2"},"fixed_version":"2.30.90.20180627-1","urgency":"not yet assigned"},"forky":{"status":"resolved","repositories":{"forky":"2.46-3"},"fixed_version":"2.30.90.20180627-1","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"2.46-3"},"fixed_version":"2.30.90.20180627-1","urgency":"not yet assigned"},"trixie":{"status":"resolved","repositories":{"trixie":"2.44-3"},"fixed_version":"2.30.90.20180627-1","urgency":"not yet assigned"}}},"CVE-2018-10535":{"description":"The ignore_section_sym function in elf.c in the Binary File Descriptor (BFD) library (aka libbfd), as distributed in GNU Binutils 2.30, does not validate the output_section pointer in the case of a symtab entry with a \"SECTION\" type that has a \"0\" value, which allows remote attackers to cause a denial of service (NULL pointer dereference and application crash) via a crafted file, as demonstrated by objcopy.","scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"2.40-2"},"fixed_version":"2.30.90.20180627-1","urgency":"not yet assigned"},"bullseye":{"status":"resolved","repositories":{"bullseye":"2.35.2-2"},"fixed_version":"2.30.90.20180627-1","urgency":"not yet assigned"},"forky":{"status":"resolved","repositories":{"forky":"2.46-3"},"fixed_version":"2.30.90.20180627-1","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"2.46-3"},"fixed_version":"2.30.90.20180627-1","urgency":"not yet assigned"},"trixie":{"status":"resolved","repositories":{"trixie":"2.44-3"},"fixed_version":"2.30.90.20180627-1","urgency":"not yet assigned"}}},"CVE-2018-12697":{"description":"A NULL pointer dereference (aka SEGV on unknown address 0x000000000000) was discovered in work_stuff_copy_to_from in cplus-dem.c in GNU libiberty, as distributed in GNU Binutils 2.30. This can occur during execution of objdump.","scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"2.40-2"},"fixed_version":"2.32.51.20190707-1","urgency":"unimportant"},"bullseye":{"status":"resolved","repositories":{"bullseye":"2.35.2-2"},"fixed_version":"2.32.51.20190707-1","urgency":"unimportant"},"forky":{"status":"resolved","repositories":{"forky":"2.46-3"},"fixed_version":"2.32.51.20190707-1","urgency":"unimportant"},"sid":{"status":"resolved","repositories":{"sid":"2.46-3"},"fixed_version":"2.32.51.20190707-1","urgency":"unimportant"},"trixie":{"status":"resolved","repositories":{"trixie":"2.44-3"},"fixed_version":"2.32.51.20190707-1","urgency":"unimportant"}}},"CVE-2018-12698":{"description":"demangle_template in cplus-dem.c in GNU libiberty, as distributed in GNU Binutils 2.30, allows attackers to trigger excessive memory consumption (aka OOM) during the \"Create an array for saving the template argument values\" XNEWVEC call. This can occur during execution of objdump.","scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"2.40-2"},"fixed_version":"2.32.51.20190707-1","urgency":"unimportant"},"bullseye":{"status":"resolved","repositories":{"bullseye":"2.35.2-2"},"fixed_version":"2.32.51.20190707-1","urgency":"unimportant"},"forky":{"status":"resolved","repositories":{"forky":"2.46-3"},"fixed_version":"2.32.51.20190707-1","urgency":"unimportant"},"sid":{"status":"resolved","repositories":{"sid":"2.46-3"},"fixed_version":"2.32.51.20190707-1","urgency":"unimportant"},"trixie":{"status":"resolved","repositories":{"trixie":"2.44-3"},"fixed_version":"2.32.51.20190707-1","urgency":"unimportant"}}},"CVE-2018-12699":{"description":"finish_stab in stabs.c in GNU Binutils 2.30 allows attackers to cause a denial of service (heap-based buffer overflow) or possibly have unspecified other impact, as demonstrated by an out-of-bounds write of 8 bytes. This can occur during execution of objdump.","scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"2.40-2"},"fixed_version":"2.32.51.20190707-1","urgency":"unimportant"},"bullseye":{"status":"resolved","repositories":{"bullseye":"2.35.2-2"},"fixed_version":"2.32.51.20190707-1","urgency":"unimportant"},"forky":{"status":"resolved","repositories":{"forky":"2.46-3"},"fixed_version":"2.32.51.20190707-1","urgency":"unimportant"},"sid":{"status":"resolved","repositories":{"sid":"2.46-3"},"fixed_version":"2.32.51.20190707-1","urgency":"unimportant"},"trixie":{"status":"resolved","repositories":{"trixie":"2.44-3"},"fixed_version":"2.32.51.20190707-1","urgency":"unimportant"}}},"CVE-2018-12934":{"description":"remember_Ktype in cplus-dem.c in GNU libiberty, as distributed in GNU Binutils 2.30, allows attackers to trigger excessive memory consumption (aka OOM). This can occur during execution of cxxfilt.","scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"2.40-2"},"fixed_version":"2.32.51.20190707-1","urgency":"unimportant"},"bullseye":{"status":"resolved","repositories":{"bullseye":"2.35.2-2"},"fixed_version":"2.32.51.20190707-1","urgency":"unimportant"},"forky":{"status":"resolved","repositories":{"forky":"2.46-3"},"fixed_version":"2.32.51.20190707-1","urgency":"unimportant"},"sid":{"status":"resolved","repositories":{"sid":"2.46-3"},"fixed_version":"2.32.51.20190707-1","urgency":"unimportant"},"trixie":{"status":"resolved","repositories":{"trixie":"2.44-3"},"fixed_version":"2.32.51.20190707-1","urgency":"unimportant"}}},"CVE-2018-13033":{"description":"The Binary File Descriptor (BFD) library (aka libbfd), as distributed in GNU Binutils 2.30, allows remote attackers to cause a denial of service (excessive memory allocation and application crash) via a crafted ELF file, as demonstrated by _bfd_elf_parse_attributes in elf-attrs.c and bfd_malloc in libbfd.c. This can occur during execution of nm.","scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"2.40-2"},"fixed_version":"2.30.90.20180627-1","urgency":"unimportant"},"bullseye":{"status":"resolved","repositories":{"bullseye":"2.35.2-2"},"fixed_version":"2.30.90.20180627-1","urgency":"unimportant"},"forky":{"status":"resolved","repositories":{"forky":"2.46-3"},"fixed_version":"2.30.90.20180627-1","urgency":"unimportant"},"sid":{"status":"resolved","repositories":{"sid":"2.46-3"},"fixed_version":"2.30.90.20180627-1","urgency":"unimportant"},"trixie":{"status":"resolved","repositories":{"trixie":"2.44-3"},"fixed_version":"2.30.90.20180627-1","urgency":"unimportant"}}},"CVE-2018-17358":{"description":"An issue was discovered in the Binary File Descriptor (BFD) library (aka libbfd), as distributed in GNU Binutils 2.31. An invalid memory access exists in _bfd_stab_section_find_nearest_line in syms.c. Attackers could leverage this vulnerability to cause a denial of service (application crash) via a crafted ELF file.","scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"2.40-2"},"fixed_version":"2.32.51.20190707-1","urgency":"unimportant"},"bullseye":{"status":"resolved","repositories":{"bullseye":"2.35.2-2"},"fixed_version":"2.32.51.20190707-1","urgency":"unimportant"},"forky":{"status":"resolved","repositories":{"forky":"2.46-3"},"fixed_version":"2.32.51.20190707-1","urgency":"unimportant"},"sid":{"status":"resolved","repositories":{"sid":"2.46-3"},"fixed_version":"2.32.51.20190707-1","urgency":"unimportant"},"trixie":{"status":"resolved","repositories":{"trixie":"2.44-3"},"fixed_version":"2.32.51.20190707-1","urgency":"unimportant"}}},"CVE-2018-17359":{"description":"An issue was discovered in the Binary File Descriptor (BFD) library (aka libbfd), as distributed in GNU Binutils 2.31. An invalid memory access exists in bfd_zalloc in opncls.c. Attackers could leverage this vulnerability to cause a denial of service (application crash) via a crafted ELF file.","scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"2.40-2"},"fixed_version":"2.32.51.20190707-1","urgency":"unimportant"},"bullseye":{"status":"resolved","repositories":{"bullseye":"2.35.2-2"},"fixed_version":"2.32.51.20190707-1","urgency":"unimportant"},"forky":{"status":"resolved","repositories":{"forky":"2.46-3"},"fixed_version":"2.32.51.20190707-1","urgency":"unimportant"},"sid":{"status":"resolved","repositories":{"sid":"2.46-3"},"fixed_version":"2.32.51.20190707-1","urgency":"unimportant"},"trixie":{"status":"resolved","repositories":{"trixie":"2.44-3"},"fixed_version":"2.32.51.20190707-1","urgency":"unimportant"}}},"CVE-2018-17360":{"description":"An issue was discovered in the Binary File Descriptor (BFD) library (aka libbfd), as distributed in GNU Binutils 2.31. a heap-based buffer over-read in bfd_getl32 in libbfd.c allows an attacker to cause a denial of service through a crafted PE file. This vulnerability can be triggered by the executable objdump.","scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"2.40-2"},"fixed_version":"2.32.51.20190707-1","urgency":"unimportant"},"bullseye":{"status":"resolved","repositories":{"bullseye":"2.35.2-2"},"fixed_version":"2.32.51.20190707-1","urgency":"unimportant"},"forky":{"status":"resolved","repositories":{"forky":"2.46-3"},"fixed_version":"2.32.51.20190707-1","urgency":"unimportant"},"sid":{"status":"resolved","repositories":{"sid":"2.46-3"},"fixed_version":"2.32.51.20190707-1","urgency":"unimportant"},"trixie":{"status":"resolved","repositories":{"trixie":"2.44-3"},"fixed_version":"2.32.51.20190707-1","urgency":"unimportant"}}},"CVE-2018-17794":{"description":"An issue was discovered in cplus-dem.c in GNU libiberty, as distributed in GNU Binutils 2.31. There is a NULL pointer dereference in work_stuff_copy_to_from when called from iterate_demangle_function.","scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"2.40-2"},"fixed_version":"2.32.51.20190707-1","urgency":"unimportant"},"bullseye":{"status":"resolved","repositories":{"bullseye":"2.35.2-2"},"fixed_version":"2.32.51.20190707-1","urgency":"unimportant"},"forky":{"status":"resolved","repositories":{"forky":"2.46-3"},"fixed_version":"2.32.51.20190707-1","urgency":"unimportant"},"sid":{"status":"resolved","repositories":{"sid":"2.46-3"},"fixed_version":"2.32.51.20190707-1","urgency":"unimportant"},"trixie":{"status":"resolved","repositories":{"trixie":"2.44-3"},"fixed_version":"2.32.51.20190707-1","urgency":"unimportant"}}},"CVE-2018-17985":{"description":"An issue was discovered in cp-demangle.c in GNU libiberty, as distributed in GNU Binutils 2.31. There is a stack consumption problem caused by the cplus_demangle_type function making recursive calls to itself in certain scenarios involving many 'P' characters.","scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"2.40-2"},"fixed_version":"2.32.51.20190707-1","urgency":"unimportant"},"bullseye":{"status":"resolved","repositories":{"bullseye":"2.35.2-2"},"fixed_version":"2.32.51.20190707-1","urgency":"unimportant"},"forky":{"status":"resolved","repositories":{"forky":"2.46-3"},"fixed_version":"2.32.51.20190707-1","urgency":"unimportant"},"sid":{"status":"resolved","repositories":{"sid":"2.46-3"},"fixed_version":"2.32.51.20190707-1","urgency":"unimportant"},"trixie":{"status":"resolved","repositories":{"trixie":"2.44-3"},"fixed_version":"2.32.51.20190707-1","urgency":"unimportant"}}},"CVE-2018-18309":{"description":"An issue was discovered in the Binary File Descriptor (BFD) library (aka libbfd), as distributed in GNU Binutils 2.31. An invalid memory address dereference was discovered in read_reloc in reloc.c. The vulnerability causes a segmentation fault and application crash, which leads to denial of service, as demonstrated by objdump, because of missing _bfd_clear_contents bounds checking.","scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"2.40-2"},"fixed_version":"2.32.51.20190707-1","urgency":"unimportant"},"bullseye":{"status":"resolved","repositories":{"bullseye":"2.35.2-2"},"fixed_version":"2.32.51.20190707-1","urgency":"unimportant"},"forky":{"status":"resolved","repositories":{"forky":"2.46-3"},"fixed_version":"2.32.51.20190707-1","urgency":"unimportant"},"sid":{"status":"resolved","repositories":{"sid":"2.46-3"},"fixed_version":"2.32.51.20190707-1","urgency":"unimportant"},"trixie":{"status":"resolved","repositories":{"trixie":"2.44-3"},"fixed_version":"2.32.51.20190707-1","urgency":"unimportant"}}},"CVE-2018-18483":{"description":"The get_count function in cplus-dem.c in GNU libiberty, as distributed in GNU Binutils 2.31, allows remote attackers to cause a denial of service (malloc called with the result of an integer-overflowing calculation) or possibly have unspecified other impact via a crafted string, as demonstrated by c++filt.","scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"2.40-2"},"fixed_version":"2.32.51.20190707-1","urgency":"unimportant"},"bullseye":{"status":"resolved","repositories":{"bullseye":"2.35.2-2"},"fixed_version":"2.32.51.20190707-1","urgency":"unimportant"},"forky":{"status":"resolved","repositories":{"forky":"2.46-3"},"fixed_version":"2.32.51.20190707-1","urgency":"unimportant"},"sid":{"status":"resolved","repositories":{"sid":"2.46-3"},"fixed_version":"2.32.51.20190707-1","urgency":"unimportant"},"trixie":{"status":"resolved","repositories":{"trixie":"2.44-3"},"fixed_version":"2.32.51.20190707-1","urgency":"unimportant"}}},"CVE-2018-18484":{"description":"An issue was discovered in cp-demangle.c in GNU libiberty, as distributed in GNU Binutils 2.31. Stack Exhaustion occurs in the C++ demangling functions provided by libiberty, and there is a stack consumption problem caused by recursive stack frames: cplus_demangle_type, d_bare_function_type, d_function_type.","scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"2.40-2"},"fixed_version":"2.32.51.20190707-1","urgency":"unimportant"},"bullseye":{"status":"resolved","repositories":{"bullseye":"2.35.2-2"},"fixed_version":"2.32.51.20190707-1","urgency":"unimportant"},"forky":{"status":"resolved","repositories":{"forky":"2.46-3"},"fixed_version":"2.32.51.20190707-1","urgency":"unimportant"},"sid":{"status":"resolved","repositories":{"sid":"2.46-3"},"fixed_version":"2.32.51.20190707-1","urgency":"unimportant"},"trixie":{"status":"resolved","repositories":{"trixie":"2.44-3"},"fixed_version":"2.32.51.20190707-1","urgency":"unimportant"}}},"CVE-2018-18605":{"description":"A heap-based buffer over-read issue was discovered in the function sec_merge_hash_lookup in merge.c in the Binary File Descriptor (BFD) library (aka libbfd), as distributed in GNU Binutils 2.31, because _bfd_add_merge_section mishandles section merges when size is not a multiple of entsize. A specially crafted ELF allows remote attackers to cause a denial of service, as demonstrated by ld.","scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"2.40-2"},"fixed_version":"2.32.51.20190707-1","urgency":"unimportant"},"bullseye":{"status":"resolved","repositories":{"bullseye":"2.35.2-2"},"fixed_version":"2.32.51.20190707-1","urgency":"unimportant"},"forky":{"status":"resolved","repositories":{"forky":"2.46-3"},"fixed_version":"2.32.51.20190707-1","urgency":"unimportant"},"sid":{"status":"resolved","repositories":{"sid":"2.46-3"},"fixed_version":"2.32.51.20190707-1","urgency":"unimportant"},"trixie":{"status":"resolved","repositories":{"trixie":"2.44-3"},"fixed_version":"2.32.51.20190707-1","urgency":"unimportant"}}},"CVE-2018-18606":{"description":"An issue was discovered in the merge_strings function in merge.c in the Binary File Descriptor (BFD) library (aka libbfd), as distributed in GNU Binutils 2.31. There is a NULL pointer dereference in _bfd_add_merge_section when attempting to merge sections with large alignments. A specially crafted ELF allows remote attackers to cause a denial of service, as demonstrated by ld.","scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"2.40-2"},"fixed_version":"2.32.51.20190707-1","urgency":"unimportant"},"bullseye":{"status":"resolved","repositories":{"bullseye":"2.35.2-2"},"fixed_version":"2.32.51.20190707-1","urgency":"unimportant"},"forky":{"status":"resolved","repositories":{"forky":"2.46-3"},"fixed_version":"2.32.51.20190707-1","urgency":"unimportant"},"sid":{"status":"resolved","repositories":{"sid":"2.46-3"},"fixed_version":"2.32.51.20190707-1","urgency":"unimportant"},"trixie":{"status":"resolved","repositories":{"trixie":"2.44-3"},"fixed_version":"2.32.51.20190707-1","urgency":"unimportant"}}},"CVE-2018-18607":{"description":"An issue was discovered in elf_link_input_bfd in elflink.c in the Binary File Descriptor (BFD) library (aka libbfd), as distributed in GNU Binutils 2.31. There is a NULL pointer dereference in elf_link_input_bfd when used for finding STT_TLS symbols without any TLS section. A specially crafted ELF allows remote attackers to cause a denial of service, as demonstrated by ld.","scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"2.40-2"},"fixed_version":"2.32.51.20190707-1","urgency":"unimportant"},"bullseye":{"status":"resolved","repositories":{"bullseye":"2.35.2-2"},"fixed_version":"2.32.51.20190707-1","urgency":"unimportant"},"forky":{"status":"resolved","repositories":{"forky":"2.46-3"},"fixed_version":"2.32.51.20190707-1","urgency":"unimportant"},"sid":{"status":"resolved","repositories":{"sid":"2.46-3"},"fixed_version":"2.32.51.20190707-1","urgency":"unimportant"},"trixie":{"status":"resolved","repositories":{"trixie":"2.44-3"},"fixed_version":"2.32.51.20190707-1","urgency":"unimportant"}}},"CVE-2018-18700":{"description":"An issue was discovered in cp-demangle.c in GNU libiberty, as distributed in GNU Binutils 2.31. There is a stack consumption vulnerability resulting from infinite recursion in the functions d_name(), d_encoding(), and d_local_name() in cp-demangle.c. Remote attackers could leverage this vulnerability to cause a denial-of-service via an ELF file, as demonstrated by nm.","scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"2.40-2"},"fixed_version":"2.32.51.20190707-1","urgency":"unimportant"},"bullseye":{"status":"resolved","repositories":{"bullseye":"2.35.2-2"},"fixed_version":"2.32.51.20190707-1","urgency":"unimportant"},"forky":{"status":"resolved","repositories":{"forky":"2.46-3"},"fixed_version":"2.32.51.20190707-1","urgency":"unimportant"},"sid":{"status":"resolved","repositories":{"sid":"2.46-3"},"fixed_version":"2.32.51.20190707-1","urgency":"unimportant"},"trixie":{"status":"resolved","repositories":{"trixie":"2.44-3"},"fixed_version":"2.32.51.20190707-1","urgency":"unimportant"}}},"CVE-2018-18701":{"description":"An issue was discovered in cp-demangle.c in GNU libiberty, as distributed in GNU Binutils 2.31. There is a stack consumption vulnerability resulting from infinite recursion in the functions next_is_type_qual() and cplus_demangle_type() in cp-demangle.c. Remote attackers could leverage this vulnerability to cause a denial-of-service via an ELF file, as demonstrated by nm.","scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"2.40-2"},"fixed_version":"2.32.51.20190707-1","urgency":"unimportant"},"bullseye":{"status":"resolved","repositories":{"bullseye":"2.35.2-2"},"fixed_version":"2.32.51.20190707-1","urgency":"unimportant"},"forky":{"status":"resolved","repositories":{"forky":"2.46-3"},"fixed_version":"2.32.51.20190707-1","urgency":"unimportant"},"sid":{"status":"resolved","repositories":{"sid":"2.46-3"},"fixed_version":"2.32.51.20190707-1","urgency":"unimportant"},"trixie":{"status":"resolved","repositories":{"trixie":"2.44-3"},"fixed_version":"2.32.51.20190707-1","urgency":"unimportant"}}},"CVE-2018-19931":{"description":"An issue was discovered in the Binary File Descriptor (BFD) library (aka libbfd), as distributed in GNU Binutils through 2.31. There is a heap-based buffer overflow in bfd_elf32_swap_phdr_in in elfcode.h because the number of program headers is not restricted.","scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"2.40-2"},"fixed_version":"2.32.51.20190707-1","urgency":"unimportant"},"bullseye":{"status":"resolved","repositories":{"bullseye":"2.35.2-2"},"fixed_version":"2.32.51.20190707-1","urgency":"unimportant"},"forky":{"status":"resolved","repositories":{"forky":"2.46-3"},"fixed_version":"2.32.51.20190707-1","urgency":"unimportant"},"sid":{"status":"resolved","repositories":{"sid":"2.46-3"},"fixed_version":"2.32.51.20190707-1","urgency":"unimportant"},"trixie":{"status":"resolved","repositories":{"trixie":"2.44-3"},"fixed_version":"2.32.51.20190707-1","urgency":"unimportant"}}},"CVE-2018-19932":{"description":"An issue was discovered in the Binary File Descriptor (BFD) library (aka libbfd), as distributed in GNU Binutils through 2.31. There is an integer overflow and infinite loop caused by the IS_CONTAINED_BY_LMA macro in elf.c.","scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"2.40-2"},"fixed_version":"2.32.51.20190707-1","urgency":"unimportant"},"bullseye":{"status":"resolved","repositories":{"bullseye":"2.35.2-2"},"fixed_version":"2.32.51.20190707-1","urgency":"unimportant"},"forky":{"status":"resolved","repositories":{"forky":"2.46-3"},"fixed_version":"2.32.51.20190707-1","urgency":"unimportant"},"sid":{"status":"resolved","repositories":{"sid":"2.46-3"},"fixed_version":"2.32.51.20190707-1","urgency":"unimportant"},"trixie":{"status":"resolved","repositories":{"trixie":"2.44-3"},"fixed_version":"2.32.51.20190707-1","urgency":"unimportant"}}},"CVE-2018-20002":{"description":"The _bfd_generic_read_minisymbols function in syms.c in the Binary File Descriptor (BFD) library (aka libbfd), as distributed in GNU Binutils 2.31, has a memory leak via a crafted ELF file, leading to a denial of service (memory consumption), as demonstrated by nm.","scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"2.40-2"},"fixed_version":"2.32.51.20190707-1","urgency":"unimportant"},"bullseye":{"status":"resolved","repositories":{"bullseye":"2.35.2-2"},"fixed_version":"2.32.51.20190707-1","urgency":"unimportant"},"forky":{"status":"resolved","repositories":{"forky":"2.46-3"},"fixed_version":"2.32.51.20190707-1","urgency":"unimportant"},"sid":{"status":"resolved","repositories":{"sid":"2.46-3"},"fixed_version":"2.32.51.20190707-1","urgency":"unimportant"},"trixie":{"status":"resolved","repositories":{"trixie":"2.44-3"},"fixed_version":"2.32.51.20190707-1","urgency":"unimportant"}}},"CVE-2018-20623":{"description":"In GNU Binutils 2.31.1, there is a use-after-free in the error function in elfcomm.c when called from the process_archive function in readelf.c via a crafted ELF file.","scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"2.40-2"},"fixed_version":"2.32.51.20190707-1","urgency":"unimportant"},"bullseye":{"status":"resolved","repositories":{"bullseye":"2.35.2-2"},"fixed_version":"2.32.51.20190707-1","urgency":"unimportant"},"forky":{"status":"resolved","repositories":{"forky":"2.46-3"},"fixed_version":"2.32.51.20190707-1","urgency":"unimportant"},"sid":{"status":"resolved","repositories":{"sid":"2.46-3"},"fixed_version":"2.32.51.20190707-1","urgency":"unimportant"},"trixie":{"status":"resolved","repositories":{"trixie":"2.44-3"},"fixed_version":"2.32.51.20190707-1","urgency":"unimportant"}}},"CVE-2018-20651":{"description":"A NULL pointer dereference was discovered in elf_link_add_object_symbols in elflink.c in the Binary File Descriptor (BFD) library (aka libbfd), as distributed in GNU Binutils 2.31.1. This occurs for a crafted ET_DYN with no program headers. A specially crafted ELF file allows remote attackers to cause a denial of service, as demonstrated by ld.","scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"2.40-2"},"fixed_version":"2.32.51.20190707-1","urgency":"unimportant"},"bullseye":{"status":"resolved","repositories":{"bullseye":"2.35.2-2"},"fixed_version":"2.32.51.20190707-1","urgency":"unimportant"},"forky":{"status":"resolved","repositories":{"forky":"2.46-3"},"fixed_version":"2.32.51.20190707-1","urgency":"unimportant"},"sid":{"status":"resolved","repositories":{"sid":"2.46-3"},"fixed_version":"2.32.51.20190707-1","urgency":"unimportant"},"trixie":{"status":"resolved","repositories":{"trixie":"2.44-3"},"fixed_version":"2.32.51.20190707-1","urgency":"unimportant"}}},"CVE-2018-20671":{"description":"load_specific_debug_section in objdump.c in GNU Binutils through 2.31.1 contains an integer overflow vulnerability that can trigger a heap-based buffer overflow via a crafted section size.","scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"2.40-2"},"fixed_version":"2.32.51.20190707-1","urgency":"unimportant"},"bullseye":{"status":"resolved","repositories":{"bullseye":"2.35.2-2"},"fixed_version":"2.32.51.20190707-1","urgency":"unimportant"},"forky":{"status":"resolved","repositories":{"forky":"2.46-3"},"fixed_version":"2.32.51.20190707-1","urgency":"unimportant"},"sid":{"status":"resolved","repositories":{"sid":"2.46-3"},"fixed_version":"2.32.51.20190707-1","urgency":"unimportant"},"trixie":{"status":"resolved","repositories":{"trixie":"2.44-3"},"fixed_version":"2.32.51.20190707-1","urgency":"unimportant"}}},"CVE-2018-20673":{"description":"The demangle_template function in cplus-dem.c in GNU libiberty, as distributed in GNU Binutils 2.31.1, contains an integer overflow vulnerability (for \"Create an array for saving the template argument values\") that can trigger a heap-based buffer overflow, as demonstrated by nm.","scope":"local","releases":{"bookworm":{"status":"open","repositories":{"bookworm":"2.40-2"},"urgency":"unimportant"},"bullseye":{"status":"open","repositories":{"bullseye":"2.35.2-2"},"urgency":"unimportant"},"forky":{"status":"open","repositories":{"forky":"2.46-3"},"urgency":"unimportant"},"sid":{"status":"open","repositories":{"sid":"2.46-3"},"urgency":"unimportant"},"trixie":{"status":"open","repositories":{"trixie":"2.44-3"},"urgency":"unimportant"}}},"CVE-2018-20712":{"description":"A heap-based buffer over-read exists in the function d_expression_1 in cp-demangle.c in GNU libiberty, as distributed in GNU Binutils 2.31.1. A crafted input can cause segmentation faults, leading to denial-of-service, as demonstrated by c++filt.","scope":"local","releases":{"bookworm":{"status":"open","repositories":{"bookworm":"2.40-2"},"urgency":"unimportant"},"bullseye":{"status":"open","repositories":{"bullseye":"2.35.2-2"},"urgency":"unimportant"},"forky":{"status":"open","repositories":{"forky":"2.46-3"},"urgency":"unimportant"},"sid":{"status":"open","repositories":{"sid":"2.46-3"},"urgency":"unimportant"},"trixie":{"status":"open","repositories":{"trixie":"2.44-3"},"urgency":"unimportant"}}},"CVE-2018-6323":{"description":"The elf_object_p function in elfcode.h in the Binary File Descriptor (BFD) library (aka libbfd), as distributed in GNU Binutils 2.29.1, has an unsigned integer overflow because bfd_size_type multiplication is not used. A crafted ELF file allows remote attackers to cause a denial of service (application crash) or possibly have unspecified other impact.","scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"2.40-2"},"fixed_version":"2.30-3","urgency":"not yet assigned"},"bullseye":{"status":"resolved","repositories":{"bullseye":"2.35.2-2"},"fixed_version":"2.30-3","urgency":"not yet assigned"},"forky":{"status":"resolved","repositories":{"forky":"2.46-3"},"fixed_version":"2.30-3","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"2.46-3"},"fixed_version":"2.30-3","urgency":"not yet assigned"},"trixie":{"status":"resolved","repositories":{"trixie":"2.44-3"},"fixed_version":"2.30-3","urgency":"not yet assigned"}}},"CVE-2018-6543":{"description":"In GNU Binutils 2.30, there's an integer overflow in the function load_specific_debug_section() in objdump.c, which results in `malloc()` with 0 size. A crafted ELF file allows remote attackers to cause a denial of service (application crash) or possibly have unspecified other impact.","scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"2.40-2"},"fixed_version":"2.30-3","urgency":"not yet assigned"},"bullseye":{"status":"resolved","repositories":{"bullseye":"2.35.2-2"},"fixed_version":"2.30-3","urgency":"not yet assigned"},"forky":{"status":"resolved","repositories":{"forky":"2.46-3"},"fixed_version":"2.30-3","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"2.46-3"},"fixed_version":"2.30-3","urgency":"not yet assigned"},"trixie":{"status":"resolved","repositories":{"trixie":"2.44-3"},"fixed_version":"2.30-3","urgency":"not yet assigned"}}},"CVE-2018-6759":{"description":"The bfd_get_debug_link_info_1 function in opncls.c in the Binary File Descriptor (BFD) library (aka libbfd), as distributed in GNU Binutils 2.30, has an unchecked strnlen operation. Remote attackers could leverage this vulnerability to cause a denial of service (segmentation fault) via a crafted ELF file.","scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"2.40-2"},"fixed_version":"2.30-3","urgency":"not yet assigned"},"bullseye":{"status":"resolved","repositories":{"bullseye":"2.35.2-2"},"fixed_version":"2.30-3","urgency":"not yet assigned"},"forky":{"status":"resolved","repositories":{"forky":"2.46-3"},"fixed_version":"2.30-3","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"2.46-3"},"fixed_version":"2.30-3","urgency":"not yet assigned"},"trixie":{"status":"resolved","repositories":{"trixie":"2.44-3"},"fixed_version":"2.30-3","urgency":"not yet assigned"}}},"CVE-2018-6872":{"description":"The elf_parse_notes function in elf.c in the Binary File Descriptor (BFD) library (aka libbfd), as distributed in GNU Binutils 2.30, allows remote attackers to cause a denial of service (out-of-bounds read and segmentation violation) via a note with a large alignment.","scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"2.40-2"},"fixed_version":"2.30-4","urgency":"not yet assigned"},"bullseye":{"status":"resolved","repositories":{"bullseye":"2.35.2-2"},"fixed_version":"2.30-4","urgency":"not yet assigned"},"forky":{"status":"resolved","repositories":{"forky":"2.46-3"},"fixed_version":"2.30-4","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"2.46-3"},"fixed_version":"2.30-4","urgency":"not yet assigned"},"trixie":{"status":"resolved","repositories":{"trixie":"2.44-3"},"fixed_version":"2.30-4","urgency":"not yet assigned"}}},"CVE-2018-7208":{"description":"In the coff_pointerize_aux function in coffgen.c in the Binary File Descriptor (BFD) library (aka libbfd), as distributed in GNU Binutils 2.30, an index is not validated, which allows remote attackers to cause a denial of service (segmentation fault) or possibly have unspecified other impact via a crafted file, as demonstrated by objcopy of a COFF object.","scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"2.40-2"},"fixed_version":"2.30-6","urgency":"not yet assigned"},"bullseye":{"status":"resolved","repositories":{"bullseye":"2.35.2-2"},"fixed_version":"2.30-6","urgency":"not yet assigned"},"forky":{"status":"resolved","repositories":{"forky":"2.46-3"},"fixed_version":"2.30-6","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"2.46-3"},"fixed_version":"2.30-6","urgency":"not yet assigned"},"trixie":{"status":"resolved","repositories":{"trixie":"2.44-3"},"fixed_version":"2.30-6","urgency":"not yet assigned"}}},"CVE-2018-7568":{"description":"The parse_die function in dwarf1.c in the Binary File Descriptor (BFD) library (aka libbfd), as distributed in GNU Binutils 2.30, allows remote attackers to cause a denial of service (integer overflow and application crash) via an ELF file with corrupt dwarf1 debug information, as demonstrated by nm.","scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"2.40-2"},"fixed_version":"2.30-6","urgency":"not yet assigned"},"bullseye":{"status":"resolved","repositories":{"bullseye":"2.35.2-2"},"fixed_version":"2.30-6","urgency":"not yet assigned"},"forky":{"status":"resolved","repositories":{"forky":"2.46-3"},"fixed_version":"2.30-6","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"2.46-3"},"fixed_version":"2.30-6","urgency":"not yet assigned"},"trixie":{"status":"resolved","repositories":{"trixie":"2.44-3"},"fixed_version":"2.30-6","urgency":"not yet assigned"}}},"CVE-2018-7569":{"description":"dwarf2.c in the Binary File Descriptor (BFD) library (aka libbfd), as distributed in GNU Binutils 2.30, allows remote attackers to cause a denial of service (integer underflow or overflow, and application crash) via an ELF file with a corrupt DWARF FORM block, as demonstrated by nm.","scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"2.40-2"},"fixed_version":"2.30-6","urgency":"not yet assigned"},"bullseye":{"status":"resolved","repositories":{"bullseye":"2.35.2-2"},"fixed_version":"2.30-6","urgency":"not yet assigned"},"forky":{"status":"resolved","repositories":{"forky":"2.46-3"},"fixed_version":"2.30-6","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"2.46-3"},"fixed_version":"2.30-6","urgency":"not yet assigned"},"trixie":{"status":"resolved","repositories":{"trixie":"2.44-3"},"fixed_version":"2.30-6","urgency":"not yet assigned"}}},"CVE-2018-7570":{"description":"The assign_file_positions_for_non_load_sections function in elf.c in the Binary File Descriptor (BFD) library (aka libbfd), as distributed in GNU Binutils 2.30, allows remote attackers to cause a denial of service (NULL pointer dereference and application crash) via an ELF file with a RELRO segment that lacks a matching LOAD segment, as demonstrated by objcopy.","scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"2.40-2"},"fixed_version":"2.30-6","urgency":"not yet assigned"},"bullseye":{"status":"resolved","repositories":{"bullseye":"2.35.2-2"},"fixed_version":"2.30-6","urgency":"not yet assigned"},"forky":{"status":"resolved","repositories":{"forky":"2.46-3"},"fixed_version":"2.30-6","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"2.46-3"},"fixed_version":"2.30-6","urgency":"not yet assigned"},"trixie":{"status":"resolved","repositories":{"trixie":"2.44-3"},"fixed_version":"2.30-6","urgency":"not yet assigned"}}},"CVE-2018-7642":{"description":"The swap_std_reloc_in function in aoutx.h in the Binary File Descriptor (BFD) library (aka libbfd), as distributed in GNU Binutils 2.30, allows remote attackers to cause a denial of service (aout_32_swap_std_reloc_out NULL pointer dereference and application crash) via a crafted ELF file, as demonstrated by objcopy.","scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"2.40-2"},"fixed_version":"2.30-6","urgency":"not yet assigned"},"bullseye":{"status":"resolved","repositories":{"bullseye":"2.35.2-2"},"fixed_version":"2.30-6","urgency":"not yet assigned"},"forky":{"status":"resolved","repositories":{"forky":"2.46-3"},"fixed_version":"2.30-6","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"2.46-3"},"fixed_version":"2.30-6","urgency":"not yet assigned"},"trixie":{"status":"resolved","repositories":{"trixie":"2.44-3"},"fixed_version":"2.30-6","urgency":"not yet assigned"}}},"CVE-2018-7643":{"description":"The display_debug_ranges function in dwarf.c in GNU Binutils 2.30 allows remote attackers to cause a denial of service (integer overflow and application crash) or possibly have unspecified other impact via a crafted ELF file, as demonstrated by objdump.","scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"2.40-2"},"fixed_version":"2.30-6","urgency":"not yet assigned"},"bullseye":{"status":"resolved","repositories":{"bullseye":"2.35.2-2"},"fixed_version":"2.30-6","urgency":"not yet assigned"},"forky":{"status":"resolved","repositories":{"forky":"2.46-3"},"fixed_version":"2.30-6","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"2.46-3"},"fixed_version":"2.30-6","urgency":"not yet assigned"},"trixie":{"status":"resolved","repositories":{"trixie":"2.44-3"},"fixed_version":"2.30-6","urgency":"not yet assigned"}}},"CVE-2018-8945":{"description":"The bfd_section_from_shdr function in elf.c in the Binary File Descriptor (BFD) library (aka libbfd), as distributed in GNU Binutils 2.30, allows remote attackers to cause a denial of service (segmentation fault) via a large attribute section.","scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"2.40-2"},"fixed_version":"2.30.90.20180627-1","urgency":"low"},"bullseye":{"status":"resolved","repositories":{"bullseye":"2.35.2-2"},"fixed_version":"2.30.90.20180627-1","urgency":"low"},"forky":{"status":"resolved","repositories":{"forky":"2.46-3"},"fixed_version":"2.30.90.20180627-1","urgency":"low"},"sid":{"status":"resolved","repositories":{"sid":"2.46-3"},"fixed_version":"2.30.90.20180627-1","urgency":"low"},"trixie":{"status":"resolved","repositories":{"trixie":"2.44-3"},"fixed_version":"2.30.90.20180627-1","urgency":"low"}}},"CVE-2018-9138":{"description":"An issue was discovered in cplus-dem.c in GNU libiberty, as distributed in GNU Binutils 2.29 and 2.30. Stack Exhaustion occurs in the C++ demangling functions provided by libiberty, and there are recursive stack frames: demangle_nested_args, demangle_args, do_arg, and do_type.","scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"2.40-2"},"fixed_version":"2.32.51.20190707-1","urgency":"unimportant"},"bullseye":{"status":"resolved","repositories":{"bullseye":"2.35.2-2"},"fixed_version":"2.32.51.20190707-1","urgency":"unimportant"},"forky":{"status":"resolved","repositories":{"forky":"2.46-3"},"fixed_version":"2.32.51.20190707-1","urgency":"unimportant"},"sid":{"status":"resolved","repositories":{"sid":"2.46-3"},"fixed_version":"2.32.51.20190707-1","urgency":"unimportant"},"trixie":{"status":"resolved","repositories":{"trixie":"2.44-3"},"fixed_version":"2.32.51.20190707-1","urgency":"unimportant"}}},"CVE-2018-9996":{"description":"An issue was discovered in cplus-dem.c in GNU libiberty, as distributed in GNU Binutils 2.30. Stack Exhaustion occurs in the C++ demangling functions provided by libiberty, and there are recursive stack frames: demangle_template_value_parm, demangle_integral_value, and demangle_expression.","scope":"local","releases":{"bookworm":{"status":"open","repositories":{"bookworm":"2.40-2"},"urgency":"unimportant"},"bullseye":{"status":"open","repositories":{"bullseye":"2.35.2-2"},"urgency":"unimportant"},"forky":{"status":"open","repositories":{"forky":"2.46-3"},"urgency":"unimportant"},"sid":{"status":"open","repositories":{"sid":"2.46-3"},"urgency":"unimportant"},"trixie":{"status":"open","repositories":{"trixie":"2.44-3"},"urgency":"unimportant"}}},"CVE-2019-1010180":{"description":"GNU gdb All versions is affected by: Buffer Overflow - Out of bound memory access. The impact is: Deny of Service, Memory Disclosure, and Possible Code Execution. The component is: The main gdb module. The attack vector is: Open an ELF for debugging. The fixed version is: Not fixed yet.","scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"2.40-2"},"fixed_version":"2.32.51.20190707-1","urgency":"unimportant"},"bullseye":{"status":"resolved","repositories":{"bullseye":"2.35.2-2"},"fixed_version":"2.32.51.20190707-1","urgency":"unimportant"},"forky":{"status":"resolved","repositories":{"forky":"2.46-3"},"fixed_version":"2.32.51.20190707-1","urgency":"unimportant"},"sid":{"status":"resolved","repositories":{"sid":"2.46-3"},"fixed_version":"2.32.51.20190707-1","urgency":"unimportant"},"trixie":{"status":"resolved","repositories":{"trixie":"2.44-3"},"fixed_version":"2.32.51.20190707-1","urgency":"unimportant"}}},"CVE-2019-1010204":{"description":"GNU binutils gold gold v1.11-v1.16 (GNU binutils v2.21-v2.31.1) is affected by: Improper Input Validation, Signed/Unsigned Comparison, Out-of-bounds Read. The impact is: Denial of service. The component is: gold/fileread.cc:497, elfcpp/elfcpp_file.h:644. The attack vector is: An ELF file with an invalid e_shoff header field must be opened.","scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"2.40-2"},"fixed_version":"2.38.50.20220627-1","urgency":"unimportant"},"bullseye":{"status":"open","repositories":{"bullseye":"2.35.2-2"},"urgency":"unimportant"},"forky":{"status":"resolved","repositories":{"forky":"2.46-3"},"fixed_version":"2.38.50.20220627-1","urgency":"unimportant"},"sid":{"status":"resolved","repositories":{"sid":"2.46-3"},"fixed_version":"2.38.50.20220627-1","urgency":"unimportant"},"trixie":{"status":"resolved","repositories":{"trixie":"2.44-3"},"fixed_version":"2.38.50.20220627-1","urgency":"unimportant"}}},"CVE-2019-12972":{"description":"An issue was discovered in the Binary File Descriptor (BFD) library (aka libbfd), as distributed in GNU Binutils 2.32. There is a heap-based buffer over-read in _bfd_doprnt in bfd.c because elf_object_p in elfcode.h mishandles an e_shstrndx section of type SHT_GROUP by omitting a trailing '\\0' character.","scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"2.40-2"},"fixed_version":"2.32.51.20190707-1","urgency":"unimportant"},"bullseye":{"status":"resolved","repositories":{"bullseye":"2.35.2-2"},"fixed_version":"2.32.51.20190707-1","urgency":"unimportant"},"forky":{"status":"resolved","repositories":{"forky":"2.46-3"},"fixed_version":"2.32.51.20190707-1","urgency":"unimportant"},"sid":{"status":"resolved","repositories":{"sid":"2.46-3"},"fixed_version":"2.32.51.20190707-1","urgency":"unimportant"},"trixie":{"status":"resolved","repositories":{"trixie":"2.44-3"},"fixed_version":"2.32.51.20190707-1","urgency":"unimportant"}}},"CVE-2019-14250":{"description":"An issue was discovered in GNU libiberty, as distributed in GNU Binutils 2.32. simple_object_elf_match in simple-object-elf.c does not check for a zero shstrndx value, leading to an integer overflow and resultant heap-based buffer overflow.","scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"2.40-2"},"fixed_version":"2.33-1","urgency":"unimportant"},"bullseye":{"status":"resolved","repositories":{"bullseye":"2.35.2-2"},"fixed_version":"2.33-1","urgency":"unimportant"},"forky":{"status":"resolved","repositories":{"forky":"2.46-3"},"fixed_version":"2.33-1","urgency":"unimportant"},"sid":{"status":"resolved","repositories":{"sid":"2.46-3"},"fixed_version":"2.33-1","urgency":"unimportant"},"trixie":{"status":"resolved","repositories":{"trixie":"2.44-3"},"fixed_version":"2.33-1","urgency":"unimportant"}}},"CVE-2019-14444":{"description":"apply_relocations in readelf.c in GNU Binutils 2.32 contains an integer overflow that allows attackers to trigger a write access violation (in byte_put_little_endian function in elfcomm.c) via an ELF file, as demonstrated by readelf.","scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"2.40-2"},"fixed_version":"2.32.51.20190813-1","urgency":"unimportant"},"bullseye":{"status":"resolved","repositories":{"bullseye":"2.35.2-2"},"fixed_version":"2.32.51.20190813-1","urgency":"unimportant"},"forky":{"status":"resolved","repositories":{"forky":"2.46-3"},"fixed_version":"2.32.51.20190813-1","urgency":"unimportant"},"sid":{"status":"resolved","repositories":{"sid":"2.46-3"},"fixed_version":"2.32.51.20190813-1","urgency":"unimportant"},"trixie":{"status":"resolved","repositories":{"trixie":"2.44-3"},"fixed_version":"2.32.51.20190813-1","urgency":"unimportant"}}},"CVE-2019-17450":{"description":"find_abstract_instance in dwarf2.c in the Binary File Descriptor (BFD) library (aka libbfd), as distributed in GNU Binutils 2.32, allows remote attackers to cause a denial of service (infinite recursion and application crash) via a crafted ELF file.","scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"2.40-2"},"fixed_version":"2.34-1","urgency":"unimportant"},"bullseye":{"status":"resolved","repositories":{"bullseye":"2.35.2-2"},"fixed_version":"2.34-1","urgency":"unimportant"},"forky":{"status":"resolved","repositories":{"forky":"2.46-3"},"fixed_version":"2.34-1","urgency":"unimportant"},"sid":{"status":"resolved","repositories":{"sid":"2.46-3"},"fixed_version":"2.34-1","urgency":"unimportant"},"trixie":{"status":"resolved","repositories":{"trixie":"2.44-3"},"fixed_version":"2.34-1","urgency":"unimportant"}}},"CVE-2019-17451":{"description":"An issue was discovered in the Binary File Descriptor (BFD) library (aka libbfd), as distributed in GNU Binutils 2.32. It is an integer overflow leading to a SEGV in _bfd_dwarf2_find_nearest_line in dwarf2.c, as demonstrated by nm.","scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"2.40-2"},"fixed_version":"2.34-1","urgency":"unimportant"},"bullseye":{"status":"resolved","repositories":{"bullseye":"2.35.2-2"},"fixed_version":"2.34-1","urgency":"unimportant"},"forky":{"status":"resolved","repositories":{"forky":"2.46-3"},"fixed_version":"2.34-1","urgency":"unimportant"},"sid":{"status":"resolved","repositories":{"sid":"2.46-3"},"fixed_version":"2.34-1","urgency":"unimportant"},"trixie":{"status":"resolved","repositories":{"trixie":"2.44-3"},"fixed_version":"2.34-1","urgency":"unimportant"}}},"CVE-2019-9070":{"description":"An issue was discovered in GNU libiberty, as distributed in GNU Binutils 2.32. It is a heap-based buffer over-read in d_expression_1 in cp-demangle.c after many recursive calls.","scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"2.40-2"},"fixed_version":"2.32.51.20190707-1","urgency":"unimportant"},"bullseye":{"status":"resolved","repositories":{"bullseye":"2.35.2-2"},"fixed_version":"2.32.51.20190707-1","urgency":"unimportant"},"forky":{"status":"resolved","repositories":{"forky":"2.46-3"},"fixed_version":"2.32.51.20190707-1","urgency":"unimportant"},"sid":{"status":"resolved","repositories":{"sid":"2.46-3"},"fixed_version":"2.32.51.20190707-1","urgency":"unimportant"},"trixie":{"status":"resolved","repositories":{"trixie":"2.44-3"},"fixed_version":"2.32.51.20190707-1","urgency":"unimportant"}}},"CVE-2019-9071":{"description":"An issue was discovered in GNU libiberty, as distributed in GNU Binutils 2.32. It is a stack consumption issue in d_count_templates_scopes in cp-demangle.c after many recursive calls.","scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"2.40-2"},"fixed_version":"2.32.51.20190707-1","urgency":"unimportant"},"bullseye":{"status":"resolved","repositories":{"bullseye":"2.35.2-2"},"fixed_version":"2.32.51.20190707-1","urgency":"unimportant"},"forky":{"status":"resolved","repositories":{"forky":"2.46-3"},"fixed_version":"2.32.51.20190707-1","urgency":"unimportant"},"sid":{"status":"resolved","repositories":{"sid":"2.46-3"},"fixed_version":"2.32.51.20190707-1","urgency":"unimportant"},"trixie":{"status":"resolved","repositories":{"trixie":"2.44-3"},"fixed_version":"2.32.51.20190707-1","urgency":"unimportant"}}},"CVE-2019-9073":{"description":"An issue was discovered in the Binary File Descriptor (BFD) library (aka libbfd), as distributed in GNU Binutils 2.32. It is an attempted excessive memory allocation in _bfd_elf_slurp_version_tables in elf.c.","scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"2.40-2"},"fixed_version":"2.32.51.20190707-1","urgency":"unimportant"},"bullseye":{"status":"resolved","repositories":{"bullseye":"2.35.2-2"},"fixed_version":"2.32.51.20190707-1","urgency":"unimportant"},"forky":{"status":"resolved","repositories":{"forky":"2.46-3"},"fixed_version":"2.32.51.20190707-1","urgency":"unimportant"},"sid":{"status":"resolved","repositories":{"sid":"2.46-3"},"fixed_version":"2.32.51.20190707-1","urgency":"unimportant"},"trixie":{"status":"resolved","repositories":{"trixie":"2.44-3"},"fixed_version":"2.32.51.20190707-1","urgency":"unimportant"}}},"CVE-2019-9074":{"description":"An issue was discovered in the Binary File Descriptor (BFD) library (aka libbfd), as distributed in GNU Binutils 2.32. It is an out-of-bounds read leading to a SEGV in bfd_getl32 in libbfd.c, when called from pex64_get_runtime_function in pei-x86_64.c.","scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"2.40-2"},"fixed_version":"2.32.51.20190707-1","urgency":"unimportant"},"bullseye":{"status":"resolved","repositories":{"bullseye":"2.35.2-2"},"fixed_version":"2.32.51.20190707-1","urgency":"unimportant"},"forky":{"status":"resolved","repositories":{"forky":"2.46-3"},"fixed_version":"2.32.51.20190707-1","urgency":"unimportant"},"sid":{"status":"resolved","repositories":{"sid":"2.46-3"},"fixed_version":"2.32.51.20190707-1","urgency":"unimportant"},"trixie":{"status":"resolved","repositories":{"trixie":"2.44-3"},"fixed_version":"2.32.51.20190707-1","urgency":"unimportant"}}},"CVE-2019-9075":{"description":"An issue was discovered in the Binary File Descriptor (BFD) library (aka libbfd), as distributed in GNU Binutils 2.32. It is a heap-based buffer overflow in _bfd_archive_64_bit_slurp_armap in archive64.c.","scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"2.40-2"},"fixed_version":"2.32.51.20190707-1","urgency":"unimportant"},"bullseye":{"status":"resolved","repositories":{"bullseye":"2.35.2-2"},"fixed_version":"2.32.51.20190707-1","urgency":"unimportant"},"forky":{"status":"resolved","repositories":{"forky":"2.46-3"},"fixed_version":"2.32.51.20190707-1","urgency":"unimportant"},"sid":{"status":"resolved","repositories":{"sid":"2.46-3"},"fixed_version":"2.32.51.20190707-1","urgency":"unimportant"},"trixie":{"status":"resolved","repositories":{"trixie":"2.44-3"},"fixed_version":"2.32.51.20190707-1","urgency":"unimportant"}}},"CVE-2019-9077":{"description":"An issue was discovered in GNU Binutils 2.32. It is a heap-based buffer overflow in process_mips_specific in readelf.c via a malformed MIPS option section.","scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"2.40-2"},"fixed_version":"2.32.51.20190707-1","urgency":"unimportant"},"bullseye":{"status":"resolved","repositories":{"bullseye":"2.35.2-2"},"fixed_version":"2.32.51.20190707-1","urgency":"unimportant"},"forky":{"status":"resolved","repositories":{"forky":"2.46-3"},"fixed_version":"2.32.51.20190707-1","urgency":"unimportant"},"sid":{"status":"resolved","repositories":{"sid":"2.46-3"},"fixed_version":"2.32.51.20190707-1","urgency":"unimportant"},"trixie":{"status":"resolved","repositories":{"trixie":"2.44-3"},"fixed_version":"2.32.51.20190707-1","urgency":"unimportant"}}},"CVE-2020-16590":{"description":"A double free vulnerability exists in the Binary File Descriptor (BFD) (aka libbrd) in GNU Binutils 2.35 in the process_symbol_table, as demonstrated in readelf, via a crafted file.","scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"2.40-2"},"fixed_version":"2.35-1","urgency":"unimportant"},"bullseye":{"status":"resolved","repositories":{"bullseye":"2.35.2-2"},"fixed_version":"2.35-1","urgency":"unimportant"},"forky":{"status":"resolved","repositories":{"forky":"2.46-3"},"fixed_version":"2.35-1","urgency":"unimportant"},"sid":{"status":"resolved","repositories":{"sid":"2.46-3"},"fixed_version":"2.35-1","urgency":"unimportant"},"trixie":{"status":"resolved","repositories":{"trixie":"2.44-3"},"fixed_version":"2.35-1","urgency":"unimportant"}}},"CVE-2020-16591":{"description":"A Denial of Service vulnerability exists in the Binary File Descriptor (BFD) in GNU Binutils 2.35 due to an invalid read in process_symbol_table, as demonstrated in readeif.","scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"2.40-2"},"fixed_version":"2.35-1","urgency":"unimportant"},"bullseye":{"status":"resolved","repositories":{"bullseye":"2.35.2-2"},"fixed_version":"2.35-1","urgency":"unimportant"},"forky":{"status":"resolved","repositories":{"forky":"2.46-3"},"fixed_version":"2.35-1","urgency":"unimportant"},"sid":{"status":"resolved","repositories":{"sid":"2.46-3"},"fixed_version":"2.35-1","urgency":"unimportant"},"trixie":{"status":"resolved","repositories":{"trixie":"2.44-3"},"fixed_version":"2.35-1","urgency":"unimportant"}}},"CVE-2020-16592":{"description":"A use after free issue exists in the Binary File Descriptor (BFD) library (aka libbfd) in GNU Binutils 2.34 in bfd_hash_lookup, as demonstrated in nm-new, that can cause a denial of service via a crafted file.","scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"2.40-2"},"fixed_version":"2.35-1","urgency":"unimportant"},"bullseye":{"status":"resolved","repositories":{"bullseye":"2.35.2-2"},"fixed_version":"2.35-1","urgency":"unimportant"},"forky":{"status":"resolved","repositories":{"forky":"2.46-3"},"fixed_version":"2.35-1","urgency":"unimportant"},"sid":{"status":"resolved","repositories":{"sid":"2.46-3"},"fixed_version":"2.35-1","urgency":"unimportant"},"trixie":{"status":"resolved","repositories":{"trixie":"2.44-3"},"fixed_version":"2.35-1","urgency":"unimportant"}}},"CVE-2020-16593":{"description":"A Null Pointer Dereference vulnerability exists in the Binary File Descriptor (BFD) library (aka libbfd), as distributed in GNU Binutils 2.35, in scan_unit_for_symbols, as demonstrated in addr2line, that can cause a denial of service via a crafted file.","scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"2.40-2"},"fixed_version":"2.35-1","urgency":"unimportant"},"bullseye":{"status":"resolved","repositories":{"bullseye":"2.35.2-2"},"fixed_version":"2.35-1","urgency":"unimportant"},"forky":{"status":"resolved","repositories":{"forky":"2.46-3"},"fixed_version":"2.35-1","urgency":"unimportant"},"sid":{"status":"resolved","repositories":{"sid":"2.46-3"},"fixed_version":"2.35-1","urgency":"unimportant"},"trixie":{"status":"resolved","repositories":{"trixie":"2.44-3"},"fixed_version":"2.35-1","urgency":"unimportant"}}},"CVE-2020-16599":{"description":"A Null Pointer Dereference vulnerability exists in the Binary File Descriptor (BFD) library (aka libbfd), as distributed in GNU Binutils 2.35, in _bfd_elf_get_symbol_version_string, as demonstrated in nm-new, that can cause a denial of service via a crafted file.","scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"2.40-2"},"fixed_version":"2.35-1","urgency":"unimportant"},"bullseye":{"status":"resolved","repositories":{"bullseye":"2.35.2-2"},"fixed_version":"2.35-1","urgency":"unimportant"},"forky":{"status":"resolved","repositories":{"forky":"2.46-3"},"fixed_version":"2.35-1","urgency":"unimportant"},"sid":{"status":"resolved","repositories":{"sid":"2.46-3"},"fixed_version":"2.35-1","urgency":"unimportant"},"trixie":{"status":"resolved","repositories":{"trixie":"2.44-3"},"fixed_version":"2.35-1","urgency":"unimportant"}}},"CVE-2020-19724":{"description":"A memory consumption issue in get_data function in binutils/nm.c in GNU nm before 2.34 allows attackers to cause a denial of service via crafted command.","scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"2.40-2"},"fixed_version":"2.33.50.20200114-1","urgency":"unimportant"},"bullseye":{"status":"resolved","repositories":{"bullseye":"2.35.2-2"},"fixed_version":"2.33.50.20200114-1","urgency":"unimportant"},"forky":{"status":"resolved","repositories":{"forky":"2.46-3"},"fixed_version":"2.33.50.20200114-1","urgency":"unimportant"},"sid":{"status":"resolved","repositories":{"sid":"2.46-3"},"fixed_version":"2.33.50.20200114-1","urgency":"unimportant"},"trixie":{"status":"resolved","repositories":{"trixie":"2.44-3"},"fixed_version":"2.33.50.20200114-1","urgency":"unimportant"}}},"CVE-2020-19726":{"description":"An issue was discovered in binutils libbfd.c 2.36 relating to the auxiliary symbol data allows attackers to read or write to system memory or cause a denial of service.","scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"2.40-2"},"fixed_version":"2.37-3","urgency":"unimportant"},"bullseye":{"status":"open","repositories":{"bullseye":"2.35.2-2"},"urgency":"unimportant"},"forky":{"status":"resolved","repositories":{"forky":"2.46-3"},"fixed_version":"2.37-3","urgency":"unimportant"},"sid":{"status":"resolved","repositories":{"sid":"2.46-3"},"fixed_version":"2.37-3","urgency":"unimportant"},"trixie":{"status":"resolved","repositories":{"trixie":"2.44-3"},"fixed_version":"2.37-3","urgency":"unimportant"}}},"CVE-2020-21490":{"description":"An issue was discovered in GNU Binutils 2.34. It is a memory leak when process microblaze-dis.c. This one will consume memory on each insn disassembled.","scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"2.40-2"},"fixed_version":"2.33.50.20200107-1","urgency":"unimportant"},"bullseye":{"status":"resolved","repositories":{"bullseye":"2.35.2-2"},"fixed_version":"2.33.50.20200107-1","urgency":"unimportant"},"forky":{"status":"resolved","repositories":{"forky":"2.46-3"},"fixed_version":"2.33.50.20200107-1","urgency":"unimportant"},"sid":{"status":"resolved","repositories":{"sid":"2.46-3"},"fixed_version":"2.33.50.20200107-1","urgency":"unimportant"},"trixie":{"status":"resolved","repositories":{"trixie":"2.44-3"},"fixed_version":"2.33.50.20200107-1","urgency":"unimportant"}}},"CVE-2020-35342":{"description":"GNU Binutils before 2.34 has an uninitialized-heap vulnerability in function tic4x_print_cond (file opcodes/tic4x-dis.c) which could allow attackers to make an information leak.","scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"2.40-2"},"fixed_version":"2.33.50.20200107-1","urgency":"unimportant"},"bullseye":{"status":"resolved","repositories":{"bullseye":"2.35.2-2"},"fixed_version":"2.33.50.20200107-1","urgency":"unimportant"},"forky":{"status":"resolved","repositories":{"forky":"2.46-3"},"fixed_version":"2.33.50.20200107-1","urgency":"unimportant"},"sid":{"status":"resolved","repositories":{"sid":"2.46-3"},"fixed_version":"2.33.50.20200107-1","urgency":"unimportant"},"trixie":{"status":"resolved","repositories":{"trixie":"2.44-3"},"fixed_version":"2.33.50.20200107-1","urgency":"unimportant"}}},"CVE-2020-35448":{"description":"An issue was discovered in the Binary File Descriptor (BFD) library (aka libbfd), as distributed in GNU Binutils 2.35.1. A heap-based buffer over-read can occur in bfd_getl_signed_32 in libbfd.c because sh_entsize is not validated in _bfd_elf_slurp_secondary_reloc_section in elf.c.","scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"2.40-2"},"fixed_version":"2.37-3","urgency":"unimportant"},"bullseye":{"status":"open","repositories":{"bullseye":"2.35.2-2"},"urgency":"unimportant"},"forky":{"status":"resolved","repositories":{"forky":"2.46-3"},"fixed_version":"2.37-3","urgency":"unimportant"},"sid":{"status":"resolved","repositories":{"sid":"2.46-3"},"fixed_version":"2.37-3","urgency":"unimportant"},"trixie":{"status":"resolved","repositories":{"trixie":"2.44-3"},"fixed_version":"2.37-3","urgency":"unimportant"}}},"CVE-2020-35493":{"description":"A flaw exists in binutils in bfd/pef.c. An attacker who is able to submit a crafted PEF file to be parsed by objdump could cause a heap buffer overflow -> out-of-bounds read that could lead to an impact to application availability. This flaw affects binutils versions prior to 2.34.","scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"2.40-2"},"fixed_version":"2.33.50.20200107-1","urgency":"unimportant"},"bullseye":{"status":"resolved","repositories":{"bullseye":"2.35.2-2"},"fixed_version":"2.33.50.20200107-1","urgency":"unimportant"},"forky":{"status":"resolved","repositories":{"forky":"2.46-3"},"fixed_version":"2.33.50.20200107-1","urgency":"unimportant"},"sid":{"status":"resolved","repositories":{"sid":"2.46-3"},"fixed_version":"2.33.50.20200107-1","urgency":"unimportant"},"trixie":{"status":"resolved","repositories":{"trixie":"2.44-3"},"fixed_version":"2.33.50.20200107-1","urgency":"unimportant"}}},"CVE-2020-35494":{"description":"There's a flaw in binutils /opcodes/tic4x-dis.c. An attacker who is able to submit a crafted input file to be processed by binutils could cause usage of uninitialized memory. The highest threat is to application availability with a lower threat to data confidentiality. This flaw affects binutils versions prior to 2.34.","scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"2.40-2"},"fixed_version":"2.33.50.20200107-1","urgency":"unimportant"},"bullseye":{"status":"resolved","repositories":{"bullseye":"2.35.2-2"},"fixed_version":"2.33.50.20200107-1","urgency":"unimportant"},"forky":{"status":"resolved","repositories":{"forky":"2.46-3"},"fixed_version":"2.33.50.20200107-1","urgency":"unimportant"},"sid":{"status":"resolved","repositories":{"sid":"2.46-3"},"fixed_version":"2.33.50.20200107-1","urgency":"unimportant"},"trixie":{"status":"resolved","repositories":{"trixie":"2.44-3"},"fixed_version":"2.33.50.20200107-1","urgency":"unimportant"}}},"CVE-2020-35495":{"description":"There's a flaw in binutils /bfd/pef.c. An attacker who is able to submit a crafted input file to be processed by the objdump program could cause a null pointer dereference. The greatest threat from this flaw is to application availability. This flaw affects binutils versions prior to 2.34.","scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"2.40-2"},"fixed_version":"2.33.50.20200107-1","urgency":"unimportant"},"bullseye":{"status":"resolved","repositories":{"bullseye":"2.35.2-2"},"fixed_version":"2.33.50.20200107-1","urgency":"unimportant"},"forky":{"status":"resolved","repositories":{"forky":"2.46-3"},"fixed_version":"2.33.50.20200107-1","urgency":"unimportant"},"sid":{"status":"resolved","repositories":{"sid":"2.46-3"},"fixed_version":"2.33.50.20200107-1","urgency":"unimportant"},"trixie":{"status":"resolved","repositories":{"trixie":"2.44-3"},"fixed_version":"2.33.50.20200107-1","urgency":"unimportant"}}},"CVE-2020-35496":{"description":"There's a flaw in bfd_pef_scan_start_address() of bfd/pef.c in binutils which could allow an attacker who is able to submit a crafted file to be processed by objdump to cause a NULL pointer dereference. The greatest threat of this flaw is to application availability. This flaw affects binutils versions prior to 2.34.","scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"2.40-2"},"fixed_version":"2.33.50.20200107-1","urgency":"unimportant"},"bullseye":{"status":"resolved","repositories":{"bullseye":"2.35.2-2"},"fixed_version":"2.33.50.20200107-1","urgency":"unimportant"},"forky":{"status":"resolved","repositories":{"forky":"2.46-3"},"fixed_version":"2.33.50.20200107-1","urgency":"unimportant"},"sid":{"status":"resolved","repositories":{"sid":"2.46-3"},"fixed_version":"2.33.50.20200107-1","urgency":"unimportant"},"trixie":{"status":"resolved","repositories":{"trixie":"2.44-3"},"fixed_version":"2.33.50.20200107-1","urgency":"unimportant"}}},"CVE-2020-35507":{"description":"There's a flaw in bfd_pef_parse_function_stubs of bfd/pef.c in binutils in versions prior to 2.34 which could allow an attacker who is able to submit a crafted file to be processed by objdump to cause a NULL pointer dereference. The greatest threat of this flaw is to application availability.","scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"2.40-2"},"fixed_version":"2.33.50.20200107-1","urgency":"unimportant"},"bullseye":{"status":"resolved","repositories":{"bullseye":"2.35.2-2"},"fixed_version":"2.33.50.20200107-1","urgency":"unimportant"},"forky":{"status":"resolved","repositories":{"forky":"2.46-3"},"fixed_version":"2.33.50.20200107-1","urgency":"unimportant"},"sid":{"status":"resolved","repositories":{"sid":"2.46-3"},"fixed_version":"2.33.50.20200107-1","urgency":"unimportant"},"trixie":{"status":"resolved","repositories":{"trixie":"2.44-3"},"fixed_version":"2.33.50.20200107-1","urgency":"unimportant"}}},"CVE-2021-20197":{"description":"There is an open race window when writing output in the following utilities in GNU binutils version 2.35 and earlier:ar, objcopy, strip, ranlib. When these utilities are run as a privileged user (presumably as part of a script updating binaries across different users), an unprivileged user can trick these utilities into getting ownership of arbitrary files through a symlink.","scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"2.40-2"},"fixed_version":"2.37-3","urgency":"unimportant"},"bullseye":{"status":"open","repositories":{"bullseye":"2.35.2-2"},"urgency":"unimportant"},"forky":{"status":"resolved","repositories":{"forky":"2.46-3"},"fixed_version":"2.37-3","urgency":"unimportant"},"sid":{"status":"resolved","repositories":{"sid":"2.46-3"},"fixed_version":"2.37-3","urgency":"unimportant"},"trixie":{"status":"resolved","repositories":{"trixie":"2.44-3"},"fixed_version":"2.37-3","urgency":"unimportant"}}},"CVE-2021-20284":{"description":"A flaw was found in GNU Binutils 2.35.1, where there is a heap-based buffer overflow in _bfd_elf_slurp_secondary_reloc_section in elf.c due to the number of symbols not calculated correctly. The highest threat from this vulnerability is to system availability.","scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"2.40-2"},"fixed_version":"2.37-3","urgency":"unimportant"},"bullseye":{"status":"open","repositories":{"bullseye":"2.35.2-2"},"urgency":"unimportant"},"forky":{"status":"resolved","repositories":{"forky":"2.46-3"},"fixed_version":"2.37-3","urgency":"unimportant"},"sid":{"status":"resolved","repositories":{"sid":"2.46-3"},"fixed_version":"2.37-3","urgency":"unimportant"},"trixie":{"status":"resolved","repositories":{"trixie":"2.44-3"},"fixed_version":"2.37-3","urgency":"unimportant"}}},"CVE-2021-20294":{"description":"A flaw was found in binutils readelf 2.35 program. An attacker who is able to convince a victim using readelf to read a crafted file could trigger a stack buffer overflow, out-of-bounds write of arbitrary data supplied by the attacker. The highest impact of this flaw is to confidentiality, integrity, and availability.","scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"2.40-2"},"fixed_version":"2.35.2-1","urgency":"unimportant"},"bullseye":{"status":"resolved","repositories":{"bullseye":"2.35.2-2"},"fixed_version":"2.35.2-1","urgency":"unimportant"},"forky":{"status":"resolved","repositories":{"forky":"2.46-3"},"fixed_version":"2.35.2-1","urgency":"unimportant"},"sid":{"status":"resolved","repositories":{"sid":"2.46-3"},"fixed_version":"2.35.2-1","urgency":"unimportant"},"trixie":{"status":"resolved","repositories":{"trixie":"2.44-3"},"fixed_version":"2.35.2-1","urgency":"unimportant"}}},"CVE-2021-32256":{"description":"An issue was discovered in GNU libiberty, as distributed in GNU Binutils 2.36. It is a stack-overflow issue in demangle_type in rust-demangle.c.","scope":"local","releases":{"bookworm":{"status":"open","repositories":{"bookworm":"2.40-2"},"urgency":"unimportant"},"bullseye":{"status":"open","repositories":{"bullseye":"2.35.2-2"},"urgency":"unimportant"},"forky":{"status":"open","repositories":{"forky":"2.46-3"},"urgency":"unimportant"},"sid":{"status":"open","repositories":{"sid":"2.46-3"},"urgency":"unimportant"},"trixie":{"status":"open","repositories":{"trixie":"2.44-3"},"urgency":"unimportant"}}},"CVE-2021-3530":{"description":"A flaw was discovered in GNU libiberty within demangle_path() in rust-demangle.c, as distributed in GNU Binutils version 2.36. A crafted symbol can cause stack memory to be exhausted leading to a crash.","scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"2.40-2"},"fixed_version":"2.37.90.20220207-1","urgency":"unimportant"},"bullseye":{"status":"open","repositories":{"bullseye":"2.35.2-2"},"urgency":"unimportant"},"forky":{"status":"resolved","repositories":{"forky":"2.46-3"},"fixed_version":"2.37.90.20220207-1","urgency":"unimportant"},"sid":{"status":"resolved","repositories":{"sid":"2.46-3"},"fixed_version":"2.37.90.20220207-1","urgency":"unimportant"},"trixie":{"status":"resolved","repositories":{"trixie":"2.44-3"},"fixed_version":"2.37.90.20220207-1","urgency":"unimportant"}}},"CVE-2021-3549":{"description":"An out of bounds flaw was found in GNU binutils objdump utility version 2.36. An attacker could use this flaw and pass a large section to avr_elf32_load_records_from_section() probably resulting in a crash or in some cases memory corruption. The highest threat from this vulnerability is to integrity as well as system availability.","scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"2.40-2"},"fixed_version":"2.37-3","urgency":"unimportant"},"bullseye":{"status":"open","repositories":{"bullseye":"2.35.2-2"},"urgency":"unimportant"},"forky":{"status":"resolved","repositories":{"forky":"2.46-3"},"fixed_version":"2.37-3","urgency":"unimportant"},"sid":{"status":"resolved","repositories":{"sid":"2.46-3"},"fixed_version":"2.37-3","urgency":"unimportant"},"trixie":{"status":"resolved","repositories":{"trixie":"2.44-3"},"fixed_version":"2.37-3","urgency":"unimportant"}}},"CVE-2021-37322":{"description":"GCC c++filt v2.26 was discovered to contain a use-after-free vulnerability via the component cplus-dem.c.","scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"2.40-2"},"fixed_version":"2.27.51.20161102-1","urgency":"unimportant"},"bullseye":{"status":"resolved","repositories":{"bullseye":"2.35.2-2"},"fixed_version":"2.27.51.20161102-1","urgency":"unimportant"},"forky":{"status":"resolved","repositories":{"forky":"2.46-3"},"fixed_version":"2.27.51.20161102-1","urgency":"unimportant"},"sid":{"status":"resolved","repositories":{"sid":"2.46-3"},"fixed_version":"2.27.51.20161102-1","urgency":"unimportant"},"trixie":{"status":"resolved","repositories":{"trixie":"2.44-3"},"fixed_version":"2.27.51.20161102-1","urgency":"unimportant"}}},"CVE-2021-3826":{"description":"Heap/stack buffer overflow in the dlang_lname function in d-demangle.c in libiberty allows attackers to potentially cause a denial of service (segmentation fault and crash) via a crafted mangled symbol.","scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"2.40-2"},"fixed_version":"2.37.50.20220121-1","urgency":"unimportant"},"bullseye":{"status":"open","repositories":{"bullseye":"2.35.2-2"},"urgency":"unimportant"},"forky":{"status":"resolved","repositories":{"forky":"2.46-3"},"fixed_version":"2.37.50.20220121-1","urgency":"unimportant"},"sid":{"status":"resolved","repositories":{"sid":"2.46-3"},"fixed_version":"2.37.50.20220121-1","urgency":"unimportant"},"trixie":{"status":"resolved","repositories":{"trixie":"2.44-3"},"fixed_version":"2.37.50.20220121-1","urgency":"unimportant"}}},"CVE-2021-45078":{"description":"stab_xcoff_builtin_type in stabs.c in GNU Binutils through 2.37 allows attackers to cause a denial of service (heap-based buffer overflow) or possibly have unspecified other impact, as demonstrated by an out-of-bounds write. NOTE: this issue exists because of an incorrect fix for CVE-2018-12699.","scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"2.40-2"},"fixed_version":"2.37.50.20220106-1","urgency":"unimportant"},"bullseye":{"status":"open","repositories":{"bullseye":"2.35.2-2"},"urgency":"unimportant"},"forky":{"status":"resolved","repositories":{"forky":"2.46-3"},"fixed_version":"2.37.50.20220106-1","urgency":"unimportant"},"sid":{"status":"resolved","repositories":{"sid":"2.46-3"},"fixed_version":"2.37.50.20220106-1","urgency":"unimportant"},"trixie":{"status":"resolved","repositories":{"trixie":"2.44-3"},"fixed_version":"2.37.50.20220106-1","urgency":"unimportant"}}},"CVE-2021-46174":{"description":"Heap-based Buffer Overflow in function bfd_getl32 in Binutils objdump 3.37.","scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"2.40-2"},"fixed_version":"2.37.90.20220207-1","urgency":"unimportant"},"bullseye":{"status":"open","repositories":{"bullseye":"2.35.2-2"},"urgency":"unimportant"},"forky":{"status":"resolved","repositories":{"forky":"2.46-3"},"fixed_version":"2.37.90.20220207-1","urgency":"unimportant"},"sid":{"status":"resolved","repositories":{"sid":"2.46-3"},"fixed_version":"2.37.90.20220207-1","urgency":"unimportant"},"trixie":{"status":"resolved","repositories":{"trixie":"2.44-3"},"fixed_version":"2.37.90.20220207-1","urgency":"unimportant"}}},"CVE-2021-46195":{"description":"GCC v12.0 was discovered to contain an uncontrolled recursion via the component libiberty/rust-demangle.c. This vulnerability allows attackers to cause a Denial of Service (DoS) by consuming excessive CPU and memory resources.","scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"2.40-2"},"fixed_version":"2.37.90.20220207-1","urgency":"unimportant"},"bullseye":{"status":"open","repositories":{"bullseye":"2.35.2-2"},"urgency":"unimportant"},"forky":{"status":"resolved","repositories":{"forky":"2.46-3"},"fixed_version":"2.37.90.20220207-1","urgency":"unimportant"},"sid":{"status":"resolved","repositories":{"sid":"2.46-3"},"fixed_version":"2.37.90.20220207-1","urgency":"unimportant"},"trixie":{"status":"resolved","repositories":{"trixie":"2.44-3"},"fixed_version":"2.37.90.20220207-1","urgency":"unimportant"}}},"CVE-2022-35205":{"description":"An issue was discovered in Binutils readelf 2.38.50, reachable assertion failure in function display_debug_names allows attackers to cause a denial of service.","scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"2.40-2"},"fixed_version":"2.38.50.20220627-1","urgency":"unimportant"},"bullseye":{"status":"open","repositories":{"bullseye":"2.35.2-2"},"urgency":"unimportant"},"forky":{"status":"resolved","repositories":{"forky":"2.46-3"},"fixed_version":"2.38.50.20220627-1","urgency":"unimportant"},"sid":{"status":"resolved","repositories":{"sid":"2.46-3"},"fixed_version":"2.38.50.20220627-1","urgency":"unimportant"},"trixie":{"status":"resolved","repositories":{"trixie":"2.44-3"},"fixed_version":"2.38.50.20220627-1","urgency":"unimportant"}}},"CVE-2022-35206":{"description":"Null pointer dereference vulnerability in Binutils readelf 2.38.50 via function read_and_display_attr_value in file dwarf.c.","scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"2.40-2"},"fixed_version":"2.38.50.20220627-1","urgency":"unimportant"},"bullseye":{"status":"open","repositories":{"bullseye":"2.35.2-2"},"urgency":"unimportant"},"forky":{"status":"resolved","repositories":{"forky":"2.46-3"},"fixed_version":"2.38.50.20220627-1","urgency":"unimportant"},"sid":{"status":"resolved","repositories":{"sid":"2.46-3"},"fixed_version":"2.38.50.20220627-1","urgency":"unimportant"},"trixie":{"status":"resolved","repositories":{"trixie":"2.44-3"},"fixed_version":"2.38.50.20220627-1","urgency":"unimportant"}}},"CVE-2022-38533":{"description":"In GNU Binutils before 2.40, there is a heap-buffer-overflow in the error function bfd_getl32 when called from the strip_main function in strip-new via a crafted file.","scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"2.40-2"},"fixed_version":"2.39.50.20221208-2","urgency":"unimportant"},"bullseye":{"status":"open","repositories":{"bullseye":"2.35.2-2"},"urgency":"unimportant"},"forky":{"status":"resolved","repositories":{"forky":"2.46-3"},"fixed_version":"2.39.50.20221208-2","urgency":"unimportant"},"sid":{"status":"resolved","repositories":{"sid":"2.46-3"},"fixed_version":"2.39.50.20221208-2","urgency":"unimportant"},"trixie":{"status":"resolved","repositories":{"trixie":"2.44-3"},"fixed_version":"2.39.50.20221208-2","urgency":"unimportant"}}},"CVE-2022-4285":{"description":"An illegal memory access flaw was found in the binutils package. Parsing an ELF file containing corrupt symbol version information may result in a denial of service. This issue is the result of an incomplete fix for CVE-2020-16599.","scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"2.40-2"},"fixed_version":"2.39.50.20221208-2","urgency":"unimportant"},"bullseye":{"status":"open","repositories":{"bullseye":"2.35.2-2"},"urgency":"unimportant"},"forky":{"status":"resolved","repositories":{"forky":"2.46-3"},"fixed_version":"2.39.50.20221208-2","urgency":"unimportant"},"sid":{"status":"resolved","repositories":{"sid":"2.46-3"},"fixed_version":"2.39.50.20221208-2","urgency":"unimportant"},"trixie":{"status":"resolved","repositories":{"trixie":"2.44-3"},"fixed_version":"2.39.50.20221208-2","urgency":"unimportant"}}},"CVE-2022-44840":{"description":"Heap buffer overflow vulnerability in binutils readelf before 2.40 via function find_section_in_set in file readelf.c.","scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"2.40-2"},"fixed_version":"2.40-2","urgency":"unimportant"},"bullseye":{"status":"open","repositories":{"bullseye":"2.35.2-2"},"urgency":"unimportant"},"forky":{"status":"resolved","repositories":{"forky":"2.46-3"},"fixed_version":"2.40-2","urgency":"unimportant"},"sid":{"status":"resolved","repositories":{"sid":"2.46-3"},"fixed_version":"2.40-2","urgency":"unimportant"},"trixie":{"status":"resolved","repositories":{"trixie":"2.44-3"},"fixed_version":"2.40-2","urgency":"unimportant"}}},"CVE-2022-45703":{"description":"Heap buffer overflow vulnerability in binutils readelf before 2.40 via function display_debug_section in file readelf.c.","scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"2.40-2"},"fixed_version":"2.40-2","urgency":"unimportant"},"bullseye":{"status":"open","repositories":{"bullseye":"2.35.2-2"},"urgency":"unimportant"},"forky":{"status":"resolved","repositories":{"forky":"2.46-3"},"fixed_version":"2.40-2","urgency":"unimportant"},"sid":{"status":"resolved","repositories":{"sid":"2.46-3"},"fixed_version":"2.40-2","urgency":"unimportant"},"trixie":{"status":"resolved","repositories":{"trixie":"2.44-3"},"fixed_version":"2.40-2","urgency":"unimportant"}}},"CVE-2022-47007":{"description":"An issue was discovered function stab_demangle_v3_arg in stabs.c in Binutils 2.34 thru 2.38, allows attackers to cause a denial of service due to memory leaks.","scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"2.40-2"},"fixed_version":"2.38.50.20220627-1","urgency":"unimportant"},"bullseye":{"status":"open","repositories":{"bullseye":"2.35.2-2"},"urgency":"unimportant"},"forky":{"status":"resolved","repositories":{"forky":"2.46-3"},"fixed_version":"2.38.50.20220627-1","urgency":"unimportant"},"sid":{"status":"resolved","repositories":{"sid":"2.46-3"},"fixed_version":"2.38.50.20220627-1","urgency":"unimportant"},"trixie":{"status":"resolved","repositories":{"trixie":"2.44-3"},"fixed_version":"2.38.50.20220627-1","urgency":"unimportant"}}},"CVE-2022-47008":{"description":"An issue was discovered function make_tempdir, and make_tempname in bucomm.c in Binutils 2.34 thru 2.38, allows attackers to cause a denial of service due to memory leaks.","scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"2.40-2"},"fixed_version":"2.38.50.20220627-1","urgency":"unimportant"},"bullseye":{"status":"open","repositories":{"bullseye":"2.35.2-2"},"urgency":"unimportant"},"forky":{"status":"resolved","repositories":{"forky":"2.46-3"},"fixed_version":"2.38.50.20220627-1","urgency":"unimportant"},"sid":{"status":"resolved","repositories":{"sid":"2.46-3"},"fixed_version":"2.38.50.20220627-1","urgency":"unimportant"},"trixie":{"status":"resolved","repositories":{"trixie":"2.44-3"},"fixed_version":"2.38.50.20220627-1","urgency":"unimportant"}}},"CVE-2022-47010":{"description":"An issue was discovered function pr_function_type in prdbg.c in Binutils 2.34 thru 2.38, allows attackers to cause a denial of service due to memory leaks.","scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"2.40-2"},"fixed_version":"2.38.50.20220627-1","urgency":"unimportant"},"bullseye":{"status":"open","repositories":{"bullseye":"2.35.2-2"},"urgency":"unimportant"},"forky":{"status":"resolved","repositories":{"forky":"2.46-3"},"fixed_version":"2.38.50.20220627-1","urgency":"unimportant"},"sid":{"status":"resolved","repositories":{"sid":"2.46-3"},"fixed_version":"2.38.50.20220627-1","urgency":"unimportant"},"trixie":{"status":"resolved","repositories":{"trixie":"2.44-3"},"fixed_version":"2.38.50.20220627-1","urgency":"unimportant"}}},"CVE-2022-47011":{"description":"An issue was discovered function parse_stab_struct_fields in stabs.c in Binutils 2.34 thru 2.38, allows attackers to cause a denial of service due to memory leaks.","scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"2.40-2"},"fixed_version":"2.38.50.20220627-1","urgency":"unimportant"},"bullseye":{"status":"open","repositories":{"bullseye":"2.35.2-2"},"urgency":"unimportant"},"forky":{"status":"resolved","repositories":{"forky":"2.46-3"},"fixed_version":"2.38.50.20220627-1","urgency":"unimportant"},"sid":{"status":"resolved","repositories":{"sid":"2.46-3"},"fixed_version":"2.38.50.20220627-1","urgency":"unimportant"},"trixie":{"status":"resolved","repositories":{"trixie":"2.44-3"},"fixed_version":"2.38.50.20220627-1","urgency":"unimportant"}}},"CVE-2022-47673":{"description":"An issue was discovered in Binutils addr2line before 2.39.3, function parse_module contains multiple out of bound reads which may cause a denial of service or other unspecified impacts.","scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"2.40-2"},"fixed_version":"2.39.50.20221224-1","urgency":"unimportant"},"bullseye":{"status":"open","repositories":{"bullseye":"2.35.2-2"},"urgency":"unimportant"},"forky":{"status":"resolved","repositories":{"forky":"2.46-3"},"fixed_version":"2.39.50.20221224-1","urgency":"unimportant"},"sid":{"status":"resolved","repositories":{"sid":"2.46-3"},"fixed_version":"2.39.50.20221224-1","urgency":"unimportant"},"trixie":{"status":"resolved","repositories":{"trixie":"2.44-3"},"fixed_version":"2.39.50.20221224-1","urgency":"unimportant"}}},"CVE-2022-47695":{"description":"An issue was discovered Binutils objdump before 2.39.3 allows attackers to cause a denial of service or other unspecified impacts via function bfd_mach_o_get_synthetic_symtab in match-o.c.","scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"2.40-2"},"fixed_version":"2.39.50.20221208-2","urgency":"unimportant"},"bullseye":{"status":"open","repositories":{"bullseye":"2.35.2-2"},"urgency":"unimportant"},"forky":{"status":"resolved","repositories":{"forky":"2.46-3"},"fixed_version":"2.39.50.20221208-2","urgency":"unimportant"},"sid":{"status":"resolved","repositories":{"sid":"2.46-3"},"fixed_version":"2.39.50.20221208-2","urgency":"unimportant"},"trixie":{"status":"resolved","repositories":{"trixie":"2.44-3"},"fixed_version":"2.39.50.20221208-2","urgency":"unimportant"}}},"CVE-2022-47696":{"description":"An issue was discovered Binutils objdump before 2.39.3 allows attackers to cause a denial of service or other unspecified impacts via function compare_symbols.","scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"2.40-2"},"fixed_version":"2.39.50.20221208-2","urgency":"unimportant"},"bullseye":{"status":"open","repositories":{"bullseye":"2.35.2-2"},"urgency":"unimportant"},"forky":{"status":"resolved","repositories":{"forky":"2.46-3"},"fixed_version":"2.39.50.20221208-2","urgency":"unimportant"},"sid":{"status":"resolved","repositories":{"sid":"2.46-3"},"fixed_version":"2.39.50.20221208-2","urgency":"unimportant"},"trixie":{"status":"resolved","repositories":{"trixie":"2.44-3"},"fixed_version":"2.39.50.20221208-2","urgency":"unimportant"}}},"CVE-2022-48063":{"description":"GNU Binutils before 2.40 was discovered to contain an excessive memory consumption vulnerability via the function load_separate_debug_files at dwarf2.c. The attacker could supply a crafted ELF file and cause a DNS attack.","scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"2.40-2"},"fixed_version":"2.40-2","urgency":"unimportant"},"bullseye":{"status":"open","repositories":{"bullseye":"2.35.2-2"},"urgency":"unimportant"},"forky":{"status":"resolved","repositories":{"forky":"2.46-3"},"fixed_version":"2.40-2","urgency":"unimportant"},"sid":{"status":"resolved","repositories":{"sid":"2.46-3"},"fixed_version":"2.40-2","urgency":"unimportant"},"trixie":{"status":"resolved","repositories":{"trixie":"2.44-3"},"fixed_version":"2.40-2","urgency":"unimportant"}}},"CVE-2022-48064":{"description":"GNU Binutils before 2.40 was discovered to contain an excessive memory consumption vulnerability via the function bfd_dwarf2_find_nearest_line_with_alt at dwarf2.c. The attacker could supply a crafted ELF file and cause a DNS attack.","scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"2.40-2"},"fixed_version":"2.40-2","urgency":"unimportant"},"bullseye":{"status":"open","repositories":{"bullseye":"2.35.2-2"},"urgency":"unimportant"},"forky":{"status":"resolved","repositories":{"forky":"2.46-3"},"fixed_version":"2.40-2","urgency":"unimportant"},"sid":{"status":"resolved","repositories":{"sid":"2.46-3"},"fixed_version":"2.40-2","urgency":"unimportant"},"trixie":{"status":"resolved","repositories":{"trixie":"2.44-3"},"fixed_version":"2.40-2","urgency":"unimportant"}}},"CVE-2022-48065":{"description":"GNU Binutils before 2.40 was discovered to contain a memory leak vulnerability var the function find_abstract_instance in dwarf2.c.","scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"2.40-2"},"fixed_version":"2.40-2","urgency":"unimportant"},"bullseye":{"status":"open","repositories":{"bullseye":"2.35.2-2"},"urgency":"unimportant"},"forky":{"status":"resolved","repositories":{"forky":"2.46-3"},"fixed_version":"2.40-2","urgency":"unimportant"},"sid":{"status":"resolved","repositories":{"sid":"2.46-3"},"fixed_version":"2.40-2","urgency":"unimportant"},"trixie":{"status":"resolved","repositories":{"trixie":"2.44-3"},"fixed_version":"2.40-2","urgency":"unimportant"}}},"CVE-2023-1579":{"description":"Heap based buffer overflow in binutils-gdb/bfd/libbfd.c in bfd_getl64.","scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"2.40-2"},"fixed_version":"2.40-2","urgency":"unimportant"},"bullseye":{"status":"open","repositories":{"bullseye":"2.35.2-2"},"urgency":"unimportant"},"forky":{"status":"resolved","repositories":{"forky":"2.46-3"},"fixed_version":"2.40-2","urgency":"unimportant"},"sid":{"status":"resolved","repositories":{"sid":"2.46-3"},"fixed_version":"2.40-2","urgency":"unimportant"},"trixie":{"status":"resolved","repositories":{"trixie":"2.44-3"},"fixed_version":"2.40-2","urgency":"unimportant"}}},"CVE-2023-1972":{"description":"A potential heap based buffer overflow was found in _bfd_elf_slurp_version_tables() in bfd/elf.c. This may lead to loss of availability.","scope":"local","releases":{"bookworm":{"status":"open","repositories":{"bookworm":"2.40-2"},"urgency":"unimportant"},"bullseye":{"status":"open","repositories":{"bullseye":"2.35.2-2"},"urgency":"unimportant"},"forky":{"status":"resolved","repositories":{"forky":"2.46-3"},"fixed_version":"2.41-1","urgency":"unimportant"},"sid":{"status":"resolved","repositories":{"sid":"2.46-3"},"fixed_version":"2.41-1","urgency":"unimportant"},"trixie":{"status":"resolved","repositories":{"trixie":"2.44-3"},"fixed_version":"2.41-1","urgency":"unimportant"}}},"CVE-2023-25584":{"description":"An out-of-bounds read flaw was found in the parse_module function in bfd/vms-alpha.c in Binutils.","scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"2.40-2"},"fixed_version":"2.39.50.20221224-1","urgency":"unimportant"},"bullseye":{"status":"open","repositories":{"bullseye":"2.35.2-2"},"urgency":"unimportant"},"forky":{"status":"resolved","repositories":{"forky":"2.46-3"},"fixed_version":"2.39.50.20221224-1","urgency":"unimportant"},"sid":{"status":"resolved","repositories":{"sid":"2.46-3"},"fixed_version":"2.39.50.20221224-1","urgency":"unimportant"},"trixie":{"status":"resolved","repositories":{"trixie":"2.44-3"},"fixed_version":"2.39.50.20221224-1","urgency":"unimportant"}}},"CVE-2023-25585":{"description":"A flaw was found in Binutils. The use of an uninitialized field in the struct module *module may lead to application crash and local denial of service.","scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"2.40-2"},"fixed_version":"2.39.50.20221224-1","urgency":"unimportant"},"bullseye":{"status":"open","repositories":{"bullseye":"2.35.2-2"},"urgency":"unimportant"},"forky":{"status":"resolved","repositories":{"forky":"2.46-3"},"fixed_version":"2.39.50.20221224-1","urgency":"unimportant"},"sid":{"status":"resolved","repositories":{"sid":"2.46-3"},"fixed_version":"2.39.50.20221224-1","urgency":"unimportant"},"trixie":{"status":"resolved","repositories":{"trixie":"2.44-3"},"fixed_version":"2.39.50.20221224-1","urgency":"unimportant"}}},"CVE-2023-25586":{"description":"A flaw was found in Binutils. A logic fail in the bfd_init_section_decompress_status function may lead to the use of an uninitialized variable that can cause a crash and local denial of service.","scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"2.40-2"},"fixed_version":"2.39.50.20221208-1","urgency":"unimportant"},"bullseye":{"status":"open","repositories":{"bullseye":"2.35.2-2"},"urgency":"unimportant"},"forky":{"status":"resolved","repositories":{"forky":"2.46-3"},"fixed_version":"2.39.50.20221208-1","urgency":"unimportant"},"sid":{"status":"resolved","repositories":{"sid":"2.46-3"},"fixed_version":"2.39.50.20221208-1","urgency":"unimportant"},"trixie":{"status":"resolved","repositories":{"trixie":"2.44-3"},"fixed_version":"2.39.50.20221208-1","urgency":"unimportant"}}},"CVE-2023-25588":{"description":"A flaw was found in Binutils. The field `the_bfd` of `asymbol`struct is uninitialized in the `bfd_mach_o_get_synthetic_symtab` function, which may lead to an application crash and local denial of service.","scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"2.40-2"},"fixed_version":"2.39.50.20221208-1","urgency":"unimportant"},"bullseye":{"status":"open","repositories":{"bullseye":"2.35.2-2"},"urgency":"unimportant"},"forky":{"status":"resolved","repositories":{"forky":"2.46-3"},"fixed_version":"2.39.50.20221208-1","urgency":"unimportant"},"sid":{"status":"resolved","repositories":{"sid":"2.46-3"},"fixed_version":"2.39.50.20221208-1","urgency":"unimportant"},"trixie":{"status":"resolved","repositories":{"trixie":"2.44-3"},"fixed_version":"2.39.50.20221208-1","urgency":"unimportant"}}},"CVE-2024-53589":{"description":"GNU objdump 2.43 is vulnerable to Buffer Overflow in the BFD (Binary File Descriptor) library's handling of tekhex format files.","scope":"local","releases":{"bookworm":{"status":"open","repositories":{"bookworm":"2.40-2"},"urgency":"unimportant"},"bullseye":{"status":"open","repositories":{"bullseye":"2.35.2-2"},"urgency":"unimportant"},"forky":{"status":"resolved","repositories":{"forky":"2.46-3"},"fixed_version":"2.44-1","urgency":"unimportant"},"sid":{"status":"resolved","repositories":{"sid":"2.46-3"},"fixed_version":"2.44-1","urgency":"unimportant"},"trixie":{"status":"resolved","repositories":{"trixie":"2.44-3"},"fixed_version":"2.44-1","urgency":"unimportant"}}},"CVE-2024-57360":{"description":"https://www.gnu.org/software/binutils/ nm >=2.43 is affected by: Incorrect Access Control. The type of exploitation is: local. The component is: `nm --without-symbol-version` function.","scope":"local","releases":{"bookworm":{"status":"open","repositories":{"bookworm":"2.40-2"},"urgency":"unimportant"},"bullseye":{"status":"open","repositories":{"bullseye":"2.35.2-2"},"urgency":"unimportant"},"forky":{"status":"resolved","repositories":{"forky":"2.46-3"},"fixed_version":"2.43.50.20241221-1","urgency":"unimportant"},"sid":{"status":"resolved","repositories":{"sid":"2.46-3"},"fixed_version":"2.43.50.20241221-1","urgency":"unimportant"},"trixie":{"status":"resolved","repositories":{"trixie":"2.44-3"},"fixed_version":"2.43.50.20241221-1","urgency":"unimportant"}}},"CVE-2025-0840":{"description":"A vulnerability, which was classified as problematic, was found in GNU Binutils up to 2.43. This affects the function disassemble_bytes of the file binutils/objdump.c. The manipulation of the argument buf leads to stack-based buffer overflow. It is possible to initiate the attack remotely. The complexity of an attack is rather high. The exploitability is told to be difficult. The exploit has been disclosed to the public and may be used. Upgrading to version 2.44 is able to address this issue. The identifier of the patch is baac6c221e9d69335bf41366a1c7d87d8ab2f893. It is recommended to upgrade the affected component.","scope":"local","releases":{"bookworm":{"status":"open","repositories":{"bookworm":"2.40-2"},"urgency":"unimportant"},"bullseye":{"status":"open","repositories":{"bullseye":"2.35.2-2"},"urgency":"unimportant"},"forky":{"status":"resolved","repositories":{"forky":"2.46-3"},"fixed_version":"2.43.90.20250122-1","urgency":"unimportant"},"sid":{"status":"resolved","repositories":{"sid":"2.46-3"},"fixed_version":"2.43.90.20250122-1","urgency":"unimportant"},"trixie":{"status":"resolved","repositories":{"trixie":"2.44-3"},"fixed_version":"2.43.90.20250122-1","urgency":"unimportant"}}},"CVE-2025-11081":{"description":"A vulnerability was detected in GNU Binutils 2.45. This issue affects the function dump_dwarf_section of the file binutils/objdump.c. Performing manipulation results in out-of-bounds read. The attack is only possible with local access. The exploit is now public and may be used. The patch is named f87a66db645caf8cc0e6fc87b0c28c78a38af59b. It is suggested to install a patch to address this issue.","scope":"local","releases":{"bookworm":{"status":"open","repositories":{"bookworm":"2.40-2"},"urgency":"unimportant"},"bullseye":{"status":"open","repositories":{"bullseye":"2.35.2-2"},"urgency":"unimportant"},"forky":{"status":"resolved","repositories":{"forky":"2.46-3"},"fixed_version":"2.46-1","urgency":"unimportant"},"sid":{"status":"resolved","repositories":{"sid":"2.46-3"},"fixed_version":"2.46-1","urgency":"unimportant"},"trixie":{"status":"open","repositories":{"trixie":"2.44-3"},"urgency":"unimportant"}}},"CVE-2025-11082":{"description":"A flaw has been found in GNU Binutils 2.45. Impacted is the function _bfd_elf_parse_eh_frame of the file bfd/elf-eh-frame.c of the component Linker. Executing manipulation can lead to heap-based buffer overflow. The attack is restricted to local execution. The exploit has been published and may be used. This patch is called ea1a0737c7692737a644af0486b71e4a392cbca8. A patch should be applied to remediate this issue. The code maintainer replied with \"[f]ixed for 2.46\".","scope":"local","releases":{"bookworm":{"status":"open","repositories":{"bookworm":"2.40-2"},"urgency":"unimportant"},"bullseye":{"status":"open","repositories":{"bullseye":"2.35.2-2"},"urgency":"unimportant"},"forky":{"status":"resolved","repositories":{"forky":"2.46-3"},"fixed_version":"2.46-1","urgency":"unimportant"},"sid":{"status":"resolved","repositories":{"sid":"2.46-3"},"fixed_version":"2.46-1","urgency":"unimportant"},"trixie":{"status":"open","repositories":{"trixie":"2.44-3"},"urgency":"unimportant"}}},"CVE-2025-11083":{"description":"A vulnerability has been found in GNU Binutils 2.45. The affected element is the function elf_swap_shdr in the library bfd/elfcode.h of the component Linker. The manipulation leads to heap-based buffer overflow. The attack must be carried out locally. The exploit has been disclosed to the public and may be used. The identifier of the patch is 9ca499644a21ceb3f946d1c179c38a83be084490. To fix this issue, it is recommended to deploy a patch. The code maintainer replied with \"[f]ixed for 2.46\".","scope":"local","releases":{"bookworm":{"status":"open","repositories":{"bookworm":"2.40-2"},"urgency":"unimportant"},"bullseye":{"status":"open","repositories":{"bullseye":"2.35.2-2"},"urgency":"unimportant"},"forky":{"status":"resolved","repositories":{"forky":"2.46-3"},"fixed_version":"2.46-1","urgency":"unimportant"},"sid":{"status":"resolved","repositories":{"sid":"2.46-3"},"fixed_version":"2.46-1","urgency":"unimportant"},"trixie":{"status":"open","repositories":{"trixie":"2.44-3"},"urgency":"unimportant"}}},"CVE-2025-11412":{"description":"A vulnerability has been found in GNU Binutils 2.45. This impacts the function bfd_elf_gc_record_vtentry of the file bfd/elflink.c of the component Linker. The manipulation leads to out-of-bounds read. Local access is required to approach this attack. The exploit has been disclosed to the public and may be used. The identifier of the patch is 047435dd988a3975d40c6626a8f739a0b2e154bc. To fix this issue, it is recommended to deploy a patch.","scope":"local","releases":{"bookworm":{"status":"open","repositories":{"bookworm":"2.40-2"},"urgency":"unimportant"},"bullseye":{"status":"open","repositories":{"bullseye":"2.35.2-2"},"urgency":"unimportant"},"forky":{"status":"resolved","repositories":{"forky":"2.46-3"},"fixed_version":"2.46-1","urgency":"unimportant"},"sid":{"status":"resolved","repositories":{"sid":"2.46-3"},"fixed_version":"2.46-1","urgency":"unimportant"},"trixie":{"status":"open","repositories":{"trixie":"2.44-3"},"urgency":"unimportant"}}},"CVE-2025-11413":{"description":"A vulnerability was found in GNU Binutils 2.45. Affected is the function elf_link_add_object_symbols of the file bfd/elflink.c of the component Linker. The manipulation results in out-of-bounds read. The attack needs to be approached locally. The exploit has been made public and could be used. Upgrading to version 2.46 is able to address this issue. The patch is identified as 72efdf166aa0ed72ecc69fc2349af6591a7a19c0. Upgrading the affected component is advised.","scope":"local","releases":{"bookworm":{"status":"open","repositories":{"bookworm":"2.40-2"},"urgency":"unimportant"},"bullseye":{"status":"open","repositories":{"bullseye":"2.35.2-2"},"urgency":"unimportant"},"forky":{"status":"resolved","repositories":{"forky":"2.46-3"},"fixed_version":"2.46-1","urgency":"unimportant"},"sid":{"status":"resolved","repositories":{"sid":"2.46-3"},"fixed_version":"2.46-1","urgency":"unimportant"},"trixie":{"status":"open","repositories":{"trixie":"2.44-3"},"urgency":"unimportant"}}},"CVE-2025-11414":{"description":"A vulnerability was determined in GNU Binutils 2.45. Affected by this vulnerability is the function get_link_hash_entry of the file bfd/elflink.c of the component Linker. This manipulation causes out-of-bounds read. The attack can only be executed locally. The exploit has been publicly disclosed and may be utilized. Upgrading to version 2.46 addresses this issue. Patch name: aeaaa9af6359c8e394ce9cf24911fec4f4d23703. It is advisable to upgrade the affected component.","scope":"local","releases":{"bookworm":{"status":"open","repositories":{"bookworm":"2.40-2"},"urgency":"unimportant"},"bullseye":{"status":"open","repositories":{"bullseye":"2.35.2-2"},"urgency":"unimportant"},"forky":{"status":"resolved","repositories":{"forky":"2.46-3"},"fixed_version":"2.46-1","urgency":"unimportant"},"sid":{"status":"resolved","repositories":{"sid":"2.46-3"},"fixed_version":"2.46-1","urgency":"unimportant"},"trixie":{"status":"open","repositories":{"trixie":"2.44-3"},"urgency":"unimportant"}}},"CVE-2025-1147":{"description":"A vulnerability has been found in GNU Binutils 2.43 and classified as problematic. Affected by this vulnerability is the function __sanitizer::internal_strlen of the file binutils/nm.c of the component nm. The manipulation of the argument const leads to buffer overflow. The attack can be launched remotely. The complexity of an attack is rather high. The exploitation appears to be difficult. The exploit has been disclosed to the public and may be used.","scope":"local","releases":{"bookworm":{"status":"open","repositories":{"bookworm":"2.40-2"},"urgency":"unimportant"},"bullseye":{"status":"open","repositories":{"bullseye":"2.35.2-2"},"urgency":"unimportant"},"forky":{"status":"resolved","repositories":{"forky":"2.46-3"},"fixed_version":"2.45-3","urgency":"unimportant"},"sid":{"status":"resolved","repositories":{"sid":"2.46-3"},"fixed_version":"2.45-3","urgency":"unimportant"},"trixie":{"status":"open","repositories":{"trixie":"2.44-3"},"urgency":"unimportant"}}},"CVE-2025-1148":{"description":"A vulnerability was found in GNU Binutils 2.43 and classified as problematic. Affected by this issue is the function link_order_scan of the file ld/ldelfgen.c of the component ld. The manipulation leads to memory leak. The attack may be launched remotely. The complexity of an attack is rather high. The exploitation is known to be difficult. The exploit has been disclosed to the public and may be used. It is recommended to apply a patch to fix this issue. The code maintainer explains: \"I'm not going to commit some of the leak fixes I've been working on to the 2.44 branch due to concern that would destabilise ld. All of the reported leaks in this bugzilla have been fixed on binutils master.\"","scope":"local","releases":{"bookworm":{"status":"open","repositories":{"bookworm":"2.40-2"},"urgency":"unimportant"},"bullseye":{"status":"open","repositories":{"bullseye":"2.35.2-2"},"urgency":"unimportant"},"forky":{"status":"resolved","repositories":{"forky":"2.46-3"},"fixed_version":"2.45-3","urgency":"unimportant"},"sid":{"status":"resolved","repositories":{"sid":"2.46-3"},"fixed_version":"2.45-3","urgency":"unimportant"},"trixie":{"status":"open","repositories":{"trixie":"2.44-3"},"urgency":"unimportant"}}},"CVE-2025-1149":{"description":"A vulnerability was found in GNU Binutils 2.43. It has been classified as problematic. This affects the function xstrdup of the file libiberty/xmalloc.c of the component ld. The manipulation leads to memory leak. It is possible to initiate the attack remotely. The complexity of an attack is rather high. The exploitability is told to be difficult. The exploit has been disclosed to the public and may be used. It is recommended to apply a patch to fix this issue. The code maintainer explains: \"I'm not going to commit some of the leak fixes I've been working on to the 2.44 branch due to concern that would destabilise ld. All of the reported leaks in this bugzilla have been fixed on binutils master.\"","scope":"local","releases":{"bookworm":{"status":"open","repositories":{"bookworm":"2.40-2"},"urgency":"unimportant"},"bullseye":{"status":"open","repositories":{"bullseye":"2.35.2-2"},"urgency":"unimportant"},"forky":{"status":"resolved","repositories":{"forky":"2.46-3"},"fixed_version":"2.45-3","urgency":"unimportant"},"sid":{"status":"resolved","repositories":{"sid":"2.46-3"},"fixed_version":"2.45-3","urgency":"unimportant"},"trixie":{"status":"open","repositories":{"trixie":"2.44-3"},"urgency":"unimportant"}}},"CVE-2025-11494":{"description":"A vulnerability was found in GNU Binutils 2.45. Impacted is the function _bfd_x86_elf_late_size_sections of the file bfd/elfxx-x86.c of the component Linker. The manipulation results in out-of-bounds read. The attack needs to be approached locally. The exploit has been made public and could be used. The patch is identified as b6ac5a8a5b82f0ae6a4642c8d7149b325f4cc60a. A patch should be applied to remediate this issue.","scope":"local","releases":{"bookworm":{"status":"open","repositories":{"bookworm":"2.40-2"},"urgency":"unimportant"},"bullseye":{"status":"open","repositories":{"bullseye":"2.35.2-2"},"urgency":"unimportant"},"forky":{"status":"resolved","repositories":{"forky":"2.46-3"},"fixed_version":"2.46-1","urgency":"unimportant"},"sid":{"status":"resolved","repositories":{"sid":"2.46-3"},"fixed_version":"2.46-1","urgency":"unimportant"},"trixie":{"status":"open","repositories":{"trixie":"2.44-3"},"urgency":"unimportant"}}},"CVE-2025-11495":{"description":"A vulnerability was determined in GNU Binutils 2.45. The affected element is the function elf_x86_64_relocate_section of the file elf64-x86-64.c of the component Linker. This manipulation causes heap-based buffer overflow. The attack can only be executed locally. The exploit has been publicly disclosed and may be utilized. Patch name: 6b21c8b2ecfef5c95142cbc2c32f185cb1c26ab0. To fix this issue, it is recommended to deploy a patch.","scope":"local","releases":{"bookworm":{"status":"open","repositories":{"bookworm":"2.40-2"},"urgency":"unimportant"},"bullseye":{"status":"open","repositories":{"bullseye":"2.35.2-2"},"urgency":"unimportant"},"forky":{"status":"resolved","repositories":{"forky":"2.46-3"},"fixed_version":"2.46-1","urgency":"unimportant"},"sid":{"status":"resolved","repositories":{"sid":"2.46-3"},"fixed_version":"2.46-1","urgency":"unimportant"},"trixie":{"status":"open","repositories":{"trixie":"2.44-3"},"urgency":"unimportant"}}},"CVE-2025-1150":{"description":"A vulnerability was found in GNU Binutils 2.43. It has been declared as problematic. This vulnerability affects the function bfd_malloc of the file libbfd.c of the component ld. The manipulation leads to memory leak. The attack can be initiated remotely. The complexity of an attack is rather high. The exploitation appears to be difficult. The exploit has been disclosed to the public and may be used. It is recommended to apply a patch to fix this issue. The code maintainer explains: \"I'm not going to commit some of the leak fixes I've been working on to the 2.44 branch due to concern that would destabilise ld. All of the reported leaks in this bugzilla have been fixed on binutils master.\"","scope":"local","releases":{"bookworm":{"status":"open","repositories":{"bookworm":"2.40-2"},"urgency":"unimportant"},"bullseye":{"status":"open","repositories":{"bullseye":"2.35.2-2"},"urgency":"unimportant"},"forky":{"status":"resolved","repositories":{"forky":"2.46-3"},"fixed_version":"2.45-3","urgency":"unimportant"},"sid":{"status":"resolved","repositories":{"sid":"2.46-3"},"fixed_version":"2.45-3","urgency":"unimportant"},"trixie":{"status":"open","repositories":{"trixie":"2.44-3"},"urgency":"unimportant"}}},"CVE-2025-1151":{"description":"A vulnerability was found in GNU Binutils 2.43. It has been rated as problematic. This issue affects the function xmemdup of the file xmemdup.c of the component ld. The manipulation leads to memory leak. The attack may be initiated remotely. The complexity of an attack is rather high. The exploitation is known to be difficult. The exploit has been disclosed to the public and may be used. It is recommended to apply a patch to fix this issue. The code maintainer explains: \"I'm not going to commit some of the leak fixes I've been working on to the 2.44 branch due to concern that would destabilise ld. All of the reported leaks in this bugzilla have been fixed on binutils master.\"","scope":"local","releases":{"bookworm":{"status":"open","repositories":{"bookworm":"2.40-2"},"urgency":"unimportant"},"bullseye":{"status":"open","repositories":{"bullseye":"2.35.2-2"},"urgency":"unimportant"},"forky":{"status":"resolved","repositories":{"forky":"2.46-3"},"fixed_version":"2.45-3","urgency":"unimportant"},"sid":{"status":"resolved","repositories":{"sid":"2.46-3"},"fixed_version":"2.45-3","urgency":"unimportant"},"trixie":{"status":"open","repositories":{"trixie":"2.44-3"},"urgency":"unimportant"}}},"CVE-2025-1152":{"description":"A vulnerability classified as problematic has been found in GNU Binutils 2.43. Affected is the function xstrdup of the file xstrdup.c of the component ld. The manipulation leads to memory leak. It is possible to launch the attack remotely. The complexity of an attack is rather high. The exploitability is told to be difficult. The exploit has been disclosed to the public and may be used. It is recommended to apply a patch to fix this issue. The code maintainer explains: \"I'm not going to commit some of the leak fixes I've been working on to the 2.44 branch due to concern that would destabilise ld. All of the reported leaks in this bugzilla have been fixed on binutils master.\"","scope":"local","releases":{"bookworm":{"status":"open","repositories":{"bookworm":"2.40-2"},"urgency":"unimportant"},"bullseye":{"status":"open","repositories":{"bullseye":"2.35.2-2"},"urgency":"unimportant"},"forky":{"status":"resolved","repositories":{"forky":"2.46-3"},"fixed_version":"2.45-3","urgency":"unimportant"},"sid":{"status":"resolved","repositories":{"sid":"2.46-3"},"fixed_version":"2.45-3","urgency":"unimportant"},"trixie":{"status":"open","repositories":{"trixie":"2.44-3"},"urgency":"unimportant"}}},"CVE-2025-1153":{"description":"A vulnerability classified as problematic was found in GNU Binutils 2.43/2.44. Affected by this vulnerability is the function bfd_set_format of the file format.c. The manipulation leads to memory corruption. The attack can be launched remotely. The complexity of an attack is rather high. The exploitation appears to be difficult. Upgrading to version 2.45 is able to address this issue. The identifier of the patch is 8d97c1a53f3dc9fd8e1ccdb039b8a33d50133150. It is recommended to upgrade the affected component.","scope":"local","releases":{"bookworm":{"status":"open","repositories":{"bookworm":"2.40-2"},"urgency":"unimportant"},"bullseye":{"status":"open","repositories":{"bullseye":"2.35.2-2"},"urgency":"unimportant"},"forky":{"status":"resolved","repositories":{"forky":"2.46-3"},"fixed_version":"2.45-3","urgency":"unimportant"},"sid":{"status":"resolved","repositories":{"sid":"2.46-3"},"fixed_version":"2.45-3","urgency":"unimportant"},"trixie":{"status":"open","repositories":{"trixie":"2.44-3"},"urgency":"unimportant"}}},"CVE-2025-1176":{"description":"A vulnerability was found in GNU Binutils 2.43 and classified as critical. This issue affects the function _bfd_elf_gc_mark_rsec of the file elflink.c of the component ld. The manipulation leads to heap-based buffer overflow. The attack may be initiated remotely. The complexity of an attack is rather high. The exploitation is known to be difficult. The exploit has been disclosed to the public and may be used. The patch is named f9978defb6fab0bd8583942d97c112b0932ac814. It is recommended to apply a patch to fix this issue.","debianbug":1108986,"scope":"local","releases":{"bookworm":{"status":"open","repositories":{"bookworm":"2.40-2"},"urgency":"unimportant"},"bullseye":{"status":"open","repositories":{"bullseye":"2.35.2-2"},"urgency":"unimportant"},"forky":{"status":"resolved","repositories":{"forky":"2.46-3"},"fixed_version":"2.45-3","urgency":"unimportant"},"sid":{"status":"resolved","repositories":{"sid":"2.46-3"},"fixed_version":"2.45-3","urgency":"unimportant"},"trixie":{"status":"open","repositories":{"trixie":"2.44-3"},"urgency":"unimportant"}}},"CVE-2025-1178":{"description":"A vulnerability was found in GNU Binutils 2.43. It has been declared as problematic. Affected by this vulnerability is the function bfd_putl64 of the file libbfd.c of the component ld. The manipulation leads to memory corruption. The attack can be launched remotely. The complexity of an attack is rather high. The exploitation appears to be difficult. The exploit has been disclosed to the public and may be used. The identifier of the patch is 75086e9de1707281172cc77f178e7949a4414ed0. It is recommended to apply a patch to fix this issue.","debianbug":1108986,"scope":"local","releases":{"bookworm":{"status":"open","repositories":{"bookworm":"2.40-2"},"urgency":"unimportant"},"bullseye":{"status":"open","repositories":{"bullseye":"2.35.2-2"},"urgency":"unimportant"},"forky":{"status":"resolved","repositories":{"forky":"2.46-3"},"fixed_version":"2.45-3","urgency":"unimportant"},"sid":{"status":"resolved","repositories":{"sid":"2.46-3"},"fixed_version":"2.45-3","urgency":"unimportant"},"trixie":{"status":"open","repositories":{"trixie":"2.44-3"},"urgency":"unimportant"}}},"CVE-2025-1179":{"description":"A vulnerability was found in GNU Binutils 2.43. It has been rated as critical. Affected by this issue is the function bfd_putl64 of the file bfd/libbfd.c of the component ld. The manipulation leads to memory corruption. The attack may be launched remotely. The complexity of an attack is rather high. The exploitation is known to be difficult. The exploit has been disclosed to the public and may be used. Upgrading to version 2.44 is able to address this issue. It is recommended to upgrade the affected component. The code maintainer explains, that \"[t]his bug has been fixed at some point between the 2.43 and 2.44 releases\".","scope":"local","releases":{"bookworm":{"status":"open","repositories":{"bookworm":"2.40-2"},"urgency":"unimportant"},"bullseye":{"status":"open","repositories":{"bullseye":"2.35.2-2"},"urgency":"unimportant"},"forky":{"status":"resolved","repositories":{"forky":"2.46-3"},"fixed_version":"2.44-1","urgency":"unimportant"},"sid":{"status":"resolved","repositories":{"sid":"2.46-3"},"fixed_version":"2.44-1","urgency":"unimportant"},"trixie":{"status":"resolved","repositories":{"trixie":"2.44-3"},"fixed_version":"2.44-1","urgency":"unimportant"}}},"CVE-2025-1180":{"description":"A vulnerability classified as problematic has been found in GNU Binutils 2.43. This affects the function _bfd_elf_write_section_eh_frame of the file bfd/elf-eh-frame.c of the component ld. The manipulation leads to memory corruption. It is possible to initiate the attack remotely. The complexity of an attack is rather high. The exploitability is told to be difficult. The exploit has been disclosed to the public and may be used. It is recommended to apply a patch to fix this issue.","debianbug":1108986,"scope":"local","releases":{"bookworm":{"status":"open","repositories":{"bookworm":"2.40-2"},"urgency":"unimportant"},"bullseye":{"status":"open","repositories":{"bullseye":"2.35.2-2"},"urgency":"unimportant"},"forky":{"status":"resolved","repositories":{"forky":"2.46-3"},"fixed_version":"2.45-3","urgency":"unimportant"},"sid":{"status":"resolved","repositories":{"sid":"2.46-3"},"fixed_version":"2.45-3","urgency":"unimportant"},"trixie":{"status":"open","repositories":{"trixie":"2.44-3"},"urgency":"unimportant"}}},"CVE-2025-1181":{"description":"A vulnerability classified as critical was found in GNU Binutils 2.43. This vulnerability affects the function _bfd_elf_gc_mark_rsec of the file bfd/elflink.c of the component ld. The manipulation leads to memory corruption. The attack can be initiated remotely. The complexity of an attack is rather high. The exploitation appears to be difficult. The exploit has been disclosed to the public and may be used. The name of the patch is 931494c9a89558acb36a03a340c01726545eef24. It is recommended to apply a patch to fix this issue.","debianbug":1108986,"scope":"local","releases":{"bookworm":{"status":"open","repositories":{"bookworm":"2.40-2"},"urgency":"unimportant"},"bullseye":{"status":"open","repositories":{"bullseye":"2.35.2-2"},"urgency":"unimportant"},"forky":{"status":"resolved","repositories":{"forky":"2.46-3"},"fixed_version":"2.45-3","urgency":"unimportant"},"sid":{"status":"resolved","repositories":{"sid":"2.46-3"},"fixed_version":"2.45-3","urgency":"unimportant"},"trixie":{"status":"open","repositories":{"trixie":"2.44-3"},"urgency":"unimportant"}}},"CVE-2025-1182":{"description":"A vulnerability, which was classified as critical, was found in GNU Binutils 2.43. Affected is the function bfd_elf_reloc_symbol_deleted_p of the file bfd/elflink.c of the component ld. The manipulation leads to memory corruption. It is possible to launch the attack remotely. The complexity of an attack is rather high. The exploitability is told to be difficult. The exploit has been disclosed to the public and may be used. The patch is identified as b425859021d17adf62f06fb904797cf8642986ad. It is recommended to apply a patch to fix this issue.","debianbug":1108986,"scope":"local","releases":{"bookworm":{"status":"open","repositories":{"bookworm":"2.40-2"},"urgency":"unimportant"},"bullseye":{"status":"open","repositories":{"bullseye":"2.35.2-2"},"urgency":"unimportant"},"forky":{"status":"resolved","repositories":{"forky":"2.46-3"},"fixed_version":"2.45-3","urgency":"unimportant"},"sid":{"status":"resolved","repositories":{"sid":"2.46-3"},"fixed_version":"2.45-3","urgency":"unimportant"},"trixie":{"status":"open","repositories":{"trixie":"2.44-3"},"urgency":"unimportant"}}},"CVE-2025-11839":{"description":"A security flaw has been discovered in GNU Binutils 2.45. Impacted is the function tg_tag_type of the file prdbg.c. Performing a manipulation results in unchecked return value. The attack needs to be approached locally. The exploit has been released to the public and may be used for attacks.","scope":"local","releases":{"bookworm":{"status":"open","repositories":{"bookworm":"2.40-2"},"urgency":"unimportant"},"bullseye":{"status":"open","repositories":{"bullseye":"2.35.2-2"},"urgency":"unimportant"},"forky":{"status":"resolved","repositories":{"forky":"2.46-3"},"fixed_version":"2.46-1","urgency":"unimportant"},"sid":{"status":"resolved","repositories":{"sid":"2.46-3"},"fixed_version":"2.46-1","urgency":"unimportant"},"trixie":{"status":"open","repositories":{"trixie":"2.44-3"},"urgency":"unimportant"}}},"CVE-2025-11840":{"description":"A weakness has been identified in GNU Binutils 2.45. The affected element is the function vfinfo of the file ldmisc.c. Executing a manipulation can lead to out-of-bounds read. The attack can only be executed locally. The exploit has been made available to the public and could be used for attacks. This patch is called 16357. It is best practice to apply a patch to resolve this issue.","scope":"local","releases":{"bookworm":{"status":"open","repositories":{"bookworm":"2.40-2"},"urgency":"unimportant"},"bullseye":{"status":"open","repositories":{"bullseye":"2.35.2-2"},"urgency":"unimportant"},"forky":{"status":"resolved","repositories":{"forky":"2.46-3"},"fixed_version":"2.46-1","urgency":"unimportant"},"sid":{"status":"resolved","repositories":{"sid":"2.46-3"},"fixed_version":"2.46-1","urgency":"unimportant"},"trixie":{"status":"open","repositories":{"trixie":"2.44-3"},"urgency":"unimportant"}}},"CVE-2025-3198":{"description":"A vulnerability has been found in GNU Binutils 2.43/2.44 and classified as problematic. Affected by this vulnerability is the function display_info of the file binutils/bucomm.c of the component objdump. The manipulation leads to memory leak. An attack has to be approached locally. The exploit has been disclosed to the public and may be used. The patch is named ba6ad3a18cb26b79e0e3b84c39f707535bbc344d. It is recommended to apply a patch to fix this issue.","scope":"local","releases":{"bookworm":{"status":"open","repositories":{"bookworm":"2.40-2"},"urgency":"unimportant"},"bullseye":{"status":"open","repositories":{"bullseye":"2.35.2-2"},"urgency":"unimportant"},"forky":{"status":"resolved","repositories":{"forky":"2.46-3"},"fixed_version":"2.45-3","urgency":"unimportant"},"sid":{"status":"resolved","repositories":{"sid":"2.46-3"},"fixed_version":"2.45-3","urgency":"unimportant"},"trixie":{"status":"open","repositories":{"trixie":"2.44-3"},"urgency":"unimportant"}}},"CVE-2025-5244":{"description":"A vulnerability was found in GNU Binutils up to 2.44. It has been rated as critical. Affected by this issue is the function elf_gc_sweep of the file bfd/elflink.c of the component ld. The manipulation leads to memory corruption. An attack has to be approached locally. The exploit has been disclosed to the public and may be used. Upgrading to version 2.45 is able to address this issue. It is recommended to upgrade the affected component.","scope":"local","releases":{"bookworm":{"status":"open","repositories":{"bookworm":"2.40-2"},"urgency":"unimportant"},"bullseye":{"status":"open","repositories":{"bullseye":"2.35.2-2"},"urgency":"unimportant"},"forky":{"status":"resolved","repositories":{"forky":"2.46-3"},"fixed_version":"2.45-3","urgency":"unimportant"},"sid":{"status":"resolved","repositories":{"sid":"2.46-3"},"fixed_version":"2.45-3","urgency":"unimportant"},"trixie":{"status":"open","repositories":{"trixie":"2.44-3"},"urgency":"unimportant"}}},"CVE-2025-5245":{"description":"A vulnerability classified as critical has been found in GNU Binutils up to 2.44. This affects the function debug_type_samep of the file /binutils/debug.c of the component objdump. The manipulation leads to memory corruption. Local access is required to approach this attack. The exploit has been disclosed to the public and may be used. It is recommended to apply a patch to fix this issue.","scope":"local","releases":{"bookworm":{"status":"open","repositories":{"bookworm":"2.40-2"},"urgency":"unimportant"},"bullseye":{"status":"open","repositories":{"bullseye":"2.35.2-2"},"urgency":"unimportant"},"forky":{"status":"resolved","repositories":{"forky":"2.46-3"},"fixed_version":"2.45-3","urgency":"unimportant"},"sid":{"status":"resolved","repositories":{"sid":"2.46-3"},"fixed_version":"2.45-3","urgency":"unimportant"},"trixie":{"status":"open","repositories":{"trixie":"2.44-3"},"urgency":"unimportant"}}},"CVE-2025-66861":{"description":"An issue was discovered in function d_unqualified_name in file cp-demangle.c in BinUtils 2.26 allowing attackers to cause a denial of service via crafted PE file.","scope":"local","releases":{"bookworm":{"status":"open","repositories":{"bookworm":"2.40-2"},"urgency":"unimportant"},"bullseye":{"status":"open","repositories":{"bullseye":"2.35.2-2"},"urgency":"unimportant"},"forky":{"status":"open","repositories":{"forky":"2.46-3"},"urgency":"unimportant"},"sid":{"status":"open","repositories":{"sid":"2.46-3"},"urgency":"unimportant"},"trixie":{"status":"open","repositories":{"trixie":"2.44-3"},"urgency":"unimportant"}}},"CVE-2025-66862":{"description":"A buffer overflow vulnerability in function gnu_special in file cplus-dem.c in BinUtils 2.26 allows attackers to cause a denial of service via crafted PE file.","scope":"local","releases":{"bookworm":{"status":"open","repositories":{"bookworm":"2.40-2"},"urgency":"unimportant"},"bullseye":{"status":"open","repositories":{"bullseye":"2.35.2-2"},"urgency":"unimportant"},"forky":{"status":"open","repositories":{"forky":"2.46-3"},"urgency":"unimportant"},"sid":{"status":"open","repositories":{"sid":"2.46-3"},"urgency":"unimportant"},"trixie":{"status":"open","repositories":{"trixie":"2.44-3"},"urgency":"unimportant"}}},"CVE-2025-66863":{"description":"An issue was discovered in function d_discriminator in file cp-demangle.c in BinUtils 2.26 allows attackers to cause a denial of service via crafted PE file.","scope":"local","releases":{"bookworm":{"status":"open","repositories":{"bookworm":"2.40-2"},"urgency":"unimportant"},"bullseye":{"status":"open","repositories":{"bullseye":"2.35.2-2"},"urgency":"unimportant"},"forky":{"status":"open","repositories":{"forky":"2.46-3"},"urgency":"unimportant"},"sid":{"status":"open","repositories":{"sid":"2.46-3"},"urgency":"unimportant"},"trixie":{"status":"open","repositories":{"trixie":"2.44-3"},"urgency":"unimportant"}}},"CVE-2025-66864":{"description":"An issue was discovered in function d_print_comp_inner in file cp-demangle.c in BinUtils 2.26 allows attackers to cause a denial of service via crafted PE file.","scope":"local","releases":{"bookworm":{"status":"open","repositories":{"bookworm":"2.40-2"},"urgency":"unimportant"},"bullseye":{"status":"open","repositories":{"bullseye":"2.35.2-2"},"urgency":"unimportant"},"forky":{"status":"open","repositories":{"forky":"2.46-3"},"urgency":"unimportant"},"sid":{"status":"open","repositories":{"sid":"2.46-3"},"urgency":"unimportant"},"trixie":{"status":"open","repositories":{"trixie":"2.44-3"},"urgency":"unimportant"}}},"CVE-2025-66865":{"description":"An issue was discovered in function d_print_comp_inner in file cp-demangle.c in BinUtils 2.26 allows attackers to cause a denial of service via crafted PE file.","scope":"local","releases":{"bookworm":{"status":"open","repositories":{"bookworm":"2.40-2"},"urgency":"unimportant"},"bullseye":{"status":"open","repositories":{"bullseye":"2.35.2-2"},"urgency":"unimportant"},"forky":{"status":"open","repositories":{"forky":"2.46-3"},"urgency":"unimportant"},"sid":{"status":"open","repositories":{"sid":"2.46-3"},"urgency":"unimportant"},"trixie":{"status":"open","repositories":{"trixie":"2.44-3"},"urgency":"unimportant"}}},"CVE-2025-66866":{"description":"An issue was discovered in function d_abi_tags in file cp-demangle.c in BinUtils 2.26 allows attackers to cause a denial of service via crafted PE file.","scope":"local","releases":{"bookworm":{"status":"open","repositories":{"bookworm":"2.40-2"},"urgency":"unimportant"},"bullseye":{"status":"open","repositories":{"bullseye":"2.35.2-2"},"urgency":"unimportant"},"forky":{"status":"open","repositories":{"forky":"2.46-3"},"urgency":"unimportant"},"sid":{"status":"open","repositories":{"sid":"2.46-3"},"urgency":"unimportant"},"trixie":{"status":"open","repositories":{"trixie":"2.44-3"},"urgency":"unimportant"}}},"CVE-2025-69644":{"description":"An issue was discovered in Binutils before 2.46. The objdump contains a denial-of-service vulnerability when processing a crafted binary with malformed debug information. A logic flaw in the handling of DWARF location list headers can cause objdump to enter an unbounded loop and produce endless output until manually interrupted. This issue affects versions prior to the upstream fix and allows a local attacker to cause excessive resource consumption by supplying a malicious input file.","scope":"local","releases":{"bookworm":{"status":"open","repositories":{"bookworm":"2.40-2"},"urgency":"unimportant"},"bullseye":{"status":"open","repositories":{"bullseye":"2.35.2-2"},"urgency":"unimportant"},"forky":{"status":"open","repositories":{"forky":"2.46-3"},"urgency":"unimportant"},"sid":{"status":"open","repositories":{"sid":"2.46-3"},"urgency":"unimportant"},"trixie":{"status":"open","repositories":{"trixie":"2.44-3"},"urgency":"unimportant"}}},"CVE-2025-69645":{"description":"Binutils objdump contains a denial-of-service vulnerability when processing a crafted binary with malformed DWARF debug information. A logic error in the handling of DWARF compilation units can result in an invalid offset_size value being used inside byte_get_little_endian, leading to an abort (SIGABRT). The issue was observed in binutils 2.44. A local attacker can trigger the crash by supplying a malicious input file.","scope":"local","releases":{"bookworm":{"status":"open","repositories":{"bookworm":"2.40-2"},"urgency":"unimportant"},"bullseye":{"status":"open","repositories":{"bullseye":"2.35.2-2"},"urgency":"unimportant"},"forky":{"status":"open","repositories":{"forky":"2.46-3"},"urgency":"unimportant"},"sid":{"status":"open","repositories":{"sid":"2.46-3"},"urgency":"unimportant"},"trixie":{"status":"open","repositories":{"trixie":"2.44-3"},"urgency":"unimportant"}}},"CVE-2025-69646":{"description":"Binutils objdump contains a denial-of-service vulnerability when processing a crafted binary with malformed DWARF debug_rnglists data. A logic error in the handling of the debug_rnglists header can cause objdump to repeatedly print the same warning message and fail to terminate, resulting in an unbounded logging loop until the process is interrupted. The issue was observed in binutils 2.44. A local attacker can exploit this vulnerability by supplying a malicious input file, leading to excessive CPU and I/O usage and preventing completion of the objdump analysis.","scope":"local","releases":{"bookworm":{"status":"open","repositories":{"bookworm":"2.40-2"},"urgency":"unimportant"},"bullseye":{"status":"open","repositories":{"bullseye":"2.35.2-2"},"urgency":"unimportant"},"forky":{"status":"open","repositories":{"forky":"2.46-3"},"urgency":"unimportant"},"sid":{"status":"open","repositories":{"sid":"2.46-3"},"urgency":"unimportant"},"trixie":{"status":"open","repositories":{"trixie":"2.44-3"},"urgency":"unimportant"}}},"CVE-2025-69647":{"description":"GNU Binutils thru 2.45.1 readelf contains a denial-of-service vulnerability when processing a crafted binary with malformed DWARF loclists data. A logic flaw in the DWARF parsing code can cause readelf to repeatedly print the same table output without making forward progress, resulting in an unbounded output loop that never terminates unless externally interrupted. A local attacker can trigger this behavior by supplying a malicious input file, causing excessive CPU and I/O usage and preventing readelf from completing its analysis.","scope":"local","releases":{"bookworm":{"status":"open","repositories":{"bookworm":"2.40-2"},"urgency":"unimportant"},"bullseye":{"status":"open","repositories":{"bullseye":"2.35.2-2"},"urgency":"unimportant"},"forky":{"status":"open","repositories":{"forky":"2.46-3"},"urgency":"unimportant"},"sid":{"status":"open","repositories":{"sid":"2.46-3"},"urgency":"unimportant"},"trixie":{"status":"open","repositories":{"trixie":"2.44-3"},"urgency":"unimportant"}}},"CVE-2025-69648":{"description":"GNU Binutils thru 2.45.1 readelf contains a denial-of-service vulnerability when processing a crafted binary with malformed DWARF .debug_rnglists data. A logic flaw in the DWARF parsing path causes readelf to repeatedly print the same warning message without making forward progress, resulting in a non-terminating output loop that requires manual interruption. No evidence of memory corruption or code execution was observed.","scope":"local","releases":{"bookworm":{"status":"open","repositories":{"bookworm":"2.40-2"},"urgency":"unimportant"},"bullseye":{"status":"open","repositories":{"bullseye":"2.35.2-2"},"urgency":"unimportant"},"forky":{"status":"open","repositories":{"forky":"2.46-3"},"urgency":"unimportant"},"sid":{"status":"open","repositories":{"sid":"2.46-3"},"urgency":"unimportant"},"trixie":{"status":"open","repositories":{"trixie":"2.44-3"},"urgency":"unimportant"}}},"CVE-2025-69649":{"description":"GNU Binutils thru 2.46 readelf contains a null pointer dereference vulnerability when processing a crafted ELF binary with malformed header fields. During relocation processing, an invalid or null section pointer may be passed into display_relocations(), resulting in a segmentation fault (SIGSEGV) and abrupt termination. No evidence of memory corruption beyond the null pointer dereference, nor any possibility of code execution, was observed.","scope":"local","releases":{"bookworm":{"status":"open","repositories":{"bookworm":"2.40-2"},"urgency":"unimportant"},"bullseye":{"status":"open","repositories":{"bullseye":"2.35.2-2"},"urgency":"unimportant"},"forky":{"status":"open","repositories":{"forky":"2.46-3"},"urgency":"unimportant"},"sid":{"status":"open","repositories":{"sid":"2.46-3"},"urgency":"unimportant"},"trixie":{"status":"open","repositories":{"trixie":"2.44-3"},"urgency":"unimportant"}}},"CVE-2025-69650":{"description":"GNU Binutils thru 2.46 readelf contains a double free vulnerability when processing a crafted ELF binary with malformed relocation data. During GOT relocation handling, dump_relocations may return early without initializing the all_relocations array. As a result, process_got_section_contents() may pass an uninitialized r_symbol pointer to free(), leading to a double free and terminating the program with SIGABRT. No evidence of exploitable memory corruption or code execution was observed; the impact is limited to denial of service.","scope":"local","releases":{"bookworm":{"status":"open","repositories":{"bookworm":"2.40-2"},"urgency":"unimportant"},"bullseye":{"status":"open","repositories":{"bullseye":"2.35.2-2"},"urgency":"unimportant"},"forky":{"status":"open","repositories":{"forky":"2.46-3"},"urgency":"unimportant"},"sid":{"status":"open","repositories":{"sid":"2.46-3"},"urgency":"unimportant"},"trixie":{"status":"open","repositories":{"trixie":"2.44-3"},"urgency":"unimportant"}}},"CVE-2025-69651":{"description":"GNU Binutils thru 2.46 readelf contains a vulnerability that leads to an invalid pointer free when processing a crafted ELF binary with malformed relocation or symbol data. If dump_relocations returns early due to parsing errors, the internal all_relocations array may remain partially uninitialized. Later, process_got_section_contents() may attempt to free an invalid r_symbol pointer, triggering memory corruption checks in glibc and causing the program to terminate with SIGABRT. No evidence of further memory corruption or code execution was observed; the impact is limited to denial of service.","scope":"local","releases":{"bookworm":{"status":"open","repositories":{"bookworm":"2.40-2"},"urgency":"unimportant"},"bullseye":{"status":"open","repositories":{"bullseye":"2.35.2-2"},"urgency":"unimportant"},"forky":{"status":"open","repositories":{"forky":"2.46-3"},"urgency":"unimportant"},"sid":{"status":"open","repositories":{"sid":"2.46-3"},"urgency":"unimportant"},"trixie":{"status":"open","repositories":{"trixie":"2.44-3"},"urgency":"unimportant"}}},"CVE-2025-69652":{"description":"GNU Binutils thru 2.46 readelf contains a vulnerability that leads to an abort (SIGABRT) when processing a crafted ELF binary with malformed DWARF abbrev or debug information. Due to incomplete state cleanup in process_debug_info(), an invalid debug_info_p state may propagate into DWARF attribute parsing routines. When certain malformed attributes result in an unexpected data length of zero, byte_get_little_endian() triggers a fatal abort. No evidence of memory corruption or code execution was observed; the impact is limited to denial of service.","scope":"local","releases":{"bookworm":{"status":"open","repositories":{"bookworm":"2.40-2"},"urgency":"unimportant"},"bullseye":{"status":"open","repositories":{"bullseye":"2.35.2-2"},"urgency":"unimportant"},"forky":{"status":"open","repositories":{"forky":"2.46-3"},"urgency":"unimportant"},"sid":{"status":"open","repositories":{"sid":"2.46-3"},"urgency":"unimportant"},"trixie":{"status":"open","repositories":{"trixie":"2.44-3"},"urgency":"unimportant"}}},"CVE-2025-7545":{"description":"A vulnerability classified as problematic was found in GNU Binutils 2.45. Affected by this vulnerability is the function copy_section of the file binutils/objcopy.c. The manipulation leads to heap-based buffer overflow. Attacking locally is a requirement. The exploit has been disclosed to the public and may be used. The patch is named 08c3cbe5926e4d355b5cb70bbec2b1eeb40c2944. It is recommended to apply a patch to fix this issue.","scope":"local","releases":{"bookworm":{"status":"open","repositories":{"bookworm":"2.40-2"},"urgency":"unimportant"},"bullseye":{"status":"open","repositories":{"bullseye":"2.35.2-2"},"urgency":"unimportant"},"forky":{"status":"resolved","repositories":{"forky":"2.46-3"},"fixed_version":"2.45-3","urgency":"unimportant"},"sid":{"status":"resolved","repositories":{"sid":"2.46-3"},"fixed_version":"2.45-3","urgency":"unimportant"},"trixie":{"status":"open","repositories":{"trixie":"2.44-3"},"urgency":"unimportant"}}},"CVE-2025-7546":{"description":"A vulnerability, which was classified as problematic, has been found in GNU Binutils 2.45. Affected by this issue is the function bfd_elf_set_group_contents of the file bfd/elf.c. The manipulation leads to out-of-bounds write. It is possible to launch the attack on the local host. The exploit has been disclosed to the public and may be used. The name of the patch is 41461010eb7c79fee7a9d5f6209accdaac66cc6b. It is recommended to apply a patch to fix this issue.","scope":"local","releases":{"bookworm":{"status":"open","repositories":{"bookworm":"2.40-2"},"urgency":"unimportant"},"bullseye":{"status":"open","repositories":{"bullseye":"2.35.2-2"},"urgency":"unimportant"},"forky":{"status":"resolved","repositories":{"forky":"2.46-3"},"fixed_version":"2.45-3","urgency":"unimportant"},"sid":{"status":"resolved","repositories":{"sid":"2.46-3"},"fixed_version":"2.45-3","urgency":"unimportant"},"trixie":{"status":"open","repositories":{"trixie":"2.44-3"},"urgency":"unimportant"}}},"CVE-2025-8224":{"description":"A vulnerability has been found in GNU Binutils 2.44 and classified as problematic. This vulnerability affects the function bfd_elf_get_str_section of the file bfd/elf.c of the component BFD Library. The manipulation leads to null pointer dereference. Local access is required to approach this attack. The exploit has been disclosed to the public and may be used. The name of the patch is db856d41004301b3a56438efd957ef5cabb91530. It is recommended to apply a patch to fix this issue.","scope":"local","releases":{"bookworm":{"status":"open","repositories":{"bookworm":"2.40-2"},"urgency":"unimportant"},"bullseye":{"status":"open","repositories":{"bullseye":"2.35.2-2"},"urgency":"unimportant"},"forky":{"status":"resolved","repositories":{"forky":"2.46-3"},"fixed_version":"2.43.1-4","urgency":"unimportant"},"sid":{"status":"resolved","repositories":{"sid":"2.46-3"},"fixed_version":"2.43.1-4","urgency":"unimportant"},"trixie":{"status":"resolved","repositories":{"trixie":"2.44-3"},"fixed_version":"2.43.1-4","urgency":"unimportant"}}},"CVE-2025-8225":{"description":"A vulnerability was found in GNU Binutils 2.44 and classified as problematic. This issue affects the function process_debug_info of the file binutils/dwarf.c of the component DWARF Section Handler. The manipulation leads to memory leak. Attacking locally is a requirement. The identifier of the patch is e51fdff7d2e538c0e5accdd65649ac68e6e0ddd4. It is recommended to apply a patch to fix this issue.","scope":"local","releases":{"bookworm":{"status":"open","repositories":{"bookworm":"2.40-2"},"urgency":"unimportant"},"bullseye":{"status":"open","repositories":{"bullseye":"2.35.2-2"},"urgency":"unimportant"},"forky":{"status":"resolved","repositories":{"forky":"2.46-3"},"fixed_version":"2.45-3","urgency":"unimportant"},"sid":{"status":"resolved","repositories":{"sid":"2.46-3"},"fixed_version":"2.45-3","urgency":"unimportant"},"trixie":{"status":"open","repositories":{"trixie":"2.44-3"},"urgency":"unimportant"}}},"CVE-2026-3441":{"releases":{"bookworm":{"status":"open","repositories":{"bookworm":"2.40-2"},"urgency":"unimportant"},"bullseye":{"status":"open","repositories":{"bullseye":"2.35.2-2"},"urgency":"unimportant"},"forky":{"status":"open","repositories":{"forky":"2.46-3"},"urgency":"unimportant"},"sid":{"status":"open","repositories":{"sid":"2.46-3"},"urgency":"unimportant"},"trixie":{"status":"open","repositories":{"trixie":"2.44-3"},"urgency":"unimportant"}}},"CVE-2026-3442":{"releases":{"bookworm":{"status":"open","repositories":{"bookworm":"2.40-2"},"urgency":"unimportant"},"bullseye":{"status":"open","repositories":{"bullseye":"2.35.2-2"},"urgency":"unimportant"},"forky":{"status":"open","repositories":{"forky":"2.46-3"},"urgency":"unimportant"},"sid":{"status":"open","repositories":{"sid":"2.46-3"},"urgency":"unimportant"},"trixie":{"status":"open","repositories":{"trixie":"2.44-3"},"urgency":"unimportant"}}},"TEMP-0000000-E52D56":{"releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"2.40-2"},"fixed_version":"2.15-6","urgency":"not yet assigned"},"bullseye":{"status":"resolved","repositories":{"bullseye":"2.35.2-2"},"fixed_version":"2.15-6","urgency":"not yet assigned"},"forky":{"status":"resolved","repositories":{"forky":"2.46-3"},"fixed_version":"2.15-6","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"2.46-3"},"fixed_version":"2.15-6","urgency":"not yet assigned"},"trixie":{"status":"resolved","repositories":{"trixie":"2.44-3"},"fixed_version":"2.15-6","urgency":"not yet assigned"}}}},"binutils-mingw-w64":{"CVE-2014-8484":{"description":"The srec_scan function in bfd/srec.c in libdbfd in GNU binutils before 2.25 allows remote attackers to cause a denial of service (out-of-bounds read) via a small S-record.","scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"10.4"},"fixed_version":"5.2","urgency":"not yet assigned"},"bullseye":{"status":"resolved","repositories":{"bullseye":"8.11"},"fixed_version":"5.2","urgency":"not yet assigned"},"forky":{"status":"resolved","repositories":{"forky":"13.3"},"fixed_version":"5.2","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"13.3"},"fixed_version":"5.2","urgency":"not yet assigned"},"trixie":{"status":"resolved","repositories":{"trixie":"12"},"fixed_version":"5.2","urgency":"not yet assigned"}}},"CVE-2014-8485":{"description":"The setup_group function in bfd/elf.c in libbfd in GNU binutils 2.24 and earlier allows remote attackers to cause a denial of service (crash) and possibly execute arbitrary code via crafted section group headers in an ELF file.","scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"10.4"},"fixed_version":"5.2","urgency":"not yet assigned"},"bullseye":{"status":"resolved","repositories":{"bullseye":"8.11"},"fixed_version":"5.2","urgency":"not yet assigned"},"forky":{"status":"resolved","repositories":{"forky":"13.3"},"fixed_version":"5.2","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"13.3"},"fixed_version":"5.2","urgency":"not yet assigned"},"trixie":{"status":"resolved","repositories":{"trixie":"12"},"fixed_version":"5.2","urgency":"not yet assigned"}}},"CVE-2014-8501":{"description":"The _bfd_XXi_swap_aouthdr_in function in bfd/peXXigen.c in GNU binutils 2.24 and earlier allows remote attackers to cause a denial of service (out-of-bounds write) and possibly have other unspecified impact via a crafted NumberOfRvaAndSizes field in the AOUT header in a PE executable.","scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"10.4"},"fixed_version":"5.2","urgency":"not yet assigned"},"bullseye":{"status":"resolved","repositories":{"bullseye":"8.11"},"fixed_version":"5.2","urgency":"not yet assigned"},"forky":{"status":"resolved","repositories":{"forky":"13.3"},"fixed_version":"5.2","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"13.3"},"fixed_version":"5.2","urgency":"not yet assigned"},"trixie":{"status":"resolved","repositories":{"trixie":"12"},"fixed_version":"5.2","urgency":"not yet assigned"}}},"CVE-2014-8502":{"description":"Heap-based buffer overflow in the pe_print_edata function in bfd/peXXigen.c in GNU binutils 2.24 and earlier allows remote attackers to cause a denial of service (crash) and possibly have other unspecified impact via a truncated export table in a PE file.","scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"10.4"},"fixed_version":"5.2","urgency":"not yet assigned"},"bullseye":{"status":"resolved","repositories":{"bullseye":"8.11"},"fixed_version":"5.2","urgency":"not yet assigned"},"forky":{"status":"resolved","repositories":{"forky":"13.3"},"fixed_version":"5.2","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"13.3"},"fixed_version":"5.2","urgency":"not yet assigned"},"trixie":{"status":"resolved","repositories":{"trixie":"12"},"fixed_version":"5.2","urgency":"not yet assigned"}}},"CVE-2014-8503":{"description":"Stack-based buffer overflow in the ihex_scan function in bfd/ihex.c in GNU binutils 2.24 and earlier allows remote attackers to cause a denial of service (crash) and possibly have other unspecified impact via a crafted ihex file.","scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"10.4"},"fixed_version":"5.2","urgency":"not yet assigned"},"bullseye":{"status":"resolved","repositories":{"bullseye":"8.11"},"fixed_version":"5.2","urgency":"not yet assigned"},"forky":{"status":"resolved","repositories":{"forky":"13.3"},"fixed_version":"5.2","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"13.3"},"fixed_version":"5.2","urgency":"not yet assigned"},"trixie":{"status":"resolved","repositories":{"trixie":"12"},"fixed_version":"5.2","urgency":"not yet assigned"}}},"CVE-2014-8504":{"description":"Stack-based buffer overflow in the srec_scan function in bfd/srec.c in GNU binutils 2.24 and earlier allows remote attackers to cause a denial of service (crash) and possibly have other unspecified impact via a crafted file.","scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"10.4"},"fixed_version":"5.2","urgency":"not yet assigned"},"bullseye":{"status":"resolved","repositories":{"bullseye":"8.11"},"fixed_version":"5.2","urgency":"not yet assigned"},"forky":{"status":"resolved","repositories":{"forky":"13.3"},"fixed_version":"5.2","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"13.3"},"fixed_version":"5.2","urgency":"not yet assigned"},"trixie":{"status":"resolved","repositories":{"trixie":"12"},"fixed_version":"5.2","urgency":"not yet assigned"}}},"CVE-2014-8737":{"description":"Multiple directory traversal vulnerabilities in GNU binutils 2.24 and earlier allow local users to delete arbitrary files via a .. (dot dot) or full path name in an archive to (1) strip or (2) objcopy or create arbitrary files via (3) a .. (dot dot) or full path name in an archive to ar.","scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"10.4"},"fixed_version":"5.2","urgency":"not yet assigned"},"bullseye":{"status":"resolved","repositories":{"bullseye":"8.11"},"fixed_version":"5.2","urgency":"not yet assigned"},"forky":{"status":"resolved","repositories":{"forky":"13.3"},"fixed_version":"5.2","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"13.3"},"fixed_version":"5.2","urgency":"not yet assigned"},"trixie":{"status":"resolved","repositories":{"trixie":"12"},"fixed_version":"5.2","urgency":"not yet assigned"}}},"CVE-2014-8738":{"description":"The _bfd_slurp_extended_name_table function in bfd/archive.c in GNU binutils 2.24 and earlier allows remote attackers to cause a denial of service (invalid write, segmentation fault, and crash) via a crafted extended name table in an archive.","scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"10.4"},"fixed_version":"5.2","urgency":"not yet assigned"},"bullseye":{"status":"resolved","repositories":{"bullseye":"8.11"},"fixed_version":"5.2","urgency":"not yet assigned"},"forky":{"status":"resolved","repositories":{"forky":"13.3"},"fixed_version":"5.2","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"13.3"},"fixed_version":"5.2","urgency":"not yet assigned"},"trixie":{"status":"resolved","repositories":{"trixie":"12"},"fixed_version":"5.2","urgency":"not yet assigned"}}}},"binwalk":{"CVE-2021-4287":{"description":"A vulnerability, which was classified as problematic, was found in ReFirm Labs binwalk up to 2.3.2. Affected is an unknown function of the file src/binwalk/modules/extractor.py of the component Archive Extraction Handler. The manipulation leads to symlink following. It is possible to launch the attack remotely. Upgrading to version 2.3.3 is able to address this issue. The name of the patch is fa0c0bd59b8588814756942fe4cb5452e76c1dcd. It is recommended to upgrade the affected component. The identifier of this vulnerability is VDB-216876.","scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"2.3.4+dfsg1-1"},"fixed_version":"2.3.3+dfsg1-1","urgency":"unimportant"},"bullseye":{"status":"open","repositories":{"bullseye":"2.3.1+dfsg1-1","bullseye-security":"2.3.1+dfsg1-1+deb11u1"},"urgency":"unimportant"},"forky":{"status":"resolved","repositories":{"forky":"2.4.3+dfsg1-2"},"fixed_version":"2.3.3+dfsg1-1","urgency":"unimportant"},"sid":{"status":"resolved","repositories":{"sid":"2.4.3+dfsg1-2"},"fixed_version":"2.3.3+dfsg1-1","urgency":"unimportant"},"trixie":{"status":"resolved","repositories":{"trixie":"2.4.3+dfsg1-2"},"fixed_version":"2.3.3+dfsg1-1","urgency":"unimportant"}}},"CVE-2022-4510":{"description":"A path traversal vulnerability was identified in ReFirm Labs binwalk from version 2.1.2b through 2.3.3 included. By crafting a malicious PFS filesystem file, an attacker can get binwalk's PFS extractor to extract files at arbitrary locations when binwalk is run in extraction mode (-e option). Remote code execution can be achieved by building a PFS filesystem that, upon extraction,\u00a0would extract a malicious binwalk module into the folder .config/binwalk/plugins.  This vulnerability is associated with program files src/binwalk/plugins/unpfs.py.  This issue affects binwalk from 2.1.2b through 2.3.3 included.","scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"2.3.4+dfsg1-1"},"fixed_version":"2.3.4+dfsg1-1","urgency":"not yet assigned"},"bullseye":{"status":"resolved","repositories":{"bullseye":"2.3.1+dfsg1-1","bullseye-security":"2.3.1+dfsg1-1+deb11u1"},"fixed_version":"2.3.1+dfsg1-1+deb11u1","urgency":"not yet assigned"},"forky":{"status":"resolved","repositories":{"forky":"2.4.3+dfsg1-2"},"fixed_version":"2.3.4+dfsg1-1","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"2.4.3+dfsg1-2"},"fixed_version":"2.3.4+dfsg1-1","urgency":"not yet assigned"},"trixie":{"status":"resolved","repositories":{"trixie":"2.4.3+dfsg1-2"},"fixed_version":"2.3.4+dfsg1-1","urgency":"not yet assigned"}}}},"biosig":{"CVE-2024-21795":{"description":"A heap-based buffer overflow vulnerability exists in the .egi parsing functionality of The Biosig Project libbiosig 2.5.0 and Master Branch (ab0ee111). A specially crafted .egi file can lead to arbitrary code execution. An attacker can provide a malicious file to trigger this vulnerability.","scope":"local","releases":{"bookworm":{"status":"open","repositories":{"bookworm":"2.5.0-1"},"urgency":"not yet assigned","nodsa":"Minor issue","nodsa_reason":""},"bullseye":{"status":"open","repositories":{"bullseye":"2.1.2-4"},"urgency":"not yet assigned","nodsa":"Minor issue, follow bookworm updates","nodsa_reason":"postponed"},"sid":{"status":"resolved","repositories":{"sid":"3.9.0-1"},"fixed_version":"2.6.0-1","urgency":"not yet assigned"},"trixie":{"status":"resolved","repositories":{"trixie":"3.9.0-1"},"fixed_version":"2.6.0-1","urgency":"not yet assigned"}}},"CVE-2024-21812":{"description":"An integer overflow vulnerability exists in the sopen_FAMOS_read functionality of The Biosig Project libbiosig 2.5.0 and Master Branch (ab0ee111). A specially crafted .famos file can lead to an out-of-bounds write which in turn can lead to arbitrary code execution. An attacker can provide a malicious file to trigger this vulnerability.","scope":"local","releases":{"bookworm":{"status":"open","repositories":{"bookworm":"2.5.0-1"},"urgency":"not yet assigned","nodsa":"Minor issue","nodsa_reason":""},"bullseye":{"status":"open","repositories":{"bullseye":"2.1.2-4"},"urgency":"not yet assigned","nodsa":"Minor issue, follow bookworm updates","nodsa_reason":"postponed"},"sid":{"status":"resolved","repositories":{"sid":"3.9.0-1"},"fixed_version":"2.6.0-1","urgency":"not yet assigned"},"trixie":{"status":"resolved","repositories":{"trixie":"3.9.0-1"},"fixed_version":"2.6.0-1","urgency":"not yet assigned"}}},"CVE-2024-22097":{"description":"A double-free vulnerability exists in the BrainVision Header Parsing functionality of The Biosig Project libbiosig Master Branch (ab0ee111) and 2.5.0. A specially crafted .vdhr file can lead to arbitrary code execution. An attacker can provide a malicious file to trigger this vulnerability.","scope":"local","releases":{"bookworm":{"status":"open","repositories":{"bookworm":"2.5.0-1"},"urgency":"not yet assigned","nodsa":"Minor issue","nodsa_reason":""},"bullseye":{"status":"open","repositories":{"bullseye":"2.1.2-4"},"urgency":"not yet assigned","nodsa":"Minor issue, follow bookworm updates","nodsa_reason":"postponed"},"sid":{"status":"resolved","repositories":{"sid":"3.9.0-1"},"fixed_version":"2.6.0-1","urgency":"not yet assigned"},"trixie":{"status":"resolved","repositories":{"trixie":"3.9.0-1"},"fixed_version":"2.6.0-1","urgency":"not yet assigned"}}},"CVE-2024-23305":{"description":"An out-of-bounds write vulnerability exists in the BrainVisionMarker Parsing functionality of The Biosig Project libbiosig 2.5.0 and Master Branch (ab0ee111). A specially crafted .vmrk file can lead to arbitrary code execution. An attacker can provide a malicious file to trigger this vulnerability.","scope":"local","releases":{"bookworm":{"status":"open","repositories":{"bookworm":"2.5.0-1"},"urgency":"not yet assigned","nodsa":"Minor issue","nodsa_reason":""},"bullseye":{"status":"open","repositories":{"bullseye":"2.1.2-4"},"urgency":"not yet assigned","nodsa":"Minor issue, follow bookworm updates","nodsa_reason":"postponed"},"sid":{"status":"resolved","repositories":{"sid":"3.9.0-1"},"fixed_version":"2.6.0-1","urgency":"not yet assigned"},"trixie":{"status":"resolved","repositories":{"trixie":"3.9.0-1"},"fixed_version":"2.6.0-1","urgency":"not yet assigned"}}},"CVE-2024-23310":{"description":"A use-after-free vulnerability exists in the sopen_FAMOS_read functionality of The Biosig Project libbiosig 2.5.0 and Master Branch (ab0ee111). A specially crafted .famos file can lead to arbitrary code execution. An attacker can provide a malicious file to trigger this vulnerability.","scope":"local","releases":{"bookworm":{"status":"open","repositories":{"bookworm":"2.5.0-1"},"urgency":"not yet assigned","nodsa":"Minor issue","nodsa_reason":""},"bullseye":{"status":"open","repositories":{"bullseye":"2.1.2-4"},"urgency":"not yet assigned","nodsa":"Minor issue, follow bookworm updates","nodsa_reason":"postponed"},"sid":{"status":"resolved","repositories":{"sid":"3.9.0-1"},"fixed_version":"2.6.0-1","urgency":"not yet assigned"},"trixie":{"status":"resolved","repositories":{"trixie":"3.9.0-1"},"fixed_version":"2.6.0-1","urgency":"not yet assigned"}}},"CVE-2024-23313":{"description":"An integer underflow vulnerability exists in the sopen_FAMOS_read functionality of The Biosig Project libbiosig 2.5.0 and Master Branch (ab0ee111). A specially crafted .famos file can lead to an out-of-bounds write which in turn can lead to arbitrary code execution. An attacker can provide a malicious file to trigger this vulnerability.","scope":"local","releases":{"bookworm":{"status":"open","repositories":{"bookworm":"2.5.0-1"},"urgency":"not yet assigned","nodsa":"Minor issue","nodsa_reason":""},"bullseye":{"status":"open","repositories":{"bullseye":"2.1.2-4"},"urgency":"not yet assigned","nodsa":"Minor issue, follow bookworm updates","nodsa_reason":"postponed"},"sid":{"status":"resolved","repositories":{"sid":"3.9.0-1"},"fixed_version":"2.6.0-1","urgency":"not yet assigned"},"trixie":{"status":"resolved","repositories":{"trixie":"3.9.0-1"},"fixed_version":"2.6.0-1","urgency":"not yet assigned"}}},"CVE-2024-23606":{"description":"An out-of-bounds write vulnerability exists in the sopen_FAMOS_read functionality of The Biosig Project libbiosig 2.5.0 and Master Branch (ab0ee111). A specially crafted .famos file can lead to arbitrary code execution. An attacker can provide a malicious file to trigger this vulnerability.","scope":"local","releases":{"bookworm":{"status":"open","repositories":{"bookworm":"2.5.0-1"},"urgency":"not yet assigned","nodsa":"Minor issue","nodsa_reason":""},"bullseye":{"status":"open","repositories":{"bullseye":"2.1.2-4"},"urgency":"not yet assigned","nodsa":"Minor issue, follow bookworm updates","nodsa_reason":"postponed"},"sid":{"status":"resolved","repositories":{"sid":"3.9.0-1"},"fixed_version":"2.6.0-1","urgency":"not yet assigned"},"trixie":{"status":"resolved","repositories":{"trixie":"3.9.0-1"},"fixed_version":"2.6.0-1","urgency":"not yet assigned"}}},"CVE-2024-23809":{"description":"A double-free vulnerability exists in the BrainVision ASCII Header Parsing functionality of The Biosig Project libbiosig 2.5.0 and Master Branch (ab0ee111). A specially crafted .vdhr file can lead to arbitrary code execution. An attacker can provide a malicious file to trigger this vulnerability.","scope":"local","releases":{"bookworm":{"status":"open","repositories":{"bookworm":"2.5.0-1"},"urgency":"not yet assigned","nodsa":"Minor issue","nodsa_reason":""},"bullseye":{"status":"open","repositories":{"bullseye":"2.1.2-4"},"urgency":"not yet assigned","nodsa":"Minor issue, follow bookworm updates","nodsa_reason":"postponed"},"sid":{"status":"resolved","repositories":{"sid":"3.9.0-1"},"fixed_version":"2.6.0-1","urgency":"not yet assigned"},"trixie":{"status":"resolved","repositories":{"trixie":"3.9.0-1"},"fixed_version":"2.6.0-1","urgency":"not yet assigned"}}},"CVE-2025-46411":{"description":"A stack-based buffer overflow vulnerability exists in the MFER parsing functionality of The Biosig Project libbiosig 3.9.0 and Master Branch (35a819fa). A specially crafted MFER file can lead to arbitrary code execution. An attacker can provide a malicious file to trigger this vulnerability.","debianbug":1112133,"scope":"local","releases":{"bookworm":{"status":"open","repositories":{"bookworm":"2.5.0-1"},"urgency":"not yet assigned","nodsa":"Minor issue","nodsa_reason":""},"bullseye":{"status":"open","repositories":{"bullseye":"2.1.2-4"},"urgency":"not yet assigned","nodsa":"Minor issue","nodsa_reason":"postponed"},"sid":{"status":"open","repositories":{"sid":"3.9.0-1"},"urgency":"not yet assigned"},"trixie":{"status":"open","repositories":{"trixie":"3.9.0-1"},"urgency":"not yet assigned","nodsa":"Minor issue","nodsa_reason":""}}},"CVE-2025-48005":{"description":"A heap-based buffer overflow vulnerability exists in the RHS2000 parsing functionality of The Biosig Project libbiosig 3.9.0 and Master Branch (35a819fa). A specially crafted RHS2000 file can lead to arbitrary code execution. An attacker can provide a malicious file to trigger this vulnerability.","debianbug":1112133,"scope":"local","releases":{"bookworm":{"status":"open","repositories":{"bookworm":"2.5.0-1"},"urgency":"not yet assigned","nodsa":"Minor issue","nodsa_reason":""},"bullseye":{"status":"open","repositories":{"bullseye":"2.1.2-4"},"urgency":"not yet assigned","nodsa":"Minor issue","nodsa_reason":"postponed"},"sid":{"status":"open","repositories":{"sid":"3.9.0-1"},"urgency":"not yet assigned"},"trixie":{"status":"open","repositories":{"trixie":"3.9.0-1"},"urgency":"not yet assigned","nodsa":"Minor issue","nodsa_reason":""}}},"CVE-2025-52461":{"description":"An out-of-bounds read vulnerability exists in the Nex parsing functionality of The Biosig Project libbiosig 3.9.0 and Master Branch (35a819fa). A specially crafted .nex file can lead to an information leak. An attacker can provide a malicious file to trigger this vulnerability.","debianbug":1112133,"scope":"local","releases":{"bookworm":{"status":"open","repositories":{"bookworm":"2.5.0-1"},"urgency":"not yet assigned","nodsa":"Minor issue","nodsa_reason":""},"bullseye":{"status":"open","repositories":{"bullseye":"2.1.2-4"},"urgency":"not yet assigned","nodsa":"Minor issue","nodsa_reason":"postponed"},"sid":{"status":"open","repositories":{"sid":"3.9.0-1"},"urgency":"not yet assigned"},"trixie":{"status":"open","repositories":{"trixie":"3.9.0-1"},"urgency":"not yet assigned","nodsa":"Minor issue","nodsa_reason":""}}},"CVE-2025-52581":{"description":"An integer overflow vulnerability exists in the GDF parsing functionality of The Biosig Project libbiosig 3.9.0 and Master Branch (35a819fa). A specially crafted GDF file can lead to arbitrary code execution. An attacker can provide a malicious file to trigger this vulnerability.","debianbug":1112133,"scope":"local","releases":{"bookworm":{"status":"open","repositories":{"bookworm":"2.5.0-1"},"urgency":"not yet assigned","nodsa":"Minor issue","nodsa_reason":""},"bullseye":{"status":"open","repositories":{"bullseye":"2.1.2-4"},"urgency":"not yet assigned","nodsa":"Minor issue","nodsa_reason":"postponed"},"sid":{"status":"open","repositories":{"sid":"3.9.0-1"},"urgency":"not yet assigned"},"trixie":{"status":"open","repositories":{"trixie":"3.9.0-1"},"urgency":"not yet assigned","nodsa":"Minor issue","nodsa_reason":""}}},"CVE-2025-53511":{"description":"A heap-based buffer overflow vulnerability exists in the MFER parsing functionality of The Biosig Project libbiosig 3.9.0 and Master Branch (35a819fa). A specially crafted MFER file can lead to arbitrary code execution. An attacker can provide a malicious file to trigger this vulnerability.","debianbug":1112133,"scope":"local","releases":{"bookworm":{"status":"open","repositories":{"bookworm":"2.5.0-1"},"urgency":"not yet assigned","nodsa":"Minor issue","nodsa_reason":""},"bullseye":{"status":"open","repositories":{"bullseye":"2.1.2-4"},"urgency":"not yet assigned","nodsa":"Minor issue","nodsa_reason":"postponed"},"sid":{"status":"open","repositories":{"sid":"3.9.0-1"},"urgency":"not yet assigned"},"trixie":{"status":"open","repositories":{"trixie":"3.9.0-1"},"urgency":"not yet assigned","nodsa":"Minor issue","nodsa_reason":""}}},"CVE-2025-53518":{"description":"An integer overflow vulnerability exists in the ABF parsing functionality of The Biosig Project libbiosig 3.9.0 and Master Branch (35a819fa). A specially crafted ABF file can lead to arbitrary code execution. An attacker can provide a malicious file to trigger this vulnerability.","debianbug":1112133,"scope":"local","releases":{"bookworm":{"status":"open","repositories":{"bookworm":"2.5.0-1"},"urgency":"not yet assigned","nodsa":"Minor issue","nodsa_reason":""},"bullseye":{"status":"open","repositories":{"bullseye":"2.1.2-4"},"urgency":"not yet assigned","nodsa":"Minor issue","nodsa_reason":"postponed"},"sid":{"status":"open","repositories":{"sid":"3.9.0-1"},"urgency":"not yet assigned"},"trixie":{"status":"open","repositories":{"trixie":"3.9.0-1"},"urgency":"not yet assigned","nodsa":"Minor issue","nodsa_reason":""}}},"CVE-2025-53557":{"description":"A heap-based buffer overflow vulnerability exists in the MFER parsing functionality of The Biosig Project libbiosig 3.9.0 and Master Branch (35a819fa). A specially crafted MFER file can lead to arbitrary code execution. An attacker can provide a malicious file to trigger this vulnerability.","debianbug":1112133,"scope":"local","releases":{"bookworm":{"status":"open","repositories":{"bookworm":"2.5.0-1"},"urgency":"not yet assigned","nodsa":"Minor issue","nodsa_reason":""},"bullseye":{"status":"open","repositories":{"bullseye":"2.1.2-4"},"urgency":"not yet assigned","nodsa":"Minor issue","nodsa_reason":"postponed"},"sid":{"status":"open","repositories":{"sid":"3.9.0-1"},"urgency":"not yet assigned"},"trixie":{"status":"open","repositories":{"trixie":"3.9.0-1"},"urgency":"not yet assigned","nodsa":"Minor issue","nodsa_reason":""}}},"CVE-2025-53853":{"description":"A heap-based buffer overflow vulnerability exists in the ISHNE parsing functionality of The Biosig Project libbiosig 3.9.0 and Master Branch (35a819fa). A specially crafted ISHNE ECG annotations file can lead to arbitrary code execution. An attacker can provide a malicious file to trigger this vulnerability.","debianbug":1112133,"scope":"local","releases":{"bookworm":{"status":"open","repositories":{"bookworm":"2.5.0-1"},"urgency":"not yet assigned","nodsa":"Minor issue","nodsa_reason":""},"bullseye":{"status":"open","repositories":{"bullseye":"2.1.2-4"},"urgency":"not yet assigned","nodsa":"Minor issue","nodsa_reason":"postponed"},"sid":{"status":"open","repositories":{"sid":"3.9.0-1"},"urgency":"not yet assigned"},"trixie":{"status":"open","repositories":{"trixie":"3.9.0-1"},"urgency":"not yet assigned","nodsa":"Minor issue","nodsa_reason":""}}},"CVE-2025-54462":{"description":"A heap-based buffer overflow vulnerability exists in the Nex parsing functionality of The Biosig Project libbiosig 3.9.0 and Master Branch (35a819fa). A specially crafted .nex file can lead to arbitrary code execution. An attacker can provide a malicious file to trigger this vulnerability.","debianbug":1112133,"scope":"local","releases":{"bookworm":{"status":"open","repositories":{"bookworm":"2.5.0-1"},"urgency":"not yet assigned","nodsa":"Minor issue","nodsa_reason":""},"bullseye":{"status":"open","repositories":{"bullseye":"2.1.2-4"},"urgency":"not yet assigned","nodsa":"Minor issue","nodsa_reason":"postponed"},"sid":{"status":"open","repositories":{"sid":"3.9.0-1"},"urgency":"not yet assigned"},"trixie":{"status":"open","repositories":{"trixie":"3.9.0-1"},"urgency":"not yet assigned","nodsa":"Minor issue","nodsa_reason":""}}},"CVE-2025-54480":{"description":"A stack-based buffer overflow vulnerability exists in the MFER parsing functionality of The Biosig Project libbiosig 3.9.0 and Master Branch (35a819fa). A specially crafted MFER file can lead to arbitrary code execution. An attacker can provide a malicious file to trigger this vulnerability.This vulnerability manifests on line 8719 of biosig.c on the current master branch (35a819fa), when the Tag is 0:\r \r \t\t\t\tif (tag==0) {\r \t\t\t\t\tif (len!=1) fprintf(stderr,\"Warning MFER tag0 incorrect length %i!=1\\n\",len);\r \t\t\t\t\tcurPos += ifread(buf,1,len,hdr);\r \t\t\t\t}","debianbug":1112133,"scope":"local","releases":{"bookworm":{"status":"open","repositories":{"bookworm":"2.5.0-1"},"urgency":"not yet assigned","nodsa":"Minor issue","nodsa_reason":""},"bullseye":{"status":"open","repositories":{"bullseye":"2.1.2-4"},"urgency":"not yet assigned","nodsa":"Minor issue","nodsa_reason":"postponed"},"sid":{"status":"open","repositories":{"sid":"3.9.0-1"},"urgency":"not yet assigned"},"trixie":{"status":"open","repositories":{"trixie":"3.9.0-1"},"urgency":"not yet assigned","nodsa":"Minor issue","nodsa_reason":""}}},"CVE-2025-54481":{"description":"A stack-based buffer overflow vulnerability exists in the MFER parsing functionality of The Biosig Project libbiosig 3.9.0 and Master Branch (35a819fa). A specially crafted MFER file can lead to arbitrary code execution. An attacker can provide a malicious file to trigger this vulnerability.This vulnerability manifests on line 8744 of biosig.c on the current master branch (35a819fa), when the Tag is 3:\r \r \t\t\t\telse if (tag==3) {\r \t\t\t\t\t// character code\r \t\t\t\t\tchar v[17];\t\t// [1]\r \t\t\t\t\tif (len>16) fprintf(stderr,\"Warning MFER tag2 incorrect length %i>16\\n\",len);\r \t\t\t\t\tcurPos += ifread(&v,1,len,hdr);\r \t\t\t\t\tv[len]  = 0;\r \r In this case, the overflowed buffer is the newly-declared `v` \\[1\\] instead of `buf`. Since `v` is only 17 bytes large, much smaller values of `len` (even those encoded using a single octet) can trigger an overflow in this code path.","debianbug":1112133,"scope":"local","releases":{"bookworm":{"status":"open","repositories":{"bookworm":"2.5.0-1"},"urgency":"not yet assigned","nodsa":"Minor issue","nodsa_reason":""},"bullseye":{"status":"open","repositories":{"bullseye":"2.1.2-4"},"urgency":"not yet assigned","nodsa":"Minor issue","nodsa_reason":"postponed"},"sid":{"status":"open","repositories":{"sid":"3.9.0-1"},"urgency":"not yet assigned"},"trixie":{"status":"open","repositories":{"trixie":"3.9.0-1"},"urgency":"not yet assigned","nodsa":"Minor issue","nodsa_reason":""}}},"CVE-2025-54482":{"description":"A stack-based buffer overflow vulnerability exists in the MFER parsing functionality of The Biosig Project libbiosig 3.9.0 and Master Branch (35a819fa). A specially crafted MFER file can lead to arbitrary code execution. An attacker can provide a malicious file to trigger this vulnerability.This vulnerability manifests on line 8751 of biosig.c on the current master branch (35a819fa), when the Tag is 4:\r \r \t\t\t\telse if (tag==4) {\r \t\t\t\t\t// SPR\r \t\t\t\t\tif (len>4) fprintf(stderr,\"Warning MFER tag4 incorrect length %i>4\\n\",len);\r \t\t\t\t\tcurPos += ifread(buf,1,len,hdr);","debianbug":1112133,"scope":"local","releases":{"bookworm":{"status":"open","repositories":{"bookworm":"2.5.0-1"},"urgency":"not yet assigned","nodsa":"Minor issue","nodsa_reason":""},"bullseye":{"status":"open","repositories":{"bullseye":"2.1.2-4"},"urgency":"not yet assigned","nodsa":"Minor issue","nodsa_reason":"postponed"},"sid":{"status":"open","repositories":{"sid":"3.9.0-1"},"urgency":"not yet assigned"},"trixie":{"status":"open","repositories":{"trixie":"3.9.0-1"},"urgency":"not yet assigned","nodsa":"Minor issue","nodsa_reason":""}}},"CVE-2025-54483":{"description":"A stack-based buffer overflow vulnerability exists in the MFER parsing functionality of The Biosig Project libbiosig 3.9.0 and Master Branch (35a819fa). A specially crafted MFER file can lead to arbitrary code execution. An attacker can provide a malicious file to trigger this vulnerability.This vulnerability manifests on line 8759 of biosig.c on the current master branch (35a819fa), when the Tag is 5:\r \r \t\t\t\telse if (tag==5)     //0x05: number of channels\r \t\t\t\t{\r \t\t\t\t\tuint16_t oldNS=hdr->NS;\r \t\t\t\t\tif (len>4) fprintf(stderr,\"Warning MFER tag5 incorrect length %i>4\\n\",len);\r \t\t\t\t\tcurPos += ifread(buf,1,len,hdr);","debianbug":1112133,"scope":"local","releases":{"bookworm":{"status":"open","repositories":{"bookworm":"2.5.0-1"},"urgency":"not yet assigned","nodsa":"Minor issue","nodsa_reason":""},"bullseye":{"status":"open","repositories":{"bullseye":"2.1.2-4"},"urgency":"not yet assigned","nodsa":"Minor issue","nodsa_reason":"postponed"},"sid":{"status":"open","repositories":{"sid":"3.9.0-1"},"urgency":"not yet assigned"},"trixie":{"status":"open","repositories":{"trixie":"3.9.0-1"},"urgency":"not yet assigned","nodsa":"Minor issue","nodsa_reason":""}}},"CVE-2025-54484":{"description":"A stack-based buffer overflow vulnerability exists in the MFER parsing functionality of The Biosig Project libbiosig 3.9.0 and Master Branch (35a819fa). A specially crafted MFER file can lead to arbitrary code execution. An attacker can provide a malicious file to trigger this vulnerability.This vulnerability manifests on line 8779 of biosig.c on the current master branch (35a819fa), when the Tag is 6:\r \r \t\t\t\telse if (tag==6) \t// 0x06 \"number of sequences\"\r \t\t\t\t{\r \t\t\t\t\t// NRec\r \t\t\t\t\tif (len>4) fprintf(stderr,\"Warning MFER tag6 incorrect length %i>4\\n\",len);\r \t\t\t\t\tcurPos += ifread(buf,1,len,hdr);","debianbug":1112133,"scope":"local","releases":{"bookworm":{"status":"open","repositories":{"bookworm":"2.5.0-1"},"urgency":"not yet assigned","nodsa":"Minor issue","nodsa_reason":""},"bullseye":{"status":"open","repositories":{"bullseye":"2.1.2-4"},"urgency":"not yet assigned","nodsa":"Minor issue","nodsa_reason":"postponed"},"sid":{"status":"open","repositories":{"sid":"3.9.0-1"},"urgency":"not yet assigned"},"trixie":{"status":"open","repositories":{"trixie":"3.9.0-1"},"urgency":"not yet assigned","nodsa":"Minor issue","nodsa_reason":""}}},"CVE-2025-54485":{"description":"A stack-based buffer overflow vulnerability exists in the MFER parsing functionality of The Biosig Project libbiosig 3.9.0 and Master Branch (35a819fa). A specially crafted MFER file can lead to arbitrary code execution. An attacker can provide a malicious file to trigger this vulnerability.This vulnerability manifests on line 8785 of biosig.c on the current master branch (35a819fa), when the Tag is 8:\r \r                 else if (tag==8) {\r                     if (len>2) fprintf(stderr,\"Warning MFER tag8 incorrect length %i>2\\n\",len);\r                     curPos += ifread(buf,1,len,hdr);","debianbug":1112133,"scope":"local","releases":{"bookworm":{"status":"open","repositories":{"bookworm":"2.5.0-1"},"urgency":"not yet assigned","nodsa":"Minor issue","nodsa_reason":""},"bullseye":{"status":"open","repositories":{"bullseye":"2.1.2-4"},"urgency":"not yet assigned","nodsa":"Minor issue","nodsa_reason":"postponed"},"sid":{"status":"open","repositories":{"sid":"3.9.0-1"},"urgency":"not yet assigned"},"trixie":{"status":"open","repositories":{"trixie":"3.9.0-1"},"urgency":"not yet assigned","nodsa":"Minor issue","nodsa_reason":""}}},"CVE-2025-54486":{"description":"A stack-based buffer overflow vulnerability exists in the MFER parsing functionality of The Biosig Project libbiosig 3.9.0 and Master Branch (35a819fa). A specially crafted MFER file can lead to arbitrary code execution. An attacker can provide a malicious file to trigger this vulnerability.This vulnerability manifests on line 8824 of biosig.c on the current master branch (35a819fa), when the Tag is 11:\r \r                 else if (tag==11)    //0x0B\r                 {\r                     // Fs\r                     if (len>6) fprintf(stderr,\"Warning MFER tag11 incorrect length %i>6\\n\",len);\r                     double  fval;\r                     curPos += ifread(buf,1,len,hdr);","debianbug":1112133,"scope":"local","releases":{"bookworm":{"status":"open","repositories":{"bookworm":"2.5.0-1"},"urgency":"not yet assigned","nodsa":"Minor issue","nodsa_reason":""},"bullseye":{"status":"open","repositories":{"bullseye":"2.1.2-4"},"urgency":"not yet assigned","nodsa":"Minor issue","nodsa_reason":"postponed"},"sid":{"status":"open","repositories":{"sid":"3.9.0-1"},"urgency":"not yet assigned"},"trixie":{"status":"open","repositories":{"trixie":"3.9.0-1"},"urgency":"not yet assigned","nodsa":"Minor issue","nodsa_reason":""}}},"CVE-2025-54487":{"description":"A stack-based buffer overflow vulnerability exists in the MFER parsing functionality of The Biosig Project libbiosig 3.9.0 and Master Branch (35a819fa). A specially crafted MFER file can lead to arbitrary code execution. An attacker can provide a malicious file to trigger this vulnerability.This vulnerability manifests on line 8842 of biosig.c on the current master branch (35a819fa), when the Tag is 12:\r \r                 else if (tag==12)    //0x0C\r                 {\r                     // sampling resolution\r                     if (len>6) fprintf(stderr,\"Warning MFER tag12 incorrect length %i>6\\n\",len);\r                     val32   = 0;\r                     int8_t  v8;\r                     curPos += ifread(&UnitCode,1,1,hdr);\r                     curPos += ifread(&v8,1,1,hdr);\r                     curPos += ifread(buf,1,len-2,hdr);\r \r In addition to values of `len` greater than 130 triggering a buffer overflow, a value of `len` smaller than 2 will also trigger a buffer overflow due to an integer underflow when computing `len-2` in this code path.","debianbug":1112133,"scope":"local","releases":{"bookworm":{"status":"open","repositories":{"bookworm":"2.5.0-1"},"urgency":"not yet assigned","nodsa":"Minor issue","nodsa_reason":""},"bullseye":{"status":"open","repositories":{"bullseye":"2.1.2-4"},"urgency":"not yet assigned","nodsa":"Minor issue","nodsa_reason":"postponed"},"sid":{"status":"open","repositories":{"sid":"3.9.0-1"},"urgency":"not yet assigned"},"trixie":{"status":"open","repositories":{"trixie":"3.9.0-1"},"urgency":"not yet assigned","nodsa":"Minor issue","nodsa_reason":""}}},"CVE-2025-54488":{"description":"A stack-based buffer overflow vulnerability exists in the MFER parsing functionality of The Biosig Project libbiosig 3.9.0 and Master Branch (35a819fa). A specially crafted MFER file can lead to arbitrary code execution. An attacker can provide a malicious file to trigger this vulnerability.This vulnerability manifests on line 8850 of biosig.c on the current master branch (35a819fa), when the Tag is 13:\r \r                 else if (tag==13) {\r                     if (len>8) fprintf(stderr,\"Warning MFER tag13 incorrect length %i>8\\n\",len);\r                     curPos += ifread(&buf,1,len,hdr);","debianbug":1112133,"scope":"local","releases":{"bookworm":{"status":"open","repositories":{"bookworm":"2.5.0-1"},"urgency":"not yet assigned","nodsa":"Minor issue","nodsa_reason":""},"bullseye":{"status":"open","repositories":{"bullseye":"2.1.2-4"},"urgency":"not yet assigned","nodsa":"Minor issue","nodsa_reason":"postponed"},"sid":{"status":"open","repositories":{"sid":"3.9.0-1"},"urgency":"not yet assigned"},"trixie":{"status":"open","repositories":{"trixie":"3.9.0-1"},"urgency":"not yet assigned","nodsa":"Minor issue","nodsa_reason":""}}},"CVE-2025-54489":{"description":"A stack-based buffer overflow vulnerability exists in the MFER parsing functionality of The Biosig Project libbiosig 3.9.0 and Master Branch (35a819fa). A specially crafted MFER file can lead to arbitrary code execution. An attacker can provide a malicious file to trigger this vulnerability.This vulnerability manifests on line 8970 of biosig.c on the current master branch (35a819fa), when the Tag is 63:\r \r                 else if (tag==63) {\r                     uint8_t tag2=255, len2=255;\r \r                     count = 0;\r                     while ((count<len) && !(FlagInfiniteLength && len2==0 && tag2==0)){\r                         curPos += ifread(&tag2,1,1,hdr);\r                         curPos += ifread(&len2,1,1,hdr);\r                         if (VERBOSE_LEVEL==9)\r                             fprintf(stdout,\"MFER: tag=%3i chan=%2i len=%-4i tag2=%3i len2=%3i curPos=%i %li count=%4i\\n\",tag,chan,len,tag2,len2,curPos,iftell(hdr),(int)count);\r \r                         if (FlagInfiniteLength && len2==0 && tag2==0) break;\r \r                         count  += (2+len2);\r                         curPos += ifread(&buf,1,len2,hdr);\r \r Here, the number of bytes read is not the Data Length decoded from the current frame in the file (`len`) but rather is a new length contained in a single octet read from the same input file (`len2`). Despite this, a stack-based buffer overflow condition can still occur, as the destination buffer is still `buf`, which has a size of only 128 bytes, while `len2` can be as large as 255.","debianbug":1112133,"scope":"local","releases":{"bookworm":{"status":"open","repositories":{"bookworm":"2.5.0-1"},"urgency":"not yet assigned","nodsa":"Minor issue","nodsa_reason":""},"bullseye":{"status":"open","repositories":{"bullseye":"2.1.2-4"},"urgency":"not yet assigned","nodsa":"Minor issue","nodsa_reason":"postponed"},"sid":{"status":"open","repositories":{"sid":"3.9.0-1"},"urgency":"not yet assigned"},"trixie":{"status":"open","repositories":{"trixie":"3.9.0-1"},"urgency":"not yet assigned","nodsa":"Minor issue","nodsa_reason":""}}},"CVE-2025-54490":{"description":"A stack-based buffer overflow vulnerability exists in the MFER parsing functionality of The Biosig Project libbiosig 3.9.0 and Master Branch (35a819fa). A specially crafted MFER file can lead to arbitrary code execution. An attacker can provide a malicious file to trigger this vulnerability.This vulnerability manifests on line 9090 of biosig.c on the current master branch (35a819fa), when the Tag is 64:\r \r                 else if (tag==64)     //0x40\r                 {\r                     // preamble\r                     char tmp[256];  // [1]\r                     curPos += ifread(tmp,1,len,hdr);\r \r In this case, the overflowed buffer is the newly-declared `tmp` \\[1\\] instead of `buf`. While `tmp` is larger than `buf`, having a size of 256 bytes, a stack overflow can still occur in cases where `len` is encoded using multiple octets and is greater than 256.","debianbug":1112133,"scope":"local","releases":{"bookworm":{"status":"open","repositories":{"bookworm":"2.5.0-1"},"urgency":"not yet assigned","nodsa":"Minor issue","nodsa_reason":""},"bullseye":{"status":"open","repositories":{"bullseye":"2.1.2-4"},"urgency":"not yet assigned","nodsa":"Minor issue","nodsa_reason":"postponed"},"sid":{"status":"open","repositories":{"sid":"3.9.0-1"},"urgency":"not yet assigned"},"trixie":{"status":"open","repositories":{"trixie":"3.9.0-1"},"urgency":"not yet assigned","nodsa":"Minor issue","nodsa_reason":""}}},"CVE-2025-54491":{"description":"A stack-based buffer overflow vulnerability exists in the MFER parsing functionality of The Biosig Project libbiosig 3.9.0 and Master Branch (35a819fa). A specially crafted MFER file can lead to arbitrary code execution. An attacker can provide a malicious file to trigger this vulnerability.This vulnerability manifests on line 9191 of biosig.c on the current master branch (35a819fa), when the Tag is 65:\r \r                 else if (tag==65)     //0x41: patient event\r                 {\r                     // event table\r \r                     curPos += ifread(buf,1,len,hdr);","debianbug":1112133,"scope":"local","releases":{"bookworm":{"status":"open","repositories":{"bookworm":"2.5.0-1"},"urgency":"not yet assigned","nodsa":"Minor issue","nodsa_reason":""},"bullseye":{"status":"open","repositories":{"bullseye":"2.1.2-4"},"urgency":"not yet assigned","nodsa":"Minor issue","nodsa_reason":"postponed"},"sid":{"status":"open","repositories":{"sid":"3.9.0-1"},"urgency":"not yet assigned"},"trixie":{"status":"open","repositories":{"trixie":"3.9.0-1"},"urgency":"not yet assigned","nodsa":"Minor issue","nodsa_reason":""}}},"CVE-2025-54492":{"description":"A stack-based buffer overflow vulnerability exists in the MFER parsing functionality of The Biosig Project libbiosig 3.9.0 and Master Branch (35a819fa). A specially crafted MFER file can lead to arbitrary code execution. An attacker can provide a malicious file to trigger this vulnerability.This vulnerability manifests on line 9141 of biosig.c on the current master branch (35a819fa), when the Tag is 67:\r \r                 else if (tag==67)     //0x43: Sample skew\r                 {\r                     int skew=0;     // [1]\r                     curPos += ifread(&skew, 1, len,hdr);\r \r In this case, the address of the newly-defined integer `skew` \\[1\\] is overflowed instead of `buf`. This means a stack overflow can occur using much smaller values of `len` in this code path.","debianbug":1112133,"scope":"local","releases":{"bookworm":{"status":"open","repositories":{"bookworm":"2.5.0-1"},"urgency":"not yet assigned","nodsa":"Minor issue","nodsa_reason":""},"bullseye":{"status":"open","repositories":{"bullseye":"2.1.2-4"},"urgency":"not yet assigned","nodsa":"Minor issue","nodsa_reason":"postponed"},"sid":{"status":"open","repositories":{"sid":"3.9.0-1"},"urgency":"not yet assigned"},"trixie":{"status":"open","repositories":{"trixie":"3.9.0-1"},"urgency":"not yet assigned","nodsa":"Minor issue","nodsa_reason":""}}},"CVE-2025-54493":{"description":"A stack-based buffer overflow vulnerability exists in the MFER parsing functionality of The Biosig Project libbiosig 3.9.0 and Master Branch (35a819fa). A specially crafted MFER file can lead to arbitrary code execution. An attacker can provide a malicious file to trigger this vulnerability.This vulnerability manifests on line 9184 of biosig.c on the current master branch (35a819fa), when the Tag is 131:\r \r                 else if (tag==131)    //0x83\r                 {\r                     // Patient Age\r                     if (len!=7) fprintf(stderr,\"Warning MFER tag131 incorrect length %i!=7\\n\",len);\r                     curPos += ifread(buf,1,len,hdr);","debianbug":1112133,"scope":"local","releases":{"bookworm":{"status":"open","repositories":{"bookworm":"2.5.0-1"},"urgency":"not yet assigned","nodsa":"Minor issue","nodsa_reason":""},"bullseye":{"status":"open","repositories":{"bullseye":"2.1.2-4"},"urgency":"not yet assigned","nodsa":"Minor issue","nodsa_reason":"postponed"},"sid":{"status":"open","repositories":{"sid":"3.9.0-1"},"urgency":"not yet assigned"},"trixie":{"status":"open","repositories":{"trixie":"3.9.0-1"},"urgency":"not yet assigned","nodsa":"Minor issue","nodsa_reason":""}}},"CVE-2025-54494":{"description":"A stack-based buffer overflow vulnerability exists in the MFER parsing functionality of The Biosig Project libbiosig 3.9.0 and Master Branch (35a819fa). A specially crafted MFER file can lead to arbitrary code execution. An attacker can provide a malicious file to trigger this vulnerability.This vulnerability manifests on line 9205 of biosig.c on the current master branch (35a819fa), when the Tag is 133:\r \r                 else if (tag==133)    //0x85\r                 {\r                     curPos += ifread(buf,1,len,hdr);","debianbug":1112133,"scope":"local","releases":{"bookworm":{"status":"open","repositories":{"bookworm":"2.5.0-1"},"urgency":"not yet assigned","nodsa":"Minor issue","nodsa_reason":""},"bullseye":{"status":"open","repositories":{"bullseye":"2.1.2-4"},"urgency":"not yet assigned","nodsa":"Minor issue","nodsa_reason":"postponed"},"sid":{"status":"open","repositories":{"sid":"3.9.0-1"},"urgency":"not yet assigned"},"trixie":{"status":"open","repositories":{"trixie":"3.9.0-1"},"urgency":"not yet assigned","nodsa":"Minor issue","nodsa_reason":""}}},"CVE-2025-64736":{"description":"An out-of-bounds read vulnerability exists in the ABF parsing functionality of The Biosig Project libbiosig 3.9.2 and Master Branch (5462afb0). A specially crafted .abf file can lead to an information leak. An attacker can provide a malicious file to trigger this vulnerability.","scope":"local","releases":{"bookworm":{"status":"open","repositories":{"bookworm":"2.5.0-1"},"urgency":"not yet assigned"},"bullseye":{"status":"open","repositories":{"bullseye":"2.1.2-4"},"urgency":"not yet assigned"},"sid":{"status":"open","repositories":{"sid":"3.9.0-1"},"urgency":"not yet assigned"},"trixie":{"status":"open","repositories":{"trixie":"3.9.0-1"},"urgency":"not yet assigned"}}},"CVE-2025-66043":{"description":"Several stack-based buffer overflow vulnerabilities exists in the MFER parsing functionality of The Biosig Project libbiosig 3.9.1. A specially crafted MFER file can lead to arbitrary code execution. An attacker can provide a malicious file to trigger these vulnerabilities.When Tag is 3","debianbug":1122863,"scope":"local","releases":{"bookworm":{"status":"open","repositories":{"bookworm":"2.5.0-1"},"urgency":"not yet assigned","nodsa":"Minor issue","nodsa_reason":""},"bullseye":{"status":"open","repositories":{"bullseye":"2.1.2-4"},"urgency":"not yet assigned","nodsa":"Minor issue","nodsa_reason":"postponed"},"sid":{"status":"open","repositories":{"sid":"3.9.0-1"},"urgency":"not yet assigned"},"trixie":{"status":"open","repositories":{"trixie":"3.9.0-1"},"urgency":"not yet assigned","nodsa":"Minor issue","nodsa_reason":""}}},"CVE-2025-66044":{"description":"Several stack-based buffer overflow vulnerabilities exists in the MFER parsing functionality of The Biosig Project libbiosig 3.9.1. A specially crafted MFER file can lead to arbitrary code execution. An attacker can provide a malicious file to trigger these vulnerabilities.When Tag is 64","debianbug":1122863,"scope":"local","releases":{"bookworm":{"status":"open","repositories":{"bookworm":"2.5.0-1"},"urgency":"not yet assigned","nodsa":"Minor issue","nodsa_reason":""},"bullseye":{"status":"open","repositories":{"bullseye":"2.1.2-4"},"urgency":"not yet assigned","nodsa":"Minor issue","nodsa_reason":"postponed"},"sid":{"status":"open","repositories":{"sid":"3.9.0-1"},"urgency":"not yet assigned"},"trixie":{"status":"open","repositories":{"trixie":"3.9.0-1"},"urgency":"not yet assigned","nodsa":"Minor issue","nodsa_reason":""}}},"CVE-2025-66045":{"description":"Several stack-based buffer overflow vulnerabilities exists in the MFER parsing functionality of The Biosig Project libbiosig 3.9.1. A specially crafted MFER file can lead to arbitrary code execution. An attacker can provide a malicious file to trigger these vulnerabilities.When Tag is 65","debianbug":1122863,"scope":"local","releases":{"bookworm":{"status":"open","repositories":{"bookworm":"2.5.0-1"},"urgency":"not yet assigned","nodsa":"Minor issue","nodsa_reason":""},"bullseye":{"status":"open","repositories":{"bullseye":"2.1.2-4"},"urgency":"not yet assigned","nodsa":"Minor issue","nodsa_reason":"postponed"},"sid":{"status":"open","repositories":{"sid":"3.9.0-1"},"urgency":"not yet assigned"},"trixie":{"status":"open","repositories":{"trixie":"3.9.0-1"},"urgency":"not yet assigned","nodsa":"Minor issue","nodsa_reason":""}}},"CVE-2025-66046":{"description":"Several stack-based buffer overflow vulnerabilities exists in the MFER parsing functionality of The Biosig Project libbiosig 3.9.1. A specially crafted MFER file can lead to arbitrary code execution. An attacker can provide a malicious file to trigger these vulnerabilities.When Tag is 67","debianbug":1122863,"scope":"local","releases":{"bookworm":{"status":"open","repositories":{"bookworm":"2.5.0-1"},"urgency":"not yet assigned","nodsa":"Minor issue","nodsa_reason":""},"bullseye":{"status":"open","repositories":{"bullseye":"2.1.2-4"},"urgency":"not yet assigned","nodsa":"Minor issue","nodsa_reason":"postponed"},"sid":{"status":"open","repositories":{"sid":"3.9.0-1"},"urgency":"not yet assigned"},"trixie":{"status":"open","repositories":{"trixie":"3.9.0-1"},"urgency":"not yet assigned","nodsa":"Minor issue","nodsa_reason":""}}},"CVE-2025-66047":{"description":"Several stack-based buffer overflow vulnerabilities exists in the MFER parsing functionality of The Biosig Project libbiosig 3.9.1. A specially crafted MFER file can lead to arbitrary code execution. An attacker can provide a malicious file to trigger these vulnerabilities.When Tag is 131","debianbug":1122863,"scope":"local","releases":{"bookworm":{"status":"open","repositories":{"bookworm":"2.5.0-1"},"urgency":"not yet assigned","nodsa":"Minor issue","nodsa_reason":""},"bullseye":{"status":"open","repositories":{"bullseye":"2.1.2-4"},"urgency":"not yet assigned","nodsa":"Minor issue","nodsa_reason":"postponed"},"sid":{"status":"open","repositories":{"sid":"3.9.0-1"},"urgency":"not yet assigned"},"trixie":{"status":"open","repositories":{"trixie":"3.9.0-1"},"urgency":"not yet assigned","nodsa":"Minor issue","nodsa_reason":""}}},"CVE-2025-66048":{"description":"Several stack-based buffer overflow vulnerabilities exists in the MFER parsing functionality of The Biosig Project libbiosig 3.9.1. A specially crafted MFER file can lead to arbitrary code execution. An attacker can provide a malicious file to trigger these vulnerabilities.When Tag is 133","debianbug":1122863,"scope":"local","releases":{"bookworm":{"status":"open","repositories":{"bookworm":"2.5.0-1"},"urgency":"not yet assigned","nodsa":"Minor issue","nodsa_reason":""},"bullseye":{"status":"open","repositories":{"bullseye":"2.1.2-4"},"urgency":"not yet assigned","nodsa":"Minor issue","nodsa_reason":"postponed"},"sid":{"status":"open","repositories":{"sid":"3.9.0-1"},"urgency":"not yet assigned"},"trixie":{"status":"open","repositories":{"trixie":"3.9.0-1"},"urgency":"not yet assigned","nodsa":"Minor issue","nodsa_reason":""}}},"CVE-2026-20777":{"description":"A heap-based buffer overflow vulnerability exists in the Nicolet WFT parsing functionality of The Biosig Project libbiosig 3.9.2 and Master Branch (db9a9a63). A specially crafted .wft file can lead to arbitrary code execution. An attacker can provide a malicious file to trigger this vulnerability.","scope":"local","releases":{"bookworm":{"status":"open","repositories":{"bookworm":"2.5.0-1"},"urgency":"not yet assigned"},"bullseye":{"status":"open","repositories":{"bullseye":"2.1.2-4"},"urgency":"not yet assigned"},"sid":{"status":"open","repositories":{"sid":"3.9.0-1"},"urgency":"not yet assigned"},"trixie":{"status":"open","repositories":{"trixie":"3.9.0-1"},"urgency":"not yet assigned"}}},"CVE-2026-22891":{"description":"A heap-based buffer overflow vulnerability exists in the Intan CLP parsing functionality of The Biosig Project libbiosig 3.9.2 and Master Branch (db9a9a63). A specially crafted Intan CLP file can lead to arbitrary code execution. An attacker can provide a malicious file to trigger this vulnerability.","scope":"local","releases":{"bookworm":{"status":"open","repositories":{"bookworm":"2.5.0-1"},"urgency":"not yet assigned"},"bullseye":{"status":"open","repositories":{"bullseye":"2.1.2-4"},"urgency":"not yet assigned"},"sid":{"status":"open","repositories":{"sid":"3.9.0-1"},"urgency":"not yet assigned"},"trixie":{"status":"open","repositories":{"trixie":"3.9.0-1"},"urgency":"not yet assigned"}}}},"bip":{"CVE-2010-3071":{"description":"bip before 0.8.6 allows remote attackers to cause a denial of service (NULL pointer dereference and daemon crash) via an empty USER command.","debianbug":595409,"scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"0.9.3-1"},"fixed_version":"0.8.6-1","urgency":"low"},"bullseye":{"status":"resolved","repositories":{"bullseye":"0.9.0~rc4-1"},"fixed_version":"0.8.6-1","urgency":"low"},"forky":{"status":"resolved","repositories":{"forky":"0.9.3-1.2"},"fixed_version":"0.8.6-1","urgency":"low"},"sid":{"status":"resolved","repositories":{"sid":"0.9.3-1.2"},"fixed_version":"0.8.6-1","urgency":"low"},"trixie":{"status":"resolved","repositories":{"trixie":"0.9.3-1.1"},"fixed_version":"0.8.6-1","urgency":"low"}}},"CVE-2011-5268":{"description":"connection.c in Bip before 0.8.9 does not properly close sockets, which allows remote attackers to cause a denial of service (file descriptor consumption and crash) via multiple failed SSL handshakes, a different vulnerability than CVE-2013-4550.  NOTE: this issue was SPLIT from CVE-2013-4550 because it is a different type of issue.","scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"0.9.3-1"},"fixed_version":"0.8.9-1","urgency":"not yet assigned"},"bullseye":{"status":"resolved","repositories":{"bullseye":"0.9.0~rc4-1"},"fixed_version":"0.8.9-1","urgency":"not yet assigned"},"forky":{"status":"resolved","repositories":{"forky":"0.9.3-1.2"},"fixed_version":"0.8.9-1","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"0.9.3-1.2"},"fixed_version":"0.8.9-1","urgency":"not yet assigned"},"trixie":{"status":"resolved","repositories":{"trixie":"0.9.3-1.1"},"fixed_version":"0.8.9-1","urgency":"not yet assigned"}}},"CVE-2012-0806":{"description":"Buffer overflow in Bip 0.8.8 and earlier might allow remote authenticated users to execute arbitrary code via vectors involving a series of TCP connections that triggers use of many open file descriptors.","debianbug":657217,"scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"0.9.3-1"},"fixed_version":"0.8.8-2","urgency":"not yet assigned"},"bullseye":{"status":"resolved","repositories":{"bullseye":"0.9.0~rc4-1"},"fixed_version":"0.8.8-2","urgency":"not yet assigned"},"forky":{"status":"resolved","repositories":{"forky":"0.9.3-1.2"},"fixed_version":"0.8.8-2","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"0.9.3-1.2"},"fixed_version":"0.8.8-2","urgency":"not yet assigned"},"trixie":{"status":"resolved","repositories":{"trixie":"0.9.3-1.1"},"fixed_version":"0.8.8-2","urgency":"not yet assigned"}}},"CVE-2013-4550":{"description":"Bip before 0.8.9, when running as a daemon, writes SSL handshake errors to an unexpected file descriptor that was previously associated with stderr before stderr has been closed, which allows remote attackers to write to other sockets and have an unspecified impact via a failed SSL handshake, a different vulnerability than CVE-2011-5268. NOTE: some sources originally mapped this CVE to two different types of issues; this CVE has since been SPLIT, producing CVE-2011-5268.","scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"0.9.3-1"},"fixed_version":"0.8.9-1","urgency":"low"},"bullseye":{"status":"resolved","repositories":{"bullseye":"0.9.0~rc4-1"},"fixed_version":"0.8.9-1","urgency":"low"},"forky":{"status":"resolved","repositories":{"forky":"0.9.3-1.2"},"fixed_version":"0.8.9-1","urgency":"low"},"sid":{"status":"resolved","repositories":{"sid":"0.9.3-1.2"},"fixed_version":"0.8.9-1","urgency":"low"},"trixie":{"status":"resolved","repositories":{"trixie":"0.9.3-1.1"},"fixed_version":"0.8.9-1","urgency":"low"}}},"TEMP-0000000-2A36A7":{"releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"0.9.3-1"},"fixed_version":"0.8.7-1","urgency":"not yet assigned"},"bullseye":{"status":"resolved","repositories":{"bullseye":"0.9.0~rc4-1"},"fixed_version":"0.8.7-1","urgency":"not yet assigned"},"forky":{"status":"resolved","repositories":{"forky":"0.9.3-1.2"},"fixed_version":"0.8.7-1","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"0.9.3-1.2"},"fixed_version":"0.8.7-1","urgency":"not yet assigned"},"trixie":{"status":"resolved","repositories":{"trixie":"0.9.3-1.1"},"fixed_version":"0.8.7-1","urgency":"not yet assigned"}}}},"bird":{"CVE-2018-12066":{"description":"BIRD Internet Routing Daemon before 1.6.4 allows local users to cause a denial of service (stack consumption and daemon crash) via BGP mask expressions in birdc.","debianbug":900967,"scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"1.6.8-2.1"},"fixed_version":"1.6.4-1","urgency":"low"},"bullseye":{"status":"resolved","repositories":{"bullseye":"1.6.8-2.1"},"fixed_version":"1.6.4-1","urgency":"low"}}},"CVE-2019-16159":{"description":"BIRD Internet Routing Daemon 1.6.x through 1.6.7 and 2.x through 2.0.5 has a stack-based buffer overflow. The BGP daemon's support for RFC 8203 administrative shutdown communication messages included an incorrect logical expression when checking the validity of an input message. Sending a shutdown communication with a sufficient message length causes a four-byte overflow to occur while processing the message, where two of the overflow bytes are attacker-controlled and two are fixed.","debianbug":939990,"scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"1.6.8-2.1"},"fixed_version":"1.6.8-1","urgency":"not yet assigned"},"bullseye":{"status":"resolved","repositories":{"bullseye":"1.6.8-2.1"},"fixed_version":"1.6.8-1","urgency":"not yet assigned"}}}},"bird2":{"CVE-2019-16159":{"description":"BIRD Internet Routing Daemon 1.6.x through 1.6.7 and 2.x through 2.0.5 has a stack-based buffer overflow. The BGP daemon's support for RFC 8203 administrative shutdown communication messages included an incorrect logical expression when checking the validity of an input message. Sending a shutdown communication with a sufficient message length causes a four-byte overflow to occur while processing the message, where two of the overflow bytes are attacker-controlled and two are fixed.","debianbug":940522,"scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"2.0.12-7"},"fixed_version":"2.0.6-1","urgency":"not yet assigned"},"bullseye":{"status":"resolved","repositories":{"bullseye":"2.0.7-4.1"},"fixed_version":"2.0.6-1","urgency":"not yet assigned"},"forky":{"status":"resolved","repositories":{"forky":"2.18-1"},"fixed_version":"2.0.6-1","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"2.18-1"},"fixed_version":"2.0.6-1","urgency":"not yet assigned"},"trixie":{"status":"resolved","repositories":{"trixie":"2.17.1-1"},"fixed_version":"2.0.6-1","urgency":"not yet assigned"}}}},"bison":{"CVE-2020-14150":{"description":"GNU Bison before 3.5.4 allows attackers to cause a denial of service (application crash). NOTE: there is a risk only if Bison is used with untrusted input, and an observed bug happens to cause unsafe behavior with a specific compiler/architecture. The bug reports were intended to show that a crash may occur in Bison itself, not that a crash may occur in code that is generated by Bison.","scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"2:3.8.2+dfsg-1"},"fixed_version":"2:3.6.1+dfsg-1","urgency":"unimportant"},"bullseye":{"status":"resolved","repositories":{"bullseye":"2:3.7.5+dfsg-1"},"fixed_version":"2:3.6.1+dfsg-1","urgency":"unimportant"},"forky":{"status":"resolved","repositories":{"forky":"2:3.8.2+dfsg-1"},"fixed_version":"2:3.6.1+dfsg-1","urgency":"unimportant"},"sid":{"status":"resolved","repositories":{"sid":"2:3.8.2+dfsg-1"},"fixed_version":"2:3.6.1+dfsg-1","urgency":"unimportant"},"trixie":{"status":"resolved","repositories":{"trixie":"2:3.8.2+dfsg-1"},"fixed_version":"2:3.6.1+dfsg-1","urgency":"unimportant"}}},"CVE-2020-24240":{"description":"GNU Bison before 3.7.1 has a use-after-free in _obstack_free in lib/obstack.c (called from gram_lex) when a '\\0' byte is encountered. NOTE: there is a risk only if Bison is used with untrusted input, and the observed bug happens to cause unsafe behavior with a specific compiler/architecture. The bug report was intended to show that a crash may occur in Bison itself, not that a crash may occur in code that is generated by Bison.","scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"2:3.8.2+dfsg-1"},"fixed_version":"2:3.7.2+dfsg-1","urgency":"unimportant"},"bullseye":{"status":"resolved","repositories":{"bullseye":"2:3.7.5+dfsg-1"},"fixed_version":"2:3.7.2+dfsg-1","urgency":"unimportant"},"forky":{"status":"resolved","repositories":{"forky":"2:3.8.2+dfsg-1"},"fixed_version":"2:3.7.2+dfsg-1","urgency":"unimportant"},"sid":{"status":"resolved","repositories":{"sid":"2:3.8.2+dfsg-1"},"fixed_version":"2:3.7.2+dfsg-1","urgency":"unimportant"},"trixie":{"status":"resolved","repositories":{"trixie":"2:3.8.2+dfsg-1"},"fixed_version":"2:3.7.2+dfsg-1","urgency":"unimportant"}}}},"bitlbee":{"CVE-2008-3920":{"description":"Unspecified vulnerability in BitlBee before 1.2.2 allows remote attackers to \"recreate\" and \"hijack\" existing accounts via unspecified vectors.","scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"3.6-1.3"},"fixed_version":"1.2.2-1","urgency":"not yet assigned"},"bullseye":{"status":"resolved","repositories":{"bullseye":"3.6-1.2"},"fixed_version":"1.2.2-1","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"3.6-2"},"fixed_version":"1.2.2-1","urgency":"not yet assigned"},"trixie":{"status":"resolved","repositories":{"trixie":"3.6-1.5"},"fixed_version":"1.2.2-1","urgency":"not yet assigned"}}},"CVE-2008-3969":{"description":"Multiple unspecified vulnerabilities in BitlBee before 1.2.3 allow remote attackers to \"overwrite\" and \"hijack\" existing accounts via unknown vectors related to \"inconsistent handling of the USTATUS_IDENTIFIED state.\" NOTE: this issue exists because of an incomplete fix for CVE-2008-3920.","debianbug":498159,"scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"3.6-1.3"},"fixed_version":"1.2.3-1","urgency":"not yet assigned"},"bullseye":{"status":"resolved","repositories":{"bullseye":"3.6-1.2"},"fixed_version":"1.2.3-1","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"3.6-2"},"fixed_version":"1.2.3-1","urgency":"not yet assigned"},"trixie":{"status":"resolved","repositories":{"trixie":"3.6-1.5"},"fixed_version":"1.2.3-1","urgency":"not yet assigned"}}},"CVE-2012-1187":{"description":"Bitlbee does not drop extra group privileges correctly in unix.c","scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"3.6-1.3"},"fixed_version":"3.0.4+bzr855-1","urgency":"low"},"bullseye":{"status":"resolved","repositories":{"bullseye":"3.6-1.2"},"fixed_version":"3.0.4+bzr855-1","urgency":"low"},"sid":{"status":"resolved","repositories":{"sid":"3.6-2"},"fixed_version":"3.0.4+bzr855-1","urgency":"low"},"trixie":{"status":"resolved","repositories":{"trixie":"3.6-1.5"},"fixed_version":"3.0.4+bzr855-1","urgency":"low"}}},"CVE-2016-10188":{"description":"Use-after-free vulnerability in bitlbee-libpurple before 3.5 allows remote servers to cause a denial of service (crash) or possibly execute arbitrary code by causing a file transfer connection to expire.","scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"3.6-1.3"},"fixed_version":"3.5-1","urgency":"not yet assigned"},"bullseye":{"status":"resolved","repositories":{"bullseye":"3.6-1.2"},"fixed_version":"3.5-1","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"3.6-2"},"fixed_version":"3.5-1","urgency":"not yet assigned"},"trixie":{"status":"resolved","repositories":{"trixie":"3.6-1.5"},"fixed_version":"3.5-1","urgency":"not yet assigned"}}},"CVE-2016-10189":{"description":"BitlBee before 3.5 allows remote attackers to cause a denial of service (NULL pointer dereference and crash) and possibly execute arbitrary code via a file transfer request for a contact that is not in the contact list.","scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"3.6-1.3"},"fixed_version":"3.5-1","urgency":"not yet assigned"},"bullseye":{"status":"resolved","repositories":{"bullseye":"3.6-1.2"},"fixed_version":"3.5-1","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"3.6-2"},"fixed_version":"3.5-1","urgency":"not yet assigned"},"trixie":{"status":"resolved","repositories":{"trixie":"3.6-1.5"},"fixed_version":"3.5-1","urgency":"not yet assigned"}}},"CVE-2017-5668":{"description":"bitlbee-libpurple before 3.5.1 allows remote attackers to cause a denial of service (NULL pointer dereference and crash) and possibly execute arbitrary code via a file transfer request for a contact that is not in the contact list.  NOTE: this vulnerability exists because of an incomplete fix for CVE-2016-10189.","debianbug":853282,"scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"3.6-1.3"},"fixed_version":"3.5.1-1","urgency":"not yet assigned"},"bullseye":{"status":"resolved","repositories":{"bullseye":"3.6-1.2"},"fixed_version":"3.5.1-1","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"3.6-2"},"fixed_version":"3.5.1-1","urgency":"not yet assigned"},"trixie":{"status":"resolved","repositories":{"trixie":"3.6-1.5"},"fixed_version":"3.5.1-1","urgency":"not yet assigned"}}}},"black":{"CVE-2024-21503":{"description":"Versions of the package black before 24.3.0 are vulnerable to Regular Expression Denial of Service (ReDoS) via the lines_with_leading_tabs_expanded function in the strings.py file. An attacker could exploit this vulnerability by crafting a malicious input that causes a denial of service.\r\rExploiting this vulnerability is possible when running Black on untrusted input, or if you habitually put thousands of leading tab characters in your docstrings.","debianbug":1067177,"scope":"local","releases":{"bookworm":{"status":"open","repositories":{"bookworm":"23.1.0-1"},"urgency":"not yet assigned","nodsa":"Minor issue","nodsa_reason":"ignored"},"bullseye":{"status":"open","repositories":{"bullseye":"20.8b1-4"},"urgency":"not yet assigned","nodsa":"Minor issue","nodsa_reason":""},"forky":{"status":"resolved","repositories":{"forky":"25.12.0-2"},"fixed_version":"24.4.0-1","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"26.1.0-1"},"fixed_version":"24.4.0-1","urgency":"not yet assigned"},"trixie":{"status":"resolved","repositories":{"trixie":"25.1.0-3"},"fixed_version":"24.4.0-1","urgency":"not yet assigned"}}}},"blender":{"CVE-2005-3151":{"description":"Buffer overflow in blenderplay in Blender Player 2.37a allows attackers to execute arbitrary code via a long command line argument.","debianbug":332413,"scope":"local","releases":{"bookworm":{"status":"open","repositories":{"bookworm":"3.4.1+dfsg-2"},"urgency":"unimportant"},"bullseye":{"status":"open","repositories":{"bullseye":"2.83.5+dfsg-5+deb11u1","bullseye-security":"2.83.5+dfsg-5+deb11u1"},"urgency":"unimportant"},"sid":{"status":"open","repositories":{"sid":"4.3.2+dfsg-2"},"urgency":"unimportant"},"trixie":{"status":"open","repositories":{"trixie":"4.3.2+dfsg-2"},"urgency":"unimportant"}}},"CVE-2005-3302":{"description":"Eval injection vulnerability in bvh_import.py in Blender 2.36 allows attackers to execute arbitrary Python code via a hierarchy element in a .bvh file, which is supplied to an eval function call.","debianbug":330895,"scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"3.4.1+dfsg-2"},"fixed_version":"2.37a-1","urgency":"medium"},"bullseye":{"status":"resolved","repositories":{"bullseye":"2.83.5+dfsg-5+deb11u1","bullseye-security":"2.83.5+dfsg-5+deb11u1"},"fixed_version":"2.37a-1","urgency":"medium"},"sid":{"status":"resolved","repositories":{"sid":"4.3.2+dfsg-2"},"fixed_version":"2.37a-1","urgency":"medium"},"trixie":{"status":"resolved","repositories":{"trixie":"4.3.2+dfsg-2"},"fixed_version":"2.37a-1","urgency":"medium"}}},"CVE-2005-4470":{"description":"Heap-based buffer overflow in the get_bhead function in readfile.c in Blender BlenLoader 2.0 through 2.40pre allows remote attackers to cause a denial of service (application crash) and possibly execute arbitrary code via a .blend file with a negative bhead.len value, which causes less memory to be allocated than expected, possibly due to an integer overflow.","debianbug":344398,"scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"3.4.1+dfsg-2"},"fixed_version":"2.40-1","urgency":"medium"},"bullseye":{"status":"resolved","repositories":{"bullseye":"2.83.5+dfsg-5+deb11u1","bullseye-security":"2.83.5+dfsg-5+deb11u1"},"fixed_version":"2.40-1","urgency":"medium"},"sid":{"status":"resolved","repositories":{"sid":"4.3.2+dfsg-2"},"fixed_version":"2.40-1","urgency":"medium"},"trixie":{"status":"resolved","repositories":{"trixie":"4.3.2+dfsg-2"},"fixed_version":"2.40-1","urgency":"medium"}}},"CVE-2007-1253":{"description":"Eval injection vulnerability in the (a) kmz_ImportWithMesh.py Script for Blender 0.1.9h, as used in (b) Blender before 2.43, allows user-assisted remote attackers to execute arbitrary Python code by importing a crafted (1) KML or (2) KMZ file.","scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"3.4.1+dfsg-2"},"fixed_version":"2.42a-6","urgency":"medium"},"bullseye":{"status":"resolved","repositories":{"bullseye":"2.83.5+dfsg-5+deb11u1","bullseye-security":"2.83.5+dfsg-5+deb11u1"},"fixed_version":"2.42a-6","urgency":"medium"},"sid":{"status":"resolved","repositories":{"sid":"4.3.2+dfsg-2"},"fixed_version":"2.42a-6","urgency":"medium"},"trixie":{"status":"resolved","repositories":{"trixie":"4.3.2+dfsg-2"},"fixed_version":"2.42a-6","urgency":"medium"}}},"CVE-2008-1102":{"description":"Stack-based buffer overflow in the imb_loadhdr function in Blender 2.45 allows user-assisted remote attackers to execute arbitrary code via a .blend file that contains a crafted Radiance RGBE image.","debianbug":477808,"scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"3.4.1+dfsg-2"},"fixed_version":"2.45-5","urgency":"medium"},"bullseye":{"status":"resolved","repositories":{"bullseye":"2.83.5+dfsg-5+deb11u1","bullseye-security":"2.83.5+dfsg-5+deb11u1"},"fixed_version":"2.45-5","urgency":"medium"},"sid":{"status":"resolved","repositories":{"sid":"4.3.2+dfsg-2"},"fixed_version":"2.45-5","urgency":"medium"},"trixie":{"status":"resolved","repositories":{"trixie":"4.3.2+dfsg-2"},"fixed_version":"2.45-5","urgency":"medium"}}},"CVE-2008-1103":{"description":"Multiple unspecified vulnerabilities in Blender have unknown impact and attack vectors, related to \"temporary file issues.\"","scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"3.4.1+dfsg-2"},"fixed_version":"2.40-1","urgency":"low"},"bullseye":{"status":"resolved","repositories":{"bullseye":"2.83.5+dfsg-5+deb11u1","bullseye-security":"2.83.5+dfsg-5+deb11u1"},"fixed_version":"2.40-1","urgency":"low"},"sid":{"status":"resolved","repositories":{"sid":"4.3.2+dfsg-2"},"fixed_version":"2.40-1","urgency":"low"},"trixie":{"status":"resolved","repositories":{"trixie":"4.3.2+dfsg-2"},"fixed_version":"2.40-1","urgency":"low"}}},"CVE-2008-4863":{"description":"Untrusted search path vulnerability in BPY_interface in Blender 2.46 allows local users to execute arbitrary code via a Trojan horse Python file in the current working directory, related to an erroneous setting of sys.path by the PySys_SetArgv function.","debianbug":503632,"scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"3.4.1+dfsg-2"},"fixed_version":"2.46+dfsg-5","urgency":"low"},"bullseye":{"status":"resolved","repositories":{"bullseye":"2.83.5+dfsg-5+deb11u1","bullseye-security":"2.83.5+dfsg-5+deb11u1"},"fixed_version":"2.46+dfsg-5","urgency":"low"},"sid":{"status":"resolved","repositories":{"sid":"4.3.2+dfsg-2"},"fixed_version":"2.46+dfsg-5","urgency":"low"},"trixie":{"status":"resolved","repositories":{"trixie":"4.3.2+dfsg-2"},"fixed_version":"2.46+dfsg-5","urgency":"low"}}},"CVE-2009-3850":{"description":"Blender 2.34, 2.35a, 2.40, and 2.49b allows remote attackers to execute arbitrary code via a .blend file that contains Python statements in the onLoad action of a ScriptLink SDNA.","scope":"local","releases":{"bookworm":{"status":"open","repositories":{"bookworm":"3.4.1+dfsg-2"},"urgency":"unimportant"},"bullseye":{"status":"open","repositories":{"bullseye":"2.83.5+dfsg-5+deb11u1","bullseye-security":"2.83.5+dfsg-5+deb11u1"},"urgency":"unimportant"},"sid":{"status":"open","repositories":{"sid":"4.3.2+dfsg-2"},"urgency":"unimportant"},"trixie":{"status":"open","repositories":{"trixie":"4.3.2+dfsg-2"},"urgency":"unimportant"}}},"CVE-2010-5105":{"description":"The undo save quit routine in the kernel in Blender 2.5, 2.63a, and earlier allows local users to overwrite arbitrary files via a symlink attack on the quit.blend temporary file.  NOTE: this issue might be a regression of CVE-2008-1103.","debianbug":584621,"scope":"local","releases":{"bookworm":{"status":"open","repositories":{"bookworm":"3.4.1+dfsg-2"},"urgency":"unimportant"},"bullseye":{"status":"open","repositories":{"bullseye":"2.83.5+dfsg-5+deb11u1","bullseye-security":"2.83.5+dfsg-5+deb11u1"},"urgency":"unimportant"},"sid":{"status":"open","repositories":{"sid":"4.3.2+dfsg-2"},"urgency":"unimportant"},"trixie":{"status":"open","repositories":{"trixie":"4.3.2+dfsg-2"},"urgency":"unimportant"}}},"CVE-2017-12081":{"description":"An exploitable integer overflow exists in the upgrade of a legacy Mesh attribute of the Blender open-source 3d creation suite v2.78c. A specially crafted .blend file can cause an integer overflow resulting in a buffer overflow which can allow for code execution under the context of the application. An attacker can convince a user to open the file or use it as a library in order to trigger this vulnerability.","scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"3.4.1+dfsg-2"},"fixed_version":"2.79.a+dfsg0-1","urgency":"not yet assigned"},"bullseye":{"status":"resolved","repositories":{"bullseye":"2.83.5+dfsg-5+deb11u1","bullseye-security":"2.83.5+dfsg-5+deb11u1"},"fixed_version":"2.79.a+dfsg0-1","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"4.3.2+dfsg-2"},"fixed_version":"2.79.a+dfsg0-1","urgency":"not yet assigned"},"trixie":{"status":"resolved","repositories":{"trixie":"4.3.2+dfsg-2"},"fixed_version":"2.79.a+dfsg0-1","urgency":"not yet assigned"}}},"CVE-2017-12082":{"description":"An exploitable integer overflow exists in the 'CustomData' Mesh loading functionality of the Blender open-source 3d creation suite. A .blend file with a specially crafted external data file can cause an integer overflow resulting in a buffer overflow which can allow for code execution under the context of the application. An attacker can convince a user to edit an object within a .blend library in their Scene in order to trigger this vulnerability.","scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"3.4.1+dfsg-2"},"fixed_version":"2.79.a+dfsg0-1","urgency":"not yet assigned"},"bullseye":{"status":"resolved","repositories":{"bullseye":"2.83.5+dfsg-5+deb11u1","bullseye-security":"2.83.5+dfsg-5+deb11u1"},"fixed_version":"2.79.a+dfsg0-1","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"4.3.2+dfsg-2"},"fixed_version":"2.79.a+dfsg0-1","urgency":"not yet assigned"},"trixie":{"status":"resolved","repositories":{"trixie":"4.3.2+dfsg-2"},"fixed_version":"2.79.a+dfsg0-1","urgency":"not yet assigned"}}},"CVE-2017-12086":{"description":"An exploitable integer overflow exists in the 'BKE_mesh_calc_normals_tessface' functionality of the Blender open-source 3d creation suite. A specially crafted .blend file can cause an integer overflow resulting in a buffer overflow which can allow for code execution under the context of the application. An attacker can convince a user to open a .blend file in order to trigger this vulnerability.","scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"3.4.1+dfsg-2"},"fixed_version":"2.79.a+dfsg0-1","urgency":"not yet assigned"},"bullseye":{"status":"resolved","repositories":{"bullseye":"2.83.5+dfsg-5+deb11u1","bullseye-security":"2.83.5+dfsg-5+deb11u1"},"fixed_version":"2.79.a+dfsg0-1","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"4.3.2+dfsg-2"},"fixed_version":"2.79.a+dfsg0-1","urgency":"not yet assigned"},"trixie":{"status":"resolved","repositories":{"trixie":"4.3.2+dfsg-2"},"fixed_version":"2.79.a+dfsg0-1","urgency":"not yet assigned"}}},"CVE-2017-12099":{"description":"An exploitable integer overflow exists in the upgrade of the legacy Mesh attribute 'tface' of the Blender open-source 3d creation suite v2.78c. A specially crafted .blend file can cause an integer overflow resulting in a buffer overflow which can allow for code execution under the context of the application. An attacker can convince a user to open the file or use it as a library in order to trigger this vulnerability.","scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"3.4.1+dfsg-2"},"fixed_version":"2.79.a+dfsg0-1","urgency":"not yet assigned"},"bullseye":{"status":"resolved","repositories":{"bullseye":"2.83.5+dfsg-5+deb11u1","bullseye-security":"2.83.5+dfsg-5+deb11u1"},"fixed_version":"2.79.a+dfsg0-1","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"4.3.2+dfsg-2"},"fixed_version":"2.79.a+dfsg0-1","urgency":"not yet assigned"},"trixie":{"status":"resolved","repositories":{"trixie":"4.3.2+dfsg-2"},"fixed_version":"2.79.a+dfsg0-1","urgency":"not yet assigned"}}},"CVE-2017-12100":{"description":"An exploitable integer overflow exists in the 'multires_load_old_dm' functionality of the Blender open-source 3d creation suite v2.78c. A specially crafted .blend file can cause an integer overflow resulting in a buffer overflow which can allow for code execution under the context of the application. An attacker can convince a user to open a .blend file in order to trigger this vulnerability.","scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"3.4.1+dfsg-2"},"fixed_version":"2.79.a+dfsg0-1","urgency":"not yet assigned"},"bullseye":{"status":"resolved","repositories":{"bullseye":"2.83.5+dfsg-5+deb11u1","bullseye-security":"2.83.5+dfsg-5+deb11u1"},"fixed_version":"2.79.a+dfsg0-1","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"4.3.2+dfsg-2"},"fixed_version":"2.79.a+dfsg0-1","urgency":"not yet assigned"},"trixie":{"status":"resolved","repositories":{"trixie":"4.3.2+dfsg-2"},"fixed_version":"2.79.a+dfsg0-1","urgency":"not yet assigned"}}},"CVE-2017-12101":{"description":"An exploitable integer overflow exists in the 'modifier_mdef_compact_influences' functionality of the Blender open-source 3d creation suite v2.78c. A specially crafted .blend file can cause an integer overflow resulting in a buffer overflow which can allow for code execution under the context of the application. An attacker can convince a user to open a .blend file in order to trigger this vulnerability.","scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"3.4.1+dfsg-2"},"fixed_version":"2.79.a+dfsg0-1","urgency":"not yet assigned"},"bullseye":{"status":"resolved","repositories":{"bullseye":"2.83.5+dfsg-5+deb11u1","bullseye-security":"2.83.5+dfsg-5+deb11u1"},"fixed_version":"2.79.a+dfsg0-1","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"4.3.2+dfsg-2"},"fixed_version":"2.79.a+dfsg0-1","urgency":"not yet assigned"},"trixie":{"status":"resolved","repositories":{"trixie":"4.3.2+dfsg-2"},"fixed_version":"2.79.a+dfsg0-1","urgency":"not yet assigned"}}},"CVE-2017-12102":{"description":"An exploitable integer overflow exists in the way that the Blender open-source 3d creation suite v2.78c converts curves to polygons. A specially crafted .blend file can cause an integer overflow resulting in a buffer overflow which can allow for code execution under the context of the application. An attacker can convince a user to open the file or use the file as a library in order to trigger this vulnerability.","scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"3.4.1+dfsg-2"},"fixed_version":"2.79.a+dfsg0-1","urgency":"not yet assigned"},"bullseye":{"status":"resolved","repositories":{"bullseye":"2.83.5+dfsg-5+deb11u1","bullseye-security":"2.83.5+dfsg-5+deb11u1"},"fixed_version":"2.79.a+dfsg0-1","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"4.3.2+dfsg-2"},"fixed_version":"2.79.a+dfsg0-1","urgency":"not yet assigned"},"trixie":{"status":"resolved","repositories":{"trixie":"4.3.2+dfsg-2"},"fixed_version":"2.79.a+dfsg0-1","urgency":"not yet assigned"}}},"CVE-2017-12103":{"description":"An exploitable integer overflow exists in the way that the Blender open-source 3d creation suite v2.78c converts text rendered as a font into a curve. A specially crafted .blend file can cause an integer overflow resulting in a buffer overflow which can allow for code execution under the context of the application. An attacker can convince a user to open the file or use the file as a library in order to trigger this vulnerability.","scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"3.4.1+dfsg-2"},"fixed_version":"2.79.a+dfsg0-1","urgency":"not yet assigned"},"bullseye":{"status":"resolved","repositories":{"bullseye":"2.83.5+dfsg-5+deb11u1","bullseye-security":"2.83.5+dfsg-5+deb11u1"},"fixed_version":"2.79.a+dfsg0-1","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"4.3.2+dfsg-2"},"fixed_version":"2.79.a+dfsg0-1","urgency":"not yet assigned"},"trixie":{"status":"resolved","repositories":{"trixie":"4.3.2+dfsg-2"},"fixed_version":"2.79.a+dfsg0-1","urgency":"not yet assigned"}}},"CVE-2017-12104":{"description":"An exploitable integer overflow exists in the way that the Blender open-source 3d creation suite v2.78c draws a Particle object. A specially crafted .blend file can cause an integer overflow resulting in a buffer overflow which can allow for code execution under the context of the application. An attacker can convince a user to open the file or use the file as a library in order to trigger this vulnerability.","scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"3.4.1+dfsg-2"},"fixed_version":"2.79.a+dfsg0-1","urgency":"not yet assigned"},"bullseye":{"status":"resolved","repositories":{"bullseye":"2.83.5+dfsg-5+deb11u1","bullseye-security":"2.83.5+dfsg-5+deb11u1"},"fixed_version":"2.79.a+dfsg0-1","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"4.3.2+dfsg-2"},"fixed_version":"2.79.a+dfsg0-1","urgency":"not yet assigned"},"trixie":{"status":"resolved","repositories":{"trixie":"4.3.2+dfsg-2"},"fixed_version":"2.79.a+dfsg0-1","urgency":"not yet assigned"}}},"CVE-2017-12105":{"description":"An exploitable integer overflow exists in the way that the Blender open-source 3d creation suite v2.78c applies a particular object modifier to a Mesh. A specially crafted .blend file can cause an integer overflow resulting in a buffer overflow which can allow for code execution under the context of the application. An attacker can convince a user to open the file or use the file as a library in order to trigger this vulnerability.","scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"3.4.1+dfsg-2"},"fixed_version":"2.79.a+dfsg0-1","urgency":"not yet assigned"},"bullseye":{"status":"resolved","repositories":{"bullseye":"2.83.5+dfsg-5+deb11u1","bullseye-security":"2.83.5+dfsg-5+deb11u1"},"fixed_version":"2.79.a+dfsg0-1","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"4.3.2+dfsg-2"},"fixed_version":"2.79.a+dfsg0-1","urgency":"not yet assigned"},"trixie":{"status":"resolved","repositories":{"trixie":"4.3.2+dfsg-2"},"fixed_version":"2.79.a+dfsg0-1","urgency":"not yet assigned"}}},"CVE-2017-2899":{"description":"An exploitable integer overflow exists in the TIFF loading functionality of the Blender open-source 3d creation suite version 2.78c. A specially crafted '.tif' file can cause an integer overflow resulting in a buffer overflow which can allow for code execution under the context of the application. An attacker can convince a user to use the file as an asset via the sequencer in order to trigger this vulnerability.","scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"3.4.1+dfsg-2"},"fixed_version":"2.79.a+dfsg0-1","urgency":"not yet assigned"},"bullseye":{"status":"resolved","repositories":{"bullseye":"2.83.5+dfsg-5+deb11u1","bullseye-security":"2.83.5+dfsg-5+deb11u1"},"fixed_version":"2.79.a+dfsg0-1","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"4.3.2+dfsg-2"},"fixed_version":"2.79.a+dfsg0-1","urgency":"not yet assigned"},"trixie":{"status":"resolved","repositories":{"trixie":"4.3.2+dfsg-2"},"fixed_version":"2.79.a+dfsg0-1","urgency":"not yet assigned"}}},"CVE-2017-2900":{"description":"An exploitable integer overflow exists in the PNG loading functionality of the Blender open-source 3d creation suite version 2.78c. A specially crafted '.png' file can cause an integer overflow resulting in a buffer overflow which can allow for code execution under the context of the application. An attacker can convince a user to use the file as an asset via the sequencer in order to trigger this vulnerability.","scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"3.4.1+dfsg-2"},"fixed_version":"2.79.a+dfsg0-1","urgency":"not yet assigned"},"bullseye":{"status":"resolved","repositories":{"bullseye":"2.83.5+dfsg-5+deb11u1","bullseye-security":"2.83.5+dfsg-5+deb11u1"},"fixed_version":"2.79.a+dfsg0-1","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"4.3.2+dfsg-2"},"fixed_version":"2.79.a+dfsg0-1","urgency":"not yet assigned"},"trixie":{"status":"resolved","repositories":{"trixie":"4.3.2+dfsg-2"},"fixed_version":"2.79.a+dfsg0-1","urgency":"not yet assigned"}}},"CVE-2017-2901":{"description":"An exploitable integer overflow exists in the IRIS loading functionality of the Blender open-source 3d creation suite version 2.78c. A specially crafted '.iris' file can cause an integer overflow resulting in a buffer overflow which can allow for code execution under the context of the application. An attacker can convince a user to use the file as an asset via the sequencer in order to trigger this vulnerability.","scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"3.4.1+dfsg-2"},"fixed_version":"2.79.a+dfsg0-1","urgency":"not yet assigned"},"bullseye":{"status":"resolved","repositories":{"bullseye":"2.83.5+dfsg-5+deb11u1","bullseye-security":"2.83.5+dfsg-5+deb11u1"},"fixed_version":"2.79.a+dfsg0-1","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"4.3.2+dfsg-2"},"fixed_version":"2.79.a+dfsg0-1","urgency":"not yet assigned"},"trixie":{"status":"resolved","repositories":{"trixie":"4.3.2+dfsg-2"},"fixed_version":"2.79.a+dfsg0-1","urgency":"not yet assigned"}}},"CVE-2017-2902":{"description":"An exploitable integer overflow exists in the DPX loading functionality of the Blender open-source 3d creation suite version 2.78c. A specially crafted '.cin' file can cause an integer overflow resulting in a buffer overflow which can allow for code execution under the context of the application. An attacker can convince a user to use the file as an asset via the sequencer in order to trigger this vulnerability.","scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"3.4.1+dfsg-2"},"fixed_version":"2.79.a+dfsg0-1","urgency":"not yet assigned"},"bullseye":{"status":"resolved","repositories":{"bullseye":"2.83.5+dfsg-5+deb11u1","bullseye-security":"2.83.5+dfsg-5+deb11u1"},"fixed_version":"2.79.a+dfsg0-1","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"4.3.2+dfsg-2"},"fixed_version":"2.79.a+dfsg0-1","urgency":"not yet assigned"},"trixie":{"status":"resolved","repositories":{"trixie":"4.3.2+dfsg-2"},"fixed_version":"2.79.a+dfsg0-1","urgency":"not yet assigned"}}},"CVE-2017-2903":{"description":"An exploitable integer overflow exists in the DPX loading functionality of the Blender open-source 3d creation suite version 2.78c. A specially crafted '.cin' file can cause an integer overflow resulting in a buffer overflow which can allow for code execution under the context of the application. An attacker can convince a user to use the file as an asset via the sequencer in order to trigger this vulnerability.","scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"3.4.1+dfsg-2"},"fixed_version":"2.79.a+dfsg0-1","urgency":"not yet assigned"},"bullseye":{"status":"resolved","repositories":{"bullseye":"2.83.5+dfsg-5+deb11u1","bullseye-security":"2.83.5+dfsg-5+deb11u1"},"fixed_version":"2.79.a+dfsg0-1","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"4.3.2+dfsg-2"},"fixed_version":"2.79.a+dfsg0-1","urgency":"not yet assigned"},"trixie":{"status":"resolved","repositories":{"trixie":"4.3.2+dfsg-2"},"fixed_version":"2.79.a+dfsg0-1","urgency":"not yet assigned"}}},"CVE-2017-2904":{"description":"An exploitable integer overflow exists in the RADIANCE loading functionality of the Blender open-source 3d creation suite version 2.78c. A specially crafted '.hdr' file can cause an integer overflow resulting in a buffer overflow which can allow for code execution under the context of the application. An attacker can convince a user to use the file as an asset via the sequencer in order to trigger this vulnerability.","scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"3.4.1+dfsg-2"},"fixed_version":"2.79.a+dfsg0-1","urgency":"not yet assigned"},"bullseye":{"status":"resolved","repositories":{"bullseye":"2.83.5+dfsg-5+deb11u1","bullseye-security":"2.83.5+dfsg-5+deb11u1"},"fixed_version":"2.79.a+dfsg0-1","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"4.3.2+dfsg-2"},"fixed_version":"2.79.a+dfsg0-1","urgency":"not yet assigned"},"trixie":{"status":"resolved","repositories":{"trixie":"4.3.2+dfsg-2"},"fixed_version":"2.79.a+dfsg0-1","urgency":"not yet assigned"}}},"CVE-2017-2905":{"description":"An exploitable integer overflow exists in the bmp loading functionality of the Blender open-source 3d creation suite version 2.78c. A specially crafted '.bmp' file can cause an integer overflow resulting in a buffer overflow which can allow for code execution under the context of the application. An attacker can convince a user to use the file as an asset via the sequencer in order to trigger this vulnerability.","scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"3.4.1+dfsg-2"},"fixed_version":"2.79.a+dfsg0-1","urgency":"not yet assigned"},"bullseye":{"status":"resolved","repositories":{"bullseye":"2.83.5+dfsg-5+deb11u1","bullseye-security":"2.83.5+dfsg-5+deb11u1"},"fixed_version":"2.79.a+dfsg0-1","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"4.3.2+dfsg-2"},"fixed_version":"2.79.a+dfsg0-1","urgency":"not yet assigned"},"trixie":{"status":"resolved","repositories":{"trixie":"4.3.2+dfsg-2"},"fixed_version":"2.79.a+dfsg0-1","urgency":"not yet assigned"}}},"CVE-2017-2906":{"description":"An exploitable integer overflow exists in the animation playing functionality of the Blender open-source 3d creation suite version 2.78c. A specially created '.avi' file can cause an integer overflow resulting in a buffer overflow which can allow for code execution under the context of the application. An attacker can convince a user to use the file as an asset in order to trigger this vulnerability.","scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"3.4.1+dfsg-2"},"fixed_version":"2.79.a+dfsg0-1","urgency":"not yet assigned"},"bullseye":{"status":"resolved","repositories":{"bullseye":"2.83.5+dfsg-5+deb11u1","bullseye-security":"2.83.5+dfsg-5+deb11u1"},"fixed_version":"2.79.a+dfsg0-1","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"4.3.2+dfsg-2"},"fixed_version":"2.79.a+dfsg0-1","urgency":"not yet assigned"},"trixie":{"status":"resolved","repositories":{"trixie":"4.3.2+dfsg-2"},"fixed_version":"2.79.a+dfsg0-1","urgency":"not yet assigned"}}},"CVE-2017-2907":{"description":"An exploitable integer overflow exists in the animation playing functionality of the Blender open-source 3d creation suite version 2.78c. A specially created '.avi' file can cause an integer overflow resulting in a buffer overflow which can allow for code execution under the context of the application. An attacker can convince a user to use the file as an asset in order to trigger this vulnerability.","scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"3.4.1+dfsg-2"},"fixed_version":"2.79.a+dfsg0-1","urgency":"not yet assigned"},"bullseye":{"status":"resolved","repositories":{"bullseye":"2.83.5+dfsg-5+deb11u1","bullseye-security":"2.83.5+dfsg-5+deb11u1"},"fixed_version":"2.79.a+dfsg0-1","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"4.3.2+dfsg-2"},"fixed_version":"2.79.a+dfsg0-1","urgency":"not yet assigned"},"trixie":{"status":"resolved","repositories":{"trixie":"4.3.2+dfsg-2"},"fixed_version":"2.79.a+dfsg0-1","urgency":"not yet assigned"}}},"CVE-2017-2908":{"description":"An exploitable integer overflow exists in the thumbnail functionality of the Blender open-source 3d creation suite version 2.78c. A specially crafted .blend file can cause an integer overflow resulting in a buffer overflow which can allow for code execution under the context of the application. An attacker can convince a user to render the thumbnail for the file while in the File->Open dialog.","scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"3.4.1+dfsg-2"},"fixed_version":"2.79.a+dfsg0-1","urgency":"not yet assigned"},"bullseye":{"status":"resolved","repositories":{"bullseye":"2.83.5+dfsg-5+deb11u1","bullseye-security":"2.83.5+dfsg-5+deb11u1"},"fixed_version":"2.79.a+dfsg0-1","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"4.3.2+dfsg-2"},"fixed_version":"2.79.a+dfsg0-1","urgency":"not yet assigned"},"trixie":{"status":"resolved","repositories":{"trixie":"4.3.2+dfsg-2"},"fixed_version":"2.79.a+dfsg0-1","urgency":"not yet assigned"}}},"CVE-2017-2918":{"description":"An exploitable integer overflow exists in the Image loading functionality of the Blender open-source 3d creation suite v2.78c. A specially crafted .blend file can cause an integer overflow resulting in a buffer overflow which can allow for code execution under the context of the application. An attacker can convince a user to open the file or use it as a library in order to trigger this vulnerability.","scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"3.4.1+dfsg-2"},"fixed_version":"2.79.a+dfsg0-1","urgency":"not yet assigned"},"bullseye":{"status":"resolved","repositories":{"bullseye":"2.83.5+dfsg-5+deb11u1","bullseye-security":"2.83.5+dfsg-5+deb11u1"},"fixed_version":"2.79.a+dfsg0-1","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"4.3.2+dfsg-2"},"fixed_version":"2.79.a+dfsg0-1","urgency":"not yet assigned"},"trixie":{"status":"resolved","repositories":{"trixie":"4.3.2+dfsg-2"},"fixed_version":"2.79.a+dfsg0-1","urgency":"not yet assigned"}}},"CVE-2022-0544":{"description":"An integer underflow in the DDS loader of Blender leads to an out-of-bounds read, possibly allowing an attacker to read sensitive data using a crafted DDS image file. This flaw affects Blender versions prior to 2.83.19, 2.93.8 and 3.1.","scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"3.4.1+dfsg-2"},"fixed_version":"3.1.2+dfsg-1","urgency":"not yet assigned"},"bullseye":{"status":"resolved","repositories":{"bullseye":"2.83.5+dfsg-5+deb11u1","bullseye-security":"2.83.5+dfsg-5+deb11u1"},"fixed_version":"2.83.5+dfsg-5+deb11u1","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"4.3.2+dfsg-2"},"fixed_version":"3.1.2+dfsg-1","urgency":"not yet assigned"},"trixie":{"status":"resolved","repositories":{"trixie":"4.3.2+dfsg-2"},"fixed_version":"3.1.2+dfsg-1","urgency":"not yet assigned"}}},"CVE-2022-0545":{"description":"An integer overflow in the processing of loaded 2D images leads to a write-what-where vulnerability and an out-of-bounds read vulnerability, allowing an attacker to leak sensitive information or achieve code execution in the context of the Blender process when a specially crafted image file is loaded. This flaw affects Blender versions prior to 2.83.19, 2.93.8 and 3.1.","scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"3.4.1+dfsg-2"},"fixed_version":"3.1.2+dfsg-1","urgency":"not yet assigned"},"bullseye":{"status":"resolved","repositories":{"bullseye":"2.83.5+dfsg-5+deb11u1","bullseye-security":"2.83.5+dfsg-5+deb11u1"},"fixed_version":"2.83.5+dfsg-5+deb11u1","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"4.3.2+dfsg-2"},"fixed_version":"3.1.2+dfsg-1","urgency":"not yet assigned"},"trixie":{"status":"resolved","repositories":{"trixie":"4.3.2+dfsg-2"},"fixed_version":"3.1.2+dfsg-1","urgency":"not yet assigned"}}},"CVE-2022-0546":{"description":"A missing bounds check in the image loader used in Blender 3.x and 2.93.8 leads to out-of-bounds heap access, allowing an attacker to cause denial of service, memory corruption or potentially code execution.","scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"3.4.1+dfsg-2"},"fixed_version":"3.1.2+dfsg-1","urgency":"not yet assigned"},"bullseye":{"status":"resolved","repositories":{"bullseye":"2.83.5+dfsg-5+deb11u1","bullseye-security":"2.83.5+dfsg-5+deb11u1"},"fixed_version":"2.83.5+dfsg-5+deb11u1","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"4.3.2+dfsg-2"},"fixed_version":"3.1.2+dfsg-1","urgency":"not yet assigned"},"trixie":{"status":"resolved","repositories":{"trixie":"4.3.2+dfsg-2"},"fixed_version":"3.1.2+dfsg-1","urgency":"not yet assigned"}}},"CVE-2022-2831":{"description":"A flaw was found in Blender 3.3.0. An interger overflow in source/blender/blendthumb/src/blendthumb_extract.cc may lead to program crash or memory corruption.","scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"3.4.1+dfsg-2"},"fixed_version":"3.2.2+dfsg-1","urgency":"not yet assigned"},"bullseye":{"status":"open","repositories":{"bullseye":"2.83.5+dfsg-5+deb11u1","bullseye-security":"2.83.5+dfsg-5+deb11u1"},"urgency":"not yet assigned","nodsa":"Minor issue","nodsa_reason":""},"sid":{"status":"resolved","repositories":{"sid":"4.3.2+dfsg-2"},"fixed_version":"3.2.2+dfsg-1","urgency":"not yet assigned"},"trixie":{"status":"resolved","repositories":{"trixie":"4.3.2+dfsg-2"},"fixed_version":"3.2.2+dfsg-1","urgency":"not yet assigned"}}},"CVE-2022-2832":{"description":"A flaw was found in Blender 3.3.0. A null pointer dereference exists in source/blender/gpu/opengl/gl_backend.cc that may lead to loss of confidentiality and integrity.","scope":"local","releases":{"bookworm":{"status":"open","repositories":{"bookworm":"3.4.1+dfsg-2"},"urgency":"unimportant"},"bullseye":{"status":"open","repositories":{"bullseye":"2.83.5+dfsg-5+deb11u1","bullseye-security":"2.83.5+dfsg-5+deb11u1"},"urgency":"unimportant"},"sid":{"status":"open","repositories":{"sid":"4.3.2+dfsg-2"},"urgency":"unimportant"},"trixie":{"status":"open","repositories":{"trixie":"4.3.2+dfsg-2"},"urgency":"unimportant"}}},"CVE-2022-2833":{"description":"Endless Infinite loop in Blender-thumnailing due to logical bugs.","scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"3.4.1+dfsg-2"},"fixed_version":"3.2.2+dfsg-1","urgency":"unimportant"},"bullseye":{"status":"open","repositories":{"bullseye":"2.83.5+dfsg-5+deb11u1","bullseye-security":"2.83.5+dfsg-5+deb11u1"},"urgency":"unimportant"},"sid":{"status":"resolved","repositories":{"sid":"4.3.2+dfsg-2"},"fixed_version":"3.2.2+dfsg-1","urgency":"unimportant"},"trixie":{"status":"resolved","repositories":{"trixie":"4.3.2+dfsg-2"},"fixed_version":"3.2.2+dfsg-1","urgency":"unimportant"}}}},"blktrace":{"CVE-2018-10689":{"description":"blktrace (aka Block IO Tracing) 1.2.0, as used with the Linux kernel and Android, has a buffer overflow in the dev_map_read function in btt/devmap.c because the device and devno arrays are too small, as demonstrated by an invalid free when using the btt program with a crafted file.","debianbug":897695,"scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"1.2.0-5"},"fixed_version":"1.2.0-1","urgency":"low"},"bullseye":{"status":"resolved","repositories":{"bullseye":"1.2.0-5"},"fixed_version":"1.2.0-1","urgency":"low"},"forky":{"status":"resolved","repositories":{"forky":"1.3.0-0.2"},"fixed_version":"1.2.0-1","urgency":"low"},"sid":{"status":"resolved","repositories":{"sid":"1.3.0-0.2"},"fixed_version":"1.2.0-1","urgency":"low"},"trixie":{"status":"resolved","repositories":{"trixie":"1.3.0-0.2"},"fixed_version":"1.2.0-1","urgency":"low"}}}},"blosxom":{"CVE-2008-2236":{"description":"Cross-site scripting (XSS) vulnerability in blosxom.cgi in Blosxom before 2.1.2 allows remote attackers to inject arbitrary web script or HTML via the flav parameter (flavour variable).  NOTE: some of these details are obtained from third party information.","debianbug":500873,"scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"2.1.2-2.1"},"fixed_version":"2.1.2-1","urgency":"low"},"bullseye":{"status":"resolved","repositories":{"bullseye":"2.1.2-2.1"},"fixed_version":"2.1.2-1","urgency":"low"},"forky":{"status":"resolved","repositories":{"forky":"2.2.0-1"},"fixed_version":"2.1.2-1","urgency":"low"},"sid":{"status":"resolved","repositories":{"sid":"2.2.0-1"},"fixed_version":"2.1.2-1","urgency":"low"},"trixie":{"status":"resolved","repositories":{"trixie":"2.1.2-2.2"},"fixed_version":"2.1.2-1","urgency":"low"}}}},"blueman":{"CVE-2015-8612":{"description":"The EnableNetwork method in the Network class in plugins/mechanism/Network.py in Blueman before 2.0.3 allows local users to gain privileges via the dhcp_handler argument.","scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"2.3.5-2"},"fixed_version":"2.0.3-1","urgency":"not yet assigned"},"bullseye":{"status":"resolved","repositories":{"bullseye":"2.1.4-1"},"fixed_version":"2.0.3-1","urgency":"not yet assigned"},"forky":{"status":"resolved","repositories":{"forky":"2.4.4-1"},"fixed_version":"2.0.3-1","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"2.4.4-1"},"fixed_version":"2.0.3-1","urgency":"not yet assigned"},"trixie":{"status":"resolved","repositories":{"trixie":"2.4.4-1"},"fixed_version":"2.0.3-1","urgency":"not yet assigned"}}},"CVE-2020-15238":{"description":"Blueman is a GTK+ Bluetooth Manager. In Blueman before 2.1.4, the DhcpClient method of the D-Bus interface to blueman-mechanism is prone to an argument injection vulnerability. The impact highly depends on the system configuration. If Polkit-1 is disabled and for versions lower than 2.0.6, any local user can possibly exploit this. If Polkit-1 is enabled for version 2.0.6 and later, a possible attacker needs to be allowed to use the `org.blueman.dhcp.client` action. That is limited to users in the wheel group in the shipped rules file that do have the privileges anyway. On systems with ISC DHCP client (dhclient), attackers can pass arguments to `ip link` with the interface name that can e.g. be used to bring down an interface or add an arbitrary XDP/BPF program. On systems with dhcpcd and without ISC DHCP client, attackers can even run arbitrary scripts by passing `-c/path/to/script` as an interface name. Patches are included in 2.1.4 and master that change the DhcpClient D-Bus method(s) to accept BlueZ network object paths instead of network interface names. A backport to 2.0(.8) is also available. As a workaround, make sure that Polkit-1-support is enabled and limit privileges for the `org.blueman.dhcp.client` action to users that are able to run arbitrary commands as root anyway in /usr/share/polkit-1/rules.d/blueman.rules.","debianbug":973718,"scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"2.3.5-2"},"fixed_version":"2.1.4-1","urgency":"not yet assigned"},"bullseye":{"status":"resolved","repositories":{"bullseye":"2.1.4-1"},"fixed_version":"2.1.4-1","urgency":"not yet assigned"},"forky":{"status":"resolved","repositories":{"forky":"2.4.4-1"},"fixed_version":"2.1.4-1","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"2.4.4-1"},"fixed_version":"2.1.4-1","urgency":"not yet assigned"},"trixie":{"status":"resolved","repositories":{"trixie":"2.4.4-1"},"fixed_version":"2.1.4-1","urgency":"not yet assigned"}}}},"bluez":{"CVE-2016-7837":{"description":"Buffer overflow in BlueZ 5.41 and earlier allows an attacker to execute arbitrary code via the parse_line function used in some userland utilities.","scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"5.66-1+deb12u2","bookworm-security":"5.66-1+deb12u1"},"fixed_version":"5.43-1","urgency":"not yet assigned"},"bullseye":{"status":"resolved","repositories":{"bullseye":"5.55-3.1+deb11u1","bullseye-security":"5.55-3.1+deb11u2"},"fixed_version":"5.43-1","urgency":"not yet assigned"},"forky":{"status":"resolved","repositories":{"forky":"5.84-1"},"fixed_version":"5.43-1","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"5.85-3"},"fixed_version":"5.43-1","urgency":"not yet assigned"},"trixie":{"status":"resolved","repositories":{"trixie":"5.82-1.1"},"fixed_version":"5.43-1","urgency":"not yet assigned"}}},"CVE-2016-9797":{"description":"In BlueZ 5.42, a buffer over-read was observed in \"l2cap_dump\" function in \"tools/parser/l2cap.c\" source file. This issue can be triggered by processing a corrupted dump file and will result in hcidump crash.","debianbug":847837,"scope":"local","releases":{"bookworm":{"status":"open","repositories":{"bookworm":"5.66-1+deb12u2","bookworm-security":"5.66-1+deb12u1"},"urgency":"unimportant"},"bullseye":{"status":"open","repositories":{"bullseye":"5.55-3.1+deb11u1","bullseye-security":"5.55-3.1+deb11u2"},"urgency":"unimportant"},"forky":{"status":"open","repositories":{"forky":"5.84-1"},"urgency":"unimportant"},"sid":{"status":"open","repositories":{"sid":"5.85-3"},"urgency":"unimportant"},"trixie":{"status":"open","repositories":{"trixie":"5.82-1.1"},"urgency":"unimportant"}}},"CVE-2016-9798":{"description":"In BlueZ 5.42, a use-after-free was identified in \"conf_opt\" function in \"tools/parser/l2cap.c\" source file. This issue can be triggered by processing a corrupted dump file and will result in hcidump crash.","debianbug":847837,"scope":"local","releases":{"bookworm":{"status":"open","repositories":{"bookworm":"5.66-1+deb12u2","bookworm-security":"5.66-1+deb12u1"},"urgency":"unimportant"},"bullseye":{"status":"open","repositories":{"bullseye":"5.55-3.1+deb11u1","bullseye-security":"5.55-3.1+deb11u2"},"urgency":"unimportant"},"forky":{"status":"open","repositories":{"forky":"5.84-1"},"urgency":"unimportant"},"sid":{"status":"open","repositories":{"sid":"5.85-3"},"urgency":"unimportant"},"trixie":{"status":"open","repositories":{"trixie":"5.82-1.1"},"urgency":"unimportant"}}},"CVE-2016-9799":{"description":"In BlueZ 5.42, a buffer overflow was observed in \"pklg_read_hci\" function in \"btsnoop.c\" source file. This issue can be triggered by processing a corrupted dump file and will result in btmon crash.","debianbug":847837,"scope":"local","releases":{"bookworm":{"status":"open","repositories":{"bookworm":"5.66-1+deb12u2","bookworm-security":"5.66-1+deb12u1"},"urgency":"unimportant"},"bullseye":{"status":"open","repositories":{"bullseye":"5.55-3.1+deb11u1","bullseye-security":"5.55-3.1+deb11u2"},"urgency":"unimportant"},"forky":{"status":"open","repositories":{"forky":"5.84-1"},"urgency":"unimportant"},"sid":{"status":"open","repositories":{"sid":"5.85-3"},"urgency":"unimportant"},"trixie":{"status":"open","repositories":{"trixie":"5.82-1.1"},"urgency":"unimportant"}}},"CVE-2016-9800":{"description":"In BlueZ 5.42, a buffer overflow was observed in \"pin_code_reply_dump\" function in \"tools/parser/hci.c\" source file. The issue exists because \"pin\" array is overflowed by supplied parameter due to lack of boundary checks on size of the buffer from frame \"pin_code_reply_cp *cp\" parameter.","debianbug":847837,"scope":"local","releases":{"bookworm":{"status":"open","repositories":{"bookworm":"5.66-1+deb12u2","bookworm-security":"5.66-1+deb12u1"},"urgency":"unimportant"},"bullseye":{"status":"open","repositories":{"bullseye":"5.55-3.1+deb11u1","bullseye-security":"5.55-3.1+deb11u2"},"urgency":"unimportant"},"forky":{"status":"open","repositories":{"forky":"5.84-1"},"urgency":"unimportant"},"sid":{"status":"open","repositories":{"sid":"5.85-3"},"urgency":"unimportant"},"trixie":{"status":"open","repositories":{"trixie":"5.82-1.1"},"urgency":"unimportant"}}},"CVE-2016-9801":{"description":"In BlueZ 5.42, a buffer overflow was observed in \"set_ext_ctrl\" function in \"tools/parser/l2cap.c\" source file when processing corrupted dump file.","debianbug":847837,"scope":"local","releases":{"bookworm":{"status":"open","repositories":{"bookworm":"5.66-1+deb12u2","bookworm-security":"5.66-1+deb12u1"},"urgency":"unimportant"},"bullseye":{"status":"open","repositories":{"bullseye":"5.55-3.1+deb11u1","bullseye-security":"5.55-3.1+deb11u2"},"urgency":"unimportant"},"forky":{"status":"open","repositories":{"forky":"5.84-1"},"urgency":"unimportant"},"sid":{"status":"open","repositories":{"sid":"5.85-3"},"urgency":"unimportant"},"trixie":{"status":"open","repositories":{"trixie":"5.82-1.1"},"urgency":"unimportant"}}},"CVE-2016-9802":{"description":"In BlueZ 5.42, a buffer over-read was identified in \"l2cap_packet\" function in \"monitor/packet.c\" source file. This issue can be triggered by processing a corrupted dump file and will result in btmon crash.","debianbug":847837,"scope":"local","releases":{"bookworm":{"status":"open","repositories":{"bookworm":"5.66-1+deb12u2","bookworm-security":"5.66-1+deb12u1"},"urgency":"unimportant"},"bullseye":{"status":"open","repositories":{"bullseye":"5.55-3.1+deb11u1","bullseye-security":"5.55-3.1+deb11u2"},"urgency":"unimportant"},"forky":{"status":"open","repositories":{"forky":"5.84-1"},"urgency":"unimportant"},"sid":{"status":"open","repositories":{"sid":"5.85-3"},"urgency":"unimportant"},"trixie":{"status":"open","repositories":{"trixie":"5.82-1.1"},"urgency":"unimportant"}}},"CVE-2016-9803":{"description":"In BlueZ 5.42, an out-of-bounds read was observed in \"le_meta_ev_dump\" function in \"tools/parser/hci.c\" source file. This issue exists because 'subevent' (which is used to read correct element from 'ev_le_meta_str' array) is overflowed.","debianbug":847837,"scope":"local","releases":{"bookworm":{"status":"open","repositories":{"bookworm":"5.66-1+deb12u2","bookworm-security":"5.66-1+deb12u1"},"urgency":"unimportant"},"bullseye":{"status":"open","repositories":{"bullseye":"5.55-3.1+deb11u1","bullseye-security":"5.55-3.1+deb11u2"},"urgency":"unimportant"},"forky":{"status":"open","repositories":{"forky":"5.84-1"},"urgency":"unimportant"},"sid":{"status":"open","repositories":{"sid":"5.85-3"},"urgency":"unimportant"},"trixie":{"status":"open","repositories":{"trixie":"5.82-1.1"},"urgency":"unimportant"}}},"CVE-2016-9804":{"description":"In BlueZ 5.42, a buffer overflow was observed in \"commands_dump\" function in \"tools/parser/csr.c\" source file. The issue exists because \"commands\" array is overflowed by supplied parameter due to lack of boundary checks on size of the buffer from frame \"frm->ptr\" parameter. This issue can be triggered by processing a corrupted dump file and will result in hcidump crash.","debianbug":847837,"scope":"local","releases":{"bookworm":{"status":"open","repositories":{"bookworm":"5.66-1+deb12u2","bookworm-security":"5.66-1+deb12u1"},"urgency":"unimportant"},"bullseye":{"status":"open","repositories":{"bullseye":"5.55-3.1+deb11u1","bullseye-security":"5.55-3.1+deb11u2"},"urgency":"unimportant"},"forky":{"status":"open","repositories":{"forky":"5.84-1"},"urgency":"unimportant"},"sid":{"status":"open","repositories":{"sid":"5.85-3"},"urgency":"unimportant"},"trixie":{"status":"open","repositories":{"trixie":"5.82-1.1"},"urgency":"unimportant"}}},"CVE-2016-9917":{"description":"In BlueZ 5.42, a buffer overflow was observed in \"read_n\" function in \"tools/hcidump.c\" source file. This issue can be triggered by processing a corrupted dump file and will result in hcidump crash.","debianbug":847837,"scope":"local","releases":{"bookworm":{"status":"open","repositories":{"bookworm":"5.66-1+deb12u2","bookworm-security":"5.66-1+deb12u1"},"urgency":"unimportant"},"bullseye":{"status":"open","repositories":{"bullseye":"5.55-3.1+deb11u1","bullseye-security":"5.55-3.1+deb11u2"},"urgency":"unimportant"},"forky":{"status":"open","repositories":{"forky":"5.84-1"},"urgency":"unimportant"},"sid":{"status":"open","repositories":{"sid":"5.85-3"},"urgency":"unimportant"},"trixie":{"status":"open","repositories":{"trixie":"5.82-1.1"},"urgency":"unimportant"}}},"CVE-2016-9918":{"description":"In BlueZ 5.42, an out-of-bounds read was identified in \"packet_hexdump\" function in \"monitor/packet.c\" source file. This issue can be triggered by processing a corrupted dump file and will result in btmon crash.","debianbug":847837,"scope":"local","releases":{"bookworm":{"status":"open","repositories":{"bookworm":"5.66-1+deb12u2","bookworm-security":"5.66-1+deb12u1"},"urgency":"unimportant"},"bullseye":{"status":"open","repositories":{"bullseye":"5.55-3.1+deb11u1","bullseye-security":"5.55-3.1+deb11u2"},"urgency":"unimportant"},"forky":{"status":"open","repositories":{"forky":"5.84-1"},"urgency":"unimportant"},"sid":{"status":"open","repositories":{"sid":"5.85-3"},"urgency":"unimportant"},"trixie":{"status":"open","repositories":{"trixie":"5.82-1.1"},"urgency":"unimportant"}}},"CVE-2017-1000250":{"description":"All versions of the SDP server in BlueZ 5.46 and earlier are vulnerable to an information disclosure vulnerability which allows remote attackers to obtain sensitive information from the bluetoothd process memory. This vulnerability lies in the processing of SDP search attribute requests.","debianbug":875633,"scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"5.66-1+deb12u2","bookworm-security":"5.66-1+deb12u1"},"fixed_version":"5.46-1","urgency":"not yet assigned"},"bullseye":{"status":"resolved","repositories":{"bullseye":"5.55-3.1+deb11u1","bullseye-security":"5.55-3.1+deb11u2"},"fixed_version":"5.46-1","urgency":"not yet assigned"},"forky":{"status":"resolved","repositories":{"forky":"5.84-1"},"fixed_version":"5.46-1","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"5.85-3"},"fixed_version":"5.46-1","urgency":"not yet assigned"},"trixie":{"status":"resolved","repositories":{"trixie":"5.82-1.1"},"fixed_version":"5.46-1","urgency":"not yet assigned"}}},"CVE-2018-10910":{"description":"A bug in Bluez may allow for the Bluetooth Discoverable state being set to on when no Bluetooth agent is registered with the system. This situation could lead to the unauthorized pairing of certain Bluetooth devices without any form of authentication. Versions before bluez 5.51 are vulnerable.","debianbug":925369,"scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"5.66-1+deb12u2","bookworm-security":"5.66-1+deb12u1"},"fixed_version":"5.54-1","urgency":"low"},"bullseye":{"status":"resolved","repositories":{"bullseye":"5.55-3.1+deb11u1","bullseye-security":"5.55-3.1+deb11u2"},"fixed_version":"5.54-1","urgency":"low"},"forky":{"status":"resolved","repositories":{"forky":"5.84-1"},"fixed_version":"5.54-1","urgency":"low"},"sid":{"status":"resolved","repositories":{"sid":"5.85-3"},"fixed_version":"5.54-1","urgency":"low"},"trixie":{"status":"resolved","repositories":{"trixie":"5.82-1.1"},"fixed_version":"5.54-1","urgency":"low"}}},"CVE-2019-8921":{"description":"An issue was discovered in bluetoothd in BlueZ through 5.48. The vulnerability lies in the handling of a SVC_ATTR_REQ by the SDP implementation. By crafting a malicious CSTATE, it is possible to trick the server into returning more bytes than the buffer actually holds, resulting in leaking arbitrary heap data. The root cause can be found in the function service_attr_req of sdpd-request.c. The server does not check whether the CSTATE data is the same in consecutive requests, and instead simply trusts that it is the same.","scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"5.66-1+deb12u2","bookworm-security":"5.66-1+deb12u1"},"fixed_version":"5.54-1","urgency":"not yet assigned"},"bullseye":{"status":"resolved","repositories":{"bullseye":"5.55-3.1+deb11u1","bullseye-security":"5.55-3.1+deb11u2"},"fixed_version":"5.54-1","urgency":"not yet assigned"},"forky":{"status":"resolved","repositories":{"forky":"5.84-1"},"fixed_version":"5.54-1","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"5.85-3"},"fixed_version":"5.54-1","urgency":"not yet assigned"},"trixie":{"status":"resolved","repositories":{"trixie":"5.82-1.1"},"fixed_version":"5.54-1","urgency":"not yet assigned"}}},"CVE-2019-8922":{"description":"A heap-based buffer overflow was discovered in bluetoothd in BlueZ through 5.48. There isn't any check on whether there is enough space in the destination buffer. The function simply appends all data passed to it. The values of all attributes that are requested are appended to the output buffer. There are no size checks whatsoever, resulting in a simple heap overflow if one can craft a request where the response is large enough to overflow the preallocated buffer. This issue exists in service_attr_req gets called by process_request (in sdpd-request.c), which also allocates the response buffer.","scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"5.66-1+deb12u2","bookworm-security":"5.66-1+deb12u1"},"fixed_version":"5.54-1","urgency":"not yet assigned"},"bullseye":{"status":"resolved","repositories":{"bullseye":"5.55-3.1+deb11u1","bullseye-security":"5.55-3.1+deb11u2"},"fixed_version":"5.54-1","urgency":"not yet assigned"},"forky":{"status":"resolved","repositories":{"forky":"5.84-1"},"fixed_version":"5.54-1","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"5.85-3"},"fixed_version":"5.54-1","urgency":"not yet assigned"},"trixie":{"status":"resolved","repositories":{"trixie":"5.82-1.1"},"fixed_version":"5.54-1","urgency":"not yet assigned"}}},"CVE-2020-0556":{"description":"Improper access control in subsystem for BlueZ before version 5.54 may allow an unauthenticated user to potentially enable escalation of privilege and denial of service via adjacent access","debianbug":953770,"scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"5.66-1+deb12u2","bookworm-security":"5.66-1+deb12u1"},"fixed_version":"5.50-1.1","urgency":"not yet assigned"},"bullseye":{"status":"resolved","repositories":{"bullseye":"5.55-3.1+deb11u1","bullseye-security":"5.55-3.1+deb11u2"},"fixed_version":"5.50-1.1","urgency":"not yet assigned"},"forky":{"status":"resolved","repositories":{"forky":"5.84-1"},"fixed_version":"5.50-1.1","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"5.85-3"},"fixed_version":"5.50-1.1","urgency":"not yet assigned"},"trixie":{"status":"resolved","repositories":{"trixie":"5.82-1.1"},"fixed_version":"5.50-1.1","urgency":"not yet assigned"}}},"CVE-2020-26558":{"description":"Bluetooth LE and BR/EDR secure pairing in Bluetooth Core Specification 2.1 through 5.2 may permit a nearby man-in-the-middle attacker to identify the Passkey used during pairing (in the Passkey authentication procedure) by reflection of the public key and the authentication evidence of the initiating device, potentially permitting this attacker to complete authenticated pairing with the responding device using the correct Passkey for the pairing session. The attack methodology determines the Passkey value one bit at a time.","debianbug":989614,"scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"5.66-1+deb12u2","bookworm-security":"5.66-1+deb12u1"},"fixed_version":"5.55-3.1","urgency":"not yet assigned"},"bullseye":{"status":"resolved","repositories":{"bullseye":"5.55-3.1+deb11u1","bullseye-security":"5.55-3.1+deb11u2"},"fixed_version":"5.55-3.1","urgency":"not yet assigned"},"forky":{"status":"resolved","repositories":{"forky":"5.84-1"},"fixed_version":"5.55-3.1","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"5.85-3"},"fixed_version":"5.55-3.1","urgency":"not yet assigned"},"trixie":{"status":"resolved","repositories":{"trixie":"5.82-1.1"},"fixed_version":"5.55-3.1","urgency":"not yet assigned"}}},"CVE-2020-27153":{"description":"In BlueZ before 5.55, a double free was found in the gatttool disconnect_cb() routine from shared/att.c. A remote attacker could potentially cause a denial of service or code execution, during service discovery, due to a redundant disconnect MGMT event.","scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"5.66-1+deb12u2","bookworm-security":"5.66-1+deb12u1"},"fixed_version":"5.55-1","urgency":"not yet assigned"},"bullseye":{"status":"resolved","repositories":{"bullseye":"5.55-3.1+deb11u1","bullseye-security":"5.55-3.1+deb11u2"},"fixed_version":"5.55-1","urgency":"not yet assigned"},"forky":{"status":"resolved","repositories":{"forky":"5.84-1"},"fixed_version":"5.55-1","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"5.85-3"},"fixed_version":"5.55-1","urgency":"not yet assigned"},"trixie":{"status":"resolved","repositories":{"trixie":"5.82-1.1"},"fixed_version":"5.55-1","urgency":"not yet assigned"}}},"CVE-2021-0129":{"description":"Improper access control in BlueZ may allow an authenticated user to potentially enable information disclosure via adjacent access.","debianbug":989614,"scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"5.66-1+deb12u2","bookworm-security":"5.66-1+deb12u1"},"fixed_version":"5.55-3.1","urgency":"not yet assigned"},"bullseye":{"status":"resolved","repositories":{"bullseye":"5.55-3.1+deb11u1","bullseye-security":"5.55-3.1+deb11u2"},"fixed_version":"5.55-3.1","urgency":"not yet assigned"},"forky":{"status":"resolved","repositories":{"forky":"5.84-1"},"fixed_version":"5.55-3.1","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"5.85-3"},"fixed_version":"5.55-3.1","urgency":"not yet assigned"},"trixie":{"status":"resolved","repositories":{"trixie":"5.82-1.1"},"fixed_version":"5.55-3.1","urgency":"not yet assigned"}}},"CVE-2021-3588":{"description":"The cli_feat_read_cb() function in src/gatt-database.c does not perform bounds checks on the 'offset' variable before using it as an index into an array for reading.","debianbug":989700,"scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"5.66-1+deb12u2","bookworm-security":"5.66-1+deb12u1"},"fixed_version":"5.55-3.1","urgency":"not yet assigned"},"bullseye":{"status":"resolved","repositories":{"bullseye":"5.55-3.1+deb11u1","bullseye-security":"5.55-3.1+deb11u2"},"fixed_version":"5.55-3.1","urgency":"not yet assigned"},"forky":{"status":"resolved","repositories":{"forky":"5.84-1"},"fixed_version":"5.55-3.1","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"5.85-3"},"fixed_version":"5.55-3.1","urgency":"not yet assigned"},"trixie":{"status":"resolved","repositories":{"trixie":"5.82-1.1"},"fixed_version":"5.55-3.1","urgency":"not yet assigned"}}},"CVE-2021-3658":{"description":"bluetoothd from bluez incorrectly saves adapters' Discoverable status when a device is powered down, and restores it when powered up. If a device is powered down while discoverable, it will be discoverable when powered on again. This could lead to inadvertent exposure of the bluetooth stack to physically nearby attackers.","debianbug":991596,"scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"5.66-1+deb12u2","bookworm-security":"5.66-1+deb12u1"},"fixed_version":"5.61-1","urgency":"not yet assigned"},"bullseye":{"status":"resolved","repositories":{"bullseye":"5.55-3.1+deb11u1","bullseye-security":"5.55-3.1+deb11u2"},"fixed_version":"5.55-3.1+deb11u2","urgency":"not yet assigned"},"forky":{"status":"resolved","repositories":{"forky":"5.84-1"},"fixed_version":"5.61-1","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"5.85-3"},"fixed_version":"5.61-1","urgency":"not yet assigned"},"trixie":{"status":"resolved","repositories":{"trixie":"5.82-1.1"},"fixed_version":"5.61-1","urgency":"not yet assigned"}}},"CVE-2021-41229":{"description":"BlueZ is a Bluetooth protocol stack for Linux. In affected versions a vulnerability exists in sdp_cstate_alloc_buf which allocates memory which will always be hung in the singly linked list of cstates and will not be freed. This will cause a memory leak over time. The data can be a very large object, which can be caused by an attacker continuously sending sdp packets and this may cause the service of the target device to crash.","debianbug":1000262,"scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"5.66-1+deb12u2","bookworm-security":"5.66-1+deb12u1"},"fixed_version":"5.62-2","urgency":"not yet assigned"},"bullseye":{"status":"resolved","repositories":{"bullseye":"5.55-3.1+deb11u1","bullseye-security":"5.55-3.1+deb11u2"},"fixed_version":"5.55-3.1+deb11u2","urgency":"not yet assigned"},"forky":{"status":"resolved","repositories":{"forky":"5.84-1"},"fixed_version":"5.62-2","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"5.85-3"},"fixed_version":"5.62-2","urgency":"not yet assigned"},"trixie":{"status":"resolved","repositories":{"trixie":"5.82-1.1"},"fixed_version":"5.62-2","urgency":"not yet assigned"}}},"CVE-2021-43400":{"description":"An issue was discovered in gatt-database.c in BlueZ 5.61. A use-after-free can occur when a client disconnects during D-Bus processing of a WriteValue call.","debianbug":998626,"scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"5.66-1+deb12u2","bookworm-security":"5.66-1+deb12u1"},"fixed_version":"5.62-1","urgency":"not yet assigned"},"bullseye":{"status":"resolved","repositories":{"bullseye":"5.55-3.1+deb11u1","bullseye-security":"5.55-3.1+deb11u2"},"fixed_version":"5.55-3.1+deb11u2","urgency":"not yet assigned"},"forky":{"status":"resolved","repositories":{"forky":"5.84-1"},"fixed_version":"5.62-1","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"5.85-3"},"fixed_version":"5.62-1","urgency":"not yet assigned"},"trixie":{"status":"resolved","repositories":{"trixie":"5.82-1.1"},"fixed_version":"5.62-1","urgency":"not yet assigned"}}},"CVE-2022-0204":{"description":"A heap overflow vulnerability was found in bluez in versions prior to 5.63. An attacker with local network access could pass specially crafted files causing an application to halt or crash, leading to a denial of service.","debianbug":1003712,"scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"5.66-1+deb12u2","bookworm-security":"5.66-1+deb12u1"},"fixed_version":"5.64-1","urgency":"not yet assigned"},"bullseye":{"status":"resolved","repositories":{"bullseye":"5.55-3.1+deb11u1","bullseye-security":"5.55-3.1+deb11u2"},"fixed_version":"5.55-3.1+deb11u2","urgency":"not yet assigned"},"forky":{"status":"resolved","repositories":{"forky":"5.84-1"},"fixed_version":"5.64-1","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"5.85-3"},"fixed_version":"5.64-1","urgency":"not yet assigned"},"trixie":{"status":"resolved","repositories":{"trixie":"5.82-1.1"},"fixed_version":"5.64-1","urgency":"not yet assigned"}}},"CVE-2022-3563":{"description":"A vulnerability classified as problematic has been found in Linux Kernel. Affected is the function read_50_controller_cap_complete of the file tools/mgmt-tester.c of the component BlueZ. The manipulation of the argument cap_len leads to null pointer dereference. It is recommended to apply a patch to fix this issue. VDB-211086 is the identifier assigned to this vulnerability.","scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"5.66-1+deb12u2","bookworm-security":"5.66-1+deb12u1"},"fixed_version":"5.65-1","urgency":"not yet assigned"},"bullseye":{"status":"resolved","repositories":{"bullseye":"5.55-3.1+deb11u1","bullseye-security":"5.55-3.1+deb11u2"},"fixed_version":"0","urgency":"unimportant"},"forky":{"status":"resolved","repositories":{"forky":"5.84-1"},"fixed_version":"5.65-1","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"5.85-3"},"fixed_version":"5.65-1","urgency":"not yet assigned"},"trixie":{"status":"resolved","repositories":{"trixie":"5.82-1.1"},"fixed_version":"5.65-1","urgency":"not yet assigned"}}},"CVE-2022-3637":{"description":"A vulnerability has been found in Linux Kernel and classified as problematic. This vulnerability affects the function jlink_init of the file monitor/jlink.c of the component BlueZ. The manipulation leads to denial of service. It is recommended to apply a patch to fix this issue. The identifier of this vulnerability is VDB-211936.","scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"5.66-1+deb12u2","bookworm-security":"5.66-1+deb12u1"},"fixed_version":"0","urgency":"unimportant"},"bullseye":{"status":"resolved","repositories":{"bullseye":"5.55-3.1+deb11u1","bullseye-security":"5.55-3.1+deb11u2"},"fixed_version":"0","urgency":"unimportant"},"forky":{"status":"resolved","repositories":{"forky":"5.84-1"},"fixed_version":"0","urgency":"unimportant"},"sid":{"status":"resolved","repositories":{"sid":"5.85-3"},"fixed_version":"0","urgency":"unimportant"},"trixie":{"status":"resolved","repositories":{"trixie":"5.82-1.1"},"fixed_version":"0","urgency":"unimportant"}}},"CVE-2022-39176":{"description":"BlueZ before 5.59 allows physically proximate attackers to obtain sensitive information because profiles/audio/avrcp.c does not validate params_len.","scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"5.66-1+deb12u2","bookworm-security":"5.66-1+deb12u1"},"fixed_version":"5.61-1","urgency":"not yet assigned"},"bullseye":{"status":"resolved","repositories":{"bullseye":"5.55-3.1+deb11u1","bullseye-security":"5.55-3.1+deb11u2"},"fixed_version":"5.55-3.1+deb11u2","urgency":"not yet assigned"},"forky":{"status":"resolved","repositories":{"forky":"5.84-1"},"fixed_version":"5.61-1","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"5.85-3"},"fixed_version":"5.61-1","urgency":"not yet assigned"},"trixie":{"status":"resolved","repositories":{"trixie":"5.82-1.1"},"fixed_version":"5.61-1","urgency":"not yet assigned"}}},"CVE-2022-39177":{"description":"BlueZ before 5.59 allows physically proximate attackers to cause a denial of service because malformed and invalid capabilities can be processed in profiles/audio/avdtp.c.","scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"5.66-1+deb12u2","bookworm-security":"5.66-1+deb12u1"},"fixed_version":"5.61-1","urgency":"not yet assigned"},"bullseye":{"status":"resolved","repositories":{"bullseye":"5.55-3.1+deb11u1","bullseye-security":"5.55-3.1+deb11u2"},"fixed_version":"5.55-3.1+deb11u2","urgency":"not yet assigned"},"forky":{"status":"resolved","repositories":{"forky":"5.84-1"},"fixed_version":"5.61-1","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"5.85-3"},"fixed_version":"5.61-1","urgency":"not yet assigned"},"trixie":{"status":"resolved","repositories":{"trixie":"5.82-1.1"},"fixed_version":"5.61-1","urgency":"not yet assigned"}}},"CVE-2023-27349":{"description":"BlueZ Audio Profile AVRCP Improper Validation of Array Index Remote Code Execution Vulnerability. This vulnerability allows network-adjacent attackers to execute arbitrary code via Bluetooth on affected installations of BlueZ. User interaction is required to exploit this vulnerability in that the target must connect to a malicious device.  The specific flaw exists within the handling of the AVRCP protocol. The issue results from the lack of proper validation of user-supplied data, which can result in a write past the end of an allocated buffer. An attacker can leverage this vulnerability to execute code in the context of root. Was ZDI-CAN-19908.","scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"5.66-1+deb12u2","bookworm-security":"5.66-1+deb12u1"},"fixed_version":"5.66-1+deb12u2","urgency":"not yet assigned"},"bullseye":{"status":"resolved","repositories":{"bullseye":"5.55-3.1+deb11u1","bullseye-security":"5.55-3.1+deb11u2"},"fixed_version":"5.55-3.1+deb11u2","urgency":"not yet assigned"},"forky":{"status":"resolved","repositories":{"forky":"5.84-1"},"fixed_version":"5.68-1","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"5.85-3"},"fixed_version":"5.68-1","urgency":"not yet assigned"},"trixie":{"status":"resolved","repositories":{"trixie":"5.82-1.1"},"fixed_version":"5.68-1","urgency":"not yet assigned"}}},"CVE-2023-44431":{"description":"BlueZ Audio Profile AVRCP Stack-based Buffer Overflow Remote Code Execution Vulnerability. This vulnerability allows network-adjacent attackers to execute arbitrary code via Bluetooth on affected installations of BlueZ. User interaction is required to exploit this vulnerability in that the target must connect to a malicious device.  The specific flaw exists within the handling of the AVRCP protocol. The issue results from the lack of proper validation of the length of user-supplied data prior to copying it to a fixed-length stack-based buffer. An attacker can leverage this vulnerability to execute code in the context of root. Was ZDI-CAN-19909.","debianbug":1077687,"scope":"local","releases":{"bookworm":{"status":"open","repositories":{"bookworm":"5.66-1+deb12u2","bookworm-security":"5.66-1+deb12u1"},"urgency":"not yet assigned","nodsa":"Minor issue, revisit when/if fixed upstream","nodsa_reason":"postponed"},"bullseye":{"status":"open","repositories":{"bullseye":"5.55-3.1+deb11u1","bullseye-security":"5.55-3.1+deb11u2"},"urgency":"not yet assigned","nodsa":"Minor issue, revisit when/if fixed upstream","nodsa_reason":"postponed"},"forky":{"status":"open","repositories":{"forky":"5.84-1"},"urgency":"not yet assigned"},"sid":{"status":"open","repositories":{"sid":"5.85-3"},"urgency":"not yet assigned"},"trixie":{"status":"open","repositories":{"trixie":"5.82-1.1"},"urgency":"not yet assigned","nodsa":"Minor issue, revisit when/if fixed upstream","nodsa_reason":"postponed"}}},"CVE-2023-45866":{"description":"Bluetooth HID Hosts in BlueZ may permit an unauthenticated Peripheral role HID Device to initiate and establish an encrypted connection, and accept HID keyboard reports, potentially permitting injection of HID messages when no user interaction has occurred in the Central role to authorize such access. An example affected package is bluez 5.64-0ubuntu1 in Ubuntu 22.04LTS. NOTE: in some cases, a CVE-2020-0556 mitigation would have already addressed this Bluetooth HID Hosts issue.","debianbug":1057914,"scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"5.66-1+deb12u2","bookworm-security":"5.66-1+deb12u1"},"fixed_version":"5.66-1+deb12u1","urgency":"not yet assigned"},"bullseye":{"status":"resolved","repositories":{"bullseye":"5.55-3.1+deb11u1","bullseye-security":"5.55-3.1+deb11u2"},"fixed_version":"5.55-3.1+deb11u1","urgency":"not yet assigned"},"forky":{"status":"resolved","repositories":{"forky":"5.84-1"},"fixed_version":"5.70-1.1","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"5.85-3"},"fixed_version":"5.70-1.1","urgency":"not yet assigned"},"trixie":{"status":"resolved","repositories":{"trixie":"5.82-1.1"},"fixed_version":"5.70-1.1","urgency":"not yet assigned"}}},"CVE-2023-50229":{"description":"BlueZ Phone Book Access Profile Heap-based Buffer Overflow Remote Code Execution Vulnerability. This vulnerability allows network-adjacent attackers to execute arbitrary code on affected installations of BlueZ. User interaction is required to exploit this vulnerability in that the target must connect to a malicious Bluetooth device.  The specific flaw exists within the handling of the Phone Book Access profile. The issue results from the lack of proper validation of the length of user-supplied data prior to copying it to a fixed-length heap-based buffer. An attacker can leverage this vulnerability to execute code in the context of root. Was ZDI-CAN-20936.","scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"5.66-1+deb12u2","bookworm-security":"5.66-1+deb12u1"},"fixed_version":"5.66-1+deb12u2","urgency":"not yet assigned"},"bullseye":{"status":"resolved","repositories":{"bullseye":"5.55-3.1+deb11u1","bullseye-security":"5.55-3.1+deb11u2"},"fixed_version":"5.55-3.1+deb11u2","urgency":"not yet assigned"},"forky":{"status":"resolved","repositories":{"forky":"5.84-1"},"fixed_version":"5.70-1","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"5.85-3"},"fixed_version":"5.70-1","urgency":"not yet assigned"},"trixie":{"status":"resolved","repositories":{"trixie":"5.82-1.1"},"fixed_version":"5.70-1","urgency":"not yet assigned"}}},"CVE-2023-50230":{"description":"BlueZ Phone Book Access Profile Heap-based Buffer Overflow Remote Code Execution Vulnerability. This vulnerability allows network-adjacent attackers to execute arbitrary code on affected installations of BlueZ. User interaction is required to exploit this vulnerability in that the target must connect to a malicious Bluetooth device.  The specific flaw exists within the handling of the Phone Book Access profile. The issue results from the lack of proper validation of the length of user-supplied data prior to copying it to a fixed-length heap-based buffer. An attacker can leverage this vulnerability to execute code in the context of root. Was ZDI-CAN-20938.","scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"5.66-1+deb12u2","bookworm-security":"5.66-1+deb12u1"},"fixed_version":"5.66-1+deb12u2","urgency":"not yet assigned"},"bullseye":{"status":"resolved","repositories":{"bullseye":"5.55-3.1+deb11u1","bullseye-security":"5.55-3.1+deb11u2"},"fixed_version":"5.55-3.1+deb11u2","urgency":"not yet assigned"},"forky":{"status":"resolved","repositories":{"forky":"5.84-1"},"fixed_version":"5.70-1","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"5.85-3"},"fixed_version":"5.70-1","urgency":"not yet assigned"},"trixie":{"status":"resolved","repositories":{"trixie":"5.82-1.1"},"fixed_version":"5.70-1","urgency":"not yet assigned"}}},"CVE-2023-51580":{"description":"BlueZ Audio Profile AVRCP avrcp_parse_attribute_list Out-Of-Bounds Read Information Disclosure Vulnerability. This vulnerability allows network-adjacent attackers to disclose sensitive information via Bluetooth on affected installations of BlueZ. User interaction is required to exploit this vulnerability in that the target must connect to a malicious device.  The specific flaw exists within the handling of the AVRCP protocol. The issue results from the lack of proper validation of user-supplied data, which can result in a read past the end of an allocated buffer. An attacker can leverage this in conjunction with other vulnerabilities to execute arbitrary code in the context of root. Was ZDI-CAN-20852.","debianbug":1081911,"scope":"local","releases":{"bookworm":{"status":"open","repositories":{"bookworm":"5.66-1+deb12u2","bookworm-security":"5.66-1+deb12u1"},"urgency":"not yet assigned","nodsa":"Minor issue, revisit when/if fixed upstream","nodsa_reason":"postponed"},"bullseye":{"status":"open","repositories":{"bullseye":"5.55-3.1+deb11u1","bullseye-security":"5.55-3.1+deb11u2"},"urgency":"not yet assigned","nodsa":"Minor issue, revisit when/if fixed upstream","nodsa_reason":"postponed"},"forky":{"status":"open","repositories":{"forky":"5.84-1"},"urgency":"not yet assigned"},"sid":{"status":"open","repositories":{"sid":"5.85-3"},"urgency":"not yet assigned"},"trixie":{"status":"open","repositories":{"trixie":"5.82-1.1"},"urgency":"not yet assigned","nodsa":"Minor issue, revisit when/if fixed upstream","nodsa_reason":"postponed"}}},"CVE-2023-51589":{"description":"BlueZ Audio Profile AVRCP parse_media_element Out-Of-Bounds Read Information Disclosure Vulnerability. This vulnerability allows network-adjacent attackers to disclose sensitive information via Bluetooth on affected installations of BlueZ. User interaction is required to exploit this vulnerability in that the target must connect to a malicious device.  The specific flaw exists within the handling of the AVRCP protocol. The issue results from the lack of proper validation of user-supplied data, which can result in a read past the end of an allocated buffer. An attacker can leverage this in conjunction with other vulnerabilities to execute arbitrary code in the context of root. Was ZDI-CAN-20853.","debianbug":1081912,"scope":"local","releases":{"bookworm":{"status":"open","repositories":{"bookworm":"5.66-1+deb12u2","bookworm-security":"5.66-1+deb12u1"},"urgency":"not yet assigned","nodsa":"Minor issue, revisit when/if fixed upstream","nodsa_reason":"postponed"},"bullseye":{"status":"open","repositories":{"bullseye":"5.55-3.1+deb11u1","bullseye-security":"5.55-3.1+deb11u2"},"urgency":"not yet assigned","nodsa":"Minor issue, revisit when/if fixed upstream","nodsa_reason":"postponed"},"forky":{"status":"open","repositories":{"forky":"5.84-1"},"urgency":"not yet assigned"},"sid":{"status":"open","repositories":{"sid":"5.85-3"},"urgency":"not yet assigned"},"trixie":{"status":"open","repositories":{"trixie":"5.82-1.1"},"urgency":"not yet assigned","nodsa":"Minor issue, revisit when/if fixed upstream","nodsa_reason":"postponed"}}},"CVE-2023-51592":{"description":"BlueZ Audio Profile AVRCP parse_media_folder Out-Of-Bounds Read Information Disclosure Vulnerability. This vulnerability allows network-adjacent attackers to disclose sensitive information via Bluetooth on affected installations of BlueZ. User interaction is required to exploit this vulnerability in that the target must connect to a malicious device.  The specific flaw exists within the handling of the AVRCP protocol. The issue results from the lack of proper validation of user-supplied data, which can result in a read past the end of an allocated buffer. An attacker can leverage this in conjunction with other vulnerabilities to execute arbitrary code in the context of root. Was ZDI-CAN-20854.","debianbug":1082869,"scope":"local","releases":{"bookworm":{"status":"open","repositories":{"bookworm":"5.66-1+deb12u2","bookworm-security":"5.66-1+deb12u1"},"urgency":"not yet assigned","nodsa":"Minor issue, revisit when/if fixed upstream","nodsa_reason":"postponed"},"bullseye":{"status":"open","repositories":{"bullseye":"5.55-3.1+deb11u1","bullseye-security":"5.55-3.1+deb11u2"},"urgency":"not yet assigned","nodsa":"Minor issue, revisit when/if fixed upstream","nodsa_reason":"postponed"},"forky":{"status":"open","repositories":{"forky":"5.84-1"},"urgency":"not yet assigned"},"sid":{"status":"open","repositories":{"sid":"5.85-3"},"urgency":"not yet assigned"},"trixie":{"status":"open","repositories":{"trixie":"5.82-1.1"},"urgency":"not yet assigned","nodsa":"Minor issue, revisit when/if fixed upstream","nodsa_reason":"postponed"}}},"CVE-2023-51594":{"description":"BlueZ OBEX Library Out-Of-Bounds Read Information Disclosure Vulnerability. This vulnerability allows network-adjacent attackers to disclose sensitive information on affected installations of BlueZ. User interaction is required to exploit this vulnerability in that the target must connect to a malicious Bluetooth device.  The specific flaw exists within the handling of OBEX protocol parameters. The issue results from the lack of proper validation of user-supplied data, which can result in a read past the end of an allocated buffer. An attacker can leverage this in conjunction with other vulnerabilities to execute arbitrary code in the context of root. Was ZDI-CAN-20937.","debianbug":1082870,"scope":"local","releases":{"bookworm":{"status":"open","repositories":{"bookworm":"5.66-1+deb12u2","bookworm-security":"5.66-1+deb12u1"},"urgency":"not yet assigned","nodsa":"Minor issue, revisit when/if fixed upstream","nodsa_reason":"postponed"},"bullseye":{"status":"open","repositories":{"bullseye":"5.55-3.1+deb11u1","bullseye-security":"5.55-3.1+deb11u2"},"urgency":"not yet assigned","nodsa":"Minor issue, revisit when/if fixed upstream","nodsa_reason":"postponed"},"forky":{"status":"open","repositories":{"forky":"5.84-1"},"urgency":"not yet assigned"},"sid":{"status":"open","repositories":{"sid":"5.85-3"},"urgency":"not yet assigned"},"trixie":{"status":"open","repositories":{"trixie":"5.82-1.1"},"urgency":"not yet assigned","nodsa":"Minor issue, revisit when/if fixed upstream","nodsa_reason":"postponed"}}},"CVE-2023-51596":{"description":"BlueZ Phone Book Access Profile Heap-based Buffer Overflow Remote Code Execution Vulnerability. This vulnerability allows network-adjacent attackers to execute arbitrary code on affected installations of BlueZ. User interaction is required to exploit this vulnerability in that the target must connect to a malicious Bluetooth device.  The specific flaw exists within the handling of the Phone Book Access profile. The issue results from the lack of proper validation of the length of user-supplied data prior to copying it to a fixed-length heap-based buffer. An attacker can leverage this vulnerability to execute code in the context of root. Was ZDI-CAN-20939.","debianbug":1074419,"scope":"local","releases":{"bookworm":{"status":"open","repositories":{"bookworm":"5.66-1+deb12u2","bookworm-security":"5.66-1+deb12u1"},"urgency":"not yet assigned","nodsa":"Minor issue, revisit when/if fixed upstream","nodsa_reason":"postponed"},"bullseye":{"status":"open","repositories":{"bullseye":"5.55-3.1+deb11u1","bullseye-security":"5.55-3.1+deb11u2"},"urgency":"not yet assigned","nodsa":"Minor issue, revisit when/if fixed upstream","nodsa_reason":"postponed"},"forky":{"status":"open","repositories":{"forky":"5.84-1"},"urgency":"not yet assigned"},"sid":{"status":"open","repositories":{"sid":"5.85-3"},"urgency":"not yet assigned"},"trixie":{"status":"open","repositories":{"trixie":"5.82-1.1"},"urgency":"not yet assigned","nodsa":"Minor issue, revisit when/if fixed upstream","nodsa_reason":"postponed"}}}},"bluez-firmware":{"CVE-2020-10370":{"description":"Certain Cypress (and Broadcom) Wireless Combo chips such as CYW43455, when a 2021-01-26 Bluetooth firmware update is not present, allow a Bluetooth outage via a \"Spectra\" attack.","scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"1.2-9"},"fixed_version":"0","urgency":"unimportant"},"bullseye":{"status":"resolved","repositories":{"bullseye":"1.2-4"},"fixed_version":"0","urgency":"unimportant"},"forky":{"status":"resolved","repositories":{"forky":"1.2-13"},"fixed_version":"0","urgency":"unimportant"},"sid":{"status":"resolved","repositories":{"sid":"1.2-13"},"fixed_version":"0","urgency":"unimportant"},"trixie":{"status":"resolved","repositories":{"trixie":"1.2-13"},"fixed_version":"0","urgency":"unimportant"}}},"CVE-2021-34145":{"description":"The Bluetooth Classic implementation in the Cypress WICED BT stack through 2.9.0 for CYW20735B1 devices does not properly handle the reception of LMP_max_slot with an invalid Baseband packet type (and LT_ADDRESS and LT_ADDR) after completion of the LMP setup procedure, allowing attackers in radio range to trigger a denial of service (firmware crash) via a crafted LMP packet.","debianbug":1024356,"scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"1.2-9"},"fixed_version":"1.2-8","urgency":"not yet assigned"},"bullseye":{"status":"resolved","repositories":{"bullseye":"1.2-4"},"fixed_version":"0","urgency":"unimportant"},"forky":{"status":"resolved","repositories":{"forky":"1.2-13"},"fixed_version":"1.2-8","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"1.2-13"},"fixed_version":"1.2-8","urgency":"not yet assigned"},"trixie":{"status":"resolved","repositories":{"trixie":"1.2-13"},"fixed_version":"1.2-8","urgency":"not yet assigned"}}},"CVE-2021-34146":{"description":"The Bluetooth Classic implementation in the Cypress CYW920735Q60EVB does not properly handle the reception of continuous unsolicited LMP responses, allowing attackers in radio range to trigger a denial of service and restart (crash) of the device by flooding it with LMP_AU_Rand packets after the paging procedure.","debianbug":1024356,"scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"1.2-9"},"fixed_version":"1.2-8","urgency":"not yet assigned"},"bullseye":{"status":"resolved","repositories":{"bullseye":"1.2-4"},"fixed_version":"0","urgency":"unimportant"},"forky":{"status":"resolved","repositories":{"forky":"1.2-13"},"fixed_version":"1.2-8","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"1.2-13"},"fixed_version":"1.2-8","urgency":"not yet assigned"},"trixie":{"status":"resolved","repositories":{"trixie":"1.2-13"},"fixed_version":"1.2-8","urgency":"not yet assigned"}}},"CVE-2021-34147":{"description":"The Bluetooth Classic implementation in the Cypress WICED BT stack through 2.9.0 for CYW20735B1 does not properly handle the reception of a malformed LMP timing accuracy response followed by multiple reconnections to the link slave, allowing attackers to exhaust device BT resources and eventually trigger a crash via multiple attempts of sending a crafted LMP timing accuracy response followed by a sudden reconnection with a random BDAddress.","debianbug":1024356,"scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"1.2-9"},"fixed_version":"1.2-8","urgency":"not yet assigned"},"bullseye":{"status":"resolved","repositories":{"bullseye":"1.2-4"},"fixed_version":"0","urgency":"unimportant"},"forky":{"status":"resolved","repositories":{"forky":"1.2-13"},"fixed_version":"1.2-8","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"1.2-13"},"fixed_version":"1.2-8","urgency":"not yet assigned"},"trixie":{"status":"resolved","repositories":{"trixie":"1.2-13"},"fixed_version":"1.2-8","urgency":"not yet assigned"}}},"CVE-2021-34148":{"description":"The Bluetooth Classic implementation in the Cypress WICED BT stack through 2.9.0 for CYW20735B1 devices does not properly handle the reception of LMP_max_slot with a greater ACL Length after completion of the LMP setup procedure, allowing attackers in radio range to trigger a denial of service (firmware crash) via a crafted LMP packet.","debianbug":1024356,"scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"1.2-9"},"fixed_version":"1.2-8","urgency":"not yet assigned"},"bullseye":{"status":"resolved","repositories":{"bullseye":"1.2-4"},"fixed_version":"0","urgency":"unimportant"},"forky":{"status":"resolved","repositories":{"forky":"1.2-13"},"fixed_version":"1.2-8","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"1.2-13"},"fixed_version":"1.2-8","urgency":"not yet assigned"},"trixie":{"status":"resolved","repositories":{"trixie":"1.2-13"},"fixed_version":"1.2-8","urgency":"not yet assigned"}}}},"bochs":{"CVE-2004-2372":{"description":"Buffer overflow in Bochs before 2.1.1, if installed setuid, allows local users to execute arbitrary code via a long HOME environment variable, which is used if the .bochsrc, bochsrc, and bochsrc.txt cannot be found in a known path.  NOTE: some external documents recommend that Bochs be installed setuid root, so this should be treated as a vulnerability.","scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"2.7+dfsg-4+deb12u1"},"fixed_version":"2.1.1-1","urgency":"not yet assigned"},"bullseye":{"status":"resolved","repositories":{"bullseye":"2.6.11+dfsg-4"},"fixed_version":"2.1.1-1","urgency":"not yet assigned"},"forky":{"status":"resolved","repositories":{"forky":"3.0+dfsg-1"},"fixed_version":"2.1.1-1","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"3.0+dfsg-1"},"fixed_version":"2.1.1-1","urgency":"not yet assigned"},"trixie":{"status":"resolved","repositories":{"trixie":"3.0+dfsg-1"},"fixed_version":"2.1.1-1","urgency":"not yet assigned"}}},"CVE-2007-2893":{"description":"Heap-based buffer overflow in the bx_ne2k_c::rx_frame function in iodev/ne2k.cc in the emulated NE2000 device in Bochs 2.3 allows local users of the guest operating system to write to arbitrary memory locations and gain privileges on the host operating system via vectors that cause TXCNT register values to exceed the device memory size, aka \"RX Frame heap overflow.\"","debianbug":427144,"scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"2.7+dfsg-4+deb12u1"},"fixed_version":"2.3+20070705-1","urgency":"low"},"bullseye":{"status":"resolved","repositories":{"bullseye":"2.6.11+dfsg-4"},"fixed_version":"2.3+20070705-1","urgency":"low"},"forky":{"status":"resolved","repositories":{"forky":"3.0+dfsg-1"},"fixed_version":"2.3+20070705-1","urgency":"low"},"sid":{"status":"resolved","repositories":{"sid":"3.0+dfsg-1"},"fixed_version":"2.3+20070705-1","urgency":"low"},"trixie":{"status":"resolved","repositories":{"trixie":"3.0+dfsg-1"},"fixed_version":"2.3+20070705-1","urgency":"low"}}},"CVE-2007-2894":{"description":"The emulated floppy disk controller in Bochs 2.3 allows local users of the guest operating system to cause a denial of service (virtual machine crash) via unspecified vectors, resulting in a divide-by-zero error.","scope":"local","releases":{"bookworm":{"status":"open","repositories":{"bookworm":"2.7+dfsg-4+deb12u1"},"urgency":"unimportant"},"bullseye":{"status":"open","repositories":{"bullseye":"2.6.11+dfsg-4"},"urgency":"unimportant"},"forky":{"status":"open","repositories":{"forky":"3.0+dfsg-1"},"urgency":"unimportant"},"sid":{"status":"open","repositories":{"sid":"3.0+dfsg-1"},"urgency":"unimportant"},"trixie":{"status":"open","repositories":{"trixie":"3.0+dfsg-1"},"urgency":"unimportant"}}},"CVE-2009-3736":{"description":"ltdl.c in libltdl in GNU Libtool 1.5.x, and 2.2.6 before 2.2.6b, as used in Ham Radio Control Libraries, Q, and possibly other products, attempts to open a .la file in the current working directory, which allows local users to gain privileges via a Trojan horse file.","scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"2.7+dfsg-4+deb12u1"},"fixed_version":"0","urgency":"unimportant"},"bullseye":{"status":"resolved","repositories":{"bullseye":"2.6.11+dfsg-4"},"fixed_version":"0","urgency":"unimportant"},"forky":{"status":"resolved","repositories":{"forky":"3.0+dfsg-1"},"fixed_version":"0","urgency":"unimportant"},"sid":{"status":"resolved","repositories":{"sid":"3.0+dfsg-1"},"fixed_version":"0","urgency":"unimportant"},"trixie":{"status":"resolved","repositories":{"trixie":"3.0+dfsg-1"},"fixed_version":"0","urgency":"unimportant"}}}},"bogofilter":{"CVE-2002-2267":{"description":"bogopass in bogofilter 0.9.0.4 allows local users to overwrite arbitrary files via a symlink attack on the bogopass temporary file.","scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"1.2.5-1"},"fixed_version":"0.9.0.5","urgency":"not yet assigned"},"bullseye":{"status":"resolved","repositories":{"bullseye":"1.2.5-1"},"fixed_version":"0.9.0.5","urgency":"not yet assigned"},"forky":{"status":"resolved","repositories":{"forky":"1.2.5-1"},"fixed_version":"0.9.0.5","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"1.2.5-1"},"fixed_version":"0.9.0.5","urgency":"not yet assigned"},"trixie":{"status":"resolved","repositories":{"trixie":"1.2.5-1"},"fixed_version":"0.9.0.5","urgency":"not yet assigned"}}},"CVE-2004-1007":{"description":"The quoted-printable decoder in bogofilter 0.17.4 to 0.92.7 allows remote attackers to cause a denial of service (application crash) via mail headers that cause a line feed (LF) to be replaced by a null byte that is written to an incorrect memory address.","scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"1.2.5-1"},"fixed_version":"0.92.8-1","urgency":"not yet assigned"},"bullseye":{"status":"resolved","repositories":{"bullseye":"1.2.5-1"},"fixed_version":"0.92.8-1","urgency":"not yet assigned"},"forky":{"status":"resolved","repositories":{"forky":"1.2.5-1"},"fixed_version":"0.92.8-1","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"1.2.5-1"},"fixed_version":"0.92.8-1","urgency":"not yet assigned"},"trixie":{"status":"resolved","repositories":{"trixie":"1.2.5-1"},"fixed_version":"0.92.8-1","urgency":"not yet assigned"}}},"CVE-2005-4591":{"description":"Heap-based buffer overflow in bogofilter 0.96.2, 0.95.2, 0.94.14, 0.94.12, and other versions from 0.93.5 to 0.96.2, when using Unicode databases, allows remote attackers to cause a denial of service (crash) and possibly execute arbitrary code via \"invalid input sequences\" that lead to heap corruption when bogofilter or bogolexer converts character sets.","scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"1.2.5-1"},"fixed_version":"0.96.3","urgency":"not yet assigned"},"bullseye":{"status":"resolved","repositories":{"bullseye":"1.2.5-1"},"fixed_version":"0.96.3","urgency":"not yet assigned"},"forky":{"status":"resolved","repositories":{"forky":"1.2.5-1"},"fixed_version":"0.96.3","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"1.2.5-1"},"fixed_version":"0.96.3","urgency":"not yet assigned"},"trixie":{"status":"resolved","repositories":{"trixie":"1.2.5-1"},"fixed_version":"0.96.3","urgency":"not yet assigned"}}},"CVE-2005-4592":{"description":"Heap-based buffer overflow in bogofilter and bogolexer 0.96.2 allows remote attackers to cause a denial of service (crash) and possibly execute arbitrary code via words that are longer than the input buffer used by flex.","scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"1.2.5-1"},"fixed_version":"0.96.3","urgency":"not yet assigned"},"bullseye":{"status":"resolved","repositories":{"bullseye":"1.2.5-1"},"fixed_version":"0.96.3","urgency":"not yet assigned"},"forky":{"status":"resolved","repositories":{"forky":"1.2.5-1"},"fixed_version":"0.96.3","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"1.2.5-1"},"fixed_version":"0.96.3","urgency":"not yet assigned"},"trixie":{"status":"resolved","repositories":{"trixie":"1.2.5-1"},"fixed_version":"0.96.3","urgency":"not yet assigned"}}},"CVE-2010-2494":{"description":"Multiple buffer underflows in the base64 decoder in base64.c in (1) bogofilter and (2) bogolexer in bogofilter before 1.2.2 allow remote attackers to cause a denial of service (heap memory corruption and application crash) via an e-mail message with invalid base64 data that begins with an = (equals) character.","debianbug":588090,"scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"1.2.5-1"},"fixed_version":"1.2.1-3","urgency":"low"},"bullseye":{"status":"resolved","repositories":{"bullseye":"1.2.5-1"},"fixed_version":"1.2.1-3","urgency":"low"},"forky":{"status":"resolved","repositories":{"forky":"1.2.5-1"},"fixed_version":"1.2.1-3","urgency":"low"},"sid":{"status":"resolved","repositories":{"sid":"1.2.5-1"},"fixed_version":"1.2.1-3","urgency":"low"},"trixie":{"status":"resolved","repositories":{"trixie":"1.2.5-1"},"fixed_version":"1.2.1-3","urgency":"low"}}},"CVE-2012-5468":{"description":"Heap-based buffer overflow in iconvert.c in the bogolexer component in Bogofilter before 1.2.3 allows remote attackers to cause a denial of service (crash) and possibly execute arbitrary code via an email containing a base64 string that is decoded to incomplete multibyte characters.","debianbug":695139,"scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"1.2.5-1"},"fixed_version":"1.2.2+dfsg1-2","urgency":"not yet assigned"},"bullseye":{"status":"resolved","repositories":{"bullseye":"1.2.5-1"},"fixed_version":"1.2.2+dfsg1-2","urgency":"not yet assigned"},"forky":{"status":"resolved","repositories":{"forky":"1.2.5-1"},"fixed_version":"1.2.2+dfsg1-2","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"1.2.5-1"},"fixed_version":"1.2.2+dfsg1-2","urgency":"not yet assigned"},"trixie":{"status":"resolved","repositories":{"trixie":"1.2.5-1"},"fixed_version":"1.2.2+dfsg1-2","urgency":"not yet assigned"}}}},"boinc":{"CVE-2009-0126":{"description":"The decrypt_public function in lib/crypt.cpp in the client in Berkeley Open Infrastructure for Network Computing (BOINC) 6.2.14 and 6.4.5 does not check the return value from the OpenSSL RSA_public_decrypt function, which allows remote attackers to bypass validation of the certificate chain via a malformed SSL/TLS signature, a similar vulnerability to CVE-2008-5077.","debianbug":511521,"scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"7.20.5+dfsg-1.1"},"fixed_version":"6.2.14-3","urgency":"not yet assigned"},"bullseye":{"status":"resolved","repositories":{"bullseye":"7.16.16+dfsg-1"},"fixed_version":"6.2.14-3","urgency":"not yet assigned"},"forky":{"status":"resolved","repositories":{"forky":"8.2.8+dfsg-1"},"fixed_version":"6.2.14-3","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"8.2.8+dfsg-1"},"fixed_version":"6.2.14-3","urgency":"not yet assigned"},"trixie":{"status":"resolved","repositories":{"trixie":"8.0.4+dfsg-1"},"fixed_version":"6.2.14-3","urgency":"not yet assigned"}}},"CVE-2011-5280":{"description":"Multiple stack-based buffer overflows in BOINC 6.13.x allow remote attackers to cause a denial of service (crash) via a long trickle-up to (1) client/cs_trickle.cpp or (2) db/db_base.cpp.","scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"7.20.5+dfsg-1.1"},"fixed_version":"7.0.2+dfsg-1","urgency":"low"},"bullseye":{"status":"resolved","repositories":{"bullseye":"7.16.16+dfsg-1"},"fixed_version":"7.0.2+dfsg-1","urgency":"low"},"forky":{"status":"resolved","repositories":{"forky":"8.2.8+dfsg-1"},"fixed_version":"7.0.2+dfsg-1","urgency":"low"},"sid":{"status":"resolved","repositories":{"sid":"8.2.8+dfsg-1"},"fixed_version":"7.0.2+dfsg-1","urgency":"low"},"trixie":{"status":"resolved","repositories":{"trixie":"8.0.4+dfsg-1"},"fixed_version":"7.0.2+dfsg-1","urgency":"low"}}},"CVE-2013-2018":{"description":"Multiple SQL injection vulnerabilities in BOINC allow remote attackers to execute arbitrary SQL commands via unspecified vectors.","scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"7.20.5+dfsg-1.1"},"fixed_version":"7.0.65+dfsg-1","urgency":"low"},"bullseye":{"status":"resolved","repositories":{"bullseye":"7.16.16+dfsg-1"},"fixed_version":"7.0.65+dfsg-1","urgency":"low"},"forky":{"status":"resolved","repositories":{"forky":"8.2.8+dfsg-1"},"fixed_version":"7.0.65+dfsg-1","urgency":"low"},"sid":{"status":"resolved","repositories":{"sid":"8.2.8+dfsg-1"},"fixed_version":"7.0.65+dfsg-1","urgency":"low"},"trixie":{"status":"resolved","repositories":{"trixie":"8.0.4+dfsg-1"},"fixed_version":"7.0.65+dfsg-1","urgency":"low"}}},"CVE-2013-2019":{"description":"Stack-based buffer overflow in BOINC 6.10.58 and 6.12.34 allows remote attackers to have unspecified impact via multiple file_signature elements.","scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"7.20.5+dfsg-1.1"},"fixed_version":"6.13.6+dfsg-1","urgency":"low"},"bullseye":{"status":"resolved","repositories":{"bullseye":"7.16.16+dfsg-1"},"fixed_version":"6.13.6+dfsg-1","urgency":"low"},"forky":{"status":"resolved","repositories":{"forky":"8.2.8+dfsg-1"},"fixed_version":"6.13.6+dfsg-1","urgency":"low"},"sid":{"status":"resolved","repositories":{"sid":"8.2.8+dfsg-1"},"fixed_version":"6.13.6+dfsg-1","urgency":"low"},"trixie":{"status":"resolved","repositories":{"trixie":"8.0.4+dfsg-1"},"fixed_version":"6.13.6+dfsg-1","urgency":"low"}}},"CVE-2013-2298":{"description":"Multiple stack-based buffer overflows in the XML parser in BOINC 7.x allow attackers to have unspecified impact via a crafted XML file, related to the scheduler.","scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"7.20.5+dfsg-1.1"},"fixed_version":"7.0.65+dfsg-1","urgency":"low"},"bullseye":{"status":"resolved","repositories":{"bullseye":"7.16.16+dfsg-1"},"fixed_version":"7.0.65+dfsg-1","urgency":"low"},"forky":{"status":"resolved","repositories":{"forky":"8.2.8+dfsg-1"},"fixed_version":"7.0.65+dfsg-1","urgency":"low"},"sid":{"status":"resolved","repositories":{"sid":"8.2.8+dfsg-1"},"fixed_version":"7.0.65+dfsg-1","urgency":"low"},"trixie":{"status":"resolved","repositories":{"trixie":"8.0.4+dfsg-1"},"fixed_version":"7.0.65+dfsg-1","urgency":"low"}}},"CVE-2013-7386":{"description":"Format string vulnerability in the PROJECT::write_account_file function in client/cs_account.cpp in BOINC, possibly 7.2.33, allows remote attackers to cause a denial of service (crash) or possibly execute arbitrary code via format string specifiers in the gui_urls item in an account file.","scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"7.20.5+dfsg-1.1"},"fixed_version":"7.1.10+dfsg-1","urgency":"low"},"bullseye":{"status":"resolved","repositories":{"bullseye":"7.16.16+dfsg-1"},"fixed_version":"7.1.10+dfsg-1","urgency":"low"},"forky":{"status":"resolved","repositories":{"forky":"8.2.8+dfsg-1"},"fixed_version":"7.1.10+dfsg-1","urgency":"low"},"sid":{"status":"resolved","repositories":{"sid":"8.2.8+dfsg-1"},"fixed_version":"7.1.10+dfsg-1","urgency":"low"},"trixie":{"status":"resolved","repositories":{"trixie":"8.0.4+dfsg-1"},"fixed_version":"7.1.10+dfsg-1","urgency":"low"}}}},"bomberclone":{"CVE-2006-0460":{"description":"Multiple buffer overflows in BomberClone before 0.11.6.2 allow remote attackers to execute arbitrary code via long error messages.","scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"0.11.9-7.1"},"fixed_version":"0.11.6.2-1","urgency":"not yet assigned"},"bullseye":{"status":"resolved","repositories":{"bullseye":"0.11.9-7.1"},"fixed_version":"0.11.6.2-1","urgency":"not yet assigned"},"forky":{"status":"resolved","repositories":{"forky":"0.11.9-9"},"fixed_version":"0.11.6.2-1","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"0.11.9-9"},"fixed_version":"0.11.6.2-1","urgency":"not yet assigned"},"trixie":{"status":"resolved","repositories":{"trixie":"0.11.9-7.1"},"fixed_version":"0.11.6.2-1","urgency":"not yet assigned"}}},"CVE-2006-4005":{"description":"BomberClone 0.11.6 and earlier allows remote attackers to cause a denial of service (daemon crash) via (1) a certain malformed PKGF_ackreq packet, which triggers a crash in the rscache_add() function in pkgcache.c; and (2) an error packet, which is intended to be received by clients and force client shutdown, but also triggers server shutdown.","debianbug":382082,"scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"0.11.9-7.1"},"fixed_version":"0.11.7-1","urgency":"medium"},"bullseye":{"status":"resolved","repositories":{"bullseye":"0.11.9-7.1"},"fixed_version":"0.11.7-1","urgency":"medium"},"forky":{"status":"resolved","repositories":{"forky":"0.11.9-9"},"fixed_version":"0.11.7-1","urgency":"medium"},"sid":{"status":"resolved","repositories":{"sid":"0.11.9-9"},"fixed_version":"0.11.7-1","urgency":"medium"},"trixie":{"status":"resolved","repositories":{"trixie":"0.11.9-7.1"},"fixed_version":"0.11.7-1","urgency":"medium"}}},"CVE-2006-4006":{"description":"The do_gameinfo function in BomberClone 0.11.6 and earlier, and possibly other functions, does not reset the packet data size, which causes the send_pkg function (packets.c) to use this data size when sending a reply, and allows remote attackers to read portions of server memory.","debianbug":382082,"scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"0.11.9-7.1"},"fixed_version":"0.11.7-1","urgency":"medium"},"bullseye":{"status":"resolved","repositories":{"bullseye":"0.11.9-7.1"},"fixed_version":"0.11.7-1","urgency":"medium"},"forky":{"status":"resolved","repositories":{"forky":"0.11.9-9"},"fixed_version":"0.11.7-1","urgency":"medium"},"sid":{"status":"resolved","repositories":{"sid":"0.11.9-9"},"fixed_version":"0.11.7-1","urgency":"medium"},"trixie":{"status":"resolved","repositories":{"trixie":"0.11.9-7.1"},"fixed_version":"0.11.7-1","urgency":"medium"}}}},"boolector":{"CVE-2019-7560":{"description":"In parser/btorsmt2.c in Boolector 3.0.0, opening a specially crafted input file leads to a use after free in get_failed_assumptions or btor_delete.","scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"1.5.118.6b56be4.121013-1.3"},"fixed_version":"0","urgency":"unimportant"},"bullseye":{"status":"resolved","repositories":{"bullseye":"1.5.118.6b56be4.121013-1"},"fixed_version":"0","urgency":"unimportant"},"forky":{"status":"resolved","repositories":{"forky":"3.2.4-1"},"fixed_version":"0","urgency":"unimportant"},"sid":{"status":"resolved","repositories":{"sid":"3.2.4-1"},"fixed_version":"0","urgency":"unimportant"},"trixie":{"status":"resolved","repositories":{"trixie":"1.5.118.6b56be4.121013-1.3"},"fixed_version":"0","urgency":"unimportant"}}}},"booth":{"CVE-2022-2553":{"description":"The authfile directive in the booth config file is ignored, preventing use of authentication in communications from node to node. As a result, nodes that do not have the correct authentication key are not prevented from communicating with other nodes in the cluster.","scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"1.0-283-g9d4029a-2+deb12u1","bookworm-security":"1.0-283-g9d4029a-2+deb12u1"},"fixed_version":"1.0-268-gdce51f9-1","urgency":"not yet assigned"},"bullseye":{"status":"resolved","repositories":{"bullseye":"1.0-237-gdd88847-2+deb11u1","bullseye-security":"1.0-237-gdd88847-2+deb11u2"},"fixed_version":"1.0-237-gdd88847-2+deb11u1","urgency":"not yet assigned"},"forky":{"status":"resolved","repositories":{"forky":"1.2-3"},"fixed_version":"1.0-268-gdce51f9-1","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"1.2-3"},"fixed_version":"1.0-268-gdce51f9-1","urgency":"not yet assigned"},"trixie":{"status":"resolved","repositories":{"trixie":"1.2-3"},"fixed_version":"1.0-268-gdce51f9-1","urgency":"not yet assigned"}}},"CVE-2024-3049":{"description":"A flaw was found in Booth, a cluster ticket manager. If a specially-crafted hash is passed to gcry_md_get_algo_dlen(), it may allow an invalid HMAC to be accepted by the Booth server.","debianbug":1073249,"scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"1.0-283-g9d4029a-2+deb12u1","bookworm-security":"1.0-283-g9d4029a-2+deb12u1"},"fixed_version":"1.0-283-g9d4029a-2+deb12u1","urgency":"not yet assigned"},"bullseye":{"status":"resolved","repositories":{"bullseye":"1.0-237-gdd88847-2+deb11u1","bullseye-security":"1.0-237-gdd88847-2+deb11u2"},"fixed_version":"1.0-237-gdd88847-2+deb11u2","urgency":"not yet assigned"},"forky":{"status":"resolved","repositories":{"forky":"1.2-3"},"fixed_version":"1.1-2","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"1.2-3"},"fixed_version":"1.1-2","urgency":"not yet assigned"},"trixie":{"status":"resolved","repositories":{"trixie":"1.2-3"},"fixed_version":"1.1-2","urgency":"not yet assigned"}}}},"borgbackup":{"CVE-2016-10099":{"description":"Borg (aka BorgBackup) before 1.0.9 has a flaw in the cryptographic protocol used to authenticate the manifest (list of archives), potentially allowing an attacker to spoof the list of archives.","scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"1.2.4-1"},"fixed_version":"1.0.9-1","urgency":"not yet assigned"},"bullseye":{"status":"resolved","repositories":{"bullseye":"1.1.16-3"},"fixed_version":"1.0.9-1","urgency":"not yet assigned"},"forky":{"status":"resolved","repositories":{"forky":"1.4.3-4"},"fixed_version":"1.0.9-1","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"1.4.3-4"},"fixed_version":"1.0.9-1","urgency":"not yet assigned"},"trixie":{"status":"resolved","repositories":{"trixie":"1.4.0-5"},"fixed_version":"1.0.9-1","urgency":"not yet assigned"}}},"CVE-2016-10100":{"description":"Borg (aka BorgBackup) before 1.0.9 has a flaw in the way duplicate archive names were processed during manifest recovery, potentially allowing an attacker to overwrite an archive.","scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"1.2.4-1"},"fixed_version":"1.0.9-1","urgency":"not yet assigned"},"bullseye":{"status":"resolved","repositories":{"bullseye":"1.1.16-3"},"fixed_version":"1.0.9-1","urgency":"not yet assigned"},"forky":{"status":"resolved","repositories":{"forky":"1.4.3-4"},"fixed_version":"1.0.9-1","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"1.4.3-4"},"fixed_version":"1.0.9-1","urgency":"not yet assigned"},"trixie":{"status":"resolved","repositories":{"trixie":"1.4.0-5"},"fixed_version":"1.0.9-1","urgency":"not yet assigned"}}},"CVE-2017-15914":{"description":"Incorrect implementation of access controls allows remote users to override repository restrictions in Borg servers 1.1.x before 1.1.3.","scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"1.2.4-1"},"fixed_version":"1.1.3-1","urgency":"not yet assigned"},"bullseye":{"status":"resolved","repositories":{"bullseye":"1.1.16-3"},"fixed_version":"1.1.3-1","urgency":"not yet assigned"},"forky":{"status":"resolved","repositories":{"forky":"1.4.3-4"},"fixed_version":"1.1.3-1","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"1.4.3-4"},"fixed_version":"1.1.3-1","urgency":"not yet assigned"},"trixie":{"status":"resolved","repositories":{"trixie":"1.4.0-5"},"fixed_version":"1.1.3-1","urgency":"not yet assigned"}}},"CVE-2023-36811":{"description":"borgbackup is an opensource, deduplicating archiver with compression and authenticated encryption. A flaw in the cryptographic authentication scheme in borgbackup allowed an attacker to fake archives and potentially indirectly cause backup data loss in the repository. The attack requires an attacker to be able to: 1. insert files (with no additional headers) into backups and 2. gain write access to the repository. This vulnerability does not disclose plaintext to the attacker, nor does it affect the authenticity of existing archives. Creating plausible fake archives may be feasible for empty or small archives, but is unlikely for large archives. The issue has been fixed in borgbackup 1.2.5. Users are advised to upgrade. Additionally to installing the fixed code, users must follow the upgrade procedure as documented in the change log. Data loss after being attacked can be avoided by reviewing the archives (timestamp and contents valid and as expected) after any \"borg check --repair\" and before \"borg prune\". There are no known workarounds for this vulnerability.","scope":"local","releases":{"bookworm":{"status":"open","repositories":{"bookworm":"1.2.4-1"},"urgency":"not yet assigned","nodsa":"Minor issue","nodsa_reason":"ignored"},"bullseye":{"status":"open","repositories":{"bullseye":"1.1.16-3"},"urgency":"not yet assigned","nodsa":"Minor issue","nodsa_reason":"ignored"},"forky":{"status":"resolved","repositories":{"forky":"1.4.3-4"},"fixed_version":"1.2.5-1","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"1.4.3-4"},"fixed_version":"1.2.5-1","urgency":"not yet assigned"},"trixie":{"status":"resolved","repositories":{"trixie":"1.4.0-5"},"fixed_version":"1.2.5-1","urgency":"not yet assigned"}}},"TEMP-0922080-E6D428":{"debianbug":922080,"releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"1.2.4-1"},"fixed_version":"1.1.9-1","urgency":"not yet assigned"},"bullseye":{"status":"resolved","repositories":{"bullseye":"1.1.16-3"},"fixed_version":"1.1.9-1","urgency":"not yet assigned"},"forky":{"status":"resolved","repositories":{"forky":"1.4.3-4"},"fixed_version":"1.1.9-1","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"1.4.3-4"},"fixed_version":"1.1.9-1","urgency":"not yet assigned"},"trixie":{"status":"resolved","repositories":{"trixie":"1.4.0-5"},"fixed_version":"1.1.9-1","urgency":"not yet assigned"}}}},"botan":{"CVE-2018-12435":{"description":"Botan 2.5.0 through 2.6.0 before 2.7.0 allows a memory-cache side-channel attack on ECDSA signatures, aka the Return Of the Hidden Number Problem or ROHNP, related to dsa/dsa.cpp, ec_group/ec_group.cpp, and ecdsa/ecdsa.cpp. To discover an ECDSA key, the attacker needs access to either the local machine or a different virtual machine on the same physical host.","debianbug":901619,"scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"2.19.3+dfsg-1+deb12u1"},"fixed_version":"2.6.0-3","urgency":"not yet assigned"},"bullseye":{"status":"resolved","repositories":{"bullseye":"2.17.3+dfsg-2"},"fixed_version":"2.6.0-3","urgency":"not yet assigned"},"trixie":{"status":"resolved","repositories":{"trixie":"2.19.5+dfsg-4"},"fixed_version":"2.6.0-3","urgency":"not yet assigned"}}},"CVE-2018-20187":{"description":"A side-channel issue was discovered in Botan before 2.9.0. An attacker capable of precisely measuring the time taken for ECC key generation may be able to derive information about the high bits of the secret key, as the function to derive the public point from the secret scalar uses an unblinded Montgomery ladder whose loop iteration count depends on the bitlength of the secret. This issue affects only key generation, not ECDSA signatures or ECDH key agreement.","debianbug":918732,"scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"2.19.3+dfsg-1+deb12u1"},"fixed_version":"2.9.0-2","urgency":"not yet assigned"},"bullseye":{"status":"resolved","repositories":{"bullseye":"2.17.3+dfsg-2"},"fixed_version":"2.9.0-2","urgency":"not yet assigned"},"trixie":{"status":"resolved","repositories":{"trixie":"2.19.5+dfsg-4"},"fixed_version":"2.9.0-2","urgency":"not yet assigned"}}},"CVE-2018-9127":{"description":"Botan 2.2.0 - 2.4.0 (fixed in 2.5.0) improperly handled wildcard certificates and could accept certain certificates as valid for hostnames when, under RFC 6125 rules, they should not match. This only affects certificates issued to the same domain as the host, so to impersonate a host one must already have a wildcard certificate matching other hosts in the same domain. For example, b*.example.com would match some hostnames that do not begin with a 'b' character.","debianbug":894648,"scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"2.19.3+dfsg-1+deb12u1"},"fixed_version":"2.4.0-5","urgency":"not yet assigned"},"bullseye":{"status":"resolved","repositories":{"bullseye":"2.17.3+dfsg-2"},"fixed_version":"2.4.0-5","urgency":"not yet assigned"},"trixie":{"status":"resolved","repositories":{"trixie":"2.19.5+dfsg-4"},"fixed_version":"2.4.0-5","urgency":"not yet assigned"}}},"CVE-2018-9860":{"description":"An issue was discovered in Botan 1.11.32 through 2.x before 2.6.0. An off-by-one error when processing malformed TLS-CBC ciphertext could cause the receiving side to include in the HMAC computation exactly 64K bytes of data following the record buffer, aka an over-read. The MAC comparison will subsequently fail and the connection will be closed. This could be used for denial of service. No information leak occurs.","scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"2.19.3+dfsg-1+deb12u1"},"fixed_version":"2.4.0-6","urgency":"not yet assigned"},"bullseye":{"status":"resolved","repositories":{"bullseye":"2.17.3+dfsg-2"},"fixed_version":"2.4.0-6","urgency":"not yet assigned"},"trixie":{"status":"resolved","repositories":{"trixie":"2.19.5+dfsg-4"},"fixed_version":"2.4.0-6","urgency":"not yet assigned"}}},"CVE-2021-24115":{"description":"In Botan before 2.17.3, constant-time computations are not used for certain decoding and encoding operations (base32, base58, base64, and hex).","scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"2.19.3+dfsg-1+deb12u1"},"fixed_version":"2.17.3+dfsg-1","urgency":"not yet assigned"},"bullseye":{"status":"resolved","repositories":{"bullseye":"2.17.3+dfsg-2"},"fixed_version":"2.17.3+dfsg-1","urgency":"not yet assigned"},"trixie":{"status":"resolved","repositories":{"trixie":"2.19.5+dfsg-4"},"fixed_version":"2.17.3+dfsg-1","urgency":"not yet assigned"}}},"CVE-2021-40529":{"description":"The ElGamal implementation in Botan through 2.18.1, as used in Thunderbird and other products, allows plaintext recovery because, during interaction between two cryptographic libraries, a certain dangerous combination of the prime defined by the receiver's public key, the generator defined by the receiver's public key, and the sender's ephemeral exponents can lead to a cross-configuration attack against OpenPGP.","debianbug":993840,"scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"2.19.3+dfsg-1+deb12u1"},"fixed_version":"2.18.1+dfsg-3","urgency":"not yet assigned"},"bullseye":{"status":"open","repositories":{"bullseye":"2.17.3+dfsg-2"},"urgency":"not yet assigned","nodsa":"Minor issue","nodsa_reason":""},"trixie":{"status":"resolved","repositories":{"trixie":"2.19.5+dfsg-4"},"fixed_version":"2.18.1+dfsg-3","urgency":"not yet assigned"}}},"CVE-2022-43705":{"description":"In Botan before 2.19.3, it is possible to forge OCSP responses due to a certificate verification error. This issue was introduced in Botan 1.11.34 (November 2016).","scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"2.19.3+dfsg-1+deb12u1"},"fixed_version":"2.19.3+dfsg-1","urgency":"not yet assigned"},"bullseye":{"status":"open","repositories":{"bullseye":"2.17.3+dfsg-2"},"urgency":"not yet assigned","nodsa":"Minor issue","nodsa_reason":""},"trixie":{"status":"resolved","repositories":{"trixie":"2.19.5+dfsg-4"},"fixed_version":"2.19.3+dfsg-1","urgency":"not yet assigned"}}},"CVE-2024-34702":{"description":"Botan is a C++ cryptography library. X.509 certificates can identify elliptic curves using either an object identifier or using explicit encoding of the parameters.  Prior to 3.5.0 and 2.19.5, checking name constraints in X.509 certificates is quadratic in the number of names and name constraints. An attacker who presented a certificate chain which contained a very large number of names in the SubjectAlternativeName, signed by a CA certificate which contained a large number of name constraints, could cause a denial of service. The problem has been addressed in Botan 3.5.0 and a partial backport has also been applied and is included in Botan 2.19.5.","scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"2.19.3+dfsg-1+deb12u1"},"fixed_version":"2.19.3+dfsg-1+deb12u1","urgency":"not yet assigned"},"bullseye":{"status":"open","repositories":{"bullseye":"2.17.3+dfsg-2"},"urgency":"not yet assigned","nodsa":"Minor issue","nodsa_reason":""},"trixie":{"status":"resolved","repositories":{"trixie":"2.19.5+dfsg-4"},"fixed_version":"2.19.5+dfsg-1","urgency":"not yet assigned"}}},"CVE-2024-34703":{"description":"Botan is a C++ cryptography library. X.509 certificates can identify elliptic curves using either an object identifier or using explicit encoding of the parameters. Prior to versions 3.3.0 and 2.19.4, an attacker could present an ECDSA X.509 certificate using explicit encoding where the parameters are very large. The proof of concept used a 16Kbit prime for this purpose. When parsing, the parameter is checked to be prime, causing excessive computation. This was patched in 2.19.4 and 3.3.0 to allow the prime parameter of the elliptic curve to be at most 521 bits. No known workarounds are available. Note that support for explicit encoding of elliptic curve parameters is deprecated in Botan.","scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"2.19.3+dfsg-1+deb12u1"},"fixed_version":"2.19.3+dfsg-1+deb12u1","urgency":"not yet assigned"},"bullseye":{"status":"open","repositories":{"bullseye":"2.17.3+dfsg-2"},"urgency":"not yet assigned","nodsa":"Minor issue","nodsa_reason":""},"trixie":{"status":"resolved","repositories":{"trixie":"2.19.5+dfsg-4"},"fixed_version":"2.19.4+dfsg-1","urgency":"not yet assigned"}}},"CVE-2024-39312":{"description":"Botan is a C++ cryptography library. X.509 certificates can identify elliptic curves using either an object identifier or using explicit encoding of the parameters. A bug in the parsing of name constraint extensions in X.509 certificates meant that if the extension included both permitted subtrees and excluded subtrees, only the permitted subtree would be checked. If a certificate included a name which was permitted by the permitted subtree but also excluded by excluded subtree, it would be accepted. Fixed in versions 3.5.0 and 2.19.5.","scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"2.19.3+dfsg-1+deb12u1"},"fixed_version":"2.19.3+dfsg-1+deb12u1","urgency":"not yet assigned"},"bullseye":{"status":"open","repositories":{"bullseye":"2.17.3+dfsg-2"},"urgency":"not yet assigned","nodsa":"Minor issue","nodsa_reason":""},"trixie":{"status":"resolved","repositories":{"trixie":"2.19.5+dfsg-4"},"fixed_version":"2.19.5+dfsg-1","urgency":"not yet assigned"}}},"CVE-2024-50382":{"description":"Botan before 3.6.0, when certain LLVM versions are used, has compiler-induced secret-dependent control flow in lib/utils/ghash/ghash.cpp in GHASH in AES-GCM. There is a branch instead of an XOR with carry. This was observed for Clang in LLVM 15 on RISC-V.","scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"2.19.3+dfsg-1+deb12u1"},"fixed_version":"2.19.3+dfsg-1+deb12u1","urgency":"not yet assigned"},"bullseye":{"status":"open","repositories":{"bullseye":"2.17.3+dfsg-2"},"urgency":"unimportant"},"trixie":{"status":"resolved","repositories":{"trixie":"2.19.5+dfsg-4"},"fixed_version":"2.19.5+dfsg-3","urgency":"unimportant"}}},"CVE-2024-50383":{"description":"Botan before 3.6.0, when certain GCC versions are used, has a compiler-induced secret-dependent operation in lib/utils/donna128.h in donna128 (used in Chacha-Poly1305 and x25519). An addition can be skipped if a carry is not set. This was observed for GCC 11.3.0 with -O2 on MIPS, and GCC on x86-i386. (Only 32-bit processors can be affected.)","debianbug":1086039,"scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"2.19.3+dfsg-1+deb12u1"},"fixed_version":"2.19.3+dfsg-1+deb12u1","urgency":"not yet assigned"},"bullseye":{"status":"open","repositories":{"bullseye":"2.17.3+dfsg-2"},"urgency":"not yet assigned","nodsa":"Minor issue; can be fixed in next update","nodsa_reason":"postponed"},"trixie":{"status":"resolved","repositories":{"trixie":"2.19.5+dfsg-4"},"fixed_version":"2.19.5+dfsg-3","urgency":"not yet assigned"}}}},"bouncycastle":{"CVE-2007-6721":{"description":"The Legion of the Bouncy Castle Java Cryptography API before release 1.38, as used in Crypto Provider Package before 1.36, has unknown impact and remote attack vectors related to \"a Bleichenbacher vulnerability in simple RSA CMS signatures without signed attributes.\"","scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"1.72-2"},"fixed_version":"1.38-1","urgency":"not yet assigned"},"bullseye":{"status":"resolved","repositories":{"bullseye":"1.68-2"},"fixed_version":"1.38-1","urgency":"not yet assigned"},"forky":{"status":"resolved","repositories":{"forky":"1.80-3"},"fixed_version":"1.38-1","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"1.80-3"},"fixed_version":"1.38-1","urgency":"not yet assigned"},"trixie":{"status":"resolved","repositories":{"trixie":"1.80-3"},"fixed_version":"1.38-1","urgency":"not yet assigned"}}},"CVE-2011-3389":{"description":"The SSL protocol, as used in certain configurations in Microsoft Windows and Microsoft Internet Explorer, Mozilla Firefox, Google Chrome, Opera, and other products, encrypts data by using CBC mode with chained initialization vectors, which allows man-in-the-middle attackers to obtain plaintext HTTP headers via a blockwise chosen-boundary attack (BCBA) on an HTTPS session, in conjunction with JavaScript code that uses (1) the HTML5 WebSocket API, (2) the Java URLConnection API, or (3) the Silverlight WebClient API, aka a \"BEAST\" attack.","scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"1.72-2"},"fixed_version":"1.49+dfsg-1","urgency":"not yet assigned"},"bullseye":{"status":"resolved","repositories":{"bullseye":"1.68-2"},"fixed_version":"1.49+dfsg-1","urgency":"not yet assigned"},"forky":{"status":"resolved","repositories":{"forky":"1.80-3"},"fixed_version":"1.49+dfsg-1","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"1.80-3"},"fixed_version":"1.49+dfsg-1","urgency":"not yet assigned"},"trixie":{"status":"resolved","repositories":{"trixie":"1.80-3"},"fixed_version":"1.49+dfsg-1","urgency":"not yet assigned"}}},"CVE-2013-0169":{"description":"The TLS protocol 1.1 and 1.2 and the DTLS protocol 1.0 and 1.2, as used in OpenSSL, OpenJDK, PolarSSL, and other products, do not properly consider timing side-channel attacks on a MAC check requirement during the processing of malformed CBC padding, which allows remote attackers to conduct distinguishing attacks and plaintext-recovery attacks via statistical analysis of timing data for crafted packets, aka the \"Lucky Thirteen\" issue.","debianbug":699885,"scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"1.72-2"},"fixed_version":"1.48+dfsg-2","urgency":"low"},"bullseye":{"status":"resolved","repositories":{"bullseye":"1.68-2"},"fixed_version":"1.48+dfsg-2","urgency":"low"},"forky":{"status":"resolved","repositories":{"forky":"1.80-3"},"fixed_version":"1.48+dfsg-2","urgency":"low"},"sid":{"status":"resolved","repositories":{"sid":"1.80-3"},"fixed_version":"1.48+dfsg-2","urgency":"low"},"trixie":{"status":"resolved","repositories":{"trixie":"1.80-3"},"fixed_version":"1.48+dfsg-2","urgency":"low"}}},"CVE-2013-1624":{"description":"The TLS implementation in the Bouncy Castle Java library before 1.48 and C# library before 1.8 does not properly consider timing side-channel attacks on a noncompliant MAC check operation during the processing of malformed CBC padding, which allows remote attackers to conduct distinguishing attacks and plaintext-recovery attacks via statistical analysis of timing data for crafted packets, a related issue to CVE-2013-0169.","debianbug":699885,"scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"1.72-2"},"fixed_version":"1.48+dfsg-2","urgency":"low"},"bullseye":{"status":"resolved","repositories":{"bullseye":"1.68-2"},"fixed_version":"1.48+dfsg-2","urgency":"low"},"forky":{"status":"resolved","repositories":{"forky":"1.80-3"},"fixed_version":"1.48+dfsg-2","urgency":"low"},"sid":{"status":"resolved","repositories":{"sid":"1.80-3"},"fixed_version":"1.48+dfsg-2","urgency":"low"},"trixie":{"status":"resolved","repositories":{"trixie":"1.80-3"},"fixed_version":"1.48+dfsg-2","urgency":"low"}}},"CVE-2014-3566":{"description":"The SSL protocol 3.0, as used in OpenSSL through 1.0.1i and other products, uses nondeterministic CBC padding, which makes it easier for man-in-the-middle attackers to obtain cleartext data via a padding-oracle attack, aka the \"POODLE\" issue.","scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"1.72-2"},"fixed_version":"0","urgency":"unimportant"},"bullseye":{"status":"resolved","repositories":{"bullseye":"1.68-2"},"fixed_version":"0","urgency":"unimportant"},"forky":{"status":"resolved","repositories":{"forky":"1.80-3"},"fixed_version":"0","urgency":"unimportant"},"sid":{"status":"resolved","repositories":{"sid":"1.80-3"},"fixed_version":"0","urgency":"unimportant"},"trixie":{"status":"resolved","repositories":{"trixie":"1.80-3"},"fixed_version":"0","urgency":"unimportant"}}},"CVE-2015-6644":{"description":"Bouncy Castle in Android before 5.1.1 LMY49F and 6.0 before 2016-01-01 allows attackers to obtain sensitive information via a crafted application, aka internal bug 24106146.","scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"1.72-2"},"fixed_version":"1.54-1","urgency":"not yet assigned"},"bullseye":{"status":"resolved","repositories":{"bullseye":"1.68-2"},"fixed_version":"1.54-1","urgency":"not yet assigned"},"forky":{"status":"resolved","repositories":{"forky":"1.80-3"},"fixed_version":"1.54-1","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"1.80-3"},"fixed_version":"1.54-1","urgency":"not yet assigned"},"trixie":{"status":"resolved","repositories":{"trixie":"1.80-3"},"fixed_version":"1.54-1","urgency":"not yet assigned"}}},"CVE-2015-7940":{"description":"The Bouncy Castle Java library before 1.51 does not validate a point is withing the elliptic curve, which makes it easier for remote attackers to obtain private keys via a series of crafted elliptic curve Diffie Hellman (ECDH) key exchanges, aka an \"invalid curve attack.\"","debianbug":802671,"scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"1.72-2"},"fixed_version":"1.51-1","urgency":"not yet assigned"},"bullseye":{"status":"resolved","repositories":{"bullseye":"1.68-2"},"fixed_version":"1.51-1","urgency":"not yet assigned"},"forky":{"status":"resolved","repositories":{"forky":"1.80-3"},"fixed_version":"1.51-1","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"1.80-3"},"fixed_version":"1.51-1","urgency":"not yet assigned"},"trixie":{"status":"resolved","repositories":{"trixie":"1.80-3"},"fixed_version":"1.51-1","urgency":"not yet assigned"}}},"CVE-2016-1000338":{"description":"In Bouncy Castle JCE Provider version 1.55 and earlier the DSA does not fully validate ASN.1 encoding of signature on verification. It is possible to inject extra elements in the sequence making up the signature and still have it validate, which in some cases may allow the introduction of 'invisible' data into a signed structure.","scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"1.72-2"},"fixed_version":"1.56-1","urgency":"not yet assigned"},"bullseye":{"status":"resolved","repositories":{"bullseye":"1.68-2"},"fixed_version":"1.56-1","urgency":"not yet assigned"},"forky":{"status":"resolved","repositories":{"forky":"1.80-3"},"fixed_version":"1.56-1","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"1.80-3"},"fixed_version":"1.56-1","urgency":"not yet assigned"},"trixie":{"status":"resolved","repositories":{"trixie":"1.80-3"},"fixed_version":"1.56-1","urgency":"not yet assigned"}}},"CVE-2016-1000339":{"description":"In the Bouncy Castle JCE Provider version 1.55 and earlier the primary engine class used for AES was AESFastEngine. Due to the highly table driven approach used in the algorithm it turns out that if the data channel on the CPU can be monitored the lookup table accesses are sufficient to leak information on the AES key being used. There was also a leak in AESEngine although it was substantially less. AESEngine has been modified to remove any signs of leakage (testing carried out on Intel X86-64) and is now the primary AES class for the BC JCE provider from 1.56. Use of AESFastEngine is now only recommended where otherwise deemed appropriate.","scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"1.72-2"},"fixed_version":"1.56-1","urgency":"not yet assigned"},"bullseye":{"status":"resolved","repositories":{"bullseye":"1.68-2"},"fixed_version":"1.56-1","urgency":"not yet assigned"},"forky":{"status":"resolved","repositories":{"forky":"1.80-3"},"fixed_version":"1.56-1","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"1.80-3"},"fixed_version":"1.56-1","urgency":"not yet assigned"},"trixie":{"status":"resolved","repositories":{"trixie":"1.80-3"},"fixed_version":"1.56-1","urgency":"not yet assigned"}}},"CVE-2016-1000340":{"description":"In the Bouncy Castle JCE Provider versions 1.51 to 1.55, a carry propagation bug was introduced in the implementation of squaring for several raw math classes have been fixed (org.bouncycastle.math.raw.Nat???). These classes are used by our custom elliptic curve implementations (org.bouncycastle.math.ec.custom.**), so there was the possibility of rare (in general usage) spurious calculations for elliptic curve scalar multiplications. Such errors would have been detected with high probability by the output validation for our scalar multipliers.","scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"1.72-2"},"fixed_version":"1.56-1","urgency":"not yet assigned"},"bullseye":{"status":"resolved","repositories":{"bullseye":"1.68-2"},"fixed_version":"1.56-1","urgency":"not yet assigned"},"forky":{"status":"resolved","repositories":{"forky":"1.80-3"},"fixed_version":"1.56-1","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"1.80-3"},"fixed_version":"1.56-1","urgency":"not yet assigned"},"trixie":{"status":"resolved","repositories":{"trixie":"1.80-3"},"fixed_version":"1.56-1","urgency":"not yet assigned"}}},"CVE-2016-1000341":{"description":"In the Bouncy Castle JCE Provider version 1.55 and earlier DSA signature generation is vulnerable to timing attack. Where timings can be closely observed for the generation of signatures, the lack of blinding in 1.55, or earlier, may allow an attacker to gain information about the signature's k value and ultimately the private value as well.","scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"1.72-2"},"fixed_version":"1.56-1","urgency":"not yet assigned"},"bullseye":{"status":"resolved","repositories":{"bullseye":"1.68-2"},"fixed_version":"1.56-1","urgency":"not yet assigned"},"forky":{"status":"resolved","repositories":{"forky":"1.80-3"},"fixed_version":"1.56-1","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"1.80-3"},"fixed_version":"1.56-1","urgency":"not yet assigned"},"trixie":{"status":"resolved","repositories":{"trixie":"1.80-3"},"fixed_version":"1.56-1","urgency":"not yet assigned"}}},"CVE-2016-1000342":{"description":"In the Bouncy Castle JCE Provider version 1.55 and earlier ECDSA does not fully validate ASN.1 encoding of signature on verification. It is possible to inject extra elements in the sequence making up the signature and still have it validate, which in some cases may allow the introduction of 'invisible' data into a signed structure.","scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"1.72-2"},"fixed_version":"1.56-1","urgency":"not yet assigned"},"bullseye":{"status":"resolved","repositories":{"bullseye":"1.68-2"},"fixed_version":"1.56-1","urgency":"not yet assigned"},"forky":{"status":"resolved","repositories":{"forky":"1.80-3"},"fixed_version":"1.56-1","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"1.80-3"},"fixed_version":"1.56-1","urgency":"not yet assigned"},"trixie":{"status":"resolved","repositories":{"trixie":"1.80-3"},"fixed_version":"1.56-1","urgency":"not yet assigned"}}},"CVE-2016-1000343":{"description":"In the Bouncy Castle JCE Provider version 1.55 and earlier the DSA key pair generator generates a weak private key if used with default values. If the JCA key pair generator is not explicitly initialised with DSA parameters, 1.55 and earlier generates a private value assuming a 1024 bit key size. In earlier releases this can be dealt with by explicitly passing parameters to the key pair generator.","scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"1.72-2"},"fixed_version":"1.56-1","urgency":"not yet assigned"},"bullseye":{"status":"resolved","repositories":{"bullseye":"1.68-2"},"fixed_version":"1.56-1","urgency":"not yet assigned"},"forky":{"status":"resolved","repositories":{"forky":"1.80-3"},"fixed_version":"1.56-1","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"1.80-3"},"fixed_version":"1.56-1","urgency":"not yet assigned"},"trixie":{"status":"resolved","repositories":{"trixie":"1.80-3"},"fixed_version":"1.56-1","urgency":"not yet assigned"}}},"CVE-2016-1000344":{"description":"In the Bouncy Castle JCE Provider version 1.55 and earlier the DHIES implementation allowed the use of ECB mode. This mode is regarded as unsafe and support for it has been removed from the provider.","scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"1.72-2"},"fixed_version":"1.56-1","urgency":"not yet assigned"},"bullseye":{"status":"resolved","repositories":{"bullseye":"1.68-2"},"fixed_version":"1.56-1","urgency":"not yet assigned"},"forky":{"status":"resolved","repositories":{"forky":"1.80-3"},"fixed_version":"1.56-1","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"1.80-3"},"fixed_version":"1.56-1","urgency":"not yet assigned"},"trixie":{"status":"resolved","repositories":{"trixie":"1.80-3"},"fixed_version":"1.56-1","urgency":"not yet assigned"}}},"CVE-2016-1000345":{"description":"In the Bouncy Castle JCE Provider version 1.55 and earlier the DHIES/ECIES CBC mode vulnerable to padding oracle attack. For BC 1.55 and older, in an environment where timings can be easily observed, it is possible with enough observations to identify when the decryption is failing due to padding.","scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"1.72-2"},"fixed_version":"1.56-1","urgency":"not yet assigned"},"bullseye":{"status":"resolved","repositories":{"bullseye":"1.68-2"},"fixed_version":"1.56-1","urgency":"not yet assigned"},"forky":{"status":"resolved","repositories":{"forky":"1.80-3"},"fixed_version":"1.56-1","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"1.80-3"},"fixed_version":"1.56-1","urgency":"not yet assigned"},"trixie":{"status":"resolved","repositories":{"trixie":"1.80-3"},"fixed_version":"1.56-1","urgency":"not yet assigned"}}},"CVE-2016-1000346":{"description":"In the Bouncy Castle JCE Provider version 1.55 and earlier the other party DH public key is not fully validated. This can cause issues as invalid keys can be used to reveal details about the other party's private key where static Diffie-Hellman is in use. As of release 1.56 the key parameters are checked on agreement calculation.","scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"1.72-2"},"fixed_version":"1.56-1","urgency":"not yet assigned"},"bullseye":{"status":"resolved","repositories":{"bullseye":"1.68-2"},"fixed_version":"1.56-1","urgency":"not yet assigned"},"forky":{"status":"resolved","repositories":{"forky":"1.80-3"},"fixed_version":"1.56-1","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"1.80-3"},"fixed_version":"1.56-1","urgency":"not yet assigned"},"trixie":{"status":"resolved","repositories":{"trixie":"1.80-3"},"fixed_version":"1.56-1","urgency":"not yet assigned"}}},"CVE-2016-1000352":{"description":"In the Bouncy Castle JCE Provider version 1.55 and earlier the ECIES implementation allowed the use of ECB mode. This mode is regarded as unsafe and support for it has been removed from the provider.","scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"1.72-2"},"fixed_version":"1.56-1","urgency":"not yet assigned"},"bullseye":{"status":"resolved","repositories":{"bullseye":"1.68-2"},"fixed_version":"1.56-1","urgency":"not yet assigned"},"forky":{"status":"resolved","repositories":{"forky":"1.80-3"},"fixed_version":"1.56-1","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"1.80-3"},"fixed_version":"1.56-1","urgency":"not yet assigned"},"trixie":{"status":"resolved","repositories":{"trixie":"1.80-3"},"fixed_version":"1.56-1","urgency":"not yet assigned"}}},"CVE-2017-13098":{"description":"BouncyCastle TLS prior to version 1.0.3, when configured to use the JCE (Java Cryptography Extension) for cryptographic functions, provides a weak Bleichenbacher oracle when any TLS cipher suite using RSA key exchange is negotiated. An attacker can recover the private key from a vulnerable application. This vulnerability is referred to as \"ROBOT.\"","debianbug":884241,"scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"1.72-2"},"fixed_version":"1.58-1","urgency":"not yet assigned"},"bullseye":{"status":"resolved","repositories":{"bullseye":"1.68-2"},"fixed_version":"1.58-1","urgency":"not yet assigned"},"forky":{"status":"resolved","repositories":{"forky":"1.80-3"},"fixed_version":"1.58-1","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"1.80-3"},"fixed_version":"1.58-1","urgency":"not yet assigned"},"trixie":{"status":"resolved","repositories":{"trixie":"1.80-3"},"fixed_version":"1.58-1","urgency":"not yet assigned"}}},"CVE-2018-1000180":{"description":"Bouncy Castle BC 1.54 - 1.59, BC-FJA 1.0.0, BC-FJA 1.0.1 and earlier have a flaw in the Low-level interface to RSA key pair generator, specifically RSA Key Pairs generated in low-level API with added certainty may have less M-R tests than expected. This appears to be fixed in versions BC 1.60 beta 4 and later, BC-FJA 1.0.2 and later.","debianbug":900843,"scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"1.72-2"},"fixed_version":"1.59-2","urgency":"not yet assigned"},"bullseye":{"status":"resolved","repositories":{"bullseye":"1.68-2"},"fixed_version":"1.59-2","urgency":"not yet assigned"},"forky":{"status":"resolved","repositories":{"forky":"1.80-3"},"fixed_version":"1.59-2","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"1.80-3"},"fixed_version":"1.59-2","urgency":"not yet assigned"},"trixie":{"status":"resolved","repositories":{"trixie":"1.80-3"},"fixed_version":"1.59-2","urgency":"not yet assigned"}}},"CVE-2018-1000613":{"description":"Legion of the Bouncy Castle Legion of the Bouncy Castle Java Cryptography APIs 1.58 up to but not including 1.60 contains a CWE-470: Use of Externally-Controlled Input to Select Classes or Code ('Unsafe Reflection') vulnerability in XMSS/XMSS^MT private key deserialization that can result in Deserializing an XMSS/XMSS^MT private key can result in the execution of unexpected code. This attack appear to be exploitable via A handcrafted private key can include references to unexpected classes which will be picked up from the class path for the executing application. This vulnerability appears to have been fixed in 1.60 and later.","scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"1.72-2"},"fixed_version":"1.60-1","urgency":"low"},"bullseye":{"status":"resolved","repositories":{"bullseye":"1.68-2"},"fixed_version":"1.60-1","urgency":"low"},"forky":{"status":"resolved","repositories":{"forky":"1.80-3"},"fixed_version":"1.60-1","urgency":"low"},"sid":{"status":"resolved","repositories":{"sid":"1.80-3"},"fixed_version":"1.60-1","urgency":"low"},"trixie":{"status":"resolved","repositories":{"trixie":"1.80-3"},"fixed_version":"1.60-1","urgency":"low"}}},"CVE-2018-5382":{"description":"The default BKS keystore use an HMAC that is only 16 bits long, which can allow an attacker to compromise the integrity of a BKS keystore. Bouncy Castle release 1.47 changes the BKS format to a format which uses a 160 bit HMAC instead. This applies to any BKS keystore generated prior to BC 1.47. For situations where people need to create the files for legacy reasons a specific keystore type \"BKS-V1\" was introduced in 1.49. It should be noted that the use of \"BKS-V1\" is discouraged by the library authors and should only be used where it is otherwise safe to do so, as in where the use of a 16 bit checksum for the file integrity check is not going to cause a security issue in itself.","scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"1.72-2"},"fixed_version":"1.48+dfsg-2","urgency":"not yet assigned"},"bullseye":{"status":"resolved","repositories":{"bullseye":"1.68-2"},"fixed_version":"1.48+dfsg-2","urgency":"not yet assigned"},"forky":{"status":"resolved","repositories":{"forky":"1.80-3"},"fixed_version":"1.48+dfsg-2","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"1.80-3"},"fixed_version":"1.48+dfsg-2","urgency":"not yet assigned"},"trixie":{"status":"resolved","repositories":{"trixie":"1.80-3"},"fixed_version":"1.48+dfsg-2","urgency":"not yet assigned"}}},"CVE-2019-17359":{"description":"The ASN.1 parser in Bouncy Castle Crypto (aka BC Java) 1.63 can trigger a large attempted memory allocation, and resultant OutOfMemoryError error, via crafted ASN.1 data. This is fixed in 1.64.","scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"1.72-2"},"fixed_version":"0","urgency":"unimportant"},"bullseye":{"status":"resolved","repositories":{"bullseye":"1.68-2"},"fixed_version":"0","urgency":"unimportant"},"forky":{"status":"resolved","repositories":{"forky":"1.80-3"},"fixed_version":"0","urgency":"unimportant"},"sid":{"status":"resolved","repositories":{"sid":"1.80-3"},"fixed_version":"0","urgency":"unimportant"},"trixie":{"status":"resolved","repositories":{"trixie":"1.80-3"},"fixed_version":"0","urgency":"unimportant"}}},"CVE-2020-15522":{"description":"Bouncy Castle BC Java before 1.66, BC C# .NET before 1.8.7, BC-FJA before 1.0.1.2, 1.0.2.1, and BC-FNA before 1.0.1.1 have a timing issue within the EC math library that can expose information about the private key when an attacker is able to observe timing information for the generation of multiple deterministic ECDSA signatures.","scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"1.72-2"},"fixed_version":"1.68-1","urgency":"not yet assigned"},"bullseye":{"status":"resolved","repositories":{"bullseye":"1.68-2"},"fixed_version":"1.68-1","urgency":"not yet assigned"},"forky":{"status":"resolved","repositories":{"forky":"1.80-3"},"fixed_version":"1.68-1","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"1.80-3"},"fixed_version":"1.68-1","urgency":"not yet assigned"},"trixie":{"status":"resolved","repositories":{"trixie":"1.80-3"},"fixed_version":"1.68-1","urgency":"not yet assigned"}}},"CVE-2020-26939":{"description":"In Legion of the Bouncy Castle BC before 1.61 and BC-FJA before 1.0.1.2, attackers can obtain sensitive information about a private exponent because of Observable Differences in Behavior to Error Inputs. This occurs in org.bouncycastle.crypto.encodings.OAEPEncoding. Sending invalid ciphertext that decrypts to a short payload in the OAEP Decoder could result in the throwing of an early exception, potentially leaking some information about the private exponent of the RSA private key performing the encryption.","scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"1.72-2"},"fixed_version":"1.61-1","urgency":"not yet assigned"},"bullseye":{"status":"resolved","repositories":{"bullseye":"1.68-2"},"fixed_version":"1.61-1","urgency":"not yet assigned"},"forky":{"status":"resolved","repositories":{"forky":"1.80-3"},"fixed_version":"1.61-1","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"1.80-3"},"fixed_version":"1.61-1","urgency":"not yet assigned"},"trixie":{"status":"resolved","repositories":{"trixie":"1.80-3"},"fixed_version":"1.61-1","urgency":"not yet assigned"}}},"CVE-2020-28052":{"description":"An issue was discovered in Legion of the Bouncy Castle BC Java 1.65 and 1.66. The OpenBSDBCrypt.checkPassword utility method compared incorrect data when checking the password, allowing incorrect passwords to indicate they were matching with previously hashed ones that were different.","debianbug":977683,"scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"1.72-2"},"fixed_version":"1.65-2","urgency":"not yet assigned"},"bullseye":{"status":"resolved","repositories":{"bullseye":"1.68-2"},"fixed_version":"1.65-2","urgency":"not yet assigned"},"forky":{"status":"resolved","repositories":{"forky":"1.80-3"},"fixed_version":"1.65-2","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"1.80-3"},"fixed_version":"1.65-2","urgency":"not yet assigned"},"trixie":{"status":"resolved","repositories":{"trixie":"1.80-3"},"fixed_version":"1.65-2","urgency":"not yet assigned"}}},"CVE-2023-33201":{"description":"Bouncy Castle For Java before 1.74 is affected by an LDAP injection vulnerability. The vulnerability only affects applications that use an LDAP CertStore from Bouncy Castle to validate X.509 certificates. During the certificate validation process, Bouncy Castle inserts the certificate's Subject Name into an LDAP search filter without any escaping, which leads to an LDAP injection vulnerability.","debianbug":1040050,"scope":"local","releases":{"bookworm":{"status":"open","repositories":{"bookworm":"1.72-2"},"urgency":"not yet assigned","nodsa":"Minor issue","nodsa_reason":""},"bullseye":{"status":"open","repositories":{"bullseye":"1.68-2"},"urgency":"not yet assigned","nodsa":"Minor issue","nodsa_reason":""},"forky":{"status":"resolved","repositories":{"forky":"1.80-3"},"fixed_version":"1.77-1","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"1.80-3"},"fixed_version":"1.77-1","urgency":"not yet assigned"},"trixie":{"status":"resolved","repositories":{"trixie":"1.80-3"},"fixed_version":"1.77-1","urgency":"not yet assigned"}}},"CVE-2023-33202":{"description":"Bouncy Castle for Java before 1.73 contains a potential Denial of Service (DoS) issue within the Bouncy Castle org.bouncycastle.openssl.PEMParser class. This class parses OpenSSL PEM encoded streams containing X.509 certificates, PKCS8 encoded keys, and PKCS7 objects. Parsing a file that has crafted ASN.1 data through the PEMParser causes an OutOfMemoryError, which can enable a denial of service attack. (For users of the FIPS Java API: BC-FJA 1.0.2.3 and earlier are affected; BC-FJA 1.0.2.4 is fixed.)","debianbug":1056754,"scope":"local","releases":{"bookworm":{"status":"open","repositories":{"bookworm":"1.72-2"},"urgency":"not yet assigned","nodsa":"Minor issue","nodsa_reason":""},"bullseye":{"status":"open","repositories":{"bullseye":"1.68-2"},"urgency":"not yet assigned","nodsa":"Minor issue","nodsa_reason":""},"forky":{"status":"resolved","repositories":{"forky":"1.80-3"},"fixed_version":"1.77-1","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"1.80-3"},"fixed_version":"1.77-1","urgency":"not yet assigned"},"trixie":{"status":"resolved","repositories":{"trixie":"1.80-3"},"fixed_version":"1.77-1","urgency":"not yet assigned"}}},"CVE-2024-29857":{"description":"An issue was discovered in ECCurve.java and ECCurve.cs in Bouncy Castle Java (BC Java) before 1.78, BC Java LTS before 2.73.6, BC-FJA before 1.0.2.5, and BC C# .Net before 2.3.1. Importing an EC certificate with crafted F2m parameters can lead to excessive CPU consumption during the evaluation of the curve parameters.","debianbug":1070655,"scope":"local","releases":{"bookworm":{"status":"open","repositories":{"bookworm":"1.72-2"},"urgency":"not yet assigned","nodsa":"Minor issue","nodsa_reason":""},"bullseye":{"status":"open","repositories":{"bullseye":"1.68-2"},"urgency":"not yet assigned","nodsa":"Minor issue","nodsa_reason":""},"forky":{"status":"resolved","repositories":{"forky":"1.80-3"},"fixed_version":"1.80-1","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"1.80-3"},"fixed_version":"1.80-1","urgency":"not yet assigned"},"trixie":{"status":"resolved","repositories":{"trixie":"1.80-3"},"fixed_version":"1.80-1","urgency":"not yet assigned"}}},"CVE-2024-30171":{"description":"An issue was discovered in Bouncy Castle Java TLS API and JSSE Provider before 1.78. Timing-based leakage may occur in RSA based handshakes because of exception processing.","debianbug":1070655,"scope":"local","releases":{"bookworm":{"status":"open","repositories":{"bookworm":"1.72-2"},"urgency":"not yet assigned","nodsa":"Minor issue","nodsa_reason":""},"bullseye":{"status":"open","repositories":{"bullseye":"1.68-2"},"urgency":"not yet assigned","nodsa":"Minor issue","nodsa_reason":""},"forky":{"status":"resolved","repositories":{"forky":"1.80-3"},"fixed_version":"1.80-1","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"1.80-3"},"fixed_version":"1.80-1","urgency":"not yet assigned"},"trixie":{"status":"resolved","repositories":{"trixie":"1.80-3"},"fixed_version":"1.80-1","urgency":"not yet assigned"}}},"CVE-2024-30172":{"description":"An issue was discovered in Bouncy Castle Java Cryptography APIs before 1.78. An Ed25519 verification code infinite loop can occur via a crafted signature and public key.","debianbug":1070655,"scope":"local","releases":{"bookworm":{"status":"open","repositories":{"bookworm":"1.72-2"},"urgency":"not yet assigned","nodsa":"Minor issue","nodsa_reason":""},"bullseye":{"status":"open","repositories":{"bullseye":"1.68-2"},"urgency":"not yet assigned","nodsa":"Minor issue","nodsa_reason":""},"forky":{"status":"resolved","repositories":{"forky":"1.80-3"},"fixed_version":"1.80-1","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"1.80-3"},"fixed_version":"1.80-1","urgency":"not yet assigned"},"trixie":{"status":"resolved","repositories":{"trixie":"1.80-3"},"fixed_version":"1.80-1","urgency":"not yet assigned"}}},"CVE-2024-34447":{"description":"An issue was discovered in the Bouncy Castle Crypto Package For Java before BC TLS Java 1.0.19 (ships with BC Java 1.78, BC Java (LTS) 2.73.6) and before BC FIPS TLS Java 1.0.19. When endpoint identification is enabled in the BCJSSE and an SSL socket is created without an explicit hostname (as happens with HttpsURLConnection), hostname verification could be performed against a DNS-resolved IP address in some situations, opening up a possibility of DNS poisoning.","debianbug":1070655,"scope":"local","releases":{"bookworm":{"status":"open","repositories":{"bookworm":"1.72-2"},"urgency":"not yet assigned","nodsa":"Minor issue","nodsa_reason":""},"bullseye":{"status":"open","repositories":{"bullseye":"1.68-2"},"urgency":"not yet assigned","nodsa":"Minor issue","nodsa_reason":""},"forky":{"status":"resolved","repositories":{"forky":"1.80-3"},"fixed_version":"1.80-1","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"1.80-3"},"fixed_version":"1.80-1","urgency":"not yet assigned"},"trixie":{"status":"resolved","repositories":{"trixie":"1.80-3"},"fixed_version":"1.80-1","urgency":"not yet assigned"}}},"CVE-2025-12194":{"description":"Uncontrolled Resource Consumption vulnerability in Legion of the Bouncy Castle Inc. Bouncy Castle for Java FIPS bc-fips on All (API modules), Legion of the Bouncy Castle Inc. Bouncy Castle for Java LTS bcprov-lts8on on All (API modules) allows Excessive Allocation. This vulnerability is associated with program files core/src/main/jdk1.9/org/bouncycastle/crypto/fips/AESNativeCFB.Java, core/src/main/jdk1.9/org/bouncycastle/crypto/fips/AESNativeGCM.Java, core/src/main/jdk1.9/org/bouncycastle/crypto/fips/SHA256NativeDigest.Java, core/src/main/jdk1.9/org/bouncycastle/crypto/fips/AESNativeEngine.Java, core/src/main/jdk1.9/org/bouncycastle/crypto/fips/AESNativeCBC.Java, core/src/main/jdk1.9/org/bouncycastle/crypto/fips/AESNativeCTR.Java, core/src/main/jdk1.9/org/bouncycastle/crypto/engines/AESNativeCFB.Java, core/src/main/jdk1.9/org/bouncycastle/crypto/engines/AESNativeGCM.Java, core/src/main/jdk1.9/org/bouncycastle/crypto/engines/AESNativeEngine.Java, core/src/main/jdk1.9/org/bouncycastle/crypto/engines/AESNativeCBC.Java, core/src/main/jdk1.9/org/bouncycastle/crypto/engines/AESNativeGCMSIV.Java, core/src/main/jdk1.9/org/bouncycastle/crypto/engines/AESNativeCCM.Java, core/src/main/jdk1.9/org/bouncycastle/crypto/engines/AESNativeCTR.Java, core/src/main/jdk1.9/org/bouncycastle/crypto/digests/SHA256NativeDigest.Java, core/src/main/jdk1.9/org/bouncycastle/crypto/digests/SHA224NativeDigest.Java, core/src/main/jdk1.9/org/bouncycastle/crypto/digests/SHA3NativeDigest.Java, core/src/main/jdk1.9/org/bouncycastle/crypto/digests/SHAKENativeDigest.Java, core/src/main/jdk1.9/org/bouncycastle/crypto/digests/SHA512NativeDigest.Java, core/src/main/jdk1.9/org/bouncycastle/crypto/digests/SHA384NativeDigest.Java.  This issue affects Bouncy Castle for Java FIPS: from 2.1.0 through 2.1.1; Bouncy Castle for Java LTS: from 2.73.0 through 2.73.7.","debianbug":1118945,"scope":"local","releases":{"bookworm":{"status":"open","repositories":{"bookworm":"1.72-2"},"urgency":"not yet assigned","nodsa":"Minor issue","nodsa_reason":""},"bullseye":{"status":"open","repositories":{"bullseye":"1.68-2"},"urgency":"not yet assigned","nodsa":"Minor issue","nodsa_reason":"ignored"},"forky":{"status":"open","repositories":{"forky":"1.80-3"},"urgency":"not yet assigned"},"sid":{"status":"open","repositories":{"sid":"1.80-3"},"urgency":"not yet assigned"},"trixie":{"status":"open","repositories":{"trixie":"1.80-3"},"urgency":"not yet assigned","nodsa":"Minor issue","nodsa_reason":""}}},"CVE-2025-8885":{"description":"Allocation of Resources Without Limits or Throttling vulnerability in Legion of the Bouncy Castle Inc. BC Java bcprov on All (API modules), Legion of the Bouncy Castle Inc. BC-FJA bc-fips on All allows Excessive Allocation. This vulnerability is associated with program files  https://github.com/bcgit/bc-java/blob/main/core/src/main/java/org/bouncycastle/asn1/ASN1ObjectIdenti... https://github.com/bcgit/bc-java/blob/main/core/src/main/java/org/bouncycastle/asn1/ASN1ObjectIdentifier.Java .  This issue affects BC Java: from 1.0 through 1.77; BC-FJA: from 1.0.0 through 1.0.2.5, from 2.0.0 through 2.0.1.","scope":"local","releases":{"bookworm":{"status":"open","repositories":{"bookworm":"1.72-2"},"urgency":"not yet assigned","nodsa":"Minor issue","nodsa_reason":""},"bullseye":{"status":"open","repositories":{"bullseye":"1.68-2"},"urgency":"not yet assigned","nodsa":"minor vulnerability; DoS","nodsa_reason":"postponed"},"forky":{"status":"resolved","repositories":{"forky":"1.80-3"},"fixed_version":"1.80-1","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"1.80-3"},"fixed_version":"1.80-1","urgency":"not yet assigned"},"trixie":{"status":"resolved","repositories":{"trixie":"1.80-3"},"fixed_version":"1.80-1","urgency":"not yet assigned"}}},"CVE-2025-8916":{"description":"Allocation of Resources Without Limits or Throttling vulnerability in Legion of the Bouncy Castle Inc. BC Java bcpkix on All (API modules), Legion of the Bouncy Castle Inc. BC Java bcprov on All (API modules), Legion of the Bouncy Castle Inc. BCPKIX FIPS bcpkix-fips on All (API modules) allows Excessive Allocation. This vulnerability is associated with program files https://github.Com/bcgit/bc-java/blob/main/pkix/src/main/java/org/bouncycastle/pkix/jcajce/PKIXCertPathReviewer.Java, https://github.Com/bcgit/bc-java/blob/main/prov/src/main/java/org/bouncycastle/x509/PKIXCertPathReviewer.Java.  This issue affects BC Java: from 1.44 through 1.78; BC Java: from 1.44 through 1.78; BCPKIX FIPS: from 1.0.0 through 1.0.7, from 2.0.0 through 2.0.7.","scope":"local","releases":{"bookworm":{"status":"open","repositories":{"bookworm":"1.72-2"},"urgency":"not yet assigned","nodsa":"Minor issue","nodsa_reason":""},"bullseye":{"status":"open","repositories":{"bullseye":"1.68-2"},"urgency":"not yet assigned","nodsa":"minor issue; DoS","nodsa_reason":"postponed"},"forky":{"status":"resolved","repositories":{"forky":"1.80-3"},"fixed_version":"1.80-1","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"1.80-3"},"fixed_version":"1.80-1","urgency":"not yet assigned"},"trixie":{"status":"resolved","repositories":{"trixie":"1.80-3"},"fixed_version":"1.80-1","urgency":"not yet assigned"}}}},"bpfcc":{"CVE-2024-2314":{"description":"If kernel headers need to be extracted, bcc will attempt to load them from a temporary directory. An unprivileged attacker could use this to force bcc to load compromised linux headers. Linux distributions which provide kernel headers by default are not affected by default.","debianbug":1071747,"scope":"local","releases":{"bookworm":{"status":"open","repositories":{"bookworm":"0.26.0+ds-1"},"urgency":"unimportant"},"bullseye":{"status":"open","repositories":{"bullseye":"0.18.0+ds-2"},"urgency":"unimportant"},"forky":{"status":"resolved","repositories":{"forky":"0.35.0+ds-1.1"},"fixed_version":"0.31.0+ds-2","urgency":"unimportant"},"sid":{"status":"resolved","repositories":{"sid":"0.35.0+ds-1.1"},"fixed_version":"0.31.0+ds-2","urgency":"unimportant"},"trixie":{"status":"resolved","repositories":{"trixie":"0.31.0+ds-7"},"fixed_version":"0.31.0+ds-2","urgency":"unimportant"}}}},"bpftrace":{"CVE-2024-2313":{"description":"If kernel headers need to be extracted, bpftrace will attempt to load them from a temporary directory. An unprivileged attacker could use this to force bcc to load compromised linux headers. Linux distributions which provide kernel headers by default are not affected by default.","debianbug":1071748,"scope":"local","releases":{"bookworm":{"status":"open","repositories":{"bookworm":"0.17.0-1"},"urgency":"unimportant"},"bullseye":{"status":"open","repositories":{"bullseye":"0.11.3-5+deb11u1"},"urgency":"unimportant"},"forky":{"status":"resolved","repositories":{"forky":"0.24.1-1.1"},"fixed_version":"0.21.0-1","urgency":"unimportant"},"sid":{"status":"resolved","repositories":{"sid":"0.24.1-1.1"},"fixed_version":"0.21.0-1","urgency":"unimportant"},"trixie":{"status":"resolved","repositories":{"trixie":"0.23.2-1"},"fixed_version":"0.21.0-1","urgency":"unimportant"}}}},"brandy":{"CVE-2019-14662":{"description":"Brandy 1.20.1 has a stack-based buffer overflow in fileio_openout in fileio.c via crafted BASIC source code.","debianbug":933996,"scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"1.22.14-1"},"fixed_version":"1.22.13-1","urgency":"unimportant"},"bullseye":{"status":"open","repositories":{"bullseye":"1.20.1-1"},"urgency":"unimportant"},"forky":{"status":"resolved","repositories":{"forky":"1.23.6-1"},"fixed_version":"1.22.13-1","urgency":"unimportant"},"sid":{"status":"resolved","repositories":{"sid":"1.23.6-1"},"fixed_version":"1.22.13-1","urgency":"unimportant"},"trixie":{"status":"resolved","repositories":{"trixie":"1.23.5-1"},"fixed_version":"1.22.13-1","urgency":"unimportant"}}},"CVE-2019-14663":{"description":"Brandy 1.20.1 has a stack-based buffer overflow in fileio_openin in fileio.c via crafted BASIC source code.","debianbug":933996,"scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"1.22.14-1"},"fixed_version":"1.22.13-1","urgency":"unimportant"},"bullseye":{"status":"open","repositories":{"bullseye":"1.20.1-1"},"urgency":"unimportant"},"forky":{"status":"resolved","repositories":{"forky":"1.23.6-1"},"fixed_version":"1.22.13-1","urgency":"unimportant"},"sid":{"status":"resolved","repositories":{"sid":"1.23.6-1"},"fixed_version":"1.22.13-1","urgency":"unimportant"},"trixie":{"status":"resolved","repositories":{"trixie":"1.23.5-1"},"fixed_version":"1.22.13-1","urgency":"unimportant"}}},"CVE-2019-14665":{"description":"Brandy 1.20.1 has a heap-based buffer overflow in define_array in variables.c via crafted BASIC source code.","debianbug":933996,"scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"1.22.14-1"},"fixed_version":"1.22.13-1","urgency":"unimportant"},"bullseye":{"status":"open","repositories":{"bullseye":"1.20.1-1"},"urgency":"unimportant"},"forky":{"status":"resolved","repositories":{"forky":"1.23.6-1"},"fixed_version":"1.22.13-1","urgency":"unimportant"},"sid":{"status":"resolved","repositories":{"sid":"1.23.6-1"},"fixed_version":"1.22.13-1","urgency":"unimportant"},"trixie":{"status":"resolved","repositories":{"trixie":"1.23.5-1"},"fixed_version":"1.22.13-1","urgency":"unimportant"}}},"CVE-2020-27372":{"description":"A buffer overflow vulnerability exists in Brandy Basic V Interpreter 1.21 in the run_interpreter function.","scope":"local","releases":{"bookworm":{"status":"open","repositories":{"bookworm":"1.22.14-1"},"urgency":"unimportant"},"bullseye":{"status":"open","repositories":{"bullseye":"1.20.1-1"},"urgency":"unimportant"},"forky":{"status":"open","repositories":{"forky":"1.23.6-1"},"urgency":"unimportant"},"sid":{"status":"open","repositories":{"sid":"1.23.6-1"},"urgency":"unimportant"},"trixie":{"status":"open","repositories":{"trixie":"1.23.5-1"},"urgency":"unimportant"}}}},"breezy":{"CVE-2017-14176":{"description":"Bazaar through 2.7.0, when Subprocess SSH is used, allows remote attackers to execute arbitrary commands via a bzr+ssh URL with an initial dash character in the hostname, a related issue to CVE-2017-9800, CVE-2017-12836, CVE-2017-12976, CVE-2017-16228, CVE-2017-1000116, and CVE-2017-1000117.","scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"3.3.2-3"},"fixed_version":"3.0.0~bzr6772-1","urgency":"not yet assigned"},"bullseye":{"status":"resolved","repositories":{"bullseye":"3.1.0-8"},"fixed_version":"3.0.0~bzr6772-1","urgency":"not yet assigned"},"forky":{"status":"resolved","repositories":{"forky":"3.3.21-1"},"fixed_version":"3.0.0~bzr6772-1","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"3.3.21-1"},"fixed_version":"3.0.0~bzr6772-1","urgency":"not yet assigned"},"trixie":{"status":"resolved","repositories":{"trixie":"3.3.11-1"},"fixed_version":"3.0.0~bzr6772-1","urgency":"not yet assigned"}}}},"bristol":{"CVE-2010-3351":{"description":"startBristol in Bristol 0.60.5 places a zero-length directory name in the LD_LIBRARY_PATH, which allows local users to gain privileges via a Trojan horse shared library in the current working directory.","debianbug":598285,"scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"0.60.11-3.1"},"fixed_version":"0.60.5-2","urgency":"not yet assigned"},"bullseye":{"status":"resolved","repositories":{"bullseye":"0.60.11-3.1"},"fixed_version":"0.60.5-2","urgency":"not yet assigned"},"forky":{"status":"resolved","repositories":{"forky":"0.60.11-5.1"},"fixed_version":"0.60.5-2","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"0.60.11-5.1"},"fixed_version":"0.60.5-2","urgency":"not yet assigned"},"trixie":{"status":"resolved","repositories":{"trixie":"0.60.11-5"},"fixed_version":"0.60.5-2","urgency":"not yet assigned"}}}},"brltty":{"CVE-2008-3279":{"description":"Untrusted search path vulnerability in libbrlttybba.so in brltty 3.7.2 allows local users to gain privileges via a crafted library, related to an incorrect RPATH setting.","scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"6.5-7+deb12u1"},"fixed_version":"0","urgency":"unimportant"},"bullseye":{"status":"resolved","repositories":{"bullseye":"6.3+dfsg-1+deb11u1"},"fixed_version":"0","urgency":"unimportant"},"forky":{"status":"resolved","repositories":{"forky":"6.9-3"},"fixed_version":"0","urgency":"unimportant"},"sid":{"status":"resolved","repositories":{"sid":"6.9-3"},"fixed_version":"0","urgency":"unimportant"},"trixie":{"status":"resolved","repositories":{"trixie":"6.7-3.1+deb13u2"},"fixed_version":"0","urgency":"unimportant"}}},"TEMP-0000000-523402":{"releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"6.5-7+deb12u1"},"fixed_version":"0","urgency":"unimportant"},"bullseye":{"status":"resolved","repositories":{"bullseye":"6.3+dfsg-1+deb11u1"},"fixed_version":"0","urgency":"unimportant"},"forky":{"status":"resolved","repositories":{"forky":"6.9-3"},"fixed_version":"0","urgency":"unimportant"},"sid":{"status":"resolved","repositories":{"sid":"6.9-3"},"fixed_version":"0","urgency":"unimportant"},"trixie":{"status":"resolved","repositories":{"trixie":"6.7-3.1+deb13u2"},"fixed_version":"0","urgency":"unimportant"}}}},"brotli":{"CVE-2016-1624":{"description":"Integer underflow in the ProcessCommandsInternal function in dec/decode.c in Brotli, as used in Google Chrome before 48.0.2564.109, allows remote attackers to cause a denial of service (buffer overflow) or possibly have unspecified other impact via crafted data with brotli compression.","debianbug":817233,"scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"1.0.9-2"},"fixed_version":"0.3.0+dfsg-3","urgency":"not yet assigned"},"bullseye":{"status":"resolved","repositories":{"bullseye":"1.0.9-2"},"fixed_version":"0.3.0+dfsg-3","urgency":"not yet assigned"},"forky":{"status":"resolved","repositories":{"forky":"1.2.0-3"},"fixed_version":"0.3.0+dfsg-3","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"1.2.0-3"},"fixed_version":"0.3.0+dfsg-3","urgency":"not yet assigned"},"trixie":{"status":"resolved","repositories":{"trixie":"1.1.0-2"},"fixed_version":"0.3.0+dfsg-3","urgency":"not yet assigned"}}},"CVE-2016-1968":{"description":"Integer underflow in Brotli, as used in Mozilla Firefox before 45.0, allows remote attackers to execute arbitrary code or cause a denial of service (buffer overflow) via crafted data with brotli compression.","debianbug":817233,"scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"1.0.9-2"},"fixed_version":"0.3.0+dfsg-3","urgency":"not yet assigned"},"bullseye":{"status":"resolved","repositories":{"bullseye":"1.0.9-2"},"fixed_version":"0.3.0+dfsg-3","urgency":"not yet assigned"},"forky":{"status":"resolved","repositories":{"forky":"1.2.0-3"},"fixed_version":"0.3.0+dfsg-3","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"1.2.0-3"},"fixed_version":"0.3.0+dfsg-3","urgency":"not yet assigned"},"trixie":{"status":"resolved","repositories":{"trixie":"1.1.0-2"},"fixed_version":"0.3.0+dfsg-3","urgency":"not yet assigned"}}},"CVE-2020-8927":{"description":"A buffer overflow exists in the Brotli library versions prior to 1.0.8 where an attacker controlling the input length of a \"one-shot\" decompression request to a script can trigger a crash, which happens when copying over chunks of data larger than 2 GiB. It is recommended to update your Brotli library to 1.0.8 or later. If one cannot update, we recommend to use the \"streaming\" API as opposed to the \"one-shot\" API, and impose chunk size limits.","scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"1.0.9-2"},"fixed_version":"1.0.9-1","urgency":"not yet assigned"},"bullseye":{"status":"resolved","repositories":{"bullseye":"1.0.9-2"},"fixed_version":"1.0.9-1","urgency":"not yet assigned"},"forky":{"status":"resolved","repositories":{"forky":"1.2.0-3"},"fixed_version":"1.0.9-1","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"1.2.0-3"},"fixed_version":"1.0.9-1","urgency":"not yet assigned"},"trixie":{"status":"resolved","repositories":{"trixie":"1.1.0-2"},"fixed_version":"1.0.9-1","urgency":"not yet assigned"}}}},"bsd-mailx":{"CVE-2004-2771":{"description":"The expand function in fio.c in Heirloom mailx 12.5 and earlier and BSD mailx 8.1.2 and earlier allows remote attackers to execute arbitrary commands via shell metacharacters in an email address.","scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"8.1.2-0.20220412cvs-1"},"fixed_version":"8.1.2-0.20071201cvs-1","urgency":"not yet assigned"},"bullseye":{"status":"resolved","repositories":{"bullseye":"8.1.2-0.20180807cvs-2"},"fixed_version":"8.1.2-0.20071201cvs-1","urgency":"not yet assigned"},"forky":{"status":"resolved","repositories":{"forky":"8.1.2-0.20220412cvs-1.1"},"fixed_version":"8.1.2-0.20071201cvs-1","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"8.1.2-0.20220412cvs-1.1"},"fixed_version":"8.1.2-0.20071201cvs-1","urgency":"not yet assigned"},"trixie":{"status":"resolved","repositories":{"trixie":"8.1.2-0.20220412cvs-1.1"},"fixed_version":"8.1.2-0.20071201cvs-1","urgency":"not yet assigned"}}},"CVE-2014-7844":{"description":"BSD mailx 8.1.2 and earlier allows remote attackers to execute arbitrary commands via a crafted email address.","scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"8.1.2-0.20220412cvs-1"},"fixed_version":"8.1.2-0.20141216cvs-1","urgency":"not yet assigned"},"bullseye":{"status":"resolved","repositories":{"bullseye":"8.1.2-0.20180807cvs-2"},"fixed_version":"8.1.2-0.20141216cvs-1","urgency":"not yet assigned"},"forky":{"status":"resolved","repositories":{"forky":"8.1.2-0.20220412cvs-1.1"},"fixed_version":"8.1.2-0.20141216cvs-1","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"8.1.2-0.20220412cvs-1.1"},"fixed_version":"8.1.2-0.20141216cvs-1","urgency":"not yet assigned"},"trixie":{"status":"resolved","repositories":{"trixie":"8.1.2-0.20220412cvs-1.1"},"fixed_version":"8.1.2-0.20141216cvs-1","urgency":"not yet assigned"}}}},"bsdgames":{"CVE-2006-1539":{"description":"Multiple buffer overflows in the checkscores function in scores.c in tetris-bsd in bsd-games before 2.17-r1 in Gentoo Linux might allow local users with games group membership to gain privileges by modifying tetris-bsd.scores to contain crafted executable content, which is executed when another user launches tetris-bsd.","debianbug":361160,"scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"2.17-29"},"fixed_version":"2.17-6","urgency":"not yet assigned"},"bullseye":{"status":"resolved","repositories":{"bullseye":"2.17-28"},"fixed_version":"2.17-6","urgency":"not yet assigned"},"forky":{"status":"resolved","repositories":{"forky":"2.17-35"},"fixed_version":"2.17-6","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"2.17-35"},"fixed_version":"2.17-6","urgency":"not yet assigned"},"trixie":{"status":"resolved","repositories":{"trixie":"2.17-35"},"fixed_version":"2.17-6","urgency":"not yet assigned"}}},"CVE-2006-1744":{"description":"Buffer overflow in pl_main.c in sail in BSDgames before 2.17-7 allows local users to execute arbitrary code via a long player name that is used in a scanf function call.","debianbug":360989,"scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"2.17-29"},"fixed_version":"2.17-7","urgency":"not yet assigned"},"bullseye":{"status":"resolved","repositories":{"bullseye":"2.17-28"},"fixed_version":"2.17-7","urgency":"not yet assigned"},"forky":{"status":"resolved","repositories":{"forky":"2.17-35"},"fixed_version":"2.17-7","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"2.17-35"},"fixed_version":"2.17-7","urgency":"not yet assigned"},"trixie":{"status":"resolved","repositories":{"trixie":"2.17-35"},"fixed_version":"2.17-7","urgency":"not yet assigned"}}}},"bsdiff":{"CVE-2014-9862":{"description":"Integer signedness error in bspatch.c in bspatch in bsdiff, as used in Apple OS X before 10.11.6 and other products, allows remote attackers to execute arbitrary code or cause a denial of service (heap-based buffer overflow) via a crafted patch file.","scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"4.3-23"},"fixed_version":"4.3-17","urgency":"not yet assigned"},"bullseye":{"status":"resolved","repositories":{"bullseye":"4.3-22"},"fixed_version":"4.3-17","urgency":"not yet assigned"},"forky":{"status":"resolved","repositories":{"forky":"4.3-23"},"fixed_version":"4.3-17","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"4.3-23"},"fixed_version":"4.3-17","urgency":"not yet assigned"},"trixie":{"status":"resolved","repositories":{"trixie":"4.3-23"},"fixed_version":"4.3-17","urgency":"not yet assigned"}}},"CVE-2020-14315":{"description":"A memory corruption vulnerability is present in bspatch as shipped in Colin Percival\u2019s bsdiff tools version 4.3. Insufficient checks when handling external inputs allows an attacker to bypass the sanity checks in place and write out of a dynamically allocated buffer boundaries.","debianbug":964796,"scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"4.3-23"},"fixed_version":"4.3-22","urgency":"not yet assigned"},"bullseye":{"status":"resolved","repositories":{"bullseye":"4.3-22"},"fixed_version":"4.3-22","urgency":"not yet assigned"},"forky":{"status":"resolved","repositories":{"forky":"4.3-23"},"fixed_version":"4.3-22","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"4.3-23"},"fixed_version":"4.3-22","urgency":"not yet assigned"},"trixie":{"status":"resolved","repositories":{"trixie":"4.3-23"},"fixed_version":"4.3-22","urgency":"not yet assigned"}}}},"bsdmainutils":{"CVE-2004-0793":{"description":"The calendar program in bsdmainutils 6.0 through 6.0.14 does not drop root privileges when executed with the -a flag, which allows attackers to execute arbitrary commands via a calendar event file.","scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"12.1.8"},"fixed_version":"6.0.15","urgency":"not yet assigned"},"bullseye":{"status":"resolved","repositories":{"bullseye":"12.1.7+nmu3"},"fixed_version":"6.0.15","urgency":"not yet assigned"},"forky":{"status":"resolved","repositories":{"forky":"12.1.8"},"fixed_version":"6.0.15","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"12.1.8"},"fixed_version":"6.0.15","urgency":"not yet assigned"},"trixie":{"status":"resolved","repositories":{"trixie":"12.1.8"},"fixed_version":"6.0.15","urgency":"not yet assigned"}}}},"bsh":{"CVE-2016-2510":{"description":"BeanShell (bsh) before 2.0b6, when included on the classpath by an application that uses Java serialization or XStream, allows remote attackers to execute arbitrary code via crafted serialized data, related to XThis.Handler.","scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"2.0b4-20"},"fixed_version":"2.0b4-16","urgency":"not yet assigned"},"bullseye":{"status":"resolved","repositories":{"bullseye":"2.0b4-20"},"fixed_version":"2.0b4-16","urgency":"not yet assigned"},"forky":{"status":"resolved","repositories":{"forky":"2.0b4-20"},"fixed_version":"2.0b4-16","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"2.0b4-20"},"fixed_version":"2.0b4-16","urgency":"not yet assigned"},"trixie":{"status":"resolved","repositories":{"trixie":"2.0b4-20"},"fixed_version":"2.0b4-16","urgency":"not yet assigned"}}}},"btrbk":{"CVE-2021-38173":{"description":"Btrbk before 0.31.2 allows command execution because of the mishandling of remote hosts filtering SSH commands using ssh_filter_btrbk.sh in authorized_keys.","scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"0.32.5-1"},"fixed_version":"0.27.1-2","urgency":"not yet assigned"},"bullseye":{"status":"resolved","repositories":{"bullseye":"0.27.1-1.1+deb11u2"},"fixed_version":"0.27.1-1.1+deb11u1","urgency":"not yet assigned"},"forky":{"status":"resolved","repositories":{"forky":"0.32.6-2"},"fixed_version":"0.27.1-2","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"0.32.6-2"},"fixed_version":"0.27.1-2","urgency":"not yet assigned"},"trixie":{"status":"resolved","repositories":{"trixie":"0.32.6-2"},"fixed_version":"0.27.1-2","urgency":"not yet assigned"}}}},"btrfsmaintenance":{"CVE-2018-14722":{"description":"An issue was discovered in evaluate_auto_mountpoint in btrfsmaintenance-functions in btrfsmaintenance through 0.4.1. Code execution as root can occur via a specially crafted filesystem label if btrfs-{scrub,balance,trim} are set to auto in /etc/sysconfig/btrfsmaintenance (this is not the default, though).","debianbug":906131,"scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"0.5-4"},"fixed_version":"0.4.1-2","urgency":"not yet assigned"},"bullseye":{"status":"resolved","repositories":{"bullseye":"0.5-1"},"fixed_version":"0.4.1-2","urgency":"not yet assigned"},"forky":{"status":"resolved","repositories":{"forky":"0.5.2-1"},"fixed_version":"0.4.1-2","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"0.5.2-1"},"fixed_version":"0.4.1-2","urgency":"not yet assigned"},"trixie":{"status":"resolved","repositories":{"trixie":"0.5.2-1"},"fixed_version":"0.4.1-2","urgency":"not yet assigned"}}}},"bubblewrap":{"CVE-2016-8659":{"description":"Bubblewrap before 0.1.3 sets the PR_SET_DUMPABLE flag, which might allow local users to gain privileges by attaching to the process, as demonstrated by sending commands to a PrivSep socket.","debianbug":840605,"scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"0.8.0-2+deb12u1","bookworm-security":"0.8.0-2+deb12u1"},"fixed_version":"0.1.2-2","urgency":"not yet assigned"},"bullseye":{"status":"resolved","repositories":{"bullseye":"0.4.1-3","bullseye-security":"0.4.1-3+deb11u1"},"fixed_version":"0.1.2-2","urgency":"not yet assigned"},"forky":{"status":"resolved","repositories":{"forky":"0.11.0-2"},"fixed_version":"0.1.2-2","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"0.11.0-2"},"fixed_version":"0.1.2-2","urgency":"not yet assigned"},"trixie":{"status":"resolved","repositories":{"trixie":"0.11.0-2"},"fixed_version":"0.1.2-2","urgency":"not yet assigned"}}},"CVE-2017-5226":{"description":"When executing a program via the bubblewrap sandbox, the nonpriv session can escape to the parent session by using the TIOCSTI ioctl to push characters into the terminal's input buffer, allowing an attacker to escape the sandbox.","debianbug":850702,"scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"0.8.0-2+deb12u1","bookworm-security":"0.8.0-2+deb12u1"},"fixed_version":"0.1.5-2","urgency":"not yet assigned"},"bullseye":{"status":"resolved","repositories":{"bullseye":"0.4.1-3","bullseye-security":"0.4.1-3+deb11u1"},"fixed_version":"0.1.5-2","urgency":"not yet assigned"},"forky":{"status":"resolved","repositories":{"forky":"0.11.0-2"},"fixed_version":"0.1.5-2","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"0.11.0-2"},"fixed_version":"0.1.5-2","urgency":"not yet assigned"},"trixie":{"status":"resolved","repositories":{"trixie":"0.11.0-2"},"fixed_version":"0.1.5-2","urgency":"not yet assigned"}}},"CVE-2019-12439":{"description":"bubblewrap.c in Bubblewrap before 0.3.3 misuses temporary directories in /tmp as a mount point. In some particular configurations (related to XDG_RUNTIME_DIR), a local attacker may abuse this flaw to prevent other users from executing bubblewrap or potentially execute code.","debianbug":923557,"scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"0.8.0-2+deb12u1","bookworm-security":"0.8.0-2+deb12u1"},"fixed_version":"0.3.1-3","urgency":"unimportant"},"bullseye":{"status":"resolved","repositories":{"bullseye":"0.4.1-3","bullseye-security":"0.4.1-3+deb11u1"},"fixed_version":"0.3.1-3","urgency":"unimportant"},"forky":{"status":"resolved","repositories":{"forky":"0.11.0-2"},"fixed_version":"0.3.1-3","urgency":"unimportant"},"sid":{"status":"resolved","repositories":{"sid":"0.11.0-2"},"fixed_version":"0.3.1-3","urgency":"unimportant"},"trixie":{"status":"resolved","repositories":{"trixie":"0.11.0-2"},"fixed_version":"0.3.1-3","urgency":"unimportant"}}},"CVE-2020-5291":{"description":"Bubblewrap (bwrap) before version 0.4.1, if installed in setuid mode and the kernel supports unprivileged user namespaces, then the `bwrap --userns2` option can be used to make the setuid process keep running as root while being traceable. This can in turn be used to gain root permissions. Note that this only affects the combination of bubblewrap in setuid mode (which is typically used when unprivileged user namespaces are not supported) and the support of unprivileged user namespaces. Known to be affected are: * Debian testing/unstable, if unprivileged user namespaces enabled (not default) * Debian buster-backports, if unprivileged user namespaces enabled (not default) * Arch if using `linux-hardened`, if unprivileged user namespaces enabled (not default) * Centos 7 flatpak COPR, if unprivileged user namespaces enabled (not default) This has been fixed in the 0.4.1 release, and all affected users should update.","debianbug":955441,"scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"0.8.0-2+deb12u1","bookworm-security":"0.8.0-2+deb12u1"},"fixed_version":"0.4.1-1","urgency":"low"},"bullseye":{"status":"resolved","repositories":{"bullseye":"0.4.1-3","bullseye-security":"0.4.1-3+deb11u1"},"fixed_version":"0.4.1-1","urgency":"low"},"forky":{"status":"resolved","repositories":{"forky":"0.11.0-2"},"fixed_version":"0.4.1-1","urgency":"low"},"sid":{"status":"resolved","repositories":{"sid":"0.11.0-2"},"fixed_version":"0.4.1-1","urgency":"low"},"trixie":{"status":"resolved","repositories":{"trixie":"0.11.0-2"},"fixed_version":"0.4.1-1","urgency":"low"}}}},"budgie-extras":{"CVE-2023-49342":{"description":"Temporary data passed between application components by Budgie Extras Clockworks applet could potentially be viewed or manipulated. The data is stored in a location that is accessible to any user who has local access to the system. Attackers may pre-create and control this file to present false information to users or deny access to the application and panel.","scope":"local","releases":{"bookworm":{"status":"open","repositories":{"bookworm":"1.5.0-2"},"urgency":"not yet assigned","nodsa":"Minor issue","nodsa_reason":""},"bullseye":{"status":"open","repositories":{"bullseye":"1.1.0-1"},"urgency":"not yet assigned","nodsa":"Minor issue","nodsa_reason":""},"sid":{"status":"resolved","repositories":{"sid":"1.9.0-1"},"fixed_version":"1.7.1-1","urgency":"not yet assigned"},"trixie":{"status":"resolved","repositories":{"trixie":"1.9.0-1"},"fixed_version":"1.7.1-1","urgency":"not yet assigned"}}},"CVE-2023-49343":{"description":"Temporary data passed between application components by Budgie Extras Dropby applet could potentially be viewed or manipulated. The data is stored in a location that is accessible to any user who has local access to the system. Attackers may pre-create and control this file to present false information to users or deny access to the application and panel.","scope":"local","releases":{"bookworm":{"status":"open","repositories":{"bookworm":"1.5.0-2"},"urgency":"not yet assigned","nodsa":"Minor issue","nodsa_reason":""},"bullseye":{"status":"open","repositories":{"bullseye":"1.1.0-1"},"urgency":"not yet assigned","nodsa":"Minor issue","nodsa_reason":""},"sid":{"status":"resolved","repositories":{"sid":"1.9.0-1"},"fixed_version":"1.7.1-1","urgency":"not yet assigned"},"trixie":{"status":"resolved","repositories":{"trixie":"1.9.0-1"},"fixed_version":"1.7.1-1","urgency":"not yet assigned"}}},"CVE-2023-49344":{"description":"Temporary data passed between application components by Budgie Extras Window Shuffler applet could potentially be viewed or manipulated. The data is stored in a location that is accessible to any user who has local access to the system. Attackers may pre-create and control this file to present false information to users or deny access to the application and panel.","scope":"local","releases":{"bookworm":{"status":"open","repositories":{"bookworm":"1.5.0-2"},"urgency":"not yet assigned","nodsa":"Minor issue","nodsa_reason":""},"bullseye":{"status":"open","repositories":{"bullseye":"1.1.0-1"},"urgency":"not yet assigned","nodsa":"Minor issue","nodsa_reason":""},"sid":{"status":"resolved","repositories":{"sid":"1.9.0-1"},"fixed_version":"1.7.1-1","urgency":"not yet assigned"},"trixie":{"status":"resolved","repositories":{"trixie":"1.9.0-1"},"fixed_version":"1.7.1-1","urgency":"not yet assigned"}}},"CVE-2023-49345":{"description":"Temporary data passed between application components by Budgie Extras Takeabreak applet could potentially be viewed or manipulated. The data is stored in a location that is accessible to any user who has local access to the system. Attackers may pre-create and control this file to present false information to users or deny access to the application and panel.","scope":"local","releases":{"bookworm":{"status":"open","repositories":{"bookworm":"1.5.0-2"},"urgency":"not yet assigned","nodsa":"Minor issue","nodsa_reason":""},"bullseye":{"status":"open","repositories":{"bullseye":"1.1.0-1"},"urgency":"not yet assigned","nodsa":"Minor issue","nodsa_reason":""},"sid":{"status":"resolved","repositories":{"sid":"1.9.0-1"},"fixed_version":"1.7.1-1","urgency":"not yet assigned"},"trixie":{"status":"resolved","repositories":{"trixie":"1.9.0-1"},"fixed_version":"1.7.1-1","urgency":"not yet assigned"}}},"CVE-2023-49346":{"description":"Temporary data passed between application components by Budgie Extras WeatherShow applet could potentially be viewed or manipulated. The data is stored in a location that is accessible to any user who has local access to the system. Attackers may pre-create and control this file to present false information to users or deny access to the application and panel.","scope":"local","releases":{"bookworm":{"status":"open","repositories":{"bookworm":"1.5.0-2"},"urgency":"not yet assigned","nodsa":"Minor issue","nodsa_reason":""},"bullseye":{"status":"open","repositories":{"bullseye":"1.1.0-1"},"urgency":"not yet assigned","nodsa":"Minor issue","nodsa_reason":""},"sid":{"status":"resolved","repositories":{"sid":"1.9.0-1"},"fixed_version":"1.7.1-1","urgency":"not yet assigned"},"trixie":{"status":"resolved","repositories":{"trixie":"1.9.0-1"},"fixed_version":"1.7.1-1","urgency":"not yet assigned"}}},"CVE-2023-49347":{"description":"Temporary data passed between application components by Budgie Extras Windows Previews could potentially be viewed or manipulated. The data is stored in a location that is accessible to any user who has local access to the system. Attackers may read private information from windows, present false information to users, or deny access to the application.","scope":"local","releases":{"bookworm":{"status":"open","repositories":{"bookworm":"1.5.0-2"},"urgency":"unimportant"},"bullseye":{"status":"open","repositories":{"bullseye":"1.1.0-1"},"urgency":"unimportant"},"sid":{"status":"resolved","repositories":{"sid":"1.9.0-1"},"fixed_version":"1.7.1-1","urgency":"unimportant"},"trixie":{"status":"resolved","repositories":{"trixie":"1.9.0-1"},"fixed_version":"1.7.1-1","urgency":"unimportant"}}}},"buildbot":{"CVE-2009-2959":{"description":"Cross-site scripting (XSS) vulnerability in the waterfall web status view (status/web/waterfall.py) in Buildbot 0.7.6 through 0.7.11p1 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors.","debianbug":543822,"scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"3.7.0-2"},"fixed_version":"0.7.11p3-1","urgency":"low"},"bullseye":{"status":"resolved","repositories":{"bullseye":"2.10.1-1"},"fixed_version":"0.7.11p3-1","urgency":"low"},"sid":{"status":"resolved","repositories":{"sid":"4.3.0-1"},"fixed_version":"0.7.11p3-1","urgency":"low"},"trixie":{"status":"resolved","repositories":{"trixie":"4.2.1-1"},"fixed_version":"0.7.11p3-1","urgency":"low"}}},"CVE-2009-2967":{"description":"Multiple cross-site scripting (XSS) vulnerabilities in Buildbot 0.7.6 through 0.7.11p2 allow remote attackers to inject arbitrary web script or HTML via unspecified vectors, different vulnerabilities than CVE-2009-2959.","scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"3.7.0-2"},"fixed_version":"0.7.11p3-1","urgency":"not yet assigned"},"bullseye":{"status":"resolved","repositories":{"bullseye":"2.10.1-1"},"fixed_version":"0.7.11p3-1","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"4.3.0-1"},"fixed_version":"0.7.11p3-1","urgency":"not yet assigned"},"trixie":{"status":"resolved","repositories":{"trixie":"4.2.1-1"},"fixed_version":"0.7.11p3-1","urgency":"not yet assigned"}}},"CVE-2019-12300":{"description":"Buildbot before 1.8.2 and 2.x before 2.3.1 accepts a user-submitted authorization token from OAuth and uses it to authenticate a user. If an attacker has a token allowing them to read the user details of a victim, they can login as the victim.","debianbug":929849,"scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"3.7.0-2"},"fixed_version":"2.0.1-2","urgency":"not yet assigned"},"bullseye":{"status":"resolved","repositories":{"bullseye":"2.10.1-1"},"fixed_version":"2.0.1-2","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"4.3.0-1"},"fixed_version":"2.0.1-2","urgency":"not yet assigned"},"trixie":{"status":"resolved","repositories":{"trixie":"4.2.1-1"},"fixed_version":"2.0.1-2","urgency":"not yet assigned"}}},"CVE-2019-7313":{"description":"www/resource.py in Buildbot before 1.8.1 allows CRLF injection in the Location header of /auth/login and /auth/logout via the redirect parameter. This affects other web sites in the same domain.","debianbug":921271,"scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"3.7.0-2"},"fixed_version":"2.0.0-1","urgency":"not yet assigned"},"bullseye":{"status":"resolved","repositories":{"bullseye":"2.10.1-1"},"fixed_version":"2.0.0-1","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"4.3.0-1"},"fixed_version":"2.0.0-1","urgency":"not yet assigned"},"trixie":{"status":"resolved","repositories":{"trixie":"4.2.1-1"},"fixed_version":"2.0.0-1","urgency":"not yet assigned"}}}},"burp":{"CVE-2017-16516":{"description":"In the yajl-ruby gem 1.3.0 for Ruby, when a crafted JSON file is supplied to Yajl::Parser.new.parse, the whole ruby process crashes with a SIGABRT in the yajl_string_decode function in yajl_encode.c. This results in the whole ruby process terminating and potentially a denial of service.","debianbug":1040146,"scope":"local","releases":{"bookworm":{"status":"open","repositories":{"bookworm":"3.1.4-1"},"urgency":"not yet assigned","nodsa":"Minor issue","nodsa_reason":""},"bullseye":{"status":"open","repositories":{"bullseye":"2.2.18-8"},"urgency":"not yet assigned","nodsa":"Minor issue","nodsa_reason":""},"forky":{"status":"resolved","repositories":{"forky":"3.1.4-5"},"fixed_version":"3.1.4-2","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"3.1.4-5"},"fixed_version":"3.1.4-2","urgency":"not yet assigned"},"trixie":{"status":"resolved","repositories":{"trixie":"3.1.4-4"},"fixed_version":"3.1.4-2","urgency":"not yet assigned"}}},"CVE-2017-18284":{"description":"The Gentoo app-backup/burp package before 2.1.32 sets the ownership of the PID file directory to the burp account, which might allow local users to kill arbitrary processes by leveraging access to this account for PID file modification before a root script sends a SIGKILL.","scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"3.1.4-1"},"fixed_version":"0","urgency":"unimportant"},"bullseye":{"status":"resolved","repositories":{"bullseye":"2.2.18-8"},"fixed_version":"0","urgency":"unimportant"},"forky":{"status":"resolved","repositories":{"forky":"3.1.4-5"},"fixed_version":"0","urgency":"unimportant"},"sid":{"status":"resolved","repositories":{"sid":"3.1.4-5"},"fixed_version":"0","urgency":"unimportant"},"trixie":{"status":"resolved","repositories":{"trixie":"3.1.4-4"},"fixed_version":"0","urgency":"unimportant"}}},"CVE-2017-18285":{"description":"The Gentoo app-backup/burp package before 2.1.32 has incorrect group ownership of the /etc/burp directory, which might allow local users to obtain read and write access to arbitrary files by leveraging access to a certain account for a burp-server.conf change.","scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"3.1.4-1"},"fixed_version":"0","urgency":"unimportant"},"bullseye":{"status":"resolved","repositories":{"bullseye":"2.2.18-8"},"fixed_version":"0","urgency":"unimportant"},"forky":{"status":"resolved","repositories":{"forky":"3.1.4-5"},"fixed_version":"0","urgency":"unimportant"},"sid":{"status":"resolved","repositories":{"sid":"3.1.4-5"},"fixed_version":"0","urgency":"unimportant"},"trixie":{"status":"resolved","repositories":{"trixie":"3.1.4-4"},"fixed_version":"0","urgency":"unimportant"}}},"CVE-2022-24795":{"description":"yajl-ruby is a C binding to the YAJL JSON parsing and generation library. The 1.x branch and the 2.x branch of `yajl` contain an integer overflow which leads to subsequent heap memory corruption when dealing with large (~2GB) inputs. The reallocation logic at `yajl_buf.c#L64` may result in the `need` 32bit integer wrapping to 0 when `need` approaches a value of 0x80000000 (i.e. ~2GB of data), which results in a reallocation of buf->alloc into a small heap chunk. These integers are declared as `size_t` in the 2.x branch of `yajl`, which practically prevents the issue from triggering on 64bit platforms, however this does not preclude this issue triggering on 32bit builds on which `size_t` is a 32bit integer. Subsequent population of this under-allocated heap chunk is based on the original buffer size, leading to heap memory corruption. This vulnerability mostly impacts process availability. Maintainers believe exploitation for arbitrary code execution is unlikely. A patch is available and anticipated to be part of yajl-ruby version 1.4.2. As a workaround, avoid passing large inputs to YAJL.","debianbug":1040146,"scope":"local","releases":{"bookworm":{"status":"open","repositories":{"bookworm":"3.1.4-1"},"urgency":"not yet assigned","nodsa":"Minor issue","nodsa_reason":""},"bullseye":{"status":"open","repositories":{"bullseye":"2.2.18-8"},"urgency":"not yet assigned","nodsa":"Minor issue","nodsa_reason":""},"forky":{"status":"resolved","repositories":{"forky":"3.1.4-5"},"fixed_version":"3.1.4-2","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"3.1.4-5"},"fixed_version":"3.1.4-2","urgency":"not yet assigned"},"trixie":{"status":"resolved","repositories":{"trixie":"3.1.4-4"},"fixed_version":"3.1.4-2","urgency":"not yet assigned"}}}},"busybox":{"CVE-2006-1058":{"description":"BusyBox 1.1.1 does not use a salt when generating passwords, which makes it easier for local users to guess passwords from a stolen password file using techniques such as rainbow tables.","debianbug":360578,"scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"1:1.35.0-4"},"fixed_version":"1:1.1.3-1","urgency":"low"},"bullseye":{"status":"resolved","repositories":{"bullseye":"1:1.30.1-6","bullseye-security":"1:1.30.1-6+deb11u1"},"fixed_version":"1:1.1.3-1","urgency":"low"},"forky":{"status":"resolved","repositories":{"forky":"1:1.37.0-10.1"},"fixed_version":"1:1.1.3-1","urgency":"low"},"sid":{"status":"resolved","repositories":{"sid":"1:1.37.0-10.1"},"fixed_version":"1:1.1.3-1","urgency":"low"},"trixie":{"status":"resolved","repositories":{"trixie":"1:1.37.0-6"},"fixed_version":"1:1.1.3-1","urgency":"low"}}},"CVE-2006-5050":{"description":"Directory traversal vulnerability in httpd in Rob Landley BusyBox allows remote attackers to read arbitrary files via URL-encoded \"%2e%2e/\" sequences in the URI.","scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"1:1.35.0-4"},"fixed_version":"0","urgency":"unimportant"},"bullseye":{"status":"resolved","repositories":{"bullseye":"1:1.30.1-6","bullseye-security":"1:1.30.1-6+deb11u1"},"fixed_version":"0","urgency":"unimportant"},"forky":{"status":"resolved","repositories":{"forky":"1:1.37.0-10.1"},"fixed_version":"0","urgency":"unimportant"},"sid":{"status":"resolved","repositories":{"sid":"1:1.37.0-10.1"},"fixed_version":"0","urgency":"unimportant"},"trixie":{"status":"resolved","repositories":{"trixie":"1:1.37.0-6"},"fixed_version":"0","urgency":"unimportant"}}},"CVE-2010-0001":{"description":"Integer underflow in the unlzw function in unlzw.c in gzip before 1.4 on 64-bit platforms, as used in ncompress and probably others, allows remote attackers to cause a denial of service (application crash) or possibly execute arbitrary code via a crafted archive that uses LZW compression, leading to an array index error.","scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"1:1.35.0-4"},"fixed_version":"0","urgency":"unimportant"},"bullseye":{"status":"resolved","repositories":{"bullseye":"1:1.30.1-6","bullseye-security":"1:1.30.1-6+deb11u1"},"fixed_version":"0","urgency":"unimportant"},"forky":{"status":"resolved","repositories":{"forky":"1:1.37.0-10.1"},"fixed_version":"0","urgency":"unimportant"},"sid":{"status":"resolved","repositories":{"sid":"1:1.37.0-10.1"},"fixed_version":"0","urgency":"unimportant"},"trixie":{"status":"resolved","repositories":{"trixie":"1:1.37.0-6"},"fixed_version":"0","urgency":"unimportant"}}},"CVE-2011-2716":{"description":"The DHCP client (udhcpc) in BusyBox before 1.20.0 allows remote DHCP servers to execute arbitrary commands via shell metacharacters in the (1) HOST_NAME, (2) DOMAIN_NAME, (3) NIS_DOMAIN, and (4) TFTP_SERVER_NAME host name options.","debianbug":635548,"scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"1:1.35.0-4"},"fixed_version":"1:1.20.0-3","urgency":"unimportant"},"bullseye":{"status":"resolved","repositories":{"bullseye":"1:1.30.1-6","bullseye-security":"1:1.30.1-6+deb11u1"},"fixed_version":"1:1.20.0-3","urgency":"unimportant"},"forky":{"status":"resolved","repositories":{"forky":"1:1.37.0-10.1"},"fixed_version":"1:1.20.0-3","urgency":"unimportant"},"sid":{"status":"resolved","repositories":{"sid":"1:1.37.0-10.1"},"fixed_version":"1:1.20.0-3","urgency":"unimportant"},"trixie":{"status":"resolved","repositories":{"trixie":"1:1.37.0-6"},"fixed_version":"1:1.20.0-3","urgency":"unimportant"}}},"CVE-2011-5325":{"description":"Directory traversal vulnerability in the BusyBox implementation of tar before 1.22.0 v5 allows remote attackers to point to files outside the current working directory via a symlink.","debianbug":802702,"scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"1:1.35.0-4"},"fixed_version":"1:1.27.2-1","urgency":"not yet assigned"},"bullseye":{"status":"resolved","repositories":{"bullseye":"1:1.30.1-6","bullseye-security":"1:1.30.1-6+deb11u1"},"fixed_version":"1:1.27.2-1","urgency":"not yet assigned"},"forky":{"status":"resolved","repositories":{"forky":"1:1.37.0-10.1"},"fixed_version":"1:1.27.2-1","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"1:1.37.0-10.1"},"fixed_version":"1:1.27.2-1","urgency":"not yet assigned"},"trixie":{"status":"resolved","repositories":{"trixie":"1:1.37.0-6"},"fixed_version":"1:1.27.2-1","urgency":"not yet assigned"}}},"CVE-2013-1813":{"description":"util-linux/mdev.c in BusyBox before 1.21.0 uses 0777 permissions for parent directories when creating nested directories under /dev/, which allows local users to have unknown impact and attack vectors.","debianbug":701965,"scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"1:1.35.0-4"},"fixed_version":"1:1.20.0-8","urgency":"low"},"bullseye":{"status":"resolved","repositories":{"bullseye":"1:1.30.1-6","bullseye-security":"1:1.30.1-6+deb11u1"},"fixed_version":"1:1.20.0-8","urgency":"low"},"forky":{"status":"resolved","repositories":{"forky":"1:1.37.0-10.1"},"fixed_version":"1:1.20.0-8","urgency":"low"},"sid":{"status":"resolved","repositories":{"sid":"1:1.37.0-10.1"},"fixed_version":"1:1.20.0-8","urgency":"low"},"trixie":{"status":"resolved","repositories":{"trixie":"1:1.37.0-6"},"fixed_version":"1:1.20.0-8","urgency":"low"}}},"CVE-2014-4607":{"description":"Integer overflow in the LZO algorithm variant in Oberhumer liblzo2 and lzo-2 before 2.07 on 32-bit platforms might allow remote attackers to execute arbitrary code via a crafted Literal Run.","debianbug":768945,"scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"1:1.35.0-4"},"fixed_version":"1:1.22.0-10","urgency":"not yet assigned"},"bullseye":{"status":"resolved","repositories":{"bullseye":"1:1.30.1-6","bullseye-security":"1:1.30.1-6+deb11u1"},"fixed_version":"1:1.22.0-10","urgency":"not yet assigned"},"forky":{"status":"resolved","repositories":{"forky":"1:1.37.0-10.1"},"fixed_version":"1:1.22.0-10","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"1:1.37.0-10.1"},"fixed_version":"1:1.22.0-10","urgency":"not yet assigned"},"trixie":{"status":"resolved","repositories":{"trixie":"1:1.37.0-6"},"fixed_version":"1:1.22.0-10","urgency":"not yet assigned"}}},"CVE-2014-9645":{"description":"The add_probe function in modutils/modprobe.c in BusyBox before 1.23.0 allows local users to bypass intended restrictions on loading kernel modules via a / (slash) character in a module name, as demonstrated by an \"ifconfig /usbserial up\" command or a \"mount -t /snd_pcm none /\" command.","debianbug":776186,"scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"1:1.35.0-4"},"fixed_version":"1:1.22.0-15","urgency":"low"},"bullseye":{"status":"resolved","repositories":{"bullseye":"1:1.30.1-6","bullseye-security":"1:1.30.1-6+deb11u1"},"fixed_version":"1:1.22.0-15","urgency":"low"},"forky":{"status":"resolved","repositories":{"forky":"1:1.37.0-10.1"},"fixed_version":"1:1.22.0-15","urgency":"low"},"sid":{"status":"resolved","repositories":{"sid":"1:1.37.0-10.1"},"fixed_version":"1:1.22.0-15","urgency":"low"},"trixie":{"status":"resolved","repositories":{"trixie":"1:1.37.0-6"},"fixed_version":"1:1.22.0-15","urgency":"low"}}},"CVE-2015-9261":{"description":"huft_build in archival/libarchive/decompress_gunzip.c in BusyBox before 1.27.2 misuses a pointer, causing segfaults and an application crash during an unzip operation on a specially crafted ZIP file.","debianbug":803097,"scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"1:1.35.0-4"},"fixed_version":"1:1.27.2-1","urgency":"not yet assigned"},"bullseye":{"status":"resolved","repositories":{"bullseye":"1:1.30.1-6","bullseye-security":"1:1.30.1-6+deb11u1"},"fixed_version":"1:1.27.2-1","urgency":"not yet assigned"},"forky":{"status":"resolved","repositories":{"forky":"1:1.37.0-10.1"},"fixed_version":"1:1.27.2-1","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"1:1.37.0-10.1"},"fixed_version":"1:1.27.2-1","urgency":"not yet assigned"},"trixie":{"status":"resolved","repositories":{"trixie":"1:1.37.0-6"},"fixed_version":"1:1.27.2-1","urgency":"not yet assigned"}}},"CVE-2016-2147":{"description":"Integer overflow in the DHCP client (udhcpc) in BusyBox before 1.25.0 allows remote attackers to cause a denial of service (crash) via a malformed RFC1035-encoded domain name, which triggers an out-of-bounds heap write.","debianbug":818499,"scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"1:1.35.0-4"},"fixed_version":"1:1.27.2-1","urgency":"not yet assigned"},"bullseye":{"status":"resolved","repositories":{"bullseye":"1:1.30.1-6","bullseye-security":"1:1.30.1-6+deb11u1"},"fixed_version":"1:1.27.2-1","urgency":"not yet assigned"},"forky":{"status":"resolved","repositories":{"forky":"1:1.37.0-10.1"},"fixed_version":"1:1.27.2-1","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"1:1.37.0-10.1"},"fixed_version":"1:1.27.2-1","urgency":"not yet assigned"},"trixie":{"status":"resolved","repositories":{"trixie":"1:1.37.0-6"},"fixed_version":"1:1.27.2-1","urgency":"not yet assigned"}}},"CVE-2016-2148":{"description":"Heap-based buffer overflow in the DHCP client (udhcpc) in BusyBox before 1.25.0 allows remote attackers to have unspecified impact via vectors involving OPTION_6RD parsing.","debianbug":818497,"scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"1:1.35.0-4"},"fixed_version":"1:1.27.2-1","urgency":"not yet assigned"},"bullseye":{"status":"resolved","repositories":{"bullseye":"1:1.30.1-6","bullseye-security":"1:1.30.1-6+deb11u1"},"fixed_version":"1:1.27.2-1","urgency":"not yet assigned"},"forky":{"status":"resolved","repositories":{"forky":"1:1.37.0-10.1"},"fixed_version":"1:1.27.2-1","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"1:1.37.0-10.1"},"fixed_version":"1:1.27.2-1","urgency":"not yet assigned"},"trixie":{"status":"resolved","repositories":{"trixie":"1:1.37.0-6"},"fixed_version":"1:1.27.2-1","urgency":"not yet assigned"}}},"CVE-2016-6301":{"description":"The recv_and_process_client_pkt function in networking/ntpd.c in busybox allows remote attackers to cause a denial of service (CPU and bandwidth consumption) via a forged NTP packet, which triggers a communication loop.","debianbug":833442,"scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"1:1.35.0-4"},"fixed_version":"1:1.27.2-1","urgency":"unimportant"},"bullseye":{"status":"resolved","repositories":{"bullseye":"1:1.30.1-6","bullseye-security":"1:1.30.1-6+deb11u1"},"fixed_version":"1:1.27.2-1","urgency":"unimportant"},"forky":{"status":"resolved","repositories":{"forky":"1:1.37.0-10.1"},"fixed_version":"1:1.27.2-1","urgency":"unimportant"},"sid":{"status":"resolved","repositories":{"sid":"1:1.37.0-10.1"},"fixed_version":"1:1.27.2-1","urgency":"unimportant"},"trixie":{"status":"resolved","repositories":{"trixie":"1:1.37.0-6"},"fixed_version":"1:1.27.2-1","urgency":"unimportant"}}},"CVE-2017-15873":{"description":"The get_next_block function in archival/libarchive/decompress_bunzip2.c in BusyBox 1.27.2 has an Integer Overflow that may lead to a write access violation.","debianbug":879732,"scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"1:1.35.0-4"},"fixed_version":"1:1.27.2-2","urgency":"not yet assigned"},"bullseye":{"status":"resolved","repositories":{"bullseye":"1:1.30.1-6","bullseye-security":"1:1.30.1-6+deb11u1"},"fixed_version":"1:1.27.2-2","urgency":"not yet assigned"},"forky":{"status":"resolved","repositories":{"forky":"1:1.37.0-10.1"},"fixed_version":"1:1.27.2-2","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"1:1.37.0-10.1"},"fixed_version":"1:1.27.2-2","urgency":"not yet assigned"},"trixie":{"status":"resolved","repositories":{"trixie":"1:1.37.0-6"},"fixed_version":"1:1.27.2-2","urgency":"not yet assigned"}}},"CVE-2017-15874":{"description":"archival/libarchive/decompress_unlzma.c in BusyBox 1.27.2 has an Integer Underflow that leads to a read access violation.","debianbug":879732,"scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"1:1.35.0-4"},"fixed_version":"1:1.27.2-2","urgency":"not yet assigned"},"bullseye":{"status":"resolved","repositories":{"bullseye":"1:1.30.1-6","bullseye-security":"1:1.30.1-6+deb11u1"},"fixed_version":"1:1.27.2-2","urgency":"not yet assigned"},"forky":{"status":"resolved","repositories":{"forky":"1:1.37.0-10.1"},"fixed_version":"1:1.27.2-2","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"1:1.37.0-10.1"},"fixed_version":"1:1.27.2-2","urgency":"not yet assigned"},"trixie":{"status":"resolved","repositories":{"trixie":"1:1.37.0-6"},"fixed_version":"1:1.27.2-2","urgency":"not yet assigned"}}},"CVE-2017-16544":{"description":"In the add_match function in libbb/lineedit.c in BusyBox through 1.27.2, the tab autocomplete feature of the shell, used to get a list of filenames in a directory, does not sanitize filenames and results in executing any escape sequence in the terminal. This could potentially result in code execution, arbitrary file writes, or other attacks.","debianbug":882258,"scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"1:1.35.0-4"},"fixed_version":"1:1.27.2-2","urgency":"not yet assigned"},"bullseye":{"status":"resolved","repositories":{"bullseye":"1:1.30.1-6","bullseye-security":"1:1.30.1-6+deb11u1"},"fixed_version":"1:1.27.2-2","urgency":"not yet assigned"},"forky":{"status":"resolved","repositories":{"forky":"1:1.37.0-10.1"},"fixed_version":"1:1.27.2-2","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"1:1.37.0-10.1"},"fixed_version":"1:1.27.2-2","urgency":"not yet assigned"},"trixie":{"status":"resolved","repositories":{"trixie":"1:1.37.0-6"},"fixed_version":"1:1.27.2-2","urgency":"not yet assigned"}}},"CVE-2018-1000500":{"description":"Busybox contains a Missing SSL certificate validation vulnerability in The \"busybox wget\" applet that can result in arbitrary code execution. This attack appear to be exploitable via Simply download any file over HTTPS using \"busybox wget https://compromised-domain.com/important-file\".","scope":"local","releases":{"bookworm":{"status":"open","repositories":{"bookworm":"1:1.35.0-4"},"urgency":"unimportant"},"bullseye":{"status":"open","repositories":{"bullseye":"1:1.30.1-6","bullseye-security":"1:1.30.1-6+deb11u1"},"urgency":"unimportant"},"forky":{"status":"open","repositories":{"forky":"1:1.37.0-10.1"},"urgency":"unimportant"},"sid":{"status":"open","repositories":{"sid":"1:1.37.0-10.1"},"urgency":"unimportant"},"trixie":{"status":"open","repositories":{"trixie":"1:1.37.0-6"},"urgency":"unimportant"}}},"CVE-2018-1000517":{"description":"BusyBox project BusyBox wget version prior to commit 8e2174e9bd836e53c8b9c6e00d1bc6e2a718686e contains a Buffer Overflow vulnerability in Busybox wget that can result in heap buffer overflow. This attack appear to be exploitable via network connectivity. This vulnerability appears to have been fixed in after commit 8e2174e9bd836e53c8b9c6e00d1bc6e2a718686e.","debianbug":902724,"scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"1:1.35.0-4"},"fixed_version":"1:1.27.2-3","urgency":"low"},"bullseye":{"status":"resolved","repositories":{"bullseye":"1:1.30.1-6","bullseye-security":"1:1.30.1-6+deb11u1"},"fixed_version":"1:1.27.2-3","urgency":"low"},"forky":{"status":"resolved","repositories":{"forky":"1:1.37.0-10.1"},"fixed_version":"1:1.27.2-3","urgency":"low"},"sid":{"status":"resolved","repositories":{"sid":"1:1.37.0-10.1"},"fixed_version":"1:1.27.2-3","urgency":"low"},"trixie":{"status":"resolved","repositories":{"trixie":"1:1.37.0-6"},"fixed_version":"1:1.27.2-3","urgency":"low"}}},"CVE-2018-20679":{"description":"An issue was discovered in BusyBox before 1.30.0. An out of bounds read in udhcp components (consumed by the DHCP server, client, and relay) allows a remote attacker to leak sensitive information from the stack by sending a crafted DHCP message. This is related to verification in udhcp_get_option() in networking/udhcp/common.c that 4-byte options are indeed 4 bytes.","debianbug":918846,"scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"1:1.35.0-4"},"fixed_version":"1:1.30.1-1","urgency":"low"},"bullseye":{"status":"resolved","repositories":{"bullseye":"1:1.30.1-6","bullseye-security":"1:1.30.1-6+deb11u1"},"fixed_version":"1:1.30.1-1","urgency":"low"},"forky":{"status":"resolved","repositories":{"forky":"1:1.37.0-10.1"},"fixed_version":"1:1.30.1-1","urgency":"low"},"sid":{"status":"resolved","repositories":{"sid":"1:1.37.0-10.1"},"fixed_version":"1:1.30.1-1","urgency":"low"},"trixie":{"status":"resolved","repositories":{"trixie":"1:1.37.0-6"},"fixed_version":"1:1.30.1-1","urgency":"low"}}},"CVE-2019-5747":{"description":"An issue was discovered in BusyBox through 1.30.0. An out of bounds read in udhcp components (consumed by the DHCP client, server, and/or relay) might allow a remote attacker to leak sensitive information from the stack by sending a crafted DHCP message. This is related to assurance of a 4-byte length when decoding DHCP_SUBNET. NOTE: this issue exists because of an incomplete fix for CVE-2018-20679.","scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"1:1.35.0-4"},"fixed_version":"1:1.30.1-2","urgency":"not yet assigned"},"bullseye":{"status":"resolved","repositories":{"bullseye":"1:1.30.1-6","bullseye-security":"1:1.30.1-6+deb11u1"},"fixed_version":"1:1.30.1-2","urgency":"not yet assigned"},"forky":{"status":"resolved","repositories":{"forky":"1:1.37.0-10.1"},"fixed_version":"1:1.30.1-2","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"1:1.37.0-10.1"},"fixed_version":"1:1.30.1-2","urgency":"not yet assigned"},"trixie":{"status":"resolved","repositories":{"trixie":"1:1.37.0-6"},"fixed_version":"1:1.30.1-2","urgency":"not yet assigned"}}},"CVE-2021-28831":{"description":"decompress_gunzip.c in BusyBox through 1.32.1 mishandles the error bit on the huft_build result pointer, with a resultant invalid free or segmentation fault, via malformed gzip data.","debianbug":985674,"scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"1:1.35.0-4"},"fixed_version":"1:1.35.0-1","urgency":"not yet assigned"},"bullseye":{"status":"resolved","repositories":{"bullseye":"1:1.30.1-6","bullseye-security":"1:1.30.1-6+deb11u1"},"fixed_version":"1:1.30.1-6+deb11u1","urgency":"not yet assigned"},"forky":{"status":"resolved","repositories":{"forky":"1:1.37.0-10.1"},"fixed_version":"1:1.35.0-1","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"1:1.37.0-10.1"},"fixed_version":"1:1.35.0-1","urgency":"not yet assigned"},"trixie":{"status":"resolved","repositories":{"trixie":"1:1.37.0-6"},"fixed_version":"1:1.35.0-1","urgency":"not yet assigned"}}},"CVE-2021-42373":{"description":"A NULL pointer dereference in Busybox's man applet leads to denial of service when a section name is supplied but no page argument is given","debianbug":999567,"scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"1:1.35.0-4"},"fixed_version":"1:1.35.0-1","urgency":"unimportant"},"bullseye":{"status":"open","repositories":{"bullseye":"1:1.30.1-6","bullseye-security":"1:1.30.1-6+deb11u1"},"urgency":"unimportant"},"forky":{"status":"resolved","repositories":{"forky":"1:1.37.0-10.1"},"fixed_version":"1:1.35.0-1","urgency":"unimportant"},"sid":{"status":"resolved","repositories":{"sid":"1:1.37.0-10.1"},"fixed_version":"1:1.35.0-1","urgency":"unimportant"},"trixie":{"status":"resolved","repositories":{"trixie":"1:1.37.0-6"},"fixed_version":"1:1.35.0-1","urgency":"unimportant"}}},"CVE-2021-42374":{"description":"An out-of-bounds heap read in Busybox's unlzma applet leads to information leak and denial of service when crafted LZMA-compressed input is decompressed. This can be triggered by any applet/format that","debianbug":999567,"scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"1:1.35.0-4"},"fixed_version":"1:1.35.0-1","urgency":"unimportant"},"bullseye":{"status":"resolved","repositories":{"bullseye":"1:1.30.1-6","bullseye-security":"1:1.30.1-6+deb11u1"},"fixed_version":"1:1.30.1-6+deb11u1","urgency":"not yet assigned"},"forky":{"status":"resolved","repositories":{"forky":"1:1.37.0-10.1"},"fixed_version":"1:1.35.0-1","urgency":"unimportant"},"sid":{"status":"resolved","repositories":{"sid":"1:1.37.0-10.1"},"fixed_version":"1:1.35.0-1","urgency":"unimportant"},"trixie":{"status":"resolved","repositories":{"trixie":"1:1.37.0-6"},"fixed_version":"1:1.35.0-1","urgency":"unimportant"}}},"CVE-2021-42375":{"description":"An incorrect handling of a special element in Busybox's ash applet leads to denial of service when processing a crafted shell command, due to the shell mistaking specific characters for reserved characters. This may be used for DoS under rare conditions of filtered command input.","debianbug":999567,"scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"1:1.35.0-4"},"fixed_version":"1:1.35.0-1","urgency":"unimportant"},"bullseye":{"status":"open","repositories":{"bullseye":"1:1.30.1-6","bullseye-security":"1:1.30.1-6+deb11u1"},"urgency":"unimportant"},"forky":{"status":"resolved","repositories":{"forky":"1:1.37.0-10.1"},"fixed_version":"1:1.35.0-1","urgency":"unimportant"},"sid":{"status":"resolved","repositories":{"sid":"1:1.37.0-10.1"},"fixed_version":"1:1.35.0-1","urgency":"unimportant"},"trixie":{"status":"resolved","repositories":{"trixie":"1:1.37.0-6"},"fixed_version":"1:1.35.0-1","urgency":"unimportant"}}},"CVE-2021-42376":{"description":"A NULL pointer dereference in Busybox's hush applet leads to denial of service when processing a crafted shell command, due to missing validation after a \\x03 delimiter character. This may be used for DoS under very rare conditions of filtered command input.","debianbug":999567,"scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"1:1.35.0-4"},"fixed_version":"1:1.35.0-1","urgency":"unimportant"},"bullseye":{"status":"open","repositories":{"bullseye":"1:1.30.1-6","bullseye-security":"1:1.30.1-6+deb11u1"},"urgency":"unimportant"},"forky":{"status":"resolved","repositories":{"forky":"1:1.37.0-10.1"},"fixed_version":"1:1.35.0-1","urgency":"unimportant"},"sid":{"status":"resolved","repositories":{"sid":"1:1.37.0-10.1"},"fixed_version":"1:1.35.0-1","urgency":"unimportant"},"trixie":{"status":"resolved","repositories":{"trixie":"1:1.37.0-6"},"fixed_version":"1:1.35.0-1","urgency":"unimportant"}}},"CVE-2021-42377":{"description":"An attacker-controlled pointer free in Busybox's hush applet leads to denial of service and possible code execution when processing a crafted shell command, due to the shell mishandling the &&& string. This may be used for remote code execution under rare conditions of filtered command input.","debianbug":999567,"scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"1:1.35.0-4"},"fixed_version":"1:1.35.0-1","urgency":"unimportant"},"bullseye":{"status":"open","repositories":{"bullseye":"1:1.30.1-6","bullseye-security":"1:1.30.1-6+deb11u1"},"urgency":"unimportant"},"forky":{"status":"resolved","repositories":{"forky":"1:1.37.0-10.1"},"fixed_version":"1:1.35.0-1","urgency":"unimportant"},"sid":{"status":"resolved","repositories":{"sid":"1:1.37.0-10.1"},"fixed_version":"1:1.35.0-1","urgency":"unimportant"},"trixie":{"status":"resolved","repositories":{"trixie":"1:1.37.0-6"},"fixed_version":"1:1.35.0-1","urgency":"unimportant"}}},"CVE-2021-42378":{"description":"A use-after-free in Busybox's awk applet leads to denial of service and possibly code execution when processing a crafted awk pattern in the getvar_i function","debianbug":999567,"scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"1:1.35.0-4"},"fixed_version":"1:1.35.0-1","urgency":"not yet assigned"},"bullseye":{"status":"resolved","repositories":{"bullseye":"1:1.30.1-6","bullseye-security":"1:1.30.1-6+deb11u1"},"fixed_version":"1:1.30.1-6+deb11u1","urgency":"not yet assigned"},"forky":{"status":"resolved","repositories":{"forky":"1:1.37.0-10.1"},"fixed_version":"1:1.35.0-1","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"1:1.37.0-10.1"},"fixed_version":"1:1.35.0-1","urgency":"not yet assigned"},"trixie":{"status":"resolved","repositories":{"trixie":"1:1.37.0-6"},"fixed_version":"1:1.35.0-1","urgency":"not yet assigned"}}},"CVE-2021-42379":{"description":"A use-after-free in Busybox's awk applet leads to denial of service and possibly code execution when processing a crafted awk pattern in the next_input_file function","debianbug":999567,"scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"1:1.35.0-4"},"fixed_version":"1:1.35.0-1","urgency":"not yet assigned"},"bullseye":{"status":"resolved","repositories":{"bullseye":"1:1.30.1-6","bullseye-security":"1:1.30.1-6+deb11u1"},"fixed_version":"1:1.30.1-6+deb11u1","urgency":"not yet assigned"},"forky":{"status":"resolved","repositories":{"forky":"1:1.37.0-10.1"},"fixed_version":"1:1.35.0-1","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"1:1.37.0-10.1"},"fixed_version":"1:1.35.0-1","urgency":"not yet assigned"},"trixie":{"status":"resolved","repositories":{"trixie":"1:1.37.0-6"},"fixed_version":"1:1.35.0-1","urgency":"not yet assigned"}}},"CVE-2021-42380":{"description":"A use-after-free in Busybox's awk applet leads to denial of service and possibly code execution when processing a crafted awk pattern in the clrvar function","debianbug":999567,"scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"1:1.35.0-4"},"fixed_version":"1:1.35.0-1","urgency":"not yet assigned"},"bullseye":{"status":"resolved","repositories":{"bullseye":"1:1.30.1-6","bullseye-security":"1:1.30.1-6+deb11u1"},"fixed_version":"1:1.30.1-6+deb11u1","urgency":"not yet assigned"},"forky":{"status":"resolved","repositories":{"forky":"1:1.37.0-10.1"},"fixed_version":"1:1.35.0-1","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"1:1.37.0-10.1"},"fixed_version":"1:1.35.0-1","urgency":"not yet assigned"},"trixie":{"status":"resolved","repositories":{"trixie":"1:1.37.0-6"},"fixed_version":"1:1.35.0-1","urgency":"not yet assigned"}}},"CVE-2021-42381":{"description":"A use-after-free in Busybox's awk applet leads to denial of service and possibly code execution when processing a crafted awk pattern in the hash_init function","debianbug":999567,"scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"1:1.35.0-4"},"fixed_version":"1:1.35.0-1","urgency":"not yet assigned"},"bullseye":{"status":"resolved","repositories":{"bullseye":"1:1.30.1-6","bullseye-security":"1:1.30.1-6+deb11u1"},"fixed_version":"1:1.30.1-6+deb11u1","urgency":"not yet assigned"},"forky":{"status":"resolved","repositories":{"forky":"1:1.37.0-10.1"},"fixed_version":"1:1.35.0-1","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"1:1.37.0-10.1"},"fixed_version":"1:1.35.0-1","urgency":"not yet assigned"},"trixie":{"status":"resolved","repositories":{"trixie":"1:1.37.0-6"},"fixed_version":"1:1.35.0-1","urgency":"not yet assigned"}}},"CVE-2021-42382":{"description":"A use-after-free in Busybox's awk applet leads to denial of service and possibly code execution when processing a crafted awk pattern in the getvar_s function","debianbug":999567,"scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"1:1.35.0-4"},"fixed_version":"1:1.35.0-1","urgency":"not yet assigned"},"bullseye":{"status":"resolved","repositories":{"bullseye":"1:1.30.1-6","bullseye-security":"1:1.30.1-6+deb11u1"},"fixed_version":"1:1.30.1-6+deb11u1","urgency":"not yet assigned"},"forky":{"status":"resolved","repositories":{"forky":"1:1.37.0-10.1"},"fixed_version":"1:1.35.0-1","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"1:1.37.0-10.1"},"fixed_version":"1:1.35.0-1","urgency":"not yet assigned"},"trixie":{"status":"resolved","repositories":{"trixie":"1:1.37.0-6"},"fixed_version":"1:1.35.0-1","urgency":"not yet assigned"}}},"CVE-2021-42383":{"description":"A use-after-free in Busybox's awk applet leads to denial of service and possibly code execution when processing a crafted awk pattern in the evaluate function","debianbug":999567,"scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"1:1.35.0-4"},"fixed_version":"1:1.35.0-1","urgency":"not yet assigned"},"bullseye":{"status":"open","repositories":{"bullseye":"1:1.30.1-6","bullseye-security":"1:1.30.1-6+deb11u1"},"urgency":"not yet assigned","nodsa":"Minor issue, requires passing arbitrary awk program, no identified patch","nodsa_reason":"postponed"},"forky":{"status":"resolved","repositories":{"forky":"1:1.37.0-10.1"},"fixed_version":"1:1.35.0-1","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"1:1.37.0-10.1"},"fixed_version":"1:1.35.0-1","urgency":"not yet assigned"},"trixie":{"status":"resolved","repositories":{"trixie":"1:1.37.0-6"},"fixed_version":"1:1.35.0-1","urgency":"not yet assigned"}}},"CVE-2021-42384":{"description":"A use-after-free in Busybox's awk applet leads to denial of service and possibly code execution when processing a crafted awk pattern in the handle_special function","debianbug":999567,"scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"1:1.35.0-4"},"fixed_version":"1:1.35.0-1","urgency":"not yet assigned"},"bullseye":{"status":"resolved","repositories":{"bullseye":"1:1.30.1-6","bullseye-security":"1:1.30.1-6+deb11u1"},"fixed_version":"1:1.30.1-6+deb11u1","urgency":"not yet assigned"},"forky":{"status":"resolved","repositories":{"forky":"1:1.37.0-10.1"},"fixed_version":"1:1.35.0-1","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"1:1.37.0-10.1"},"fixed_version":"1:1.35.0-1","urgency":"not yet assigned"},"trixie":{"status":"resolved","repositories":{"trixie":"1:1.37.0-6"},"fixed_version":"1:1.35.0-1","urgency":"not yet assigned"}}},"CVE-2021-42385":{"description":"A use-after-free in Busybox's awk applet leads to denial of service and possibly code execution when processing a crafted awk pattern in the evaluate function","debianbug":999567,"scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"1:1.35.0-4"},"fixed_version":"1:1.35.0-1","urgency":"not yet assigned"},"bullseye":{"status":"resolved","repositories":{"bullseye":"1:1.30.1-6","bullseye-security":"1:1.30.1-6+deb11u1"},"fixed_version":"1:1.30.1-6+deb11u1","urgency":"not yet assigned"},"forky":{"status":"resolved","repositories":{"forky":"1:1.37.0-10.1"},"fixed_version":"1:1.35.0-1","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"1:1.37.0-10.1"},"fixed_version":"1:1.35.0-1","urgency":"not yet assigned"},"trixie":{"status":"resolved","repositories":{"trixie":"1:1.37.0-6"},"fixed_version":"1:1.35.0-1","urgency":"not yet assigned"}}},"CVE-2021-42386":{"description":"A use-after-free in Busybox's awk applet leads to denial of service and possibly code execution when processing a crafted awk pattern in the nvalloc function","debianbug":999567,"scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"1:1.35.0-4"},"fixed_version":"1:1.35.0-1","urgency":"not yet assigned"},"bullseye":{"status":"resolved","repositories":{"bullseye":"1:1.30.1-6","bullseye-security":"1:1.30.1-6+deb11u1"},"fixed_version":"1:1.30.1-6+deb11u1","urgency":"not yet assigned"},"forky":{"status":"resolved","repositories":{"forky":"1:1.37.0-10.1"},"fixed_version":"1:1.35.0-1","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"1:1.37.0-10.1"},"fixed_version":"1:1.35.0-1","urgency":"not yet assigned"},"trixie":{"status":"resolved","repositories":{"trixie":"1:1.37.0-6"},"fixed_version":"1:1.35.0-1","urgency":"not yet assigned"}}},"CVE-2022-28391":{"description":"BusyBox through 1.35.0 allows remote attackers to execute arbitrary code if netstat is used to print a DNS PTR record's value to a VT compatible terminal. Alternatively, the attacker could choose to change the terminal's colors.","scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"1:1.35.0-4"},"fixed_version":"0","urgency":"unimportant"},"bullseye":{"status":"resolved","repositories":{"bullseye":"1:1.30.1-6","bullseye-security":"1:1.30.1-6+deb11u1"},"fixed_version":"0","urgency":"unimportant"},"forky":{"status":"resolved","repositories":{"forky":"1:1.37.0-10.1"},"fixed_version":"0","urgency":"unimportant"},"sid":{"status":"resolved","repositories":{"sid":"1:1.37.0-10.1"},"fixed_version":"0","urgency":"unimportant"},"trixie":{"status":"resolved","repositories":{"trixie":"1:1.37.0-6"},"fixed_version":"0","urgency":"unimportant"}}},"CVE-2022-30065":{"description":"A use-after-free in Busybox 1.35-x's awk applet leads to denial of service and possibly code execution when processing a crafted awk pattern in the copyvar function.","scope":"local","releases":{"bookworm":{"status":"open","repositories":{"bookworm":"1:1.35.0-4"},"urgency":"unimportant"},"bullseye":{"status":"open","repositories":{"bullseye":"1:1.30.1-6","bullseye-security":"1:1.30.1-6+deb11u1"},"urgency":"unimportant"},"forky":{"status":"resolved","repositories":{"forky":"1:1.37.0-10.1"},"fixed_version":"1:1.36.1-1","urgency":"unimportant"},"sid":{"status":"resolved","repositories":{"sid":"1:1.37.0-10.1"},"fixed_version":"1:1.36.1-1","urgency":"unimportant"},"trixie":{"status":"resolved","repositories":{"trixie":"1:1.37.0-6"},"fixed_version":"1:1.36.1-1","urgency":"unimportant"}}},"CVE-2022-48174":{"description":"There is a stack overflow vulnerability in ash.c:6030 in busybox before 1.35. In the environment of Internet of Vehicles, this vulnerability can be executed from command to arbitrary code execution.","debianbug":1059049,"scope":"local","releases":{"bookworm":{"status":"open","repositories":{"bookworm":"1:1.35.0-4"},"urgency":"not yet assigned","nodsa":"Minor issue, revisit when fixed upstream","nodsa_reason":"postponed","next_point_update":true},"bullseye":{"status":"resolved","repositories":{"bullseye":"1:1.30.1-6","bullseye-security":"1:1.30.1-6+deb11u1"},"fixed_version":"1:1.30.1-6+deb11u1","urgency":"not yet assigned"},"forky":{"status":"resolved","repositories":{"forky":"1:1.37.0-10.1"},"fixed_version":"1:1.37.0-1","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"1:1.37.0-10.1"},"fixed_version":"1:1.37.0-1","urgency":"not yet assigned"},"trixie":{"status":"resolved","repositories":{"trixie":"1:1.37.0-6"},"fixed_version":"1:1.37.0-1","urgency":"not yet assigned"}}},"CVE-2023-39810":{"description":"An issue in the CPIO command of Busybox v1.33.2 allows attackers to execute a directory traversal.","debianbug":1055307,"scope":"local","releases":{"bookworm":{"status":"open","repositories":{"bookworm":"1:1.35.0-4"},"urgency":"not yet assigned","nodsa":"Minor issue","nodsa_reason":""},"bullseye":{"status":"open","repositories":{"bullseye":"1:1.30.1-6","bullseye-security":"1:1.30.1-6+deb11u1"},"urgency":"not yet assigned","nodsa":"Minor issue","nodsa_reason":"postponed"},"forky":{"status":"resolved","repositories":{"forky":"1:1.37.0-10.1"},"fixed_version":"1:1.37.0-7","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"1:1.37.0-10.1"},"fixed_version":"1:1.37.0-7","urgency":"not yet assigned"},"trixie":{"status":"open","repositories":{"trixie":"1:1.37.0-6"},"urgency":"not yet assigned","nodsa":"Minor issue","nodsa_reason":""}}},"CVE-2023-42363":{"description":"A use-after-free vulnerability was discovered in xasprintf function in xfuncs_printf.c:344 in BusyBox v.1.36.1.","debianbug":1059050,"scope":"local","releases":{"bookworm":{"status":"open","repositories":{"bookworm":"1:1.35.0-4"},"urgency":"not yet assigned","nodsa":"Minor issue","nodsa_reason":"","next_point_update":true},"bullseye":{"status":"open","repositories":{"bullseye":"1:1.30.1-6","bullseye-security":"1:1.30.1-6+deb11u1"},"urgency":"not yet assigned","nodsa":"Minor issue","nodsa_reason":"ignored"},"forky":{"status":"resolved","repositories":{"forky":"1:1.37.0-10.1"},"fixed_version":"1:1.37.0-1","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"1:1.37.0-10.1"},"fixed_version":"1:1.37.0-1","urgency":"not yet assigned"},"trixie":{"status":"resolved","repositories":{"trixie":"1:1.37.0-6"},"fixed_version":"1:1.37.0-1","urgency":"not yet assigned"}}},"CVE-2023-42364":{"description":"A use-after-free vulnerability in BusyBox v.1.36.1 allows attackers to cause a denial of service via a crafted awk pattern in the awk.c evaluate function.","debianbug":1059051,"scope":"local","releases":{"bookworm":{"status":"open","repositories":{"bookworm":"1:1.35.0-4"},"urgency":"not yet assigned","nodsa":"Minor issue, revisit when fixed upstream","nodsa_reason":"postponed","next_point_update":true},"bullseye":{"status":"resolved","repositories":{"bullseye":"1:1.30.1-6","bullseye-security":"1:1.30.1-6+deb11u1"},"fixed_version":"1:1.30.1-6+deb11u1","urgency":"not yet assigned"},"forky":{"status":"resolved","repositories":{"forky":"1:1.37.0-10.1"},"fixed_version":"1:1.37.0-1","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"1:1.37.0-10.1"},"fixed_version":"1:1.37.0-1","urgency":"not yet assigned"},"trixie":{"status":"resolved","repositories":{"trixie":"1:1.37.0-6"},"fixed_version":"1:1.37.0-1","urgency":"not yet assigned"}}},"CVE-2023-42365":{"description":"A use-after-free vulnerability was discovered in BusyBox v.1.36.1 via a crafted awk pattern in the awk.c copyvar function.","debianbug":1059052,"scope":"local","releases":{"bookworm":{"status":"open","repositories":{"bookworm":"1:1.35.0-4"},"urgency":"not yet assigned","nodsa":"Minor issue, revisit when fixed upstream","nodsa_reason":"postponed","next_point_update":true},"bullseye":{"status":"resolved","repositories":{"bullseye":"1:1.30.1-6","bullseye-security":"1:1.30.1-6+deb11u1"},"fixed_version":"1:1.30.1-6+deb11u1","urgency":"not yet assigned"},"forky":{"status":"resolved","repositories":{"forky":"1:1.37.0-10.1"},"fixed_version":"1:1.37.0-1","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"1:1.37.0-10.1"},"fixed_version":"1:1.37.0-1","urgency":"not yet assigned"},"trixie":{"status":"resolved","repositories":{"trixie":"1:1.37.0-6"},"fixed_version":"1:1.37.0-1","urgency":"not yet assigned"}}},"CVE-2023-42366":{"description":"A heap-buffer-overflow was discovered in BusyBox v.1.36.1 in the next_token function at awk.c:1159.","debianbug":1059053,"scope":"local","releases":{"bookworm":{"status":"open","repositories":{"bookworm":"1:1.35.0-4"},"urgency":"not yet assigned","nodsa":"Minor issue, revisit when fixed upstream","nodsa_reason":"postponed"},"bullseye":{"status":"open","repositories":{"bullseye":"1:1.30.1-6","bullseye-security":"1:1.30.1-6+deb11u1"},"urgency":"not yet assigned","nodsa":"Minor issue","nodsa_reason":"postponed"},"forky":{"status":"resolved","repositories":{"forky":"1:1.37.0-10.1"},"fixed_version":"1:1.37.0-8","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"1:1.37.0-10.1"},"fixed_version":"1:1.37.0-8","urgency":"not yet assigned"},"trixie":{"status":"open","repositories":{"trixie":"1:1.37.0-6"},"urgency":"not yet assigned","nodsa":"Minor issue, revisit when fixed upstream","nodsa_reason":"postponed"}}},"CVE-2024-58251":{"description":"In netstat in BusyBox through 1.37.0, local users can launch of network application with an argv[0] containing an ANSI terminal escape sequence, leading to a denial of service (terminal locked up) when netstat is used by a victim.","debianbug":1104009,"scope":"local","releases":{"bookworm":{"status":"open","repositories":{"bookworm":"1:1.35.0-4"},"urgency":"not yet assigned","nodsa":"Minor issue, revisit when fixed upstream","nodsa_reason":"postponed"},"bullseye":{"status":"open","repositories":{"bullseye":"1:1.30.1-6","bullseye-security":"1:1.30.1-6+deb11u1"},"urgency":"not yet assigned","nodsa":"Minor issue, DoS, revisit when fixed upstream","nodsa_reason":"postponed"},"forky":{"status":"resolved","repositories":{"forky":"1:1.37.0-10.1"},"fixed_version":"1:1.37.0-9","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"1:1.37.0-10.1"},"fixed_version":"1:1.37.0-9","urgency":"not yet assigned"},"trixie":{"status":"open","repositories":{"trixie":"1:1.37.0-6"},"urgency":"not yet assigned","nodsa":"Minor issue, revisit when fixed upstream","nodsa_reason":"postponed"}}},"CVE-2025-46394":{"description":"In tar in BusyBox through 1.37.0, a TAR archive can have filenames hidden from a listing through the use of terminal escape sequences.","debianbug":1104008,"scope":"local","releases":{"bookworm":{"status":"open","repositories":{"bookworm":"1:1.35.0-4"},"urgency":"not yet assigned","nodsa":"Minor issue, revisit when fixed upstream","nodsa_reason":"postponed"},"bullseye":{"status":"open","repositories":{"bullseye":"1:1.30.1-6","bullseye-security":"1:1.30.1-6+deb11u1"},"urgency":"not yet assigned","nodsa":"Minor issue, terminal corruption, revisit when fixed upstream","nodsa_reason":"postponed"},"forky":{"status":"resolved","repositories":{"forky":"1:1.37.0-10.1"},"fixed_version":"1:1.37.0-8","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"1:1.37.0-10.1"},"fixed_version":"1:1.37.0-8","urgency":"not yet assigned"},"trixie":{"status":"open","repositories":{"trixie":"1:1.37.0-6"},"urgency":"not yet assigned","nodsa":"Minor issue, revisit when fixed upstream","nodsa_reason":"postponed"}}},"CVE-2025-60876":{"description":"BusyBox wget thru 1.3.7 accepted raw CR (0x0D)/LF (0x0A) and other C0 control bytes in the HTTP request-target (path/query), allowing the request line to be split and attacker-controlled headers to be injected. To preserve the HTTP/1.1 request-line shape METHOD SP request-target SP HTTP/1.1, a raw space (0x20) in the request-target must also be rejected (clients should use %20).","debianbug":1120795,"scope":"local","releases":{"bookworm":{"status":"open","repositories":{"bookworm":"1:1.35.0-4"},"urgency":"not yet assigned","nodsa":"Minor issue, revisit when fixed upstream","nodsa_reason":"postponed"},"bullseye":{"status":"open","repositories":{"bullseye":"1:1.30.1-6","bullseye-security":"1:1.30.1-6+deb11u1"},"urgency":"not yet assigned","nodsa":"Minor issue, revisit when fixed upstream","nodsa_reason":"postponed"},"forky":{"status":"resolved","repositories":{"forky":"1:1.37.0-10.1"},"fixed_version":"1:1.37.0-8","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"1:1.37.0-10.1"},"fixed_version":"1:1.37.0-8","urgency":"not yet assigned"},"trixie":{"status":"open","repositories":{"trixie":"1:1.37.0-6"},"urgency":"not yet assigned","nodsa":"Minor issue, revisit when fixed upstream","nodsa_reason":"postponed"}}},"CVE-2026-26157":{"description":"A flaw was found in BusyBox. Incomplete path sanitization in its archive extraction utilities allows an attacker to craft malicious archives that when extracted, and under specific conditions, may write to files outside the intended directory. This can lead to arbitrary file overwrite, potentially enabling code execution through the modification of sensitive system files.","debianbug":1127782,"scope":"local","releases":{"bookworm":{"status":"open","repositories":{"bookworm":"1:1.35.0-4"},"urgency":"not yet assigned","nodsa":"Minor issue","nodsa_reason":""},"bullseye":{"status":"open","repositories":{"bullseye":"1:1.30.1-6","bullseye-security":"1:1.30.1-6+deb11u1"},"urgency":"not yet assigned","nodsa":"Minor issue","nodsa_reason":"postponed"},"forky":{"status":"resolved","repositories":{"forky":"1:1.37.0-10.1"},"fixed_version":"1:1.37.0-10.1","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"1:1.37.0-10.1"},"fixed_version":"1:1.37.0-10.1","urgency":"not yet assigned"},"trixie":{"status":"open","repositories":{"trixie":"1:1.37.0-6"},"urgency":"not yet assigned","nodsa":"Minor issue","nodsa_reason":""}}},"CVE-2026-26158":{"description":"A flaw was found in BusyBox. This vulnerability allows an attacker to modify files outside of the intended extraction directory by crafting a malicious tar archive containing unvalidated hardlink or symlink entries. If the tar archive is extracted with elevated privileges, this flaw can lead to privilege escalation, enabling an attacker to gain unauthorized access to critical system files.","debianbug":1127782,"scope":"local","releases":{"bookworm":{"status":"open","repositories":{"bookworm":"1:1.35.0-4"},"urgency":"not yet assigned","nodsa":"Minor issue","nodsa_reason":""},"bullseye":{"status":"open","repositories":{"bullseye":"1:1.30.1-6","bullseye-security":"1:1.30.1-6+deb11u1"},"urgency":"not yet assigned","nodsa":"Minor issue","nodsa_reason":"postponed"},"forky":{"status":"resolved","repositories":{"forky":"1:1.37.0-10.1"},"fixed_version":"1:1.37.0-10.1","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"1:1.37.0-10.1"},"fixed_version":"1:1.37.0-10.1","urgency":"not yet assigned"},"trixie":{"status":"open","repositories":{"trixie":"1:1.37.0-6"},"urgency":"not yet assigned","nodsa":"Minor issue","nodsa_reason":""}}}},"bwa":{"CVE-2019-10269":{"description":"BWA (aka Burrow-Wheeler Aligner) before 2019-01-23 has a stack-based buffer overflow in the bns_restore function in bntseq.c via a long sequence name in a .alt file.","debianbug":926014,"scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"0.7.17-7"},"fixed_version":"0.7.17-3","urgency":"low"},"bullseye":{"status":"resolved","repositories":{"bullseye":"0.7.17-6"},"fixed_version":"0.7.17-3","urgency":"low"},"forky":{"status":"resolved","repositories":{"forky":"0.7.19-1"},"fixed_version":"0.7.17-3","urgency":"low"},"sid":{"status":"resolved","repositories":{"sid":"0.7.19-1"},"fixed_version":"0.7.17-3","urgency":"low"},"trixie":{"status":"resolved","repositories":{"trixie":"0.7.18-1"},"fixed_version":"0.7.17-3","urgency":"low"}}},"CVE-2019-11371":{"description":"BWA (aka Burrow-Wheeler Aligner) 0.7.17 r1198 has a Buffer Overflow via a long prefix that is mishandled in bns_fasta2bntseq and bns_dump at btnseq.c.","scope":"local","releases":{"bookworm":{"status":"open","repositories":{"bookworm":"0.7.17-7"},"urgency":"unimportant"},"bullseye":{"status":"open","repositories":{"bullseye":"0.7.17-6"},"urgency":"unimportant"},"forky":{"status":"open","repositories":{"forky":"0.7.19-1"},"urgency":"unimportant"},"sid":{"status":"open","repositories":{"sid":"0.7.19-1"},"urgency":"unimportant"},"trixie":{"status":"open","repositories":{"trixie":"0.7.18-1"},"urgency":"unimportant"}}}},"bwm-ng":{"CVE-2022-1341":{"description":"An issue was discovered in in bwm-ng v0.6.2. An arbitrary null write exists in get_cmdln_options() function in src/options.c.","scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"0.6.3-2"},"fixed_version":"0.6.3-1","urgency":"unimportant"},"bullseye":{"status":"resolved","repositories":{"bullseye":"0.6.3-1"},"fixed_version":"0.6.3-1","urgency":"unimportant"},"forky":{"status":"resolved","repositories":{"forky":"0.6.3-2"},"fixed_version":"0.6.3-1","urgency":"unimportant"},"sid":{"status":"resolved","repositories":{"sid":"0.6.3-2"},"fixed_version":"0.6.3-1","urgency":"unimportant"},"trixie":{"status":"resolved","repositories":{"trixie":"0.6.3-2"},"fixed_version":"0.6.3-1","urgency":"unimportant"}}}},"byacc":{"CVE-2008-3196":{"description":"skeleton.c in yacc does not properly handle reduction of a rule with an empty right hand side, which allows context-dependent attackers to cause an out-of-bounds stack access when the yacc stack pointer points to the end of the stack.","debianbug":491182,"scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"1:2.0.20221106-1"},"fixed_version":"20070509-1.1","urgency":"low"},"bullseye":{"status":"resolved","repositories":{"bullseye":"20140715-1"},"fixed_version":"20070509-1.1","urgency":"low"},"forky":{"status":"resolved","repositories":{"forky":"1:2.0.20260126-1"},"fixed_version":"20070509-1.1","urgency":"low"},"sid":{"status":"resolved","repositories":{"sid":"1:2.0.20260126-1"},"fixed_version":"20070509-1.1","urgency":"low"},"trixie":{"status":"resolved","repositories":{"trixie":"1:2.0.20241231-1"},"fixed_version":"20070509-1.1","urgency":"low"}}}},"byobu":{"CVE-2019-7306":{"description":"Byobu Apport hook may disclose sensitive information since it automatically uploads the local user's .screenrc which may contain private hostnames, usernames and passwords. This issue affects: byobu","scope":"local","releases":{"bookworm":{"status":"open","repositories":{"bookworm":"5.133-1.1"},"urgency":"unimportant"},"bullseye":{"status":"open","repositories":{"bullseye":"5.133-1"},"urgency":"unimportant"},"forky":{"status":"open","repositories":{"forky":"5.133-1.2"},"urgency":"unimportant"},"sid":{"status":"open","repositories":{"sid":"5.133-1.2"},"urgency":"unimportant"},"trixie":{"status":"open","repositories":{"trixie":"5.133-1.1"},"urgency":"unimportant"}}}},"byzanz":{"CVE-2015-2785":{"description":"The GIF encoder in Byzanz allows remote attackers to cause a denial of service (out-of-bounds heap write and crash) or possibly execute arbitrary code via a crafted Byzanz debug data recording (ByzanzRecording file) to the byzanz-playback command.","debianbug":778261,"scope":"local","releases":{"bookworm":{"status":"open","repositories":{"bookworm":"0.3.0+git20160312-5"},"urgency":"unimportant"},"bullseye":{"status":"open","repositories":{"bullseye":"0.3.0+git20160312-4"},"urgency":"unimportant"},"forky":{"status":"open","repositories":{"forky":"0.3.0+git20160312-6"},"urgency":"unimportant"},"sid":{"status":"open","repositories":{"sid":"0.3.0+git20160312-6"},"urgency":"unimportant"},"trixie":{"status":"open","repositories":{"trixie":"0.3.0+git20160312-5"},"urgency":"unimportant"}}}},"bzflag":{"CVE-2005-4584":{"description":"BZFlag server 2.0.4 and earlier allows remote attackers to cause a denial of service (application crash) via a callsign that is not followed by a NULL (\\0) character.","debianbug":345245,"scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"2.4.26-1"},"fixed_version":"2.0.6.20060412-1","urgency":"low"},"bullseye":{"status":"resolved","repositories":{"bullseye":"2.4.20-1"},"fixed_version":"2.0.6.20060412-1","urgency":"low"},"forky":{"status":"resolved","repositories":{"forky":"2.4.30-1"},"fixed_version":"2.0.6.20060412-1","urgency":"low"},"sid":{"status":"resolved","repositories":{"sid":"2.4.30-1"},"fixed_version":"2.0.6.20060412-1","urgency":"low"},"trixie":{"status":"resolved","repositories":{"trixie":"2.4.30-1"},"fixed_version":"2.0.6.20060412-1","urgency":"low"}}}},"bzip2":{"CVE-2005-0758":{"description":"zgrep in gzip before 1.3.5 does not properly sanitize arguments, which allows local users to execute arbitrary commands via filenames that are injected into a sed script.","debianbug":321286,"scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"1.0.8-5"},"fixed_version":"1.0.2-8.1","urgency":"low"},"bullseye":{"status":"resolved","repositories":{"bullseye":"1.0.8-4"},"fixed_version":"1.0.2-8.1","urgency":"low"},"forky":{"status":"resolved","repositories":{"forky":"1.0.8-6"},"fixed_version":"1.0.2-8.1","urgency":"low"},"sid":{"status":"resolved","repositories":{"sid":"1.0.8-6"},"fixed_version":"1.0.2-8.1","urgency":"low"},"trixie":{"status":"resolved","repositories":{"trixie":"1.0.8-6"},"fixed_version":"1.0.2-8.1","urgency":"low"}}},"CVE-2005-0953":{"description":"Race condition in bzip2 1.0.2 and earlier allows local users to modify permissions of arbitrary files via a hard link attack on a file while it is being decompressed, whose permissions are changed by bzip2 after the decompression is complete.","scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"1.0.8-5"},"fixed_version":"1.0.2-6","urgency":"not yet assigned"},"bullseye":{"status":"resolved","repositories":{"bullseye":"1.0.8-4"},"fixed_version":"1.0.2-6","urgency":"not yet assigned"},"forky":{"status":"resolved","repositories":{"forky":"1.0.8-6"},"fixed_version":"1.0.2-6","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"1.0.8-6"},"fixed_version":"1.0.2-6","urgency":"not yet assigned"},"trixie":{"status":"resolved","repositories":{"trixie":"1.0.8-6"},"fixed_version":"1.0.2-6","urgency":"not yet assigned"}}},"CVE-2005-1260":{"description":"bzip2 allows remote attackers to cause a denial of service (hard drive consumption) via a crafted bzip2 file that causes an infinite loop (a.k.a \"decompression bomb\").","scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"1.0.8-5"},"fixed_version":"1.0.2-7","urgency":"not yet assigned"},"bullseye":{"status":"resolved","repositories":{"bullseye":"1.0.8-4"},"fixed_version":"1.0.2-7","urgency":"not yet assigned"},"forky":{"status":"resolved","repositories":{"forky":"1.0.8-6"},"fixed_version":"1.0.2-7","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"1.0.8-6"},"fixed_version":"1.0.2-7","urgency":"not yet assigned"},"trixie":{"status":"resolved","repositories":{"trixie":"1.0.8-6"},"fixed_version":"1.0.2-7","urgency":"not yet assigned"}}},"CVE-2008-1372":{"description":"bzlib.c in bzip2 before 1.0.5 allows user-assisted remote attackers to cause a denial of service (crash) via a crafted file that triggers a buffer over-read, as demonstrated by the PROTOS GENOME test suite for Archive Formats.","debianbug":471670,"scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"1.0.8-5"},"fixed_version":"1.0.5-0.1","urgency":"low"},"bullseye":{"status":"resolved","repositories":{"bullseye":"1.0.8-4"},"fixed_version":"1.0.5-0.1","urgency":"low"},"forky":{"status":"resolved","repositories":{"forky":"1.0.8-6"},"fixed_version":"1.0.5-0.1","urgency":"low"},"sid":{"status":"resolved","repositories":{"sid":"1.0.8-6"},"fixed_version":"1.0.5-0.1","urgency":"low"},"trixie":{"status":"resolved","repositories":{"trixie":"1.0.8-6"},"fixed_version":"1.0.5-0.1","urgency":"low"}}},"CVE-2010-0405":{"description":"Integer overflow in the BZ2_decompress function in decompress.c in bzip2 and libbzip2 before 1.0.6 allows context-dependent attackers to cause a denial of service (application crash) or possibly execute arbitrary code via a crafted compressed file.","scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"1.0.8-5"},"fixed_version":"1.0.5-6","urgency":"not yet assigned"},"bullseye":{"status":"resolved","repositories":{"bullseye":"1.0.8-4"},"fixed_version":"1.0.5-6","urgency":"not yet assigned"},"forky":{"status":"resolved","repositories":{"forky":"1.0.8-6"},"fixed_version":"1.0.5-6","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"1.0.8-6"},"fixed_version":"1.0.5-6","urgency":"not yet assigned"},"trixie":{"status":"resolved","repositories":{"trixie":"1.0.8-6"},"fixed_version":"1.0.5-6","urgency":"not yet assigned"}}},"CVE-2011-4089":{"description":"The bzexe command in bzip2 1.0.5 and earlier generates compressed executables that do not properly handle temporary files during extraction, which allows local users to execute arbitrary code by precreating a temporary directory.","debianbug":632862,"scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"1.0.8-5"},"fixed_version":"1.0.6-1","urgency":"low"},"bullseye":{"status":"resolved","repositories":{"bullseye":"1.0.8-4"},"fixed_version":"1.0.6-1","urgency":"low"},"forky":{"status":"resolved","repositories":{"forky":"1.0.8-6"},"fixed_version":"1.0.6-1","urgency":"low"},"sid":{"status":"resolved","repositories":{"sid":"1.0.8-6"},"fixed_version":"1.0.6-1","urgency":"low"},"trixie":{"status":"resolved","repositories":{"trixie":"1.0.8-6"},"fixed_version":"1.0.6-1","urgency":"low"}}},"CVE-2016-3189":{"description":"Use-after-free vulnerability in bzip2recover in bzip2 1.0.6 allows remote attackers to cause a denial of service (crash) via a crafted bzip2 file, related to block ends set to before the start of the block.","debianbug":827744,"scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"1.0.8-5"},"fixed_version":"1.0.6-8.1","urgency":"low"},"bullseye":{"status":"resolved","repositories":{"bullseye":"1.0.8-4"},"fixed_version":"1.0.6-8.1","urgency":"low"},"forky":{"status":"resolved","repositories":{"forky":"1.0.8-6"},"fixed_version":"1.0.6-8.1","urgency":"low"},"sid":{"status":"resolved","repositories":{"sid":"1.0.8-6"},"fixed_version":"1.0.6-8.1","urgency":"low"},"trixie":{"status":"resolved","repositories":{"trixie":"1.0.8-6"},"fixed_version":"1.0.6-8.1","urgency":"low"}}},"CVE-2019-12900":{"description":"BZ2_decompress in decompress.c in bzip2 through 1.0.6 has an out-of-bounds write when there are many selectors.","debianbug":930886,"scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"1.0.8-5"},"fixed_version":"1.0.6-9.1","urgency":"not yet assigned"},"bullseye":{"status":"resolved","repositories":{"bullseye":"1.0.8-4"},"fixed_version":"1.0.6-9.1","urgency":"not yet assigned"},"forky":{"status":"resolved","repositories":{"forky":"1.0.8-6"},"fixed_version":"1.0.6-9.1","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"1.0.8-6"},"fixed_version":"1.0.6-9.1","urgency":"not yet assigned"},"trixie":{"status":"resolved","repositories":{"trixie":"1.0.8-6"},"fixed_version":"1.0.6-9.1","urgency":"not yet assigned"}}}},"bzip3":{"CVE-2023-29415":{"description":"An issue was discovered in libbzip3.a in bzip3 before 1.3.0. A denial of service (process hang) can occur with a crafted archive because bzip3 does not follow the required procedure for interacting with libsais.","debianbug":1034177,"scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"1.2.2-2"},"fixed_version":"1.2.2-2","urgency":"not yet assigned"},"forky":{"status":"resolved","repositories":{"forky":"1.5.3-2"},"fixed_version":"1.2.2-2","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"1.5.3-2"},"fixed_version":"1.2.2-2","urgency":"not yet assigned"},"trixie":{"status":"resolved","repositories":{"trixie":"1.5.1-1"},"fixed_version":"1.2.2-2","urgency":"not yet assigned"}}},"CVE-2023-29416":{"description":"An issue was discovered in libbzip3.a in bzip3 before 1.3.0. A bz3_decode_block out-of-bounds write can occur with a crafted archive because bzip3 does not follow the required procedure for interacting with libsais.","debianbug":1034177,"scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"1.2.2-2"},"fixed_version":"1.2.2-2","urgency":"not yet assigned"},"forky":{"status":"resolved","repositories":{"forky":"1.5.3-2"},"fixed_version":"1.2.2-2","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"1.5.3-2"},"fixed_version":"1.2.2-2","urgency":"not yet assigned"},"trixie":{"status":"resolved","repositories":{"trixie":"1.5.1-1"},"fixed_version":"1.2.2-2","urgency":"not yet assigned"}}},"CVE-2023-29417":{"description":"An issue was discovered in libbzip3.a in bzip3 1.2.2. There is a bz3_decompress out-of-bounds read in certain situations where buffers passed to bzip3 do not contain enough space to be filled with decompressed data. NOTE: the vendor's perspective is that the observed behavior can only occur for a contract violation, and thus the report is invalid.","scope":"local","releases":{"bookworm":{"status":"open","repositories":{"bookworm":"1.2.2-2"},"urgency":"unimportant"},"forky":{"status":"open","repositories":{"forky":"1.5.3-2"},"urgency":"unimportant"},"sid":{"status":"open","repositories":{"sid":"1.5.3-2"},"urgency":"unimportant"},"trixie":{"status":"open","repositories":{"trixie":"1.5.1-1"},"urgency":"unimportant"}}},"CVE-2023-29418":{"description":"An issue was discovered in libbzip3.a in bzip3 before 1.2.3. There is an xwrite out-of-bounds read.","debianbug":1034177,"scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"1.2.2-2"},"fixed_version":"1.2.2-2","urgency":"not yet assigned"},"forky":{"status":"resolved","repositories":{"forky":"1.5.3-2"},"fixed_version":"1.2.2-2","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"1.5.3-2"},"fixed_version":"1.2.2-2","urgency":"not yet assigned"},"trixie":{"status":"resolved","repositories":{"trixie":"1.5.1-1"},"fixed_version":"1.2.2-2","urgency":"not yet assigned"}}},"CVE-2023-29419":{"description":"An issue was discovered in libbzip3.a in bzip3 before 1.2.3. There is a bz3_decode_block out-of-bounds read.","debianbug":1034177,"scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"1.2.2-2"},"fixed_version":"1.2.2-2","urgency":"not yet assigned"},"forky":{"status":"resolved","repositories":{"forky":"1.5.3-2"},"fixed_version":"1.2.2-2","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"1.5.3-2"},"fixed_version":"1.2.2-2","urgency":"not yet assigned"},"trixie":{"status":"resolved","repositories":{"trixie":"1.5.1-1"},"fixed_version":"1.2.2-2","urgency":"not yet assigned"}}},"CVE-2023-29420":{"description":"An issue was discovered in libbzip3.a in bzip3 before 1.2.3. There is a crash caused by an invalid memmove in bz3_decode_block.","debianbug":1034177,"scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"1.2.2-2"},"fixed_version":"1.2.2-2","urgency":"not yet assigned"},"forky":{"status":"resolved","repositories":{"forky":"1.5.3-2"},"fixed_version":"1.2.2-2","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"1.5.3-2"},"fixed_version":"1.2.2-2","urgency":"not yet assigned"},"trixie":{"status":"resolved","repositories":{"trixie":"1.5.1-1"},"fixed_version":"1.2.2-2","urgency":"not yet assigned"}}},"CVE-2023-29421":{"description":"An issue was discovered in libbzip3.a in bzip3 before 1.2.3. There is an out-of-bounds write in bz3_decode_block.","debianbug":1034177,"scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"1.2.2-2"},"fixed_version":"1.2.2-2","urgency":"not yet assigned"},"forky":{"status":"resolved","repositories":{"forky":"1.5.3-2"},"fixed_version":"1.2.2-2","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"1.5.3-2"},"fixed_version":"1.2.2-2","urgency":"not yet assigned"},"trixie":{"status":"resolved","repositories":{"trixie":"1.5.1-1"},"fixed_version":"1.2.2-2","urgency":"not yet assigned"}}}},"bzr":{"CVE-2013-2099":{"description":"Algorithmic complexity vulnerability in the ssl.match_hostname function in Python 3.2.x, 3.3.x, and earlier, and unspecified versions of python-backports-ssl_match_hostname as used for older Python versions, allows remote attackers to cause a denial of service (CPU consumption) via multiple wildcard characters in the common name in a certificate.","debianbug":709068,"scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"2.7.0+bzr6622+brz"},"fixed_version":"2.6.0~bzr6574-1","urgency":"low"},"bullseye":{"status":"resolved","repositories":{"bullseye":"2.7.0+bzr6622+brz"},"fixed_version":"2.6.0~bzr6574-1","urgency":"low"},"trixie":{"status":"resolved","repositories":{"trixie":"2.7.0+bzr6622+brz"},"fixed_version":"2.6.0~bzr6574-1","urgency":"low"}}},"CVE-2017-14176":{"description":"Bazaar through 2.7.0, when Subprocess SSH is used, allows remote attackers to execute arbitrary commands via a bzr+ssh URL with an initial dash character in the hostname, a related issue to CVE-2017-9800, CVE-2017-12836, CVE-2017-12976, CVE-2017-16228, CVE-2017-1000116, and CVE-2017-1000117.","debianbug":874429,"scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"2.7.0+bzr6622+brz"},"fixed_version":"2.7.0+bzr6622-7","urgency":"not yet assigned"},"bullseye":{"status":"resolved","repositories":{"bullseye":"2.7.0+bzr6622+brz"},"fixed_version":"2.7.0+bzr6622-7","urgency":"not yet assigned"},"trixie":{"status":"resolved","repositories":{"trixie":"2.7.0+bzr6622+brz"},"fixed_version":"2.7.0+bzr6622-7","urgency":"not yet assigned"}}}},"bzrtp":{"CVE-2016-6271":{"description":"The Bzrtp library (aka libbzrtp) 1.0.x before 1.0.4 allows man-in-the-middle attackers to conduct spoofing attacks by leveraging a missing HVI check on DHPart2 packet reception.","debianbug":859277,"scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"5.1.64-2"},"fixed_version":"1.0.2-1.2","urgency":"not yet assigned"},"bullseye":{"status":"resolved","repositories":{"bullseye":"4.4.13-2"},"fixed_version":"1.0.2-1.2","urgency":"not yet assigned"},"forky":{"status":"resolved","repositories":{"forky":"5.3.105-1"},"fixed_version":"1.0.2-1.2","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"5.3.105-1"},"fixed_version":"1.0.2-1.2","urgency":"not yet assigned"},"trixie":{"status":"resolved","repositories":{"trixie":"5.3.105-1"},"fixed_version":"1.0.2-1.2","urgency":"not yet assigned"}}}},"c-ares":{"CVE-2016-5180":{"description":"Heap-based buffer overflow in the ares_create_query function in c-ares 1.x before 1.12.0 allows remote attackers to cause a denial of service (out-of-bounds write) or possibly execute arbitrary code via a hostname with an escaped trailing dot.","debianbug":839151,"scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"1.18.1-3"},"fixed_version":"1.12.0-1","urgency":"medium"},"bullseye":{"status":"resolved","repositories":{"bullseye":"1.17.1-1+deb11u3","bullseye-security":"1.17.1-1+deb11u3"},"fixed_version":"1.12.0-1","urgency":"medium"},"forky":{"status":"resolved","repositories":{"forky":"1.34.6-1"},"fixed_version":"1.12.0-1","urgency":"medium"},"sid":{"status":"resolved","repositories":{"sid":"1.34.6-1"},"fixed_version":"1.12.0-1","urgency":"medium"},"trixie":{"status":"resolved","repositories":{"trixie":"1.34.5-1+deb13u1","trixie-security":"1.34.5-1+deb13u1"},"fixed_version":"1.12.0-1","urgency":"medium"}}},"CVE-2017-1000381":{"description":"The c-ares function `ares_parse_naptr_reply()`, which is used for parsing NAPTR responses, could be triggered to read memory outside of the given input buffer if the passed in DNS response packet was crafted in a particular way.","debianbug":865360,"scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"1.18.1-3"},"fixed_version":"1.12.0-4","urgency":"not yet assigned"},"bullseye":{"status":"resolved","repositories":{"bullseye":"1.17.1-1+deb11u3","bullseye-security":"1.17.1-1+deb11u3"},"fixed_version":"1.12.0-4","urgency":"not yet assigned"},"forky":{"status":"resolved","repositories":{"forky":"1.34.6-1"},"fixed_version":"1.12.0-4","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"1.34.6-1"},"fixed_version":"1.12.0-4","urgency":"not yet assigned"},"trixie":{"status":"resolved","repositories":{"trixie":"1.34.5-1+deb13u1","trixie-security":"1.34.5-1+deb13u1"},"fixed_version":"1.12.0-4","urgency":"not yet assigned"}}},"CVE-2020-14354":{"description":"A possible use-after-free and double-free in c-ares lib version 1.16.0 if ares_destroy() is called prior to ares_getaddrinfo() completing. This flaw possibly allows an attacker to crash the service that uses c-ares lib. The highest threat from this vulnerability is to this service availability.","scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"1.18.1-3"},"fixed_version":"1.16.1-1","urgency":"not yet assigned"},"bullseye":{"status":"resolved","repositories":{"bullseye":"1.17.1-1+deb11u3","bullseye-security":"1.17.1-1+deb11u3"},"fixed_version":"1.16.1-1","urgency":"not yet assigned"},"forky":{"status":"resolved","repositories":{"forky":"1.34.6-1"},"fixed_version":"1.16.1-1","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"1.34.6-1"},"fixed_version":"1.16.1-1","urgency":"not yet assigned"},"trixie":{"status":"resolved","repositories":{"trixie":"1.34.5-1+deb13u1","trixie-security":"1.34.5-1+deb13u1"},"fixed_version":"1.16.1-1","urgency":"not yet assigned"}}},"CVE-2020-22217":{"description":"Buffer overflow vulnerability in c-ares before 1_16_1 thru 1_17_0 via function ares_parse_soa_reply in ares_parse_soa_reply.c.","scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"1.18.1-3"},"fixed_version":"1.17.1-1","urgency":"not yet assigned"},"bullseye":{"status":"resolved","repositories":{"bullseye":"1.17.1-1+deb11u3","bullseye-security":"1.17.1-1+deb11u3"},"fixed_version":"1.17.1-1","urgency":"not yet assigned"},"forky":{"status":"resolved","repositories":{"forky":"1.34.6-1"},"fixed_version":"1.17.1-1","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"1.34.6-1"},"fixed_version":"1.17.1-1","urgency":"not yet assigned"},"trixie":{"status":"resolved","repositories":{"trixie":"1.34.5-1+deb13u1","trixie-security":"1.34.5-1+deb13u1"},"fixed_version":"1.17.1-1","urgency":"not yet assigned"}}},"CVE-2020-8277":{"description":"A Node.js application that allows an attacker to trigger a DNS request for a host of their choice could trigger a Denial of Service in versions < 15.2.1, < 14.15.1, and < 12.19.1 by getting the application to resolve a DNS record with a larger number of responses. This is fixed in 15.2.1, 14.15.1, and 12.19.1.","scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"1.18.1-3"},"fixed_version":"1.17.1-1","urgency":"not yet assigned"},"bullseye":{"status":"resolved","repositories":{"bullseye":"1.17.1-1+deb11u3","bullseye-security":"1.17.1-1+deb11u3"},"fixed_version":"1.17.1-1","urgency":"not yet assigned"},"forky":{"status":"resolved","repositories":{"forky":"1.34.6-1"},"fixed_version":"1.17.1-1","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"1.34.6-1"},"fixed_version":"1.17.1-1","urgency":"not yet assigned"},"trixie":{"status":"resolved","repositories":{"trixie":"1.34.5-1+deb13u1","trixie-security":"1.34.5-1+deb13u1"},"fixed_version":"1.17.1-1","urgency":"not yet assigned"}}},"CVE-2021-3672":{"description":"A flaw was found in c-ares library, where a missing input validation check of host names returned by DNS (Domain Name Servers) can lead to output of wrong hostnames which might potentially lead to Domain Hijacking. The highest threat from this vulnerability is to confidentiality and integrity as well as system availability.","debianbug":992053,"scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"1.18.1-3"},"fixed_version":"1.17.1-1.1","urgency":"not yet assigned"},"bullseye":{"status":"resolved","repositories":{"bullseye":"1.17.1-1+deb11u3","bullseye-security":"1.17.1-1+deb11u3"},"fixed_version":"1.17.1-1+deb11u1","urgency":"not yet assigned"},"forky":{"status":"resolved","repositories":{"forky":"1.34.6-1"},"fixed_version":"1.17.1-1.1","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"1.34.6-1"},"fixed_version":"1.17.1-1.1","urgency":"not yet assigned"},"trixie":{"status":"resolved","repositories":{"trixie":"1.34.5-1+deb13u1","trixie-security":"1.34.5-1+deb13u1"},"fixed_version":"1.17.1-1.1","urgency":"not yet assigned"}}},"CVE-2022-4904":{"description":"A flaw was found in the c-ares package. The ares_set_sortlist is missing checks about the validity of the input string, which allows a possible arbitrary length stack overflow. This issue may cause a denial of service or a limited impact on confidentiality and integrity.","debianbug":1031525,"scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"1.18.1-3"},"fixed_version":"1.18.1-2","urgency":"not yet assigned"},"bullseye":{"status":"resolved","repositories":{"bullseye":"1.17.1-1+deb11u3","bullseye-security":"1.17.1-1+deb11u3"},"fixed_version":"1.17.1-1+deb11u2","urgency":"not yet assigned"},"forky":{"status":"resolved","repositories":{"forky":"1.34.6-1"},"fixed_version":"1.18.1-2","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"1.34.6-1"},"fixed_version":"1.18.1-2","urgency":"not yet assigned"},"trixie":{"status":"resolved","repositories":{"trixie":"1.34.5-1+deb13u1","trixie-security":"1.34.5-1+deb13u1"},"fixed_version":"1.18.1-2","urgency":"not yet assigned"}}},"CVE-2023-31124":{"description":"c-ares is an asynchronous resolver library. When cross-compiling c-ares and using the autotools build system, CARES_RANDOM_FILE will not be set, as seen when cross compiling aarch64 android.  This will downgrade to using rand() as a fallback which could allow an attacker to take advantage of the lack of entropy by not using a CSPRNG. This issue was patched in version 1.19.1.","scope":"local","releases":{"bookworm":{"status":"open","repositories":{"bookworm":"1.18.1-3"},"urgency":"unimportant"},"bullseye":{"status":"open","repositories":{"bullseye":"1.17.1-1+deb11u3","bullseye-security":"1.17.1-1+deb11u3"},"urgency":"unimportant"},"forky":{"status":"resolved","repositories":{"forky":"1.34.6-1"},"fixed_version":"1.19.1-2","urgency":"unimportant"},"sid":{"status":"resolved","repositories":{"sid":"1.34.6-1"},"fixed_version":"1.19.1-2","urgency":"unimportant"},"trixie":{"status":"resolved","repositories":{"trixie":"1.34.5-1+deb13u1","trixie-security":"1.34.5-1+deb13u1"},"fixed_version":"1.19.1-2","urgency":"unimportant"}}},"CVE-2023-31130":{"description":"c-ares is an asynchronous resolver library. ares_inet_net_pton() is vulnerable to a buffer underflow for certain ipv6 addresses, in particular \"0::00:00:00/2\" was found to cause an issue.  C-ares only uses this function internally for configuration purposes which would require an administrator to configure such an address via ares_set_sortlist(). However, users may externally use ares_inet_net_pton() for other purposes and thus be vulnerable to more severe issues. This issue has been fixed in 1.19.1.","scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"1.18.1-3"},"fixed_version":"1.18.1-3","urgency":"not yet assigned"},"bullseye":{"status":"resolved","repositories":{"bullseye":"1.17.1-1+deb11u3","bullseye-security":"1.17.1-1+deb11u3"},"fixed_version":"1.17.1-1+deb11u3","urgency":"not yet assigned"},"forky":{"status":"resolved","repositories":{"forky":"1.34.6-1"},"fixed_version":"1.18.1-3","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"1.34.6-1"},"fixed_version":"1.18.1-3","urgency":"not yet assigned"},"trixie":{"status":"resolved","repositories":{"trixie":"1.34.5-1+deb13u1","trixie-security":"1.34.5-1+deb13u1"},"fixed_version":"1.18.1-3","urgency":"not yet assigned"}}},"CVE-2023-31147":{"description":"c-ares is an asynchronous resolver library. When /dev/urandom or RtlGenRandom() are unavailable, c-ares uses rand() to generate random numbers used for DNS query ids. This is not a CSPRNG, and it is also not seeded by srand() so will generate predictable output. Input from the random number generator is fed into a non-compilant RC4 implementation and may not be as strong as the original RC4 implementation. No attempt is made to look for modern OS-provided CSPRNGs like arc4random() that is widely available. This issue has been fixed in version 1.19.1.","scope":"local","releases":{"bookworm":{"status":"open","repositories":{"bookworm":"1.18.1-3"},"urgency":"unimportant"},"bullseye":{"status":"open","repositories":{"bullseye":"1.17.1-1+deb11u3","bullseye-security":"1.17.1-1+deb11u3"},"urgency":"unimportant"},"forky":{"status":"resolved","repositories":{"forky":"1.34.6-1"},"fixed_version":"1.19.1-2","urgency":"unimportant"},"sid":{"status":"resolved","repositories":{"sid":"1.34.6-1"},"fixed_version":"1.19.1-2","urgency":"unimportant"},"trixie":{"status":"resolved","repositories":{"trixie":"1.34.5-1+deb13u1","trixie-security":"1.34.5-1+deb13u1"},"fixed_version":"1.19.1-2","urgency":"unimportant"}}},"CVE-2023-32067":{"description":"c-ares is an asynchronous resolver library. c-ares is vulnerable to denial of service. If a target resolver sends a query, the attacker forges a malformed UDP packet with a length of 0 and returns them to the target resolver. The target resolver erroneously interprets the 0 length as a graceful shutdown of the connection. This issue has been patched in version 1.19.1.","scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"1.18.1-3"},"fixed_version":"1.18.1-3","urgency":"not yet assigned"},"bullseye":{"status":"resolved","repositories":{"bullseye":"1.17.1-1+deb11u3","bullseye-security":"1.17.1-1+deb11u3"},"fixed_version":"1.17.1-1+deb11u3","urgency":"not yet assigned"},"forky":{"status":"resolved","repositories":{"forky":"1.34.6-1"},"fixed_version":"1.18.1-3","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"1.34.6-1"},"fixed_version":"1.18.1-3","urgency":"not yet assigned"},"trixie":{"status":"resolved","repositories":{"trixie":"1.34.5-1+deb13u1","trixie-security":"1.34.5-1+deb13u1"},"fixed_version":"1.18.1-3","urgency":"not yet assigned"}}},"CVE-2024-25629":{"description":"c-ares is a C library for asynchronous DNS requests. `ares__read_line()` is used to parse local configuration files such as `/etc/resolv.conf`, `/etc/nsswitch.conf`, the `HOSTALIASES` file, and if using a c-ares version prior to 1.27.0, the `/etc/hosts` file. If any of these configuration files has an embedded `NULL` character as the first character in a new line, it can lead to attempting to read memory prior to the start of the given buffer which may result in a crash. This issue is fixed in c-ares 1.27.0. No known workarounds exist.","scope":"local","releases":{"bookworm":{"status":"open","repositories":{"bookworm":"1.18.1-3"},"urgency":"not yet assigned","nodsa":"Minor issue","nodsa_reason":""},"bullseye":{"status":"open","repositories":{"bullseye":"1.17.1-1+deb11u3","bullseye-security":"1.17.1-1+deb11u3"},"urgency":"not yet assigned","nodsa":"Minor issue","nodsa_reason":""},"forky":{"status":"resolved","repositories":{"forky":"1.34.6-1"},"fixed_version":"1.27.0-1","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"1.34.6-1"},"fixed_version":"1.27.0-1","urgency":"not yet assigned"},"trixie":{"status":"resolved","repositories":{"trixie":"1.34.5-1+deb13u1","trixie-security":"1.34.5-1+deb13u1"},"fixed_version":"1.27.0-1","urgency":"not yet assigned"}}},"CVE-2025-31498":{"description":"c-ares is an asynchronous resolver library. From 1.32.3 through 1.34.4, there is a use-after-free in read_answers() when process_answer() may re-enqueue a query either due to a DNS Cookie Failure or when the upstream server does not properly support EDNS, or possibly on TCP queries if the remote closed the connection immediately after a response. If there was an issue trying to put that new transaction on the wire, it would close the connection handle, but read_answers() was still expecting the connection handle to be available to possibly dequeue other responses. In theory a remote attacker might be able to trigger this by flooding the target with ICMP UNREACHABLE packets if they also control the upstream nameserver and can return a result with one of those conditions, this has been untested. Otherwise only a local attacker might be able to change system behavior to make send()/write() return a failure condition. This vulnerability is fixed in 1.34.5.","scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"1.18.1-3"},"fixed_version":"0","urgency":"unimportant"},"bullseye":{"status":"resolved","repositories":{"bullseye":"1.17.1-1+deb11u3","bullseye-security":"1.17.1-1+deb11u3"},"fixed_version":"0","urgency":"unimportant"},"forky":{"status":"resolved","repositories":{"forky":"1.34.6-1"},"fixed_version":"1.34.5-1","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"1.34.6-1"},"fixed_version":"1.34.5-1","urgency":"not yet assigned"},"trixie":{"status":"resolved","repositories":{"trixie":"1.34.5-1+deb13u1","trixie-security":"1.34.5-1+deb13u1"},"fixed_version":"1.34.5-1","urgency":"not yet assigned"}}},"CVE-2025-62408":{"description":"c-ares is an asynchronous resolver library. Versions 1.32.3 through 1.34.5  terminate a query after maximum attempts when using read_answer() and process_answer(), which can cause a Denial of Service. This issue is fixed in version 1.34.6.","scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"1.18.1-3"},"fixed_version":"0","urgency":"unimportant"},"bullseye":{"status":"resolved","repositories":{"bullseye":"1.17.1-1+deb11u3","bullseye-security":"1.17.1-1+deb11u3"},"fixed_version":"0","urgency":"unimportant"},"forky":{"status":"resolved","repositories":{"forky":"1.34.6-1"},"fixed_version":"1.34.6-1","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"1.34.6-1"},"fixed_version":"1.34.6-1","urgency":"not yet assigned"},"trixie":{"status":"resolved","repositories":{"trixie":"1.34.5-1+deb13u1","trixie-security":"1.34.5-1+deb13u1"},"fixed_version":"1.34.5-1+deb13u1","urgency":"not yet assigned"}}}},"c-blosc2":{"CVE-2024-3203":{"description":"A vulnerability, which was classified as critical, was found in c-blosc2 up to 2.13.2. Affected is the function ndlz8_decompress of the file /src/c-blosc2/plugins/codecs/ndlz/ndlz8x8.c. The manipulation leads to heap-based buffer overflow. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used. Upgrading to version 2.14.3 is able to address this issue. It is recommended to upgrade the affected component. VDB-259050 is the identifier assigned to this vulnerability.","scope":"local","releases":{"forky":{"status":"resolved","repositories":{"forky":"2.23.0+ds-1"},"fixed_version":"2.13.1+ds-3","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"2.23.1+ds-1"},"fixed_version":"2.13.1+ds-3","urgency":"not yet assigned"},"trixie":{"status":"resolved","repositories":{"trixie":"2.17.1+ds-1"},"fixed_version":"2.13.1+ds-3","urgency":"not yet assigned"}}},"CVE-2024-3204":{"description":"A vulnerability has been found in c-blosc2 up to 2.13.2 and classified as critical. Affected by this vulnerability is the function ndlz4_decompress of the file /src/c-blosc2/plugins/codecs/ndlz/ndlz4x4.c. The manipulation leads to heap-based buffer overflow. The attack can be launched remotely. The exploit has been disclosed to the public and may be used. Upgrading to version 2.14.3 is able to address this issue. It is recommended to upgrade the affected component. The associated identifier of this vulnerability is VDB-259051.","scope":"local","releases":{"forky":{"status":"resolved","repositories":{"forky":"2.23.0+ds-1"},"fixed_version":"2.13.1+ds-3","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"2.23.1+ds-1"},"fixed_version":"2.13.1+ds-3","urgency":"not yet assigned"},"trixie":{"status":"resolved","repositories":{"trixie":"2.17.1+ds-1"},"fixed_version":"2.13.1+ds-3","urgency":"not yet assigned"}}},"CVE-2025-29476":{"description":"Buffer Overflow vulnerability in compress_chunk_fuzzer with oss-fuzz on commit 16450518afddcb3139de627157208e49bfef6987 in c-blosc2 v.2.17.0 and before.","debianbug":1102152,"scope":"local","releases":{"forky":{"status":"resolved","repositories":{"forky":"2.23.0+ds-1"},"fixed_version":"2.17.1+ds-1","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"2.23.1+ds-1"},"fixed_version":"2.17.1+ds-1","urgency":"not yet assigned"},"trixie":{"status":"resolved","repositories":{"trixie":"2.17.1+ds-1"},"fixed_version":"2.17.1+ds-1","urgency":"not yet assigned"}}}},"c-icap":{"CVE-2013-7401":{"description":"The parse_request function in request.c in c-icap 0.2.x allows remote attackers to cause a denial of service (crash) via a URI without a \" \" or \"?\" character in an ICAP request, as demonstrated by use of the OPTIONS method.","scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"1:0.5.10-4"},"fixed_version":"1:0.3.1-1","urgency":"not yet assigned"},"bullseye":{"status":"resolved","repositories":{"bullseye":"1:0.5.6-2"},"fixed_version":"1:0.3.1-1","urgency":"not yet assigned"},"forky":{"status":"resolved","repositories":{"forky":"1:0.5.10-7"},"fixed_version":"1:0.3.1-1","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"1:0.5.10-7"},"fixed_version":"1:0.3.1-1","urgency":"not yet assigned"},"trixie":{"status":"resolved","repositories":{"trixie":"1:0.5.10-6.1"},"fixed_version":"1:0.3.1-1","urgency":"not yet assigned"}}},"CVE-2013-7402":{"description":"Multiple unspecified vulnerabilities in request.c in c-icap 0.2.x allow remote attackers to cause a denial of service (crash) via a crafted ICAP request.","scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"1:0.5.10-4"},"fixed_version":"1:0.3.1-1","urgency":"not yet assigned"},"bullseye":{"status":"resolved","repositories":{"bullseye":"1:0.5.6-2"},"fixed_version":"1:0.3.1-1","urgency":"not yet assigned"},"forky":{"status":"resolved","repositories":{"forky":"1:0.5.10-7"},"fixed_version":"1:0.3.1-1","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"1:0.5.10-7"},"fixed_version":"1:0.3.1-1","urgency":"not yet assigned"},"trixie":{"status":"resolved","repositories":{"trixie":"1:0.5.10-6.1"},"fixed_version":"1:0.3.1-1","urgency":"not yet assigned"}}}},"c3p0":{"CVE-2018-20433":{"description":"c3p0 0.9.5.2 allows XXE in extractXmlConfigFromInputStream in com/mchange/v2/c3p0/cfg/C3P0ConfigXmlUtils.java during initialization.","debianbug":917257,"scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"0.9.1.2-10"},"fixed_version":"0.9.1.2-10","urgency":"not yet assigned"},"bullseye":{"status":"resolved","repositories":{"bullseye":"0.9.1.2-10"},"fixed_version":"0.9.1.2-10","urgency":"not yet assigned"},"forky":{"status":"resolved","repositories":{"forky":"0.9.1.2-11"},"fixed_version":"0.9.1.2-10","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"0.9.1.2-11"},"fixed_version":"0.9.1.2-10","urgency":"not yet assigned"},"trixie":{"status":"resolved","repositories":{"trixie":"0.9.1.2-10.1"},"fixed_version":"0.9.1.2-10","urgency":"not yet assigned"}}},"CVE-2019-5427":{"description":"c3p0 version < 0.9.5.4 may be exploited by a billion laughs attack when loading XML configuration due to missing protections against recursive entity expansion when loading configuration.","debianbug":927936,"scope":"local","releases":{"bookworm":{"status":"open","repositories":{"bookworm":"0.9.1.2-10"},"urgency":"low","nodsa":"Minor issue","nodsa_reason":""},"bullseye":{"status":"open","repositories":{"bullseye":"0.9.1.2-10"},"urgency":"low","nodsa":"Minor issue","nodsa_reason":""},"forky":{"status":"resolved","repositories":{"forky":"0.9.1.2-11"},"fixed_version":"0.9.1.2-10.1","urgency":"low"},"sid":{"status":"resolved","repositories":{"sid":"0.9.1.2-11"},"fixed_version":"0.9.1.2-10.1","urgency":"low"},"trixie":{"status":"resolved","repositories":{"trixie":"0.9.1.2-10.1"},"fixed_version":"0.9.1.2-10.1","urgency":"low"}}},"CVE-2026-27830":{"description":"c3p0, a JDBC Connection pooling library, is vulnerable to attack via maliciously crafted Java-serialized objects and `javax.naming.Reference` instances. Several c3p0 `ConnectionPoolDataSource` implementations have a property called `userOverridesAsString` which conceptually represents a `Map<String,Map<String,String>>`. Prior to v0.12.0, that property was maintained as a hex-encoded serialized object. Any attacker able to reset this property, on an existing `ConnectionPoolDataSource` or via maliciously crafted serialized objects or `javax.naming.Reference` instances could be tailored execute unexpected code on the application's `CLASSPATH`. The danger of this vulnerability was strongly magnified by vulnerabilities in c3p0's main dependency, mchange-commons-java. This library includes code that mirrors early implementations of JNDI functionality, including ungated support for remote `factoryClassLocation` values. Attackers could set c3p0's `userOverridesAsString` hex-encoded serialized objects that include objects \"indirectly serialized\" via JNDI references. Deserialization of those objects and dereferencing of the embedded `javax.naming.Reference` objects could provoke download and execution of malicious code from a remote `factoryClassLocation`. Although hazard presented by c3p0's vulnerabilites are exarcerbated by vulnerabilities in mchange-commons-java, use of Java-serialized-object hex as the format for a writable Java-Bean property, of objects that may be exposed across JNDI interfaces, represents a serious independent fragility. The `userOverridesAsString` property of c3p0 `ConnectionPoolDataSource` classes has been reimplemented to use a safe CSV-based format, rather than rely upon potentially dangerous Java object deserialization. c3p0-0.12.0+ and above depend upon mchange-commons-java 0.4.0+, which gates support for remote `factoryClassLocation` values by configuration parameters that default to restrictive values. c3p0 additionally enforces the new mchange-commons-java `com.mchange.v2.naming.nameGuardClassName` to prevent injection of unexpected, potentially remote JNDI names. There is no supported workaround for versions of c3p0 prior to 0.12.0.","debianbug":1129318,"scope":"local","releases":{"bookworm":{"status":"open","repositories":{"bookworm":"0.9.1.2-10"},"urgency":"not yet assigned"},"bullseye":{"status":"open","repositories":{"bullseye":"0.9.1.2-10"},"urgency":"not yet assigned"},"forky":{"status":"open","repositories":{"forky":"0.9.1.2-11"},"urgency":"not yet assigned"},"sid":{"status":"open","repositories":{"sid":"0.9.1.2-11"},"urgency":"not yet assigned"},"trixie":{"status":"open","repositories":{"trixie":"0.9.1.2-10.1"},"urgency":"not yet assigned"}}}},"cabextract":{"CVE-2004-0916":{"description":"Directory traversal vulnerability in cabextract before 1.1 allows remote attackers to overwrite arbitrary files via a cabinet file containing .. (dot dot) sequences in a filename.","scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"1.9-3"},"fixed_version":"1.1-1","urgency":"not yet assigned"},"bullseye":{"status":"resolved","repositories":{"bullseye":"1.9-3"},"fixed_version":"1.1-1","urgency":"not yet assigned"},"forky":{"status":"resolved","repositories":{"forky":"1.11-2"},"fixed_version":"1.1-1","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"1.11-2"},"fixed_version":"1.1-1","urgency":"not yet assigned"},"trixie":{"status":"resolved","repositories":{"trixie":"1.11-2"},"fixed_version":"1.1-1","urgency":"not yet assigned"}}},"CVE-2010-2800":{"description":"The MS-ZIP decompressor in cabextract before 1.3 allows remote attackers to cause a denial of service (infinite loop) via a malformed MSZIP archive in a .cab file during a (1) test or (2) extract action, related to the libmspack library.","debianbug":591552,"scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"1.9-3"},"fixed_version":"1.3-1","urgency":"unimportant"},"bullseye":{"status":"resolved","repositories":{"bullseye":"1.9-3"},"fixed_version":"1.3-1","urgency":"unimportant"},"forky":{"status":"resolved","repositories":{"forky":"1.11-2"},"fixed_version":"1.3-1","urgency":"unimportant"},"sid":{"status":"resolved","repositories":{"sid":"1.11-2"},"fixed_version":"1.3-1","urgency":"unimportant"},"trixie":{"status":"resolved","repositories":{"trixie":"1.11-2"},"fixed_version":"1.3-1","urgency":"unimportant"}}},"CVE-2010-2801":{"description":"Integer signedness error in the Quantum decompressor in cabextract before 1.3, when archive test mode is used, allows user-assisted remote attackers to cause a denial of service (application crash) or possibly execute arbitrary code via a crafted Quantum archive in a .cab file, related to the libmspack library.","debianbug":591552,"scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"1.9-3"},"fixed_version":"1.3-1","urgency":"not yet assigned"},"bullseye":{"status":"resolved","repositories":{"bullseye":"1.9-3"},"fixed_version":"1.3-1","urgency":"not yet assigned"},"forky":{"status":"resolved","repositories":{"forky":"1.11-2"},"fixed_version":"1.3-1","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"1.11-2"},"fixed_version":"1.3-1","urgency":"not yet assigned"},"trixie":{"status":"resolved","repositories":{"trixie":"1.11-2"},"fixed_version":"1.3-1","urgency":"not yet assigned"}}},"CVE-2014-9556":{"description":"Integer overflow in the qtmd_decompress function in libmspack 0.4 allows remote attackers to cause a denial of service (hang) via a crafted CAB file, which triggers an infinite loop.","debianbug":772891,"scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"1.9-3"},"fixed_version":"1.4-5","urgency":"not yet assigned"},"bullseye":{"status":"resolved","repositories":{"bullseye":"1.9-3"},"fixed_version":"1.4-5","urgency":"not yet assigned"},"forky":{"status":"resolved","repositories":{"forky":"1.11-2"},"fixed_version":"1.4-5","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"1.11-2"},"fixed_version":"1.4-5","urgency":"not yet assigned"},"trixie":{"status":"resolved","repositories":{"trixie":"1.11-2"},"fixed_version":"1.4-5","urgency":"not yet assigned"}}},"CVE-2015-2060":{"description":"cabextract before 1.6 does not properly check for leading slashes when extracting files, which allows remote attackers to conduct absolute directory traversal attacks via a malformed UTF-8 character that is changed to a UTF-8 encoded slash.","debianbug":778753,"scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"1.9-3"},"fixed_version":"1.6-1","urgency":"not yet assigned"},"bullseye":{"status":"resolved","repositories":{"bullseye":"1.9-3"},"fixed_version":"1.6-1","urgency":"not yet assigned"},"forky":{"status":"resolved","repositories":{"forky":"1.11-2"},"fixed_version":"1.6-1","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"1.11-2"},"fixed_version":"1.6-1","urgency":"not yet assigned"},"trixie":{"status":"resolved","repositories":{"trixie":"1.11-2"},"fixed_version":"1.6-1","urgency":"not yet assigned"}}},"CVE-2018-18584":{"description":"In mspack/cab.h in libmspack before 0.8alpha and cabextract before 1.8, the CAB block input buffer is one byte too small for the maximal Quantum block, leading to an out-of-bounds write.","scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"1.9-3"},"fixed_version":"1.4-5","urgency":"not yet assigned"},"bullseye":{"status":"resolved","repositories":{"bullseye":"1.9-3"},"fixed_version":"1.4-5","urgency":"not yet assigned"},"forky":{"status":"resolved","repositories":{"forky":"1.11-2"},"fixed_version":"1.4-5","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"1.11-2"},"fixed_version":"1.4-5","urgency":"not yet assigned"},"trixie":{"status":"resolved","repositories":{"trixie":"1.11-2"},"fixed_version":"1.4-5","urgency":"not yet assigned"}}},"TEMP-0000000-970209":{"releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"1.9-3"},"fixed_version":"1.4-5","urgency":"not yet assigned"},"bullseye":{"status":"resolved","repositories":{"bullseye":"1.9-3"},"fixed_version":"1.4-5","urgency":"not yet assigned"},"forky":{"status":"resolved","repositories":{"forky":"1.11-2"},"fixed_version":"1.4-5","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"1.11-2"},"fixed_version":"1.4-5","urgency":"not yet assigned"},"trixie":{"status":"resolved","repositories":{"trixie":"1.11-2"},"fixed_version":"1.4-5","urgency":"not yet assigned"}}},"TEMP-0000000-A4F3DE":{"releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"1.9-3"},"fixed_version":"1.4-5","urgency":"not yet assigned"},"bullseye":{"status":"resolved","repositories":{"bullseye":"1.9-3"},"fixed_version":"1.4-5","urgency":"not yet assigned"},"forky":{"status":"resolved","repositories":{"forky":"1.11-2"},"fixed_version":"1.4-5","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"1.11-2"},"fixed_version":"1.4-5","urgency":"not yet assigned"},"trixie":{"status":"resolved","repositories":{"trixie":"1.11-2"},"fixed_version":"1.4-5","urgency":"not yet assigned"}}}},"cacti":{"CVE-2002-1477":{"description":"graphs.php in Cacti before 0.6.8 allows remote authenticated Cacti administrators to execute arbitrary commands via shell metacharacters in the title during edit mode.","scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"1.2.24+ds1-1+deb12u5","bookworm-security":"1.2.24+ds1-1+deb12u5"},"fixed_version":"0.6.8a-2","urgency":"not yet assigned"},"bullseye":{"status":"resolved","repositories":{"bullseye":"1.2.16+ds1-2+deb11u3","bullseye-security":"1.2.16+ds1-2+deb11u5"},"fixed_version":"0.6.8a-2","urgency":"not yet assigned"},"forky":{"status":"resolved","repositories":{"forky":"1.2.30+ds1-1"},"fixed_version":"0.6.8a-2","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"1.2.30+ds1-1"},"fixed_version":"0.6.8a-2","urgency":"not yet assigned"},"trixie":{"status":"resolved","repositories":{"trixie":"1.2.30+ds1-1"},"fixed_version":"0.6.8a-2","urgency":"not yet assigned"}}},"CVE-2002-1478":{"description":"Cacti before 0.6.8 allows attackers to execute arbitrary commands via the \"Data Input\" option in console mode.","scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"1.2.24+ds1-1+deb12u5","bookworm-security":"1.2.24+ds1-1+deb12u5"},"fixed_version":"0.6.8a-2","urgency":"not yet assigned"},"bullseye":{"status":"resolved","repositories":{"bullseye":"1.2.16+ds1-2+deb11u3","bullseye-security":"1.2.16+ds1-2+deb11u5"},"fixed_version":"0.6.8a-2","urgency":"not yet assigned"},"forky":{"status":"resolved","repositories":{"forky":"1.2.30+ds1-1"},"fixed_version":"0.6.8a-2","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"1.2.30+ds1-1"},"fixed_version":"0.6.8a-2","urgency":"not yet assigned"},"trixie":{"status":"resolved","repositories":{"trixie":"1.2.30+ds1-1"},"fixed_version":"0.6.8a-2","urgency":"not yet assigned"}}},"CVE-2002-1479":{"description":"Cacti before 0.6.8 stores a MySQL username and password in plaintext in config.php, which has world-readable permissions, which allows local users to modify databases as the Cacti user and possibly gain privileges.","scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"1.2.24+ds1-1+deb12u5","bookworm-security":"1.2.24+ds1-1+deb12u5"},"fixed_version":"0.6.8-1","urgency":"not yet assigned"},"bullseye":{"status":"resolved","repositories":{"bullseye":"1.2.16+ds1-2+deb11u3","bullseye-security":"1.2.16+ds1-2+deb11u5"},"fixed_version":"0.6.8-1","urgency":"not yet assigned"},"forky":{"status":"resolved","repositories":{"forky":"1.2.30+ds1-1"},"fixed_version":"0.6.8-1","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"1.2.30+ds1-1"},"fixed_version":"0.6.8-1","urgency":"not yet assigned"},"trixie":{"status":"resolved","repositories":{"trixie":"1.2.30+ds1-1"},"fixed_version":"0.6.8-1","urgency":"not yet assigned"}}},"CVE-2004-1736":{"description":"Cacti 0.8.5a allows remote attackers to gain sensitive information via an HTTP request to (1) auth.php, (2) auth_login.php, (3) auth_changepassword.php, and possibly other php files, which reveal the installation path in a PHP error message.","scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"1.2.24+ds1-1+deb12u5","bookworm-security":"1.2.24+ds1-1+deb12u5"},"fixed_version":"0.8.5a-5","urgency":"not yet assigned"},"bullseye":{"status":"resolved","repositories":{"bullseye":"1.2.16+ds1-2+deb11u3","bullseye-security":"1.2.16+ds1-2+deb11u5"},"fixed_version":"0.8.5a-5","urgency":"not yet assigned"},"forky":{"status":"resolved","repositories":{"forky":"1.2.30+ds1-1"},"fixed_version":"0.8.5a-5","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"1.2.30+ds1-1"},"fixed_version":"0.8.5a-5","urgency":"not yet assigned"},"trixie":{"status":"resolved","repositories":{"trixie":"1.2.30+ds1-1"},"fixed_version":"0.8.5a-5","urgency":"not yet assigned"}}},"CVE-2004-1737":{"description":"SQL injection vulnerability in auth_login.php in Cacti 0.8.5a allows remote attackers to execute arbitrary SQL commands and bypass authentication via the (1) username or (2) password parameters.","scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"1.2.24+ds1-1+deb12u5","bookworm-security":"1.2.24+ds1-1+deb12u5"},"fixed_version":"0.8.5a-5","urgency":"not yet assigned"},"bullseye":{"status":"resolved","repositories":{"bullseye":"1.2.16+ds1-2+deb11u3","bullseye-security":"1.2.16+ds1-2+deb11u5"},"fixed_version":"0.8.5a-5","urgency":"not yet assigned"},"forky":{"status":"resolved","repositories":{"forky":"1.2.30+ds1-1"},"fixed_version":"0.8.5a-5","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"1.2.30+ds1-1"},"fixed_version":"0.8.5a-5","urgency":"not yet assigned"},"trixie":{"status":"resolved","repositories":{"trixie":"1.2.30+ds1-1"},"fixed_version":"0.8.5a-5","urgency":"not yet assigned"}}},"CVE-2005-10004":{"description":"Cacti versions prior to 0.8.6-d contain a remote command execution vulnerability in the graph_view.php script. An authenticated user can inject arbitrary shell commands via the graph_start GET parameter, which is improperly handled during graph rendering. This flaw allows attackers to execute commands on the underlying operating system with the privileges of the web server process, potentially compromising system integrity.","scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"1.2.24+ds1-1+deb12u5","bookworm-security":"1.2.24+ds1-1+deb12u5"},"fixed_version":"0.8.6d-1","urgency":"not yet assigned"},"bullseye":{"status":"resolved","repositories":{"bullseye":"1.2.16+ds1-2+deb11u3","bullseye-security":"1.2.16+ds1-2+deb11u5"},"fixed_version":"0.8.6d-1","urgency":"not yet assigned"},"forky":{"status":"resolved","repositories":{"forky":"1.2.30+ds1-1"},"fixed_version":"0.8.6d-1","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"1.2.30+ds1-1"},"fixed_version":"0.8.6d-1","urgency":"not yet assigned"},"trixie":{"status":"resolved","repositories":{"trixie":"1.2.30+ds1-1"},"fixed_version":"0.8.6d-1","urgency":"not yet assigned"}}},"CVE-2005-1524":{"description":"PHP file inclusion vulnerability in top_graph_header.php in Cacti 0.8.6d and possibly earlier versions allows remote attackers to execute arbitrary PHP code via the config[library_path] parameter.","debianbug":315703,"scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"1.2.24+ds1-1+deb12u5","bookworm-security":"1.2.24+ds1-1+deb12u5"},"fixed_version":"0.8.6e-1","urgency":"high"},"bullseye":{"status":"resolved","repositories":{"bullseye":"1.2.16+ds1-2+deb11u3","bullseye-security":"1.2.16+ds1-2+deb11u5"},"fixed_version":"0.8.6e-1","urgency":"high"},"forky":{"status":"resolved","repositories":{"forky":"1.2.30+ds1-1"},"fixed_version":"0.8.6e-1","urgency":"high"},"sid":{"status":"resolved","repositories":{"sid":"1.2.30+ds1-1"},"fixed_version":"0.8.6e-1","urgency":"high"},"trixie":{"status":"resolved","repositories":{"trixie":"1.2.30+ds1-1"},"fixed_version":"0.8.6e-1","urgency":"high"}}},"CVE-2005-1525":{"description":"SQL injection vulnerability in config_settings.php for Cacti before 0.8.6e allows remote attackers to execute arbitrary SQL commands via the id parameter.","debianbug":315703,"scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"1.2.24+ds1-1+deb12u5","bookworm-security":"1.2.24+ds1-1+deb12u5"},"fixed_version":"0.8.6e-1","urgency":"high"},"bullseye":{"status":"resolved","repositories":{"bullseye":"1.2.16+ds1-2+deb11u3","bullseye-security":"1.2.16+ds1-2+deb11u5"},"fixed_version":"0.8.6e-1","urgency":"high"},"forky":{"status":"resolved","repositories":{"forky":"1.2.30+ds1-1"},"fixed_version":"0.8.6e-1","urgency":"high"},"sid":{"status":"resolved","repositories":{"sid":"1.2.30+ds1-1"},"fixed_version":"0.8.6e-1","urgency":"high"},"trixie":{"status":"resolved","repositories":{"trixie":"1.2.30+ds1-1"},"fixed_version":"0.8.6e-1","urgency":"high"}}},"CVE-2005-1526":{"description":"PHP remote file inclusion vulnerability in config_settings.php in Cacti before 0.8.6e allows remote attackers to execute arbitrary PHP code via the config[include_path] parameter.","debianbug":315703,"scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"1.2.24+ds1-1+deb12u5","bookworm-security":"1.2.24+ds1-1+deb12u5"},"fixed_version":"0.8.6e-1","urgency":"high"},"bullseye":{"status":"resolved","repositories":{"bullseye":"1.2.16+ds1-2+deb11u3","bullseye-security":"1.2.16+ds1-2+deb11u5"},"fixed_version":"0.8.6e-1","urgency":"high"},"forky":{"status":"resolved","repositories":{"forky":"1.2.30+ds1-1"},"fixed_version":"0.8.6e-1","urgency":"high"},"sid":{"status":"resolved","repositories":{"sid":"1.2.30+ds1-1"},"fixed_version":"0.8.6e-1","urgency":"high"},"trixie":{"status":"resolved","repositories":{"trixie":"1.2.30+ds1-1"},"fixed_version":"0.8.6e-1","urgency":"high"}}},"CVE-2005-2148":{"description":"Cacti 0.8.6e and earlier does not perform proper input validation to protect against common attacks, which allows remote attackers to execute arbitrary commands or SQL by sending a legitimate value in a POST request or cookie, then specifying the attack string in the URL, which causes the get_request_var function to return the wrong value in the $_REQUEST variable, which is cleansed while the original malicious $_GET value remains unmodified, as demonstrated in (1) graph_image.php and (2) graph.php.","debianbug":316590,"scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"1.2.24+ds1-1+deb12u5","bookworm-security":"1.2.24+ds1-1+deb12u5"},"fixed_version":"0.8.6f-1","urgency":"high"},"bullseye":{"status":"resolved","repositories":{"bullseye":"1.2.16+ds1-2+deb11u3","bullseye-security":"1.2.16+ds1-2+deb11u5"},"fixed_version":"0.8.6f-1","urgency":"high"},"forky":{"status":"resolved","repositories":{"forky":"1.2.30+ds1-1"},"fixed_version":"0.8.6f-1","urgency":"high"},"sid":{"status":"resolved","repositories":{"sid":"1.2.30+ds1-1"},"fixed_version":"0.8.6f-1","urgency":"high"},"trixie":{"status":"resolved","repositories":{"trixie":"1.2.30+ds1-1"},"fixed_version":"0.8.6f-1","urgency":"high"}}},"CVE-2005-2149":{"description":"config.php in Cacti 0.8.6e and earlier allows remote attackers to set the no_http_headers switch, then modify session information to gain privileges and disable the use of addslashes to conduct SQL injection attacks.","debianbug":316590,"scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"1.2.24+ds1-1+deb12u5","bookworm-security":"1.2.24+ds1-1+deb12u5"},"fixed_version":"0.8.6f-1","urgency":"high"},"bullseye":{"status":"resolved","repositories":{"bullseye":"1.2.16+ds1-2+deb11u3","bullseye-security":"1.2.16+ds1-2+deb11u5"},"fixed_version":"0.8.6f-1","urgency":"high"},"forky":{"status":"resolved","repositories":{"forky":"1.2.30+ds1-1"},"fixed_version":"0.8.6f-1","urgency":"high"},"sid":{"status":"resolved","repositories":{"sid":"1.2.30+ds1-1"},"fixed_version":"0.8.6f-1","urgency":"high"},"trixie":{"status":"resolved","repositories":{"trixie":"1.2.30+ds1-1"},"fixed_version":"0.8.6f-1","urgency":"high"}}},"CVE-2006-0146":{"description":"The server.php test script in ADOdb for PHP before 4.70, as used in multiple products including (1) Mantis, (2) PostNuke, (3) Moodle, (4) Cacti, (5) Xaraya, (6) PHPOpenChat, (7) MAXdev MD-Pro, and (8) MediaBeez, when the MySQL root password is empty, allows remote attackers to execute arbitrary SQL commands via the sql parameter.","scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"1.2.24+ds1-1+deb12u5","bookworm-security":"1.2.24+ds1-1+deb12u5"},"fixed_version":"0.8.6d-1","urgency":"medium"},"bullseye":{"status":"resolved","repositories":{"bullseye":"1.2.16+ds1-2+deb11u3","bullseye-security":"1.2.16+ds1-2+deb11u5"},"fixed_version":"0.8.6d-1","urgency":"medium"},"forky":{"status":"resolved","repositories":{"forky":"1.2.30+ds1-1"},"fixed_version":"0.8.6d-1","urgency":"medium"},"sid":{"status":"resolved","repositories":{"sid":"1.2.30+ds1-1"},"fixed_version":"0.8.6d-1","urgency":"medium"},"trixie":{"status":"resolved","repositories":{"trixie":"1.2.30+ds1-1"},"fixed_version":"0.8.6d-1","urgency":"medium"}}},"CVE-2006-0147":{"description":"Dynamic code evaluation vulnerability in tests/tmssql.php test script in ADOdb for PHP before 4.70, as used in multiple products including (1) Mantis, (2) PostNuke, (3) Moodle, (4) Cacti, (5) Xaraya, (6) PhpOpenChat, possibly (7) MAXdev MD-Pro, and (8) Simplog, allows remote attackers to execute arbitrary PHP functions via the do parameter, which is saved in a variable that is then executed as a function, as demonstrated using phpinfo.","scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"1.2.24+ds1-1+deb12u5","bookworm-security":"1.2.24+ds1-1+deb12u5"},"fixed_version":"0.8.6d-1","urgency":"medium"},"bullseye":{"status":"resolved","repositories":{"bullseye":"1.2.16+ds1-2+deb11u3","bullseye-security":"1.2.16+ds1-2+deb11u5"},"fixed_version":"0.8.6d-1","urgency":"medium"},"forky":{"status":"resolved","repositories":{"forky":"1.2.30+ds1-1"},"fixed_version":"0.8.6d-1","urgency":"medium"},"sid":{"status":"resolved","repositories":{"sid":"1.2.30+ds1-1"},"fixed_version":"0.8.6d-1","urgency":"medium"},"trixie":{"status":"resolved","repositories":{"trixie":"1.2.30+ds1-1"},"fixed_version":"0.8.6d-1","urgency":"medium"}}},"CVE-2006-0410":{"description":"SQL injection vulnerability in ADOdb before 4.71, when using PostgreSQL, allows remote attackers to execute arbitrary SQL commands via unspecified attack vectors involving binary strings.","scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"1.2.24+ds1-1+deb12u5","bookworm-security":"1.2.24+ds1-1+deb12u5"},"fixed_version":"0.8.6d-1","urgency":"medium"},"bullseye":{"status":"resolved","repositories":{"bullseye":"1.2.16+ds1-2+deb11u3","bullseye-security":"1.2.16+ds1-2+deb11u5"},"fixed_version":"0.8.6d-1","urgency":"medium"},"forky":{"status":"resolved","repositories":{"forky":"1.2.30+ds1-1"},"fixed_version":"0.8.6d-1","urgency":"medium"},"sid":{"status":"resolved","repositories":{"sid":"1.2.30+ds1-1"},"fixed_version":"0.8.6d-1","urgency":"medium"},"trixie":{"status":"resolved","repositories":{"trixie":"1.2.30+ds1-1"},"fixed_version":"0.8.6d-1","urgency":"medium"}}},"CVE-2006-0806":{"description":"Multiple cross-site scripting (XSS) vulnerabilities in ADOdb 4.71, as used in multiple packages such as phpESP, allow remote attackers to inject arbitrary web script or HTML via (1) the next_page parameter in adodb-pager.inc.php and (2) other unspecified vectors related to PHP_SELF.","scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"1.2.24+ds1-1+deb12u5","bookworm-security":"1.2.24+ds1-1+deb12u5"},"fixed_version":"0.8.6d-1","urgency":"medium"},"bullseye":{"status":"resolved","repositories":{"bullseye":"1.2.16+ds1-2+deb11u3","bullseye-security":"1.2.16+ds1-2+deb11u5"},"fixed_version":"0.8.6d-1","urgency":"medium"},"forky":{"status":"resolved","repositories":{"forky":"1.2.30+ds1-1"},"fixed_version":"0.8.6d-1","urgency":"medium"},"sid":{"status":"resolved","repositories":{"sid":"1.2.30+ds1-1"},"fixed_version":"0.8.6d-1","urgency":"medium"},"trixie":{"status":"resolved","repositories":{"trixie":"1.2.30+ds1-1"},"fixed_version":"0.8.6d-1","urgency":"medium"}}},"CVE-2006-6799":{"description":"SQL injection vulnerability in Cacti 0.8.6i and earlier, when register_argc_argv is enabled, allows remote attackers to execute arbitrary SQL commands via the (1) second or (2) third arguments to cmd.php.  NOTE: this issue can be leveraged to execute arbitrary commands since the SQL query results are later used in the polling_items array and popen function.","debianbug":404818,"scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"1.2.24+ds1-1+deb12u5","bookworm-security":"1.2.24+ds1-1+deb12u5"},"fixed_version":"0.8.6i-3","urgency":"high"},"bullseye":{"status":"resolved","repositories":{"bullseye":"1.2.16+ds1-2+deb11u3","bullseye-security":"1.2.16+ds1-2+deb11u5"},"fixed_version":"0.8.6i-3","urgency":"high"},"forky":{"status":"resolved","repositories":{"forky":"1.2.30+ds1-1"},"fixed_version":"0.8.6i-3","urgency":"high"},"sid":{"status":"resolved","repositories":{"sid":"1.2.30+ds1-1"},"fixed_version":"0.8.6i-3","urgency":"high"},"trixie":{"status":"resolved","repositories":{"trixie":"1.2.30+ds1-1"},"fixed_version":"0.8.6i-3","urgency":"high"}}},"CVE-2007-3112":{"description":"graph_image.php in Cacti 0.8.6i, and possibly other versions, allows remote authenticated users to cause a denial of service (CPU consumption) via a large value of the (1) graph_start or (2) graph_end parameter, different vectors than CVE-2007-3113.","debianbug":429224,"scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"1.2.24+ds1-1+deb12u5","bookworm-security":"1.2.24+ds1-1+deb12u5"},"fixed_version":"0.8.6j-1.1","urgency":"low"},"bullseye":{"status":"resolved","repositories":{"bullseye":"1.2.16+ds1-2+deb11u3","bullseye-security":"1.2.16+ds1-2+deb11u5"},"fixed_version":"0.8.6j-1.1","urgency":"low"},"forky":{"status":"resolved","repositories":{"forky":"1.2.30+ds1-1"},"fixed_version":"0.8.6j-1.1","urgency":"low"},"sid":{"status":"resolved","repositories":{"sid":"1.2.30+ds1-1"},"fixed_version":"0.8.6j-1.1","urgency":"low"},"trixie":{"status":"resolved","repositories":{"trixie":"1.2.30+ds1-1"},"fixed_version":"0.8.6j-1.1","urgency":"low"}}},"CVE-2007-3113":{"description":"Cacti 0.8.6i, and possibly other versions, allows remote authenticated users to cause a denial of service (CPU consumption) via a large value of the (1) graph_height or (2) graph_width parameter, different vectors than CVE-2007-3112.","debianbug":429224,"scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"1.2.24+ds1-1+deb12u5","bookworm-security":"1.2.24+ds1-1+deb12u5"},"fixed_version":"0.8.6j-1.1","urgency":"low"},"bullseye":{"status":"resolved","repositories":{"bullseye":"1.2.16+ds1-2+deb11u3","bullseye-security":"1.2.16+ds1-2+deb11u5"},"fixed_version":"0.8.6j-1.1","urgency":"low"},"forky":{"status":"resolved","repositories":{"forky":"1.2.30+ds1-1"},"fixed_version":"0.8.6j-1.1","urgency":"low"},"sid":{"status":"resolved","repositories":{"sid":"1.2.30+ds1-1"},"fixed_version":"0.8.6j-1.1","urgency":"low"},"trixie":{"status":"resolved","repositories":{"trixie":"1.2.30+ds1-1"},"fixed_version":"0.8.6j-1.1","urgency":"low"}}},"CVE-2007-6035":{"description":"SQL injection vulnerability in graph.php in Cacti before 0.8.7a allows remote attackers to execute arbitrary SQL commands via the local_graph_id parameter.","debianbug":452085,"scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"1.2.24+ds1-1+deb12u5","bookworm-security":"1.2.24+ds1-1+deb12u5"},"fixed_version":"0.8.7a-1","urgency":"medium"},"bullseye":{"status":"resolved","repositories":{"bullseye":"1.2.16+ds1-2+deb11u3","bullseye-security":"1.2.16+ds1-2+deb11u5"},"fixed_version":"0.8.7a-1","urgency":"medium"},"forky":{"status":"resolved","repositories":{"forky":"1.2.30+ds1-1"},"fixed_version":"0.8.7a-1","urgency":"medium"},"sid":{"status":"resolved","repositories":{"sid":"1.2.30+ds1-1"},"fixed_version":"0.8.7a-1","urgency":"medium"},"trixie":{"status":"resolved","repositories":{"trixie":"1.2.30+ds1-1"},"fixed_version":"0.8.7a-1","urgency":"medium"}}},"CVE-2008-0783":{"description":"Multiple cross-site scripting (XSS) vulnerabilities in Cacti 0.8.7 before 0.8.7b and 0.8.6 before 0.8.6k allow remote attackers to inject arbitrary web script or HTML via (1) the view_type parameter to graph.php; (2) the filter parameter to graph_view.php; (3) the action parameter to the draw_navigation_text function in lib/functions.php, reachable through index.php (aka the login page) or data_input.php; or (4) the login_username parameter to index.php.","debianbug":530919,"scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"1.2.24+ds1-1+deb12u5","bookworm-security":"1.2.24+ds1-1+deb12u5"},"fixed_version":"0.8.7b-1","urgency":"low"},"bullseye":{"status":"resolved","repositories":{"bullseye":"1.2.16+ds1-2+deb11u3","bullseye-security":"1.2.16+ds1-2+deb11u5"},"fixed_version":"0.8.7b-1","urgency":"low"},"forky":{"status":"resolved","repositories":{"forky":"1.2.30+ds1-1"},"fixed_version":"0.8.7b-1","urgency":"low"},"sid":{"status":"resolved","repositories":{"sid":"1.2.30+ds1-1"},"fixed_version":"0.8.7b-1","urgency":"low"},"trixie":{"status":"resolved","repositories":{"trixie":"1.2.30+ds1-1"},"fixed_version":"0.8.7b-1","urgency":"low"}}},"CVE-2008-0784":{"description":"graph.php in Cacti 0.8.7 before 0.8.7b and 0.8.6 before 0.8.6k allows remote attackers to obtain the full path via an invalid local_graph_id parameter and other unspecified vectors.","scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"1.2.24+ds1-1+deb12u5","bookworm-security":"1.2.24+ds1-1+deb12u5"},"fixed_version":"0.8.7b-1","urgency":"unimportant"},"bullseye":{"status":"resolved","repositories":{"bullseye":"1.2.16+ds1-2+deb11u3","bullseye-security":"1.2.16+ds1-2+deb11u5"},"fixed_version":"0.8.7b-1","urgency":"unimportant"},"forky":{"status":"resolved","repositories":{"forky":"1.2.30+ds1-1"},"fixed_version":"0.8.7b-1","urgency":"unimportant"},"sid":{"status":"resolved","repositories":{"sid":"1.2.30+ds1-1"},"fixed_version":"0.8.7b-1","urgency":"unimportant"},"trixie":{"status":"resolved","repositories":{"trixie":"1.2.30+ds1-1"},"fixed_version":"0.8.7b-1","urgency":"unimportant"}}},"CVE-2008-0785":{"description":"Multiple SQL injection vulnerabilities in Cacti 0.8.7 before 0.8.7b and 0.8.6 before 0.8.6k allow remote authenticated users to execute arbitrary SQL commands via the (1) graph_list parameter to graph_view.php, (2) leaf_id and id parameters to tree.php, (3) local_graph_id parameter to graph_xport.php, and (4) login_username parameter to index.php/login.","debianbug":530919,"scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"1.2.24+ds1-1+deb12u5","bookworm-security":"1.2.24+ds1-1+deb12u5"},"fixed_version":"0.8.7b-1","urgency":"low"},"bullseye":{"status":"resolved","repositories":{"bullseye":"1.2.16+ds1-2+deb11u3","bullseye-security":"1.2.16+ds1-2+deb11u5"},"fixed_version":"0.8.7b-1","urgency":"low"},"forky":{"status":"resolved","repositories":{"forky":"1.2.30+ds1-1"},"fixed_version":"0.8.7b-1","urgency":"low"},"sid":{"status":"resolved","repositories":{"sid":"1.2.30+ds1-1"},"fixed_version":"0.8.7b-1","urgency":"low"},"trixie":{"status":"resolved","repositories":{"trixie":"1.2.30+ds1-1"},"fixed_version":"0.8.7b-1","urgency":"low"}}},"CVE-2008-0786":{"description":"CRLF injection vulnerability in Cacti 0.8.7 before 0.8.7b and 0.8.6 before 0.8.6k, when running on older PHP interpreters, allows remote attackers to inject arbitrary HTTP headers and conduct HTTP response splitting attacks via unspecified vectors.","scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"1.2.24+ds1-1+deb12u5","bookworm-security":"1.2.24+ds1-1+deb12u5"},"fixed_version":"0.8.7b-1","urgency":"not yet assigned"},"bullseye":{"status":"resolved","repositories":{"bullseye":"1.2.16+ds1-2+deb11u3","bullseye-security":"1.2.16+ds1-2+deb11u5"},"fixed_version":"0.8.7b-1","urgency":"not yet assigned"},"forky":{"status":"resolved","repositories":{"forky":"1.2.30+ds1-1"},"fixed_version":"0.8.7b-1","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"1.2.30+ds1-1"},"fixed_version":"0.8.7b-1","urgency":"not yet assigned"},"trixie":{"status":"resolved","repositories":{"trixie":"1.2.30+ds1-1"},"fixed_version":"0.8.7b-1","urgency":"not yet assigned"}}},"CVE-2009-4032":{"description":"Multiple cross-site scripting (XSS) vulnerabilities in Cacti 0.8.7e allow remote attackers to inject arbitrary web script or HTML via vectors related to (1) graph.php, (2) include/top_graph_header.php, (3) lib/html_form.php, and (4) lib/timespan_settings.php, as demonstrated by the (a) graph_end or (b) graph_start parameters to graph.php; (c) the date1 parameter in a tree action to graph_view.php; and the (d) page_refresh and (e) default_dual_pane_width parameters to graph_settings.php.","debianbug":561338,"scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"1.2.24+ds1-1+deb12u5","bookworm-security":"1.2.24+ds1-1+deb12u5"},"fixed_version":"0.8.7e-1.1","urgency":"low"},"bullseye":{"status":"resolved","repositories":{"bullseye":"1.2.16+ds1-2+deb11u3","bullseye-security":"1.2.16+ds1-2+deb11u5"},"fixed_version":"0.8.7e-1.1","urgency":"low"},"forky":{"status":"resolved","repositories":{"forky":"1.2.30+ds1-1"},"fixed_version":"0.8.7e-1.1","urgency":"low"},"sid":{"status":"resolved","repositories":{"sid":"1.2.30+ds1-1"},"fixed_version":"0.8.7e-1.1","urgency":"low"},"trixie":{"status":"resolved","repositories":{"trixie":"1.2.30+ds1-1"},"fixed_version":"0.8.7e-1.1","urgency":"low"}}},"CVE-2009-4112":{"description":"Cacti 0.8.7e and earlier allows remote authenticated administrators to gain privileges by modifying the \"Data Input Method\" for the \"Linux - Get Memory Usage\" setting to contain arbitrary commands.","debianbug":561339,"scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"1.2.24+ds1-1+deb12u5","bookworm-security":"1.2.24+ds1-1+deb12u5"},"fixed_version":"1.2.1+ds1-1","urgency":"unimportant"},"bullseye":{"status":"resolved","repositories":{"bullseye":"1.2.16+ds1-2+deb11u3","bullseye-security":"1.2.16+ds1-2+deb11u5"},"fixed_version":"1.2.1+ds1-1","urgency":"unimportant"},"forky":{"status":"resolved","repositories":{"forky":"1.2.30+ds1-1"},"fixed_version":"1.2.1+ds1-1","urgency":"unimportant"},"sid":{"status":"resolved","repositories":{"sid":"1.2.30+ds1-1"},"fixed_version":"1.2.1+ds1-1","urgency":"unimportant"},"trixie":{"status":"resolved","repositories":{"trixie":"1.2.30+ds1-1"},"fixed_version":"1.2.1+ds1-1","urgency":"unimportant"}}},"CVE-2010-1431":{"description":"SQL injection vulnerability in templates_export.php in Cacti 0.8.7e and earlier allows remote attackers to execute arbitrary SQL commands via the export_item_id parameter.","debianbug":578909,"scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"1.2.24+ds1-1+deb12u5","bookworm-security":"1.2.24+ds1-1+deb12u5"},"fixed_version":"0.8.7e-3","urgency":"not yet assigned"},"bullseye":{"status":"resolved","repositories":{"bullseye":"1.2.16+ds1-2+deb11u3","bullseye-security":"1.2.16+ds1-2+deb11u5"},"fixed_version":"0.8.7e-3","urgency":"not yet assigned"},"forky":{"status":"resolved","repositories":{"forky":"1.2.30+ds1-1"},"fixed_version":"0.8.7e-3","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"1.2.30+ds1-1"},"fixed_version":"0.8.7e-3","urgency":"not yet assigned"},"trixie":{"status":"resolved","repositories":{"trixie":"1.2.30+ds1-1"},"fixed_version":"0.8.7e-3","urgency":"not yet assigned"}}},"CVE-2010-1644":{"description":"Multiple cross-site scripting (XSS) vulnerabilities in Cacti before 0.8.7f, as used in Red Hat High Performance Computing (HPC) Solution and other products, allow remote attackers to inject arbitrary web script or HTML via the (1) hostname or (2) description parameter to host.php, or (3) the host_id parameter to data_sources.php.","scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"1.2.24+ds1-1+deb12u5","bookworm-security":"1.2.24+ds1-1+deb12u5"},"fixed_version":"0.8.7g-1","urgency":"not yet assigned"},"bullseye":{"status":"resolved","repositories":{"bullseye":"1.2.16+ds1-2+deb11u3","bullseye-security":"1.2.16+ds1-2+deb11u5"},"fixed_version":"0.8.7g-1","urgency":"not yet assigned"},"forky":{"status":"resolved","repositories":{"forky":"1.2.30+ds1-1"},"fixed_version":"0.8.7g-1","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"1.2.30+ds1-1"},"fixed_version":"0.8.7g-1","urgency":"not yet assigned"},"trixie":{"status":"resolved","repositories":{"trixie":"1.2.30+ds1-1"},"fixed_version":"0.8.7g-1","urgency":"not yet assigned"}}},"CVE-2010-1645":{"description":"Cacti before 0.8.7f, as used in Red Hat High Performance Computing (HPC) Solution and other products, allows remote authenticated administrators to execute arbitrary commands via shell metacharacters in (1) the FQDN field of a Device or (2) the Vertical Label field of a Graph Template.","scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"1.2.24+ds1-1+deb12u5","bookworm-security":"1.2.24+ds1-1+deb12u5"},"fixed_version":"0.8.7g-1","urgency":"not yet assigned"},"bullseye":{"status":"resolved","repositories":{"bullseye":"1.2.16+ds1-2+deb11u3","bullseye-security":"1.2.16+ds1-2+deb11u5"},"fixed_version":"0.8.7g-1","urgency":"not yet assigned"},"forky":{"status":"resolved","repositories":{"forky":"1.2.30+ds1-1"},"fixed_version":"0.8.7g-1","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"1.2.30+ds1-1"},"fixed_version":"0.8.7g-1","urgency":"not yet assigned"},"trixie":{"status":"resolved","repositories":{"trixie":"1.2.30+ds1-1"},"fixed_version":"0.8.7g-1","urgency":"not yet assigned"}}},"CVE-2010-2092":{"description":"SQL injection vulnerability in graph.php in Cacti 0.8.7e and earlier allows remote attackers to execute arbitrary SQL commands via a crafted rra_id parameter in a GET request in conjunction with a valid rra_id value in a POST request or a cookie, which causes the POST or cookie value to bypass the validation routine, but inserts the $_GET value into the resulting query.","debianbug":582691,"scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"1.2.24+ds1-1+deb12u5","bookworm-security":"1.2.24+ds1-1+deb12u5"},"fixed_version":"0.8.7e-4","urgency":"not yet assigned"},"bullseye":{"status":"resolved","repositories":{"bullseye":"1.2.16+ds1-2+deb11u3","bullseye-security":"1.2.16+ds1-2+deb11u5"},"fixed_version":"0.8.7e-4","urgency":"not yet assigned"},"forky":{"status":"resolved","repositories":{"forky":"1.2.30+ds1-1"},"fixed_version":"0.8.7e-4","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"1.2.30+ds1-1"},"fixed_version":"0.8.7e-4","urgency":"not yet assigned"},"trixie":{"status":"resolved","repositories":{"trixie":"1.2.30+ds1-1"},"fixed_version":"0.8.7e-4","urgency":"not yet assigned"}}},"CVE-2010-2543":{"description":"Cross-site scripting (XSS) vulnerability in include/top_graph_header.php in Cacti before 0.8.7g allows remote attackers to inject arbitrary web script or HTML via the graph_start parameter to graph.php.  NOTE: this vulnerability exists because of an incorrect fix for CVE-2009-4032.2.b.","scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"1.2.24+ds1-1+deb12u5","bookworm-security":"1.2.24+ds1-1+deb12u5"},"fixed_version":"0.8.7g-1","urgency":"not yet assigned"},"bullseye":{"status":"resolved","repositories":{"bullseye":"1.2.16+ds1-2+deb11u3","bullseye-security":"1.2.16+ds1-2+deb11u5"},"fixed_version":"0.8.7g-1","urgency":"not yet assigned"},"forky":{"status":"resolved","repositories":{"forky":"1.2.30+ds1-1"},"fixed_version":"0.8.7g-1","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"1.2.30+ds1-1"},"fixed_version":"0.8.7g-1","urgency":"not yet assigned"},"trixie":{"status":"resolved","repositories":{"trixie":"1.2.30+ds1-1"},"fixed_version":"0.8.7g-1","urgency":"not yet assigned"}}},"CVE-2010-2544":{"description":"Cross-site scripting (XSS) vulnerability in utilities.php in Cacti before 0.8.7g, as used in Red Hat High Performance Computing (HPC) Solution and other products, allows remote attackers to inject arbitrary web script or HTML via the filter parameter.","scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"1.2.24+ds1-1+deb12u5","bookworm-security":"1.2.24+ds1-1+deb12u5"},"fixed_version":"0.8.7g-1","urgency":"not yet assigned"},"bullseye":{"status":"resolved","repositories":{"bullseye":"1.2.16+ds1-2+deb11u3","bullseye-security":"1.2.16+ds1-2+deb11u5"},"fixed_version":"0.8.7g-1","urgency":"not yet assigned"},"forky":{"status":"resolved","repositories":{"forky":"1.2.30+ds1-1"},"fixed_version":"0.8.7g-1","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"1.2.30+ds1-1"},"fixed_version":"0.8.7g-1","urgency":"not yet assigned"},"trixie":{"status":"resolved","repositories":{"trixie":"1.2.30+ds1-1"},"fixed_version":"0.8.7g-1","urgency":"not yet assigned"}}},"CVE-2010-2545":{"description":"Multiple cross-site scripting (XSS) vulnerabilities in Cacti before 0.8.7g, as used in Red Hat High Performance Computing (HPC) Solution and other products, allow remote attackers to inject arbitrary web script or HTML via (1) the name element in an XML template to templates_import.php; and allow remote authenticated administrators to inject arbitrary web script or HTML via vectors related to (2) cdef.php, (3) data_input.php, (4) data_queries.php, (5) data_sources.php, (6) data_templates.php, (7) gprint_presets.php, (8) graph.php, (9) graphs_new.php, (10) graphs.php, (11) graph_templates_inputs.php, (12) graph_templates_items.php, (13) graph_templates.php, (14) graph_view.php, (15) host.php, (16) host_templates.php, (17) lib/functions.php, (18) lib/html_form.php, (19) lib/html_form_template.php, (20) lib/html.php, (21) lib/html_tree.php, (22) lib/rrd.php, (23) rra.php, (24) tree.php, and (25) user_admin.php.","scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"1.2.24+ds1-1+deb12u5","bookworm-security":"1.2.24+ds1-1+deb12u5"},"fixed_version":"0.8.7g-1","urgency":"not yet assigned"},"bullseye":{"status":"resolved","repositories":{"bullseye":"1.2.16+ds1-2+deb11u3","bullseye-security":"1.2.16+ds1-2+deb11u5"},"fixed_version":"0.8.7g-1","urgency":"not yet assigned"},"forky":{"status":"resolved","repositories":{"forky":"1.2.30+ds1-1"},"fixed_version":"0.8.7g-1","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"1.2.30+ds1-1"},"fixed_version":"0.8.7g-1","urgency":"not yet assigned"},"trixie":{"status":"resolved","repositories":{"trixie":"1.2.30+ds1-1"},"fixed_version":"0.8.7g-1","urgency":"not yet assigned"}}},"CVE-2011-4824":{"description":"SQL injection vulnerability in auth_login.php in Cacti before 0.8.7h allows remote attackers to execute arbitrary SQL commands via the login_username parameter.","debianbug":652371,"scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"1.2.24+ds1-1+deb12u5","bookworm-security":"1.2.24+ds1-1+deb12u5"},"fixed_version":"0.8.7i-1","urgency":"high"},"bullseye":{"status":"resolved","repositories":{"bullseye":"1.2.16+ds1-2+deb11u3","bullseye-security":"1.2.16+ds1-2+deb11u5"},"fixed_version":"0.8.7i-1","urgency":"high"},"forky":{"status":"resolved","repositories":{"forky":"1.2.30+ds1-1"},"fixed_version":"0.8.7i-1","urgency":"high"},"sid":{"status":"resolved","repositories":{"sid":"1.2.30+ds1-1"},"fixed_version":"0.8.7i-1","urgency":"high"},"trixie":{"status":"resolved","repositories":{"trixie":"1.2.30+ds1-1"},"fixed_version":"0.8.7i-1","urgency":"high"}}},"CVE-2011-5223":{"description":"Cross-site request forgery (CSRF) vulnerability in logout.php in Cacti before 0.8.7i allows remote attackers to hijack the authentication of unspecified victims via unknown vectors.","scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"1.2.24+ds1-1+deb12u5","bookworm-security":"1.2.24+ds1-1+deb12u5"},"fixed_version":"0.8.7i-1","urgency":"low"},"bullseye":{"status":"resolved","repositories":{"bullseye":"1.2.16+ds1-2+deb11u3","bullseye-security":"1.2.16+ds1-2+deb11u5"},"fixed_version":"0.8.7i-1","urgency":"low"},"forky":{"status":"resolved","repositories":{"forky":"1.2.30+ds1-1"},"fixed_version":"0.8.7i-1","urgency":"low"},"sid":{"status":"resolved","repositories":{"sid":"1.2.30+ds1-1"},"fixed_version":"0.8.7i-1","urgency":"low"},"trixie":{"status":"resolved","repositories":{"trixie":"1.2.30+ds1-1"},"fixed_version":"0.8.7i-1","urgency":"low"}}},"CVE-2013-1434":{"description":"Multiple SQL injection vulnerabilities in (1) api_poller.php and (2) utility.php in Cacti before 0.8.8b allow remote attackers to execute arbitrary SQL commands via unspecified vectors.","scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"1.2.24+ds1-1+deb12u5","bookworm-security":"1.2.24+ds1-1+deb12u5"},"fixed_version":"0.8.8b+dfsg-1","urgency":"not yet assigned"},"bullseye":{"status":"resolved","repositories":{"bullseye":"1.2.16+ds1-2+deb11u3","bullseye-security":"1.2.16+ds1-2+deb11u5"},"fixed_version":"0.8.8b+dfsg-1","urgency":"not yet assigned"},"forky":{"status":"resolved","repositories":{"forky":"1.2.30+ds1-1"},"fixed_version":"0.8.8b+dfsg-1","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"1.2.30+ds1-1"},"fixed_version":"0.8.8b+dfsg-1","urgency":"not yet assigned"},"trixie":{"status":"resolved","repositories":{"trixie":"1.2.30+ds1-1"},"fixed_version":"0.8.8b+dfsg-1","urgency":"not yet assigned"}}},"CVE-2013-1435":{"description":"(1) snmp.php and (2) rrd.php in Cacti before 0.8.8b allows remote attackers to execute arbitrary commands via shell metacharacters in unspecified vectors.","scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"1.2.24+ds1-1+deb12u5","bookworm-security":"1.2.24+ds1-1+deb12u5"},"fixed_version":"0.8.8b+dfsg-1","urgency":"not yet assigned"},"bullseye":{"status":"resolved","repositories":{"bullseye":"1.2.16+ds1-2+deb11u3","bullseye-security":"1.2.16+ds1-2+deb11u5"},"fixed_version":"0.8.8b+dfsg-1","urgency":"not yet assigned"},"forky":{"status":"resolved","repositories":{"forky":"1.2.30+ds1-1"},"fixed_version":"0.8.8b+dfsg-1","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"1.2.30+ds1-1"},"fixed_version":"0.8.8b+dfsg-1","urgency":"not yet assigned"},"trixie":{"status":"resolved","repositories":{"trixie":"1.2.30+ds1-1"},"fixed_version":"0.8.8b+dfsg-1","urgency":"not yet assigned"}}},"CVE-2013-5588":{"description":"Multiple cross-site scripting (XSS) vulnerabilities in Cacti 0.8.8b and earlier allow remote attackers to inject arbitrary web script or HTML via (1) the step parameter to install/index.php or (2) the id parameter to cacti/host.php.","scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"1.2.24+ds1-1+deb12u5","bookworm-security":"1.2.24+ds1-1+deb12u5"},"fixed_version":"0.8.8b+dfsg-3","urgency":"not yet assigned"},"bullseye":{"status":"resolved","repositories":{"bullseye":"1.2.16+ds1-2+deb11u3","bullseye-security":"1.2.16+ds1-2+deb11u5"},"fixed_version":"0.8.8b+dfsg-3","urgency":"not yet assigned"},"forky":{"status":"resolved","repositories":{"forky":"1.2.30+ds1-1"},"fixed_version":"0.8.8b+dfsg-3","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"1.2.30+ds1-1"},"fixed_version":"0.8.8b+dfsg-3","urgency":"not yet assigned"},"trixie":{"status":"resolved","repositories":{"trixie":"1.2.30+ds1-1"},"fixed_version":"0.8.8b+dfsg-3","urgency":"not yet assigned"}}},"CVE-2013-5589":{"description":"SQL injection vulnerability in cacti/host.php in Cacti 0.8.8b and earlier allows remote attackers to execute arbitrary SQL commands via the id parameter.","scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"1.2.24+ds1-1+deb12u5","bookworm-security":"1.2.24+ds1-1+deb12u5"},"fixed_version":"0.8.8b+dfsg-3","urgency":"not yet assigned"},"bullseye":{"status":"resolved","repositories":{"bullseye":"1.2.16+ds1-2+deb11u3","bullseye-security":"1.2.16+ds1-2+deb11u5"},"fixed_version":"0.8.8b+dfsg-3","urgency":"not yet assigned"},"forky":{"status":"resolved","repositories":{"forky":"1.2.30+ds1-1"},"fixed_version":"0.8.8b+dfsg-3","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"1.2.30+ds1-1"},"fixed_version":"0.8.8b+dfsg-3","urgency":"not yet assigned"},"trixie":{"status":"resolved","repositories":{"trixie":"1.2.30+ds1-1"},"fixed_version":"0.8.8b+dfsg-3","urgency":"not yet assigned"}}},"CVE-2013-7464":{"description":"In csrf-magic before 1.0.4, if $GLOBALS['csrf']['secret'] is not configured, the Anti-CSRF Token used is predictable and would permit an attacker to bypass the CSRF protections, because an automatically generated secret is not used.","scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"1.2.24+ds1-1+deb12u5","bookworm-security":"1.2.24+ds1-1+deb12u5"},"fixed_version":"0","urgency":"unimportant"},"bullseye":{"status":"resolved","repositories":{"bullseye":"1.2.16+ds1-2+deb11u3","bullseye-security":"1.2.16+ds1-2+deb11u5"},"fixed_version":"0","urgency":"unimportant"},"forky":{"status":"resolved","repositories":{"forky":"1.2.30+ds1-1"},"fixed_version":"0","urgency":"unimportant"},"sid":{"status":"resolved","repositories":{"sid":"1.2.30+ds1-1"},"fixed_version":"0","urgency":"unimportant"},"trixie":{"status":"resolved","repositories":{"trixie":"1.2.30+ds1-1"},"fixed_version":"0","urgency":"unimportant"}}},"CVE-2014-2326":{"description":"Cross-site scripting (XSS) vulnerability in cdef.php in Cacti 0.8.7g, 0.8.8b, and earlier allows remote attackers to inject arbitrary web  script or HTML via unspecified vectors.","debianbug":742768,"scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"1.2.24+ds1-1+deb12u5","bookworm-security":"1.2.24+ds1-1+deb12u5"},"fixed_version":"0.8.8b+dfsg-4","urgency":"not yet assigned"},"bullseye":{"status":"resolved","repositories":{"bullseye":"1.2.16+ds1-2+deb11u3","bullseye-security":"1.2.16+ds1-2+deb11u5"},"fixed_version":"0.8.8b+dfsg-4","urgency":"not yet assigned"},"forky":{"status":"resolved","repositories":{"forky":"1.2.30+ds1-1"},"fixed_version":"0.8.8b+dfsg-4","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"1.2.30+ds1-1"},"fixed_version":"0.8.8b+dfsg-4","urgency":"not yet assigned"},"trixie":{"status":"resolved","repositories":{"trixie":"1.2.30+ds1-1"},"fixed_version":"0.8.8b+dfsg-4","urgency":"not yet assigned"}}},"CVE-2014-2327":{"description":"Cross-site request forgery (CSRF) vulnerability in Cacti 0.8.7g, 0.8.8b, and earlier allows remote attackers to hijack the authentication of users for unspecified commands, as demonstrated by requests that (1) modify binary files, (2) modify configurations, or (3) add arbitrary users.","debianbug":742768,"scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"1.2.24+ds1-1+deb12u5","bookworm-security":"1.2.24+ds1-1+deb12u5"},"fixed_version":"0.8.8b+dfsg-6","urgency":"not yet assigned"},"bullseye":{"status":"resolved","repositories":{"bullseye":"1.2.16+ds1-2+deb11u3","bullseye-security":"1.2.16+ds1-2+deb11u5"},"fixed_version":"0.8.8b+dfsg-6","urgency":"not yet assigned"},"forky":{"status":"resolved","repositories":{"forky":"1.2.30+ds1-1"},"fixed_version":"0.8.8b+dfsg-6","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"1.2.30+ds1-1"},"fixed_version":"0.8.8b+dfsg-6","urgency":"not yet assigned"},"trixie":{"status":"resolved","repositories":{"trixie":"1.2.30+ds1-1"},"fixed_version":"0.8.8b+dfsg-6","urgency":"not yet assigned"}}},"CVE-2014-2328":{"description":"lib/graph_export.php in Cacti 0.8.7g, 0.8.8b, and earlier allows remote authenticated users to execute arbitrary commands via shell metacharacters in unspecified vectors.","debianbug":742768,"scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"1.2.24+ds1-1+deb12u5","bookworm-security":"1.2.24+ds1-1+deb12u5"},"fixed_version":"0.8.8b+dfsg-4","urgency":"not yet assigned"},"bullseye":{"status":"resolved","repositories":{"bullseye":"1.2.16+ds1-2+deb11u3","bullseye-security":"1.2.16+ds1-2+deb11u5"},"fixed_version":"0.8.8b+dfsg-4","urgency":"not yet assigned"},"forky":{"status":"resolved","repositories":{"forky":"1.2.30+ds1-1"},"fixed_version":"0.8.8b+dfsg-4","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"1.2.30+ds1-1"},"fixed_version":"0.8.8b+dfsg-4","urgency":"not yet assigned"},"trixie":{"status":"resolved","repositories":{"trixie":"1.2.30+ds1-1"},"fixed_version":"0.8.8b+dfsg-4","urgency":"not yet assigned"}}},"CVE-2014-2708":{"description":"Multiple SQL injection vulnerabilities in graph_xport.php in Cacti 0.8.7g, 0.8.8b, and earlier allow remote attackers to execute arbitrary SQL commands via the (1) graph_start, (2) graph_end, (3) graph_height, (4) graph_width, (5) graph_nolegend, (6) print_source, (7) local_graph_id, or (8) rra_id parameter.","debianbug":743565,"scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"1.2.24+ds1-1+deb12u5","bookworm-security":"1.2.24+ds1-1+deb12u5"},"fixed_version":"0.8.8b+dfsg-4","urgency":"not yet assigned"},"bullseye":{"status":"resolved","repositories":{"bullseye":"1.2.16+ds1-2+deb11u3","bullseye-security":"1.2.16+ds1-2+deb11u5"},"fixed_version":"0.8.8b+dfsg-4","urgency":"not yet assigned"},"forky":{"status":"resolved","repositories":{"forky":"1.2.30+ds1-1"},"fixed_version":"0.8.8b+dfsg-4","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"1.2.30+ds1-1"},"fixed_version":"0.8.8b+dfsg-4","urgency":"not yet assigned"},"trixie":{"status":"resolved","repositories":{"trixie":"1.2.30+ds1-1"},"fixed_version":"0.8.8b+dfsg-4","urgency":"not yet assigned"}}},"CVE-2014-2709":{"description":"lib/rrd.php in Cacti 0.8.7g, 0.8.8b, and earlier allows remote attackers to execute arbitrary commands via shell metacharacters in unspecified parameters.","debianbug":743565,"scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"1.2.24+ds1-1+deb12u5","bookworm-security":"1.2.24+ds1-1+deb12u5"},"fixed_version":"0.8.8b+dfsg-4","urgency":"not yet assigned"},"bullseye":{"status":"resolved","repositories":{"bullseye":"1.2.16+ds1-2+deb11u3","bullseye-security":"1.2.16+ds1-2+deb11u5"},"fixed_version":"0.8.8b+dfsg-4","urgency":"not yet assigned"},"forky":{"status":"resolved","repositories":{"forky":"1.2.30+ds1-1"},"fixed_version":"0.8.8b+dfsg-4","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"1.2.30+ds1-1"},"fixed_version":"0.8.8b+dfsg-4","urgency":"not yet assigned"},"trixie":{"status":"resolved","repositories":{"trixie":"1.2.30+ds1-1"},"fixed_version":"0.8.8b+dfsg-4","urgency":"not yet assigned"}}},"CVE-2014-4000":{"description":"Cacti before 1.0.0 allows remote authenticated users to conduct PHP object injection attacks and execute arbitrary PHP code via a crafted serialized object, related to calling unserialize(stripslashes()).","scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"1.2.24+ds1-1+deb12u5","bookworm-security":"1.2.24+ds1-1+deb12u5"},"fixed_version":"0.8.8e+ds1-1","urgency":"low"},"bullseye":{"status":"resolved","repositories":{"bullseye":"1.2.16+ds1-2+deb11u3","bullseye-security":"1.2.16+ds1-2+deb11u5"},"fixed_version":"0.8.8e+ds1-1","urgency":"low"},"forky":{"status":"resolved","repositories":{"forky":"1.2.30+ds1-1"},"fixed_version":"0.8.8e+ds1-1","urgency":"low"},"sid":{"status":"resolved","repositories":{"sid":"1.2.30+ds1-1"},"fixed_version":"0.8.8e+ds1-1","urgency":"low"},"trixie":{"status":"resolved","repositories":{"trixie":"1.2.30+ds1-1"},"fixed_version":"0.8.8e+ds1-1","urgency":"low"}}},"CVE-2014-4002":{"description":"Multiple cross-site scripting (XSS) vulnerabilities in Cacti 0.8.8b allow remote attackers to inject arbitrary web script or HTML via the (1) drp_action parameter to cdef.php, (2) data_input.php, (3) data_queries.php, (4) data_sources.php, (5) data_templates.php, (6) graph_templates.php, (7) graphs.php, (8) host.php, or (9) host_templates.php or the (10) graph_template_input_id or (11) graph_template_id parameter to graph_templates_inputs.php.","debianbug":752573,"scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"1.2.24+ds1-1+deb12u5","bookworm-security":"1.2.24+ds1-1+deb12u5"},"fixed_version":"0.8.8b+dfsg-6","urgency":"not yet assigned"},"bullseye":{"status":"resolved","repositories":{"bullseye":"1.2.16+ds1-2+deb11u3","bullseye-security":"1.2.16+ds1-2+deb11u5"},"fixed_version":"0.8.8b+dfsg-6","urgency":"not yet assigned"},"forky":{"status":"resolved","repositories":{"forky":"1.2.30+ds1-1"},"fixed_version":"0.8.8b+dfsg-6","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"1.2.30+ds1-1"},"fixed_version":"0.8.8b+dfsg-6","urgency":"not yet assigned"},"trixie":{"status":"resolved","repositories":{"trixie":"1.2.30+ds1-1"},"fixed_version":"0.8.8b+dfsg-6","urgency":"not yet assigned"}}},"CVE-2014-5025":{"description":"Cross-site scripting (XSS) vulnerability in data_sources.php in Cacti 0.8.8b allows remote authenticated users with console access to inject arbitrary web script or HTML via the name_cache parameter in a ds_edit action.","scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"1.2.24+ds1-1+deb12u5","bookworm-security":"1.2.24+ds1-1+deb12u5"},"fixed_version":"0.8.8b+dfsg-7","urgency":"not yet assigned"},"bullseye":{"status":"resolved","repositories":{"bullseye":"1.2.16+ds1-2+deb11u3","bullseye-security":"1.2.16+ds1-2+deb11u5"},"fixed_version":"0.8.8b+dfsg-7","urgency":"not yet assigned"},"forky":{"status":"resolved","repositories":{"forky":"1.2.30+ds1-1"},"fixed_version":"0.8.8b+dfsg-7","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"1.2.30+ds1-1"},"fixed_version":"0.8.8b+dfsg-7","urgency":"not yet assigned"},"trixie":{"status":"resolved","repositories":{"trixie":"1.2.30+ds1-1"},"fixed_version":"0.8.8b+dfsg-7","urgency":"not yet assigned"}}},"CVE-2014-5026":{"description":"Multiple cross-site scripting (XSS) vulnerabilities in Cacti 0.8.8b allow remote authenticated users with console access to inject arbitrary web script or HTML via a (1) Graph Tree Title in a delete or (2) edit action; (3) CDEF Name, (4) Data Input Method Name, or (5) Host Templates Name in a delete action; (6) Data Source Title; (7) Graph Title; or (8) Graph Template Name in a delete or (9) duplicate action.","scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"1.2.24+ds1-1+deb12u5","bookworm-security":"1.2.24+ds1-1+deb12u5"},"fixed_version":"0.8.8b+dfsg-7","urgency":"not yet assigned"},"bullseye":{"status":"resolved","repositories":{"bullseye":"1.2.16+ds1-2+deb11u3","bullseye-security":"1.2.16+ds1-2+deb11u5"},"fixed_version":"0.8.8b+dfsg-7","urgency":"not yet assigned"},"forky":{"status":"resolved","repositories":{"forky":"1.2.30+ds1-1"},"fixed_version":"0.8.8b+dfsg-7","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"1.2.30+ds1-1"},"fixed_version":"0.8.8b+dfsg-7","urgency":"not yet assigned"},"trixie":{"status":"resolved","repositories":{"trixie":"1.2.30+ds1-1"},"fixed_version":"0.8.8b+dfsg-7","urgency":"not yet assigned"}}},"CVE-2014-5261":{"description":"The graph settings script (graph_settings.php) in Cacti 0.8.8b and earlier allows remote attackers to execute arbitrary commands via shell metacharacters in a font size, related to the rrdtool commandline in lib/rrd.php.","scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"1.2.24+ds1-1+deb12u5","bookworm-security":"1.2.24+ds1-1+deb12u5"},"fixed_version":"0.8.8b+dfsg-8","urgency":"not yet assigned"},"bullseye":{"status":"resolved","repositories":{"bullseye":"1.2.16+ds1-2+deb11u3","bullseye-security":"1.2.16+ds1-2+deb11u5"},"fixed_version":"0.8.8b+dfsg-8","urgency":"not yet assigned"},"forky":{"status":"resolved","repositories":{"forky":"1.2.30+ds1-1"},"fixed_version":"0.8.8b+dfsg-8","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"1.2.30+ds1-1"},"fixed_version":"0.8.8b+dfsg-8","urgency":"not yet assigned"},"trixie":{"status":"resolved","repositories":{"trixie":"1.2.30+ds1-1"},"fixed_version":"0.8.8b+dfsg-8","urgency":"not yet assigned"}}},"CVE-2014-5262":{"description":"SQL injection vulnerability in the graph settings script (graph_settings.php) in Cacti 0.8.8b and earlier allows remote attackers to execute arbitrary SQL commands via unspecified vectors.","scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"1.2.24+ds1-1+deb12u5","bookworm-security":"1.2.24+ds1-1+deb12u5"},"fixed_version":"0.8.8b+dfsg-8","urgency":"not yet assigned"},"bullseye":{"status":"resolved","repositories":{"bullseye":"1.2.16+ds1-2+deb11u3","bullseye-security":"1.2.16+ds1-2+deb11u5"},"fixed_version":"0.8.8b+dfsg-8","urgency":"not yet assigned"},"forky":{"status":"resolved","repositories":{"forky":"1.2.30+ds1-1"},"fixed_version":"0.8.8b+dfsg-8","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"1.2.30+ds1-1"},"fixed_version":"0.8.8b+dfsg-8","urgency":"not yet assigned"},"trixie":{"status":"resolved","repositories":{"trixie":"1.2.30+ds1-1"},"fixed_version":"0.8.8b+dfsg-8","urgency":"not yet assigned"}}},"CVE-2015-0916":{"description":"SQL injection vulnerability in graph.php in Cacti before 0.8.6f allows remote authenticated users to execute arbitrary SQL commands via the local_graph_id parameter, a different vulnerability than CVE-2007-6035.","scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"1.2.24+ds1-1+deb12u5","bookworm-security":"1.2.24+ds1-1+deb12u5"},"fixed_version":"0.8.6f-1","urgency":"not yet assigned"},"bullseye":{"status":"resolved","repositories":{"bullseye":"1.2.16+ds1-2+deb11u3","bullseye-security":"1.2.16+ds1-2+deb11u5"},"fixed_version":"0.8.6f-1","urgency":"not yet assigned"},"forky":{"status":"resolved","repositories":{"forky":"1.2.30+ds1-1"},"fixed_version":"0.8.6f-1","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"1.2.30+ds1-1"},"fixed_version":"0.8.6f-1","urgency":"not yet assigned"},"trixie":{"status":"resolved","repositories":{"trixie":"1.2.30+ds1-1"},"fixed_version":"0.8.6f-1","urgency":"not yet assigned"}}},"CVE-2015-2665":{"description":"Cross-site scripting (XSS) vulnerability in Cacti before 0.8.8d allows remote attackers to inject arbitrary web script or HTML via unspecified vectors.","scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"1.2.24+ds1-1+deb12u5","bookworm-security":"1.2.24+ds1-1+deb12u5"},"fixed_version":"0.8.8d+ds1-1","urgency":"not yet assigned"},"bullseye":{"status":"resolved","repositories":{"bullseye":"1.2.16+ds1-2+deb11u3","bullseye-security":"1.2.16+ds1-2+deb11u5"},"fixed_version":"0.8.8d+ds1-1","urgency":"not yet assigned"},"forky":{"status":"resolved","repositories":{"forky":"1.2.30+ds1-1"},"fixed_version":"0.8.8d+ds1-1","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"1.2.30+ds1-1"},"fixed_version":"0.8.8d+ds1-1","urgency":"not yet assigned"},"trixie":{"status":"resolved","repositories":{"trixie":"1.2.30+ds1-1"},"fixed_version":"0.8.8d+ds1-1","urgency":"not yet assigned"}}},"CVE-2015-2967":{"description":"Cross-site scripting (XSS) vulnerability in settings.php in Cacti before 0.8.8d allows remote attackers to inject arbitrary web script or HTML via unspecified vectors.","scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"1.2.24+ds1-1+deb12u5","bookworm-security":"1.2.24+ds1-1+deb12u5"},"fixed_version":"0.8.8d+ds1-1","urgency":"not yet assigned"},"bullseye":{"status":"resolved","repositories":{"bullseye":"1.2.16+ds1-2+deb11u3","bullseye-security":"1.2.16+ds1-2+deb11u5"},"fixed_version":"0.8.8d+ds1-1","urgency":"not yet assigned"},"forky":{"status":"resolved","repositories":{"forky":"1.2.30+ds1-1"},"fixed_version":"0.8.8d+ds1-1","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"1.2.30+ds1-1"},"fixed_version":"0.8.8d+ds1-1","urgency":"not yet assigned"},"trixie":{"status":"resolved","repositories":{"trixie":"1.2.30+ds1-1"},"fixed_version":"0.8.8d+ds1-1","urgency":"not yet assigned"}}},"CVE-2015-4342":{"description":"SQL injection vulnerability in Cacti before 0.8.8d allows remote attackers to execute arbitrary SQL commands via unspecified vectors involving a cdef id.","scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"1.2.24+ds1-1+deb12u5","bookworm-security":"1.2.24+ds1-1+deb12u5"},"fixed_version":"0.8.8d+ds1-1","urgency":"not yet assigned"},"bullseye":{"status":"resolved","repositories":{"bullseye":"1.2.16+ds1-2+deb11u3","bullseye-security":"1.2.16+ds1-2+deb11u5"},"fixed_version":"0.8.8d+ds1-1","urgency":"not yet assigned"},"forky":{"status":"resolved","repositories":{"forky":"1.2.30+ds1-1"},"fixed_version":"0.8.8d+ds1-1","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"1.2.30+ds1-1"},"fixed_version":"0.8.8d+ds1-1","urgency":"not yet assigned"},"trixie":{"status":"resolved","repositories":{"trixie":"1.2.30+ds1-1"},"fixed_version":"0.8.8d+ds1-1","urgency":"not yet assigned"}}},"CVE-2015-4454":{"description":"SQL injection vulnerability in the get_hash_graph_template function in lib/functions.php in Cacti before 0.8.8d allows remote attackers to execute arbitrary SQL commands via the graph_template_id parameter to graph_templates.php.","scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"1.2.24+ds1-1+deb12u5","bookworm-security":"1.2.24+ds1-1+deb12u5"},"fixed_version":"0.8.8d+ds1-1","urgency":"not yet assigned"},"bullseye":{"status":"resolved","repositories":{"bullseye":"1.2.16+ds1-2+deb11u3","bullseye-security":"1.2.16+ds1-2+deb11u5"},"fixed_version":"0.8.8d+ds1-1","urgency":"not yet assigned"},"forky":{"status":"resolved","repositories":{"forky":"1.2.30+ds1-1"},"fixed_version":"0.8.8d+ds1-1","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"1.2.30+ds1-1"},"fixed_version":"0.8.8d+ds1-1","urgency":"not yet assigned"},"trixie":{"status":"resolved","repositories":{"trixie":"1.2.30+ds1-1"},"fixed_version":"0.8.8d+ds1-1","urgency":"not yet assigned"}}},"CVE-2015-4634":{"description":"SQL injection vulnerability in graphs.php in Cacti before 0.8.8e allows remote attackers to execute arbitrary SQL commands via the local_graph_id parameter.","scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"1.2.24+ds1-1+deb12u5","bookworm-security":"1.2.24+ds1-1+deb12u5"},"fixed_version":"0.8.8e+ds1-1","urgency":"not yet assigned"},"bullseye":{"status":"resolved","repositories":{"bullseye":"1.2.16+ds1-2+deb11u3","bullseye-security":"1.2.16+ds1-2+deb11u5"},"fixed_version":"0.8.8e+ds1-1","urgency":"not yet assigned"},"forky":{"status":"resolved","repositories":{"forky":"1.2.30+ds1-1"},"fixed_version":"0.8.8e+ds1-1","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"1.2.30+ds1-1"},"fixed_version":"0.8.8e+ds1-1","urgency":"not yet assigned"},"trixie":{"status":"resolved","repositories":{"trixie":"1.2.30+ds1-1"},"fixed_version":"0.8.8e+ds1-1","urgency":"not yet assigned"}}},"CVE-2015-8369":{"description":"SQL injection vulnerability in include/top_graph_header.php in Cacti 0.8.8f and earlier allows remote attackers to execute arbitrary SQL commands via the rra_id parameter in a properties action to graph.php.","debianbug":807599,"scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"1.2.24+ds1-1+deb12u5","bookworm-security":"1.2.24+ds1-1+deb12u5"},"fixed_version":"0.8.8f+ds1-3","urgency":"not yet assigned"},"bullseye":{"status":"resolved","repositories":{"bullseye":"1.2.16+ds1-2+deb11u3","bullseye-security":"1.2.16+ds1-2+deb11u5"},"fixed_version":"0.8.8f+ds1-3","urgency":"not yet assigned"},"forky":{"status":"resolved","repositories":{"forky":"1.2.30+ds1-1"},"fixed_version":"0.8.8f+ds1-3","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"1.2.30+ds1-1"},"fixed_version":"0.8.8f+ds1-3","urgency":"not yet assigned"},"trixie":{"status":"resolved","repositories":{"trixie":"1.2.30+ds1-1"},"fixed_version":"0.8.8f+ds1-3","urgency":"not yet assigned"}}},"CVE-2015-8377":{"description":"SQL injection vulnerability in the host_new_graphs_save function in graphs_new.php in Cacti 0.8.8f and earlier allows remote authenticated users to execute arbitrary SQL commands via crafted serialized data in the selected_graphs_array parameter in a save action.","scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"1.2.24+ds1-1+deb12u5","bookworm-security":"1.2.24+ds1-1+deb12u5"},"fixed_version":"0.8.8f+ds1-4","urgency":"not yet assigned"},"bullseye":{"status":"resolved","repositories":{"bullseye":"1.2.16+ds1-2+deb11u3","bullseye-security":"1.2.16+ds1-2+deb11u5"},"fixed_version":"0.8.8f+ds1-4","urgency":"not yet assigned"},"forky":{"status":"resolved","repositories":{"forky":"1.2.30+ds1-1"},"fixed_version":"0.8.8f+ds1-4","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"1.2.30+ds1-1"},"fixed_version":"0.8.8f+ds1-4","urgency":"not yet assigned"},"trixie":{"status":"resolved","repositories":{"trixie":"1.2.30+ds1-1"},"fixed_version":"0.8.8f+ds1-4","urgency":"not yet assigned"}}},"CVE-2015-8604":{"description":"SQL injection vulnerability in the host_new_graphs function in graphs_new.php in Cacti 0.8.8f and earlier allows remote authenticated users to execute arbitrary SQL commands via the cg_g parameter in a save action.","scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"1.2.24+ds1-1+deb12u5","bookworm-security":"1.2.24+ds1-1+deb12u5"},"fixed_version":"0.8.8f+ds1-4","urgency":"not yet assigned"},"bullseye":{"status":"resolved","repositories":{"bullseye":"1.2.16+ds1-2+deb11u3","bullseye-security":"1.2.16+ds1-2+deb11u5"},"fixed_version":"0.8.8f+ds1-4","urgency":"not yet assigned"},"forky":{"status":"resolved","repositories":{"forky":"1.2.30+ds1-1"},"fixed_version":"0.8.8f+ds1-4","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"1.2.30+ds1-1"},"fixed_version":"0.8.8f+ds1-4","urgency":"not yet assigned"},"trixie":{"status":"resolved","repositories":{"trixie":"1.2.30+ds1-1"},"fixed_version":"0.8.8f+ds1-4","urgency":"not yet assigned"}}},"CVE-2016-10700":{"description":"auth_login.php in Cacti before 1.0.0 allows remote authenticated users who use web authentication to bypass intended access restrictions by logging in as a user not in the cacti database, because the guest user is not considered. NOTE: this vulnerability exists because of an incomplete fix for CVE-2016-2313.","debianbug":833420,"scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"1.2.24+ds1-1+deb12u5","bookworm-security":"1.2.24+ds1-1+deb12u5"},"fixed_version":"0.8.8h+ds1-5","urgency":"not yet assigned"},"bullseye":{"status":"resolved","repositories":{"bullseye":"1.2.16+ds1-2+deb11u3","bullseye-security":"1.2.16+ds1-2+deb11u5"},"fixed_version":"0.8.8h+ds1-5","urgency":"not yet assigned"},"forky":{"status":"resolved","repositories":{"forky":"1.2.30+ds1-1"},"fixed_version":"0.8.8h+ds1-5","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"1.2.30+ds1-1"},"fixed_version":"0.8.8h+ds1-5","urgency":"not yet assigned"},"trixie":{"status":"resolved","repositories":{"trixie":"1.2.30+ds1-1"},"fixed_version":"0.8.8h+ds1-5","urgency":"not yet assigned"}}},"CVE-2016-2313":{"description":"auth_login.php in Cacti before 0.8.8g allows remote authenticated users who use web authentication to bypass intended access restrictions by logging in as a user not in the cacti database.","debianbug":814353,"scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"1.2.24+ds1-1+deb12u5","bookworm-security":"1.2.24+ds1-1+deb12u5"},"fixed_version":"0.8.8g+ds1-1","urgency":"not yet assigned"},"bullseye":{"status":"resolved","repositories":{"bullseye":"1.2.16+ds1-2+deb11u3","bullseye-security":"1.2.16+ds1-2+deb11u5"},"fixed_version":"0.8.8g+ds1-1","urgency":"not yet assigned"},"forky":{"status":"resolved","repositories":{"forky":"1.2.30+ds1-1"},"fixed_version":"0.8.8g+ds1-1","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"1.2.30+ds1-1"},"fixed_version":"0.8.8g+ds1-1","urgency":"not yet assigned"},"trixie":{"status":"resolved","repositories":{"trixie":"1.2.30+ds1-1"},"fixed_version":"0.8.8g+ds1-1","urgency":"not yet assigned"}}},"CVE-2016-3172":{"description":"SQL injection vulnerability in tree.php in Cacti 0.8.8g and earlier allows remote authenticated users to execute arbitrary SQL commands via the parent_id parameter in an item_edit action.","debianbug":818647,"scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"1.2.24+ds1-1+deb12u5","bookworm-security":"1.2.24+ds1-1+deb12u5"},"fixed_version":"0.8.8g+ds1-2","urgency":"not yet assigned"},"bullseye":{"status":"resolved","repositories":{"bullseye":"1.2.16+ds1-2+deb11u3","bullseye-security":"1.2.16+ds1-2+deb11u5"},"fixed_version":"0.8.8g+ds1-2","urgency":"not yet assigned"},"forky":{"status":"resolved","repositories":{"forky":"1.2.30+ds1-1"},"fixed_version":"0.8.8g+ds1-2","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"1.2.30+ds1-1"},"fixed_version":"0.8.8g+ds1-2","urgency":"not yet assigned"},"trixie":{"status":"resolved","repositories":{"trixie":"1.2.30+ds1-1"},"fixed_version":"0.8.8g+ds1-2","urgency":"not yet assigned"}}},"CVE-2016-3659":{"description":"SQL injection vulnerability in graph_view.php in Cacti 0.8.8.g allows remote authenticated users to execute arbitrary SQL commands via the host_group_data parameter.","debianbug":820521,"scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"1.2.24+ds1-1+deb12u5","bookworm-security":"1.2.24+ds1-1+deb12u5"},"fixed_version":"0.8.8h+ds1-1","urgency":"not yet assigned"},"bullseye":{"status":"resolved","repositories":{"bullseye":"1.2.16+ds1-2+deb11u3","bullseye-security":"1.2.16+ds1-2+deb11u5"},"fixed_version":"0.8.8h+ds1-1","urgency":"not yet assigned"},"forky":{"status":"resolved","repositories":{"forky":"1.2.30+ds1-1"},"fixed_version":"0.8.8h+ds1-1","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"1.2.30+ds1-1"},"fixed_version":"0.8.8h+ds1-1","urgency":"not yet assigned"},"trixie":{"status":"resolved","repositories":{"trixie":"1.2.30+ds1-1"},"fixed_version":"0.8.8h+ds1-1","urgency":"not yet assigned"}}},"CVE-2017-1000031":{"description":"SQL injection vulnerability in graph_templates_inputs.php in Cacti 0.8.8b allows remote attackers to execute arbitrary SQL commands via the graph_template_input_id and graph_template_id parameters.","scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"1.2.24+ds1-1+deb12u5","bookworm-security":"1.2.24+ds1-1+deb12u5"},"fixed_version":"0.8.8e+ds1-1","urgency":"not yet assigned"},"bullseye":{"status":"resolved","repositories":{"bullseye":"1.2.16+ds1-2+deb11u3","bullseye-security":"1.2.16+ds1-2+deb11u5"},"fixed_version":"0.8.8e+ds1-1","urgency":"not yet assigned"},"forky":{"status":"resolved","repositories":{"forky":"1.2.30+ds1-1"},"fixed_version":"0.8.8e+ds1-1","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"1.2.30+ds1-1"},"fixed_version":"0.8.8e+ds1-1","urgency":"not yet assigned"},"trixie":{"status":"resolved","repositories":{"trixie":"1.2.30+ds1-1"},"fixed_version":"0.8.8e+ds1-1","urgency":"not yet assigned"}}},"CVE-2017-1000032":{"description":"Cross-Site scripting (XSS) vulnerabilities in Cacti 0.8.8b allow remote attackers to inject arbitrary web script or HTML via the parent_id parameter to tree.php and drp_action parameter to data_sources.php.","scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"1.2.24+ds1-1+deb12u5","bookworm-security":"1.2.24+ds1-1+deb12u5"},"fixed_version":"0.8.8b+dfsg-6","urgency":"not yet assigned"},"bullseye":{"status":"resolved","repositories":{"bullseye":"1.2.16+ds1-2+deb11u3","bullseye-security":"1.2.16+ds1-2+deb11u5"},"fixed_version":"0.8.8b+dfsg-6","urgency":"not yet assigned"},"forky":{"status":"resolved","repositories":{"forky":"1.2.30+ds1-1"},"fixed_version":"0.8.8b+dfsg-6","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"1.2.30+ds1-1"},"fixed_version":"0.8.8b+dfsg-6","urgency":"not yet assigned"},"trixie":{"status":"resolved","repositories":{"trixie":"1.2.30+ds1-1"},"fixed_version":"0.8.8b+dfsg-6","urgency":"not yet assigned"}}},"CVE-2017-10970":{"description":"Cross-site scripting (XSS) vulnerability in link.php in Cacti 1.1.12 allows remote anonymous users to inject arbitrary web script or HTML via the id parameter, related to the die_html_input_error function in lib/html_validate.php.","debianbug":867532,"scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"1.2.24+ds1-1+deb12u5","bookworm-security":"1.2.24+ds1-1+deb12u5"},"fixed_version":"1.1.12+ds1-1","urgency":"not yet assigned"},"bullseye":{"status":"resolved","repositories":{"bullseye":"1.2.16+ds1-2+deb11u3","bullseye-security":"1.2.16+ds1-2+deb11u5"},"fixed_version":"1.1.12+ds1-1","urgency":"not yet assigned"},"forky":{"status":"resolved","repositories":{"forky":"1.2.30+ds1-1"},"fixed_version":"1.1.12+ds1-1","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"1.2.30+ds1-1"},"fixed_version":"1.1.12+ds1-1","urgency":"not yet assigned"},"trixie":{"status":"resolved","repositories":{"trixie":"1.2.30+ds1-1"},"fixed_version":"1.1.12+ds1-1","urgency":"not yet assigned"}}},"CVE-2017-11163":{"description":"Cross-site scripting (XSS) vulnerability in aggregate_graphs.php in Cacti 1.1.12 allows remote authenticated users to inject arbitrary web script or HTML via specially crafted HTTP Referer headers, related to the $cancel_url variable.","debianbug":868080,"scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"1.2.24+ds1-1+deb12u5","bookworm-security":"1.2.24+ds1-1+deb12u5"},"fixed_version":"1.1.12+ds1-1","urgency":"not yet assigned"},"bullseye":{"status":"resolved","repositories":{"bullseye":"1.2.16+ds1-2+deb11u3","bullseye-security":"1.2.16+ds1-2+deb11u5"},"fixed_version":"1.1.12+ds1-1","urgency":"not yet assigned"},"forky":{"status":"resolved","repositories":{"forky":"1.2.30+ds1-1"},"fixed_version":"1.1.12+ds1-1","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"1.2.30+ds1-1"},"fixed_version":"1.1.12+ds1-1","urgency":"not yet assigned"},"trixie":{"status":"resolved","repositories":{"trixie":"1.2.30+ds1-1"},"fixed_version":"1.1.12+ds1-1","urgency":"not yet assigned"}}},"CVE-2017-11691":{"description":"Cross-site scripting (XSS) vulnerability in auth_profile.php in Cacti 1.1.13 allows remote attackers to inject arbitrary web script or HTML via specially crafted HTTP Referer headers.","debianbug":869848,"scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"1.2.24+ds1-1+deb12u5","bookworm-security":"1.2.24+ds1-1+deb12u5"},"fixed_version":"1.1.15+ds1-1","urgency":"not yet assigned"},"bullseye":{"status":"resolved","repositories":{"bullseye":"1.2.16+ds1-2+deb11u3","bullseye-security":"1.2.16+ds1-2+deb11u5"},"fixed_version":"1.1.15+ds1-1","urgency":"not yet assigned"},"forky":{"status":"resolved","repositories":{"forky":"1.2.30+ds1-1"},"fixed_version":"1.1.15+ds1-1","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"1.2.30+ds1-1"},"fixed_version":"1.1.15+ds1-1","urgency":"not yet assigned"},"trixie":{"status":"resolved","repositories":{"trixie":"1.2.30+ds1-1"},"fixed_version":"1.1.15+ds1-1","urgency":"not yet assigned"}}},"CVE-2017-12065":{"description":"spikekill.php in Cacti before 1.1.16 might allow remote attackers to execute arbitrary code via the avgnan, outlier-start, or outlier-end parameter.","debianbug":870353,"scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"1.2.24+ds1-1+deb12u5","bookworm-security":"1.2.24+ds1-1+deb12u5"},"fixed_version":"1.1.16+ds1-1","urgency":"not yet assigned"},"bullseye":{"status":"resolved","repositories":{"bullseye":"1.2.16+ds1-2+deb11u3","bullseye-security":"1.2.16+ds1-2+deb11u5"},"fixed_version":"1.1.16+ds1-1","urgency":"not yet assigned"},"forky":{"status":"resolved","repositories":{"forky":"1.2.30+ds1-1"},"fixed_version":"1.1.16+ds1-1","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"1.2.30+ds1-1"},"fixed_version":"1.1.16+ds1-1","urgency":"not yet assigned"},"trixie":{"status":"resolved","repositories":{"trixie":"1.2.30+ds1-1"},"fixed_version":"1.1.16+ds1-1","urgency":"not yet assigned"}}},"CVE-2017-12066":{"description":"Cross-site scripting (XSS) vulnerability in aggregate_graphs.php in Cacti before 1.1.16 allows remote authenticated users to inject arbitrary web script or HTML via specially crafted HTTP Referer headers, related to the $cancel_url variable. NOTE: this vulnerability exists because of an incomplete fix (lack of the htmlspecialchars ENT_QUOTES flag) for CVE-2017-11163.","debianbug":870354,"scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"1.2.24+ds1-1+deb12u5","bookworm-security":"1.2.24+ds1-1+deb12u5"},"fixed_version":"1.1.16+ds1-1","urgency":"not yet assigned"},"bullseye":{"status":"resolved","repositories":{"bullseye":"1.2.16+ds1-2+deb11u3","bullseye-security":"1.2.16+ds1-2+deb11u5"},"fixed_version":"1.1.16+ds1-1","urgency":"not yet assigned"},"forky":{"status":"resolved","repositories":{"forky":"1.2.30+ds1-1"},"fixed_version":"1.1.16+ds1-1","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"1.2.30+ds1-1"},"fixed_version":"1.1.16+ds1-1","urgency":"not yet assigned"},"trixie":{"status":"resolved","repositories":{"trixie":"1.2.30+ds1-1"},"fixed_version":"1.1.16+ds1-1","urgency":"not yet assigned"}}},"CVE-2017-12927":{"description":"A cross-site scripting vulnerability exists in Cacti 1.1.17 in the method parameter in spikekill.php.","debianbug":872478,"scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"1.2.24+ds1-1+deb12u5","bookworm-security":"1.2.24+ds1-1+deb12u5"},"fixed_version":"1.1.17+ds1-2","urgency":"not yet assigned"},"bullseye":{"status":"resolved","repositories":{"bullseye":"1.2.16+ds1-2+deb11u3","bullseye-security":"1.2.16+ds1-2+deb11u5"},"fixed_version":"1.1.17+ds1-2","urgency":"not yet assigned"},"forky":{"status":"resolved","repositories":{"forky":"1.2.30+ds1-1"},"fixed_version":"1.1.17+ds1-2","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"1.2.30+ds1-1"},"fixed_version":"1.1.17+ds1-2","urgency":"not yet assigned"},"trixie":{"status":"resolved","repositories":{"trixie":"1.2.30+ds1-1"},"fixed_version":"1.1.17+ds1-2","urgency":"not yet assigned"}}},"CVE-2017-12978":{"description":"lib/html.php in Cacti before 1.1.18 has XSS via the title field of an external link added by an authenticated user.","scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"1.2.24+ds1-1+deb12u5","bookworm-security":"1.2.24+ds1-1+deb12u5"},"fixed_version":"1.1.18+ds1-1","urgency":"not yet assigned"},"bullseye":{"status":"resolved","repositories":{"bullseye":"1.2.16+ds1-2+deb11u3","bullseye-security":"1.2.16+ds1-2+deb11u5"},"fixed_version":"1.1.18+ds1-1","urgency":"not yet assigned"},"forky":{"status":"resolved","repositories":{"forky":"1.2.30+ds1-1"},"fixed_version":"1.1.18+ds1-1","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"1.2.30+ds1-1"},"fixed_version":"1.1.18+ds1-1","urgency":"not yet assigned"},"trixie":{"status":"resolved","repositories":{"trixie":"1.2.30+ds1-1"},"fixed_version":"1.1.18+ds1-1","urgency":"not yet assigned"}}},"CVE-2017-15194":{"description":"include/global_session.php in Cacti 1.1.25 has XSS related to (1) the URI or (2) the refresh page.","debianbug":878304,"scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"1.2.24+ds1-1+deb12u5","bookworm-security":"1.2.24+ds1-1+deb12u5"},"fixed_version":"1.1.25+ds1-1","urgency":"not yet assigned"},"bullseye":{"status":"resolved","repositories":{"bullseye":"1.2.16+ds1-2+deb11u3","bullseye-security":"1.2.16+ds1-2+deb11u5"},"fixed_version":"1.1.25+ds1-1","urgency":"not yet assigned"},"forky":{"status":"resolved","repositories":{"forky":"1.2.30+ds1-1"},"fixed_version":"1.1.25+ds1-1","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"1.2.30+ds1-1"},"fixed_version":"1.1.25+ds1-1","urgency":"not yet assigned"},"trixie":{"status":"resolved","repositories":{"trixie":"1.2.30+ds1-1"},"fixed_version":"1.1.25+ds1-1","urgency":"not yet assigned"}}},"CVE-2017-16641":{"description":"lib/rrd.php in Cacti 1.1.27 allows remote authenticated administrators to execute arbitrary OS commands via the path_rrdtool parameter in an action=save request to settings.php.","debianbug":881110,"scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"1.2.24+ds1-1+deb12u5","bookworm-security":"1.2.24+ds1-1+deb12u5"},"fixed_version":"1.1.27+ds1-3","urgency":"not yet assigned"},"bullseye":{"status":"resolved","repositories":{"bullseye":"1.2.16+ds1-2+deb11u3","bullseye-security":"1.2.16+ds1-2+deb11u5"},"fixed_version":"1.1.27+ds1-3","urgency":"not yet assigned"},"forky":{"status":"resolved","repositories":{"forky":"1.2.30+ds1-1"},"fixed_version":"1.1.27+ds1-3","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"1.2.30+ds1-1"},"fixed_version":"1.1.27+ds1-3","urgency":"not yet assigned"},"trixie":{"status":"resolved","repositories":{"trixie":"1.2.30+ds1-1"},"fixed_version":"1.1.27+ds1-3","urgency":"not yet assigned"}}},"CVE-2017-16660":{"description":"Cacti 1.1.27 allows remote authenticated administrators to conduct Remote Code Execution attacks by placing the Log Path under the web root, and then making a remote_agent.php request containing PHP code in a Client-ip header.","scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"1.2.24+ds1-1+deb12u5","bookworm-security":"1.2.24+ds1-1+deb12u5"},"fixed_version":"1.1.27+ds1-3","urgency":"not yet assigned"},"bullseye":{"status":"resolved","repositories":{"bullseye":"1.2.16+ds1-2+deb11u3","bullseye-security":"1.2.16+ds1-2+deb11u5"},"fixed_version":"1.1.27+ds1-3","urgency":"not yet assigned"},"forky":{"status":"resolved","repositories":{"forky":"1.2.30+ds1-1"},"fixed_version":"1.1.27+ds1-3","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"1.2.30+ds1-1"},"fixed_version":"1.1.27+ds1-3","urgency":"not yet assigned"},"trixie":{"status":"resolved","repositories":{"trixie":"1.2.30+ds1-1"},"fixed_version":"1.1.27+ds1-3","urgency":"not yet assigned"}}},"CVE-2017-16661":{"description":"Cacti 1.1.27 allows remote authenticated administrators to read arbitrary files by placing the Log Path into a private directory, and then making a clog.php?filename= request, as demonstrated by filename=passwd (with a Log Path under /etc) to read /etc/passwd.","scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"1.2.24+ds1-1+deb12u5","bookworm-security":"1.2.24+ds1-1+deb12u5"},"fixed_version":"1.1.27+ds1-3","urgency":"not yet assigned"},"bullseye":{"status":"resolved","repositories":{"bullseye":"1.2.16+ds1-2+deb11u3","bullseye-security":"1.2.16+ds1-2+deb11u5"},"fixed_version":"1.1.27+ds1-3","urgency":"not yet assigned"},"forky":{"status":"resolved","repositories":{"forky":"1.2.30+ds1-1"},"fixed_version":"1.1.27+ds1-3","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"1.2.30+ds1-1"},"fixed_version":"1.1.27+ds1-3","urgency":"not yet assigned"},"trixie":{"status":"resolved","repositories":{"trixie":"1.2.30+ds1-1"},"fixed_version":"1.1.27+ds1-3","urgency":"not yet assigned"}}},"CVE-2017-16785":{"description":"Cacti 1.1.27 has reflected XSS via the PATH_INFO to host.php.","scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"1.2.24+ds1-1+deb12u5","bookworm-security":"1.2.24+ds1-1+deb12u5"},"fixed_version":"1.1.27+ds1-3","urgency":"not yet assigned"},"bullseye":{"status":"resolved","repositories":{"bullseye":"1.2.16+ds1-2+deb11u3","bullseye-security":"1.2.16+ds1-2+deb11u5"},"fixed_version":"1.1.27+ds1-3","urgency":"not yet assigned"},"forky":{"status":"resolved","repositories":{"forky":"1.2.30+ds1-1"},"fixed_version":"1.1.27+ds1-3","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"1.2.30+ds1-1"},"fixed_version":"1.1.27+ds1-3","urgency":"not yet assigned"},"trixie":{"status":"resolved","repositories":{"trixie":"1.2.30+ds1-1"},"fixed_version":"1.1.27+ds1-3","urgency":"not yet assigned"}}},"CVE-2018-10059":{"description":"Cacti before 1.1.37 has XSS because the get_current_page function in lib/functions.php relies on $_SERVER['PHP_SELF'] instead of $_SERVER['SCRIPT_NAME'] to determine a page name.","scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"1.2.24+ds1-1+deb12u5","bookworm-security":"1.2.24+ds1-1+deb12u5"},"fixed_version":"1.1.37+ds1-1","urgency":"not yet assigned"},"bullseye":{"status":"resolved","repositories":{"bullseye":"1.2.16+ds1-2+deb11u3","bullseye-security":"1.2.16+ds1-2+deb11u5"},"fixed_version":"1.1.37+ds1-1","urgency":"not yet assigned"},"forky":{"status":"resolved","repositories":{"forky":"1.2.30+ds1-1"},"fixed_version":"1.1.37+ds1-1","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"1.2.30+ds1-1"},"fixed_version":"1.1.37+ds1-1","urgency":"not yet assigned"},"trixie":{"status":"resolved","repositories":{"trixie":"1.2.30+ds1-1"},"fixed_version":"1.1.37+ds1-1","urgency":"not yet assigned"}}},"CVE-2018-10060":{"description":"Cacti before 1.1.37 has XSS because it does not properly reject unintended characters, related to use of the sanitize_uri function in lib/functions.php.","scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"1.2.24+ds1-1+deb12u5","bookworm-security":"1.2.24+ds1-1+deb12u5"},"fixed_version":"1.1.37+ds1-1","urgency":"low"},"bullseye":{"status":"resolved","repositories":{"bullseye":"1.2.16+ds1-2+deb11u3","bullseye-security":"1.2.16+ds1-2+deb11u5"},"fixed_version":"1.1.37+ds1-1","urgency":"low"},"forky":{"status":"resolved","repositories":{"forky":"1.2.30+ds1-1"},"fixed_version":"1.1.37+ds1-1","urgency":"low"},"sid":{"status":"resolved","repositories":{"sid":"1.2.30+ds1-1"},"fixed_version":"1.1.37+ds1-1","urgency":"low"},"trixie":{"status":"resolved","repositories":{"trixie":"1.2.30+ds1-1"},"fixed_version":"1.1.37+ds1-1","urgency":"low"}}},"CVE-2018-10061":{"description":"Cacti before 1.1.37 has XSS because it makes certain htmlspecialchars calls without the ENT_QUOTES flag (these calls occur when the html_escape function in lib/html.php is not used).","scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"1.2.24+ds1-1+deb12u5","bookworm-security":"1.2.24+ds1-1+deb12u5"},"fixed_version":"1.1.37+ds1-1","urgency":"low"},"bullseye":{"status":"resolved","repositories":{"bullseye":"1.2.16+ds1-2+deb11u3","bullseye-security":"1.2.16+ds1-2+deb11u5"},"fixed_version":"1.1.37+ds1-1","urgency":"low"},"forky":{"status":"resolved","repositories":{"forky":"1.2.30+ds1-1"},"fixed_version":"1.1.37+ds1-1","urgency":"low"},"sid":{"status":"resolved","repositories":{"sid":"1.2.30+ds1-1"},"fixed_version":"1.1.37+ds1-1","urgency":"low"},"trixie":{"status":"resolved","repositories":{"trixie":"1.2.30+ds1-1"},"fixed_version":"1.1.37+ds1-1","urgency":"low"}}},"CVE-2018-20723":{"description":"A cross-site scripting (XSS) vulnerability exists in color_templates.php in Cacti before 1.2.0 due to lack of escaping of unintended characters in the Name field for a Color.","scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"1.2.24+ds1-1+deb12u5","bookworm-security":"1.2.24+ds1-1+deb12u5"},"fixed_version":"1.2.1+ds1-1","urgency":"low"},"bullseye":{"status":"resolved","repositories":{"bullseye":"1.2.16+ds1-2+deb11u3","bullseye-security":"1.2.16+ds1-2+deb11u5"},"fixed_version":"1.2.1+ds1-1","urgency":"low"},"forky":{"status":"resolved","repositories":{"forky":"1.2.30+ds1-1"},"fixed_version":"1.2.1+ds1-1","urgency":"low"},"sid":{"status":"resolved","repositories":{"sid":"1.2.30+ds1-1"},"fixed_version":"1.2.1+ds1-1","urgency":"low"},"trixie":{"status":"resolved","repositories":{"trixie":"1.2.30+ds1-1"},"fixed_version":"1.2.1+ds1-1","urgency":"low"}}},"CVE-2018-20724":{"description":"A cross-site scripting (XSS) vulnerability exists in pollers.php in Cacti before 1.2.0 due to lack of escaping of unintended characters in the Website Hostname for Data Collectors.","scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"1.2.24+ds1-1+deb12u5","bookworm-security":"1.2.24+ds1-1+deb12u5"},"fixed_version":"1.2.1+ds1-1","urgency":"low"},"bullseye":{"status":"resolved","repositories":{"bullseye":"1.2.16+ds1-2+deb11u3","bullseye-security":"1.2.16+ds1-2+deb11u5"},"fixed_version":"1.2.1+ds1-1","urgency":"low"},"forky":{"status":"resolved","repositories":{"forky":"1.2.30+ds1-1"},"fixed_version":"1.2.1+ds1-1","urgency":"low"},"sid":{"status":"resolved","repositories":{"sid":"1.2.30+ds1-1"},"fixed_version":"1.2.1+ds1-1","urgency":"low"},"trixie":{"status":"resolved","repositories":{"trixie":"1.2.30+ds1-1"},"fixed_version":"1.2.1+ds1-1","urgency":"low"}}},"CVE-2018-20725":{"description":"A cross-site scripting (XSS) vulnerability exists in graph_templates.php in Cacti before 1.2.0 due to lack of escaping of unintended characters in the Graph Vertical Label.","scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"1.2.24+ds1-1+deb12u5","bookworm-security":"1.2.24+ds1-1+deb12u5"},"fixed_version":"1.2.1+ds1-1","urgency":"low"},"bullseye":{"status":"resolved","repositories":{"bullseye":"1.2.16+ds1-2+deb11u3","bullseye-security":"1.2.16+ds1-2+deb11u5"},"fixed_version":"1.2.1+ds1-1","urgency":"low"},"forky":{"status":"resolved","repositories":{"forky":"1.2.30+ds1-1"},"fixed_version":"1.2.1+ds1-1","urgency":"low"},"sid":{"status":"resolved","repositories":{"sid":"1.2.30+ds1-1"},"fixed_version":"1.2.1+ds1-1","urgency":"low"},"trixie":{"status":"resolved","repositories":{"trixie":"1.2.30+ds1-1"},"fixed_version":"1.2.1+ds1-1","urgency":"low"}}},"CVE-2018-20726":{"description":"A cross-site scripting (XSS) vulnerability exists in host.php (via tree.php) in Cacti before 1.2.0 due to lack of escaping of unintended characters in the Website Hostname field for Devices.","scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"1.2.24+ds1-1+deb12u5","bookworm-security":"1.2.24+ds1-1+deb12u5"},"fixed_version":"1.2.1+ds1-1","urgency":"low"},"bullseye":{"status":"resolved","repositories":{"bullseye":"1.2.16+ds1-2+deb11u3","bullseye-security":"1.2.16+ds1-2+deb11u5"},"fixed_version":"1.2.1+ds1-1","urgency":"low"},"forky":{"status":"resolved","repositories":{"forky":"1.2.30+ds1-1"},"fixed_version":"1.2.1+ds1-1","urgency":"low"},"sid":{"status":"resolved","repositories":{"sid":"1.2.30+ds1-1"},"fixed_version":"1.2.1+ds1-1","urgency":"low"},"trixie":{"status":"resolved","repositories":{"trixie":"1.2.30+ds1-1"},"fixed_version":"1.2.1+ds1-1","urgency":"low"}}},"CVE-2019-11025":{"description":"In clearFilter() in utilities.php in Cacti before 1.2.3, no escaping occurs before printing out the value of the SNMP community string (SNMP Options) in the View poller cache, leading to XSS.","debianbug":926700,"scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"1.2.24+ds1-1+deb12u5","bookworm-security":"1.2.24+ds1-1+deb12u5"},"fixed_version":"1.2.2+ds1-2","urgency":"low"},"bullseye":{"status":"resolved","repositories":{"bullseye":"1.2.16+ds1-2+deb11u3","bullseye-security":"1.2.16+ds1-2+deb11u5"},"fixed_version":"1.2.2+ds1-2","urgency":"low"},"forky":{"status":"resolved","repositories":{"forky":"1.2.30+ds1-1"},"fixed_version":"1.2.2+ds1-2","urgency":"low"},"sid":{"status":"resolved","repositories":{"sid":"1.2.30+ds1-1"},"fixed_version":"1.2.2+ds1-2","urgency":"low"},"trixie":{"status":"resolved","repositories":{"trixie":"1.2.30+ds1-1"},"fixed_version":"1.2.2+ds1-2","urgency":"low"}}},"CVE-2019-16723":{"description":"In Cacti through 1.2.6, authenticated users may bypass authorization checks (for viewing a graph) via a direct graph_json.php request with a modified local_graph_id parameter.","debianbug":941036,"scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"1.2.24+ds1-1+deb12u5","bookworm-security":"1.2.24+ds1-1+deb12u5"},"fixed_version":"1.2.7+ds1-1","urgency":"not yet assigned"},"bullseye":{"status":"resolved","repositories":{"bullseye":"1.2.16+ds1-2+deb11u3","bullseye-security":"1.2.16+ds1-2+deb11u5"},"fixed_version":"1.2.7+ds1-1","urgency":"not yet assigned"},"forky":{"status":"resolved","repositories":{"forky":"1.2.30+ds1-1"},"fixed_version":"1.2.7+ds1-1","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"1.2.30+ds1-1"},"fixed_version":"1.2.7+ds1-1","urgency":"not yet assigned"},"trixie":{"status":"resolved","repositories":{"trixie":"1.2.30+ds1-1"},"fixed_version":"1.2.7+ds1-1","urgency":"not yet assigned"}}},"CVE-2019-17357":{"description":"Cacti through 1.2.7 is affected by a graphs.php?template_id= SQL injection vulnerability affecting how template identifiers are handled when a string and id composite value are used to identify the template type and id. An authenticated attacker can exploit this to extract data from the database, or an unauthenticated remote attacker could exploit this via Cross-Site Request Forgery.","debianbug":947374,"scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"1.2.24+ds1-1+deb12u5","bookworm-security":"1.2.24+ds1-1+deb12u5"},"fixed_version":"1.2.8+ds1-1","urgency":"not yet assigned"},"bullseye":{"status":"resolved","repositories":{"bullseye":"1.2.16+ds1-2+deb11u3","bullseye-security":"1.2.16+ds1-2+deb11u5"},"fixed_version":"1.2.8+ds1-1","urgency":"not yet assigned"},"forky":{"status":"resolved","repositories":{"forky":"1.2.30+ds1-1"},"fixed_version":"1.2.8+ds1-1","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"1.2.30+ds1-1"},"fixed_version":"1.2.8+ds1-1","urgency":"not yet assigned"},"trixie":{"status":"resolved","repositories":{"trixie":"1.2.30+ds1-1"},"fixed_version":"1.2.8+ds1-1","urgency":"not yet assigned"}}},"CVE-2019-17358":{"description":"Cacti through 1.2.7 is affected by multiple instances of lib/functions.php unsafe deserialization of user-controlled data to populate arrays. An authenticated attacker could use this to influence object data values and control actions taken by Cacti or potentially cause memory corruption in the PHP module.","debianbug":947375,"scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"1.2.24+ds1-1+deb12u5","bookworm-security":"1.2.24+ds1-1+deb12u5"},"fixed_version":"1.2.8+ds1-1","urgency":"not yet assigned"},"bullseye":{"status":"resolved","repositories":{"bullseye":"1.2.16+ds1-2+deb11u3","bullseye-security":"1.2.16+ds1-2+deb11u5"},"fixed_version":"1.2.8+ds1-1","urgency":"not yet assigned"},"forky":{"status":"resolved","repositories":{"forky":"1.2.30+ds1-1"},"fixed_version":"1.2.8+ds1-1","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"1.2.30+ds1-1"},"fixed_version":"1.2.8+ds1-1","urgency":"not yet assigned"},"trixie":{"status":"resolved","repositories":{"trixie":"1.2.30+ds1-1"},"fixed_version":"1.2.8+ds1-1","urgency":"not yet assigned"}}},"CVE-2020-13230":{"description":"In Cacti before 1.2.11, disabling a user account does not immediately invalidate any permissions granted to that account (e.g., permission to view logs).","scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"1.2.24+ds1-1+deb12u5","bookworm-security":"1.2.24+ds1-1+deb12u5"},"fixed_version":"1.2.11+ds1-1","urgency":"not yet assigned"},"bullseye":{"status":"resolved","repositories":{"bullseye":"1.2.16+ds1-2+deb11u3","bullseye-security":"1.2.16+ds1-2+deb11u5"},"fixed_version":"1.2.11+ds1-1","urgency":"not yet assigned"},"forky":{"status":"resolved","repositories":{"forky":"1.2.30+ds1-1"},"fixed_version":"1.2.11+ds1-1","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"1.2.30+ds1-1"},"fixed_version":"1.2.11+ds1-1","urgency":"not yet assigned"},"trixie":{"status":"resolved","repositories":{"trixie":"1.2.30+ds1-1"},"fixed_version":"1.2.11+ds1-1","urgency":"not yet assigned"}}},"CVE-2020-13231":{"description":"In Cacti before 1.2.11, auth_profile.php?action=edit allows CSRF for an admin email change.","scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"1.2.24+ds1-1+deb12u5","bookworm-security":"1.2.24+ds1-1+deb12u5"},"fixed_version":"1.2.11+ds1-1","urgency":"not yet assigned"},"bullseye":{"status":"resolved","repositories":{"bullseye":"1.2.16+ds1-2+deb11u3","bullseye-security":"1.2.16+ds1-2+deb11u5"},"fixed_version":"1.2.11+ds1-1","urgency":"not yet assigned"},"forky":{"status":"resolved","repositories":{"forky":"1.2.30+ds1-1"},"fixed_version":"1.2.11+ds1-1","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"1.2.30+ds1-1"},"fixed_version":"1.2.11+ds1-1","urgency":"not yet assigned"},"trixie":{"status":"resolved","repositories":{"trixie":"1.2.30+ds1-1"},"fixed_version":"1.2.11+ds1-1","urgency":"not yet assigned"}}},"CVE-2020-14295":{"description":"A SQL injection issue in color.php in Cacti 1.2.12 allows an admin to inject SQL via the filter parameter. This can lead to remote command execution because the product accepts stacked queries.","debianbug":963139,"scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"1.2.24+ds1-1+deb12u5","bookworm-security":"1.2.24+ds1-1+deb12u5"},"fixed_version":"1.2.13+ds1-1","urgency":"not yet assigned"},"bullseye":{"status":"resolved","repositories":{"bullseye":"1.2.16+ds1-2+deb11u3","bullseye-security":"1.2.16+ds1-2+deb11u5"},"fixed_version":"1.2.13+ds1-1","urgency":"not yet assigned"},"forky":{"status":"resolved","repositories":{"forky":"1.2.30+ds1-1"},"fixed_version":"1.2.13+ds1-1","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"1.2.30+ds1-1"},"fixed_version":"1.2.13+ds1-1","urgency":"not yet assigned"},"trixie":{"status":"resolved","repositories":{"trixie":"1.2.30+ds1-1"},"fixed_version":"1.2.13+ds1-1","urgency":"not yet assigned"}}},"CVE-2020-14424":{"description":"Cacti before 1.2.18 allows remote attackers to trigger XSS via template import for the midwinter theme.","scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"1.2.24+ds1-1+deb12u5","bookworm-security":"1.2.24+ds1-1+deb12u5"},"fixed_version":"1.2.19+ds1-1","urgency":"not yet assigned"},"bullseye":{"status":"resolved","repositories":{"bullseye":"1.2.16+ds1-2+deb11u3","bullseye-security":"1.2.16+ds1-2+deb11u5"},"fixed_version":"0","urgency":"unimportant"},"forky":{"status":"resolved","repositories":{"forky":"1.2.30+ds1-1"},"fixed_version":"1.2.19+ds1-1","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"1.2.30+ds1-1"},"fixed_version":"1.2.19+ds1-1","urgency":"not yet assigned"},"trixie":{"status":"resolved","repositories":{"trixie":"1.2.30+ds1-1"},"fixed_version":"1.2.19+ds1-1","urgency":"not yet assigned"}}},"CVE-2020-23226":{"description":"Multiple Cross Site Scripting (XSS) vulneratiblities exist in Cacti 1.2.12 in (1) reports_admin.php, (2) data_queries.php, (3) data_input.php, (4) graph_templates.php, (5) graphs.php, (6) reports_admin.php, and (7) data_input.php.","scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"1.2.24+ds1-1+deb12u5","bookworm-security":"1.2.24+ds1-1+deb12u5"},"fixed_version":"1.2.13+ds1-1","urgency":"not yet assigned"},"bullseye":{"status":"resolved","repositories":{"bullseye":"1.2.16+ds1-2+deb11u3","bullseye-security":"1.2.16+ds1-2+deb11u5"},"fixed_version":"1.2.13+ds1-1","urgency":"not yet assigned"},"forky":{"status":"resolved","repositories":{"forky":"1.2.30+ds1-1"},"fixed_version":"1.2.13+ds1-1","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"1.2.30+ds1-1"},"fixed_version":"1.2.13+ds1-1","urgency":"not yet assigned"},"trixie":{"status":"resolved","repositories":{"trixie":"1.2.30+ds1-1"},"fixed_version":"1.2.13+ds1-1","urgency":"not yet assigned"}}},"CVE-2020-25706":{"description":"A cross-site scripting (XSS) vulnerability exists in templates_import.php (Cacti 1.2.13) due to Improper escaping of error message during template import preview in the xml_path field","scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"1.2.24+ds1-1+deb12u5","bookworm-security":"1.2.24+ds1-1+deb12u5"},"fixed_version":"1.2.14+ds1-1","urgency":"not yet assigned"},"bullseye":{"status":"resolved","repositories":{"bullseye":"1.2.16+ds1-2+deb11u3","bullseye-security":"1.2.16+ds1-2+deb11u5"},"fixed_version":"1.2.14+ds1-1","urgency":"not yet assigned"},"forky":{"status":"resolved","repositories":{"forky":"1.2.30+ds1-1"},"fixed_version":"1.2.14+ds1-1","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"1.2.30+ds1-1"},"fixed_version":"1.2.14+ds1-1","urgency":"not yet assigned"},"trixie":{"status":"resolved","repositories":{"trixie":"1.2.30+ds1-1"},"fixed_version":"1.2.14+ds1-1","urgency":"not yet assigned"}}},"CVE-2020-35701":{"description":"An issue was discovered in Cacti 1.2.x through 1.2.16. A SQL injection vulnerability in data_debug.php allows remote authenticated attackers to execute arbitrary SQL commands via the site_id parameter. This can lead to remote code execution.","debianbug":979998,"scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"1.2.24+ds1-1+deb12u5","bookworm-security":"1.2.24+ds1-1+deb12u5"},"fixed_version":"1.2.16+ds1-2","urgency":"not yet assigned"},"bullseye":{"status":"resolved","repositories":{"bullseye":"1.2.16+ds1-2+deb11u3","bullseye-security":"1.2.16+ds1-2+deb11u5"},"fixed_version":"1.2.16+ds1-2","urgency":"not yet assigned"},"forky":{"status":"resolved","repositories":{"forky":"1.2.30+ds1-1"},"fixed_version":"1.2.16+ds1-2","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"1.2.30+ds1-1"},"fixed_version":"1.2.16+ds1-2","urgency":"not yet assigned"},"trixie":{"status":"resolved","repositories":{"trixie":"1.2.30+ds1-1"},"fixed_version":"1.2.16+ds1-2","urgency":"not yet assigned"}}},"CVE-2020-7058":{"description":"data_input.php in Cacti 1.2.8 allows remote code execution via a crafted Input String to Data Collection -> Data Input Methods -> Unix -> Ping Host. NOTE: the vendor has stated \"This is a false alarm.","scope":"local","releases":{"bookworm":{"status":"open","repositories":{"bookworm":"1.2.24+ds1-1+deb12u5","bookworm-security":"1.2.24+ds1-1+deb12u5"},"urgency":"unimportant"},"bullseye":{"status":"open","repositories":{"bullseye":"1.2.16+ds1-2+deb11u3","bullseye-security":"1.2.16+ds1-2+deb11u5"},"urgency":"unimportant"},"forky":{"status":"open","repositories":{"forky":"1.2.30+ds1-1"},"urgency":"unimportant"},"sid":{"status":"open","repositories":{"sid":"1.2.30+ds1-1"},"urgency":"unimportant"},"trixie":{"status":"open","repositories":{"trixie":"1.2.30+ds1-1"},"urgency":"unimportant"}}},"CVE-2020-7106":{"description":"Cacti 1.2.8 has stored XSS in data_sources.php, color_templates_item.php, graphs.php, graph_items.php, lib/api_automation.php, user_admin.php, and user_group_admin.php, as demonstrated by the description parameter in data_sources.php (a raw string from the database that is displayed by $header to trigger the XSS).","debianbug":949996,"scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"1.2.24+ds1-1+deb12u5","bookworm-security":"1.2.24+ds1-1+deb12u5"},"fixed_version":"1.2.9+ds1-1","urgency":"not yet assigned"},"bullseye":{"status":"resolved","repositories":{"bullseye":"1.2.16+ds1-2+deb11u3","bullseye-security":"1.2.16+ds1-2+deb11u5"},"fixed_version":"1.2.9+ds1-1","urgency":"not yet assigned"},"forky":{"status":"resolved","repositories":{"forky":"1.2.30+ds1-1"},"fixed_version":"1.2.9+ds1-1","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"1.2.30+ds1-1"},"fixed_version":"1.2.9+ds1-1","urgency":"not yet assigned"},"trixie":{"status":"resolved","repositories":{"trixie":"1.2.30+ds1-1"},"fixed_version":"1.2.9+ds1-1","urgency":"not yet assigned"}}},"CVE-2020-7237":{"description":"Cacti 1.2.8 allows Remote Code Execution (by privileged users) via shell metacharacters in the Performance Boost Debug Log field of poller_automation.php. OS commands are executed when a new poller cycle begins. The attacker must be authenticated, and must have access to modify the Performance Settings of the product.","debianbug":949997,"scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"1.2.24+ds1-1+deb12u5","bookworm-security":"1.2.24+ds1-1+deb12u5"},"fixed_version":"1.2.9+ds1-1","urgency":"not yet assigned"},"bullseye":{"status":"resolved","repositories":{"bullseye":"1.2.16+ds1-2+deb11u3","bullseye-security":"1.2.16+ds1-2+deb11u5"},"fixed_version":"1.2.9+ds1-1","urgency":"not yet assigned"},"forky":{"status":"resolved","repositories":{"forky":"1.2.30+ds1-1"},"fixed_version":"1.2.9+ds1-1","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"1.2.30+ds1-1"},"fixed_version":"1.2.9+ds1-1","urgency":"not yet assigned"},"trixie":{"status":"resolved","repositories":{"trixie":"1.2.30+ds1-1"},"fixed_version":"1.2.9+ds1-1","urgency":"not yet assigned"}}},"CVE-2020-8813":{"description":"graph_realtime.php in Cacti 1.2.8 allows remote attackers to execute arbitrary OS commands via shell metacharacters in a cookie, if a guest user has the graph real-time privilege.","debianbug":951832,"scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"1.2.24+ds1-1+deb12u5","bookworm-security":"1.2.24+ds1-1+deb12u5"},"fixed_version":"1.2.10+ds1-1","urgency":"not yet assigned"},"bullseye":{"status":"resolved","repositories":{"bullseye":"1.2.16+ds1-2+deb11u3","bullseye-security":"1.2.16+ds1-2+deb11u5"},"fixed_version":"1.2.10+ds1-1","urgency":"not yet assigned"},"forky":{"status":"resolved","repositories":{"forky":"1.2.30+ds1-1"},"fixed_version":"1.2.10+ds1-1","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"1.2.30+ds1-1"},"fixed_version":"1.2.10+ds1-1","urgency":"not yet assigned"},"trixie":{"status":"resolved","repositories":{"trixie":"1.2.30+ds1-1"},"fixed_version":"1.2.10+ds1-1","urgency":"not yet assigned"}}},"CVE-2021-23225":{"description":"Cacti 1.1.38 allows authenticated users with User Management permissions to inject arbitrary web script or HTML in the \"new_username\" field during creation of a new user via \"Copy\" method at user_admin.php.","scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"1.2.24+ds1-1+deb12u5","bookworm-security":"1.2.24+ds1-1+deb12u5"},"fixed_version":"1.2.1+ds1-1","urgency":"not yet assigned"},"bullseye":{"status":"resolved","repositories":{"bullseye":"1.2.16+ds1-2+deb11u3","bullseye-security":"1.2.16+ds1-2+deb11u5"},"fixed_version":"1.2.1+ds1-1","urgency":"not yet assigned"},"forky":{"status":"resolved","repositories":{"forky":"1.2.30+ds1-1"},"fixed_version":"1.2.1+ds1-1","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"1.2.30+ds1-1"},"fixed_version":"1.2.1+ds1-1","urgency":"not yet assigned"},"trixie":{"status":"resolved","repositories":{"trixie":"1.2.30+ds1-1"},"fixed_version":"1.2.1+ds1-1","urgency":"not yet assigned"}}},"CVE-2021-26247":{"description":"As an unauthenticated remote user, visit \"http://<CACTI_SERVER>/auth_changepassword.php?ref=<script>alert(1)</script>\" to successfully execute the JavaScript payload present in the \"ref\" URL parameter.","scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"1.2.24+ds1-1+deb12u5","bookworm-security":"1.2.24+ds1-1+deb12u5"},"fixed_version":"0.8.7i-1","urgency":"not yet assigned"},"bullseye":{"status":"resolved","repositories":{"bullseye":"1.2.16+ds1-2+deb11u3","bullseye-security":"1.2.16+ds1-2+deb11u5"},"fixed_version":"0.8.7i-1","urgency":"not yet assigned"},"forky":{"status":"resolved","repositories":{"forky":"1.2.30+ds1-1"},"fixed_version":"0.8.7i-1","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"1.2.30+ds1-1"},"fixed_version":"0.8.7i-1","urgency":"not yet assigned"},"trixie":{"status":"resolved","repositories":{"trixie":"1.2.30+ds1-1"},"fixed_version":"0.8.7i-1","urgency":"not yet assigned"}}},"CVE-2021-3816":{"description":"Cacti 1.1.38 allows authenticated users with User Management permissions to inject arbitrary HTML in the group_prefix field during the creation of a new group via \"Copy\" method at user_group_admin.php.","scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"1.2.24+ds1-1+deb12u5","bookworm-security":"1.2.24+ds1-1+deb12u5"},"fixed_version":"1.2.1+ds1-1","urgency":"not yet assigned"},"bullseye":{"status":"resolved","repositories":{"bullseye":"1.2.16+ds1-2+deb11u3","bullseye-security":"1.2.16+ds1-2+deb11u5"},"fixed_version":"1.2.1+ds1-1","urgency":"not yet assigned"},"forky":{"status":"resolved","repositories":{"forky":"1.2.30+ds1-1"},"fixed_version":"1.2.1+ds1-1","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"1.2.30+ds1-1"},"fixed_version":"1.2.1+ds1-1","urgency":"not yet assigned"},"trixie":{"status":"resolved","repositories":{"trixie":"1.2.30+ds1-1"},"fixed_version":"1.2.1+ds1-1","urgency":"not yet assigned"}}},"CVE-2022-0730":{"description":"Under certain ldap conditions, Cacti authentication can be bypassed with certain credential types.","debianbug":1008693,"scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"1.2.24+ds1-1+deb12u5","bookworm-security":"1.2.24+ds1-1+deb12u5"},"fixed_version":"1.2.20+ds1-1","urgency":"not yet assigned"},"bullseye":{"status":"resolved","repositories":{"bullseye":"1.2.16+ds1-2+deb11u3","bullseye-security":"1.2.16+ds1-2+deb11u5"},"fixed_version":"1.2.16+ds1-2+deb11u1","urgency":"not yet assigned"},"forky":{"status":"resolved","repositories":{"forky":"1.2.30+ds1-1"},"fixed_version":"1.2.20+ds1-1","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"1.2.30+ds1-1"},"fixed_version":"1.2.20+ds1-1","urgency":"not yet assigned"},"trixie":{"status":"resolved","repositories":{"trixie":"1.2.30+ds1-1"},"fixed_version":"1.2.20+ds1-1","urgency":"not yet assigned"}}},"CVE-2022-41444":{"description":"Cross Site Scripting (XSS) vulnerability in Cacti 1.2.21 via crafted POST request to graphs_new.php.","scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"1.2.24+ds1-1+deb12u5","bookworm-security":"1.2.24+ds1-1+deb12u5"},"fixed_version":"1.2.22+ds1-1","urgency":"not yet assigned"},"bullseye":{"status":"resolved","repositories":{"bullseye":"1.2.16+ds1-2+deb11u3","bullseye-security":"1.2.16+ds1-2+deb11u5"},"fixed_version":"1.2.16+ds1-2+deb11u4","urgency":"not yet assigned"},"forky":{"status":"resolved","repositories":{"forky":"1.2.30+ds1-1"},"fixed_version":"1.2.22+ds1-1","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"1.2.30+ds1-1"},"fixed_version":"1.2.22+ds1-1","urgency":"not yet assigned"},"trixie":{"status":"resolved","repositories":{"trixie":"1.2.30+ds1-1"},"fixed_version":"1.2.22+ds1-1","urgency":"not yet assigned"}}},"CVE-2022-46169":{"description":"Cacti is an open source platform which provides a robust and extensible operational monitoring and fault management framework for users. In affected versions a command injection vulnerability allows an unauthenticated user to execute arbitrary code on a server running Cacti, if a specific data source was selected for any monitored device. The vulnerability resides in the `remote_agent.php` file. This file can be accessed without authentication. This function retrieves the IP address of the client via `get_client_addr` and resolves this IP address to the corresponding hostname via `gethostbyaddr`. After this, it is verified that an entry within the `poller` table exists, where the hostname corresponds to the resolved hostname. If such an entry was found, the function returns `true` and the client is authorized. This authorization can be bypassed due to the implementation of the `get_client_addr` function. The function is defined in the file `lib/functions.php` and checks serval `$_SERVER` variables to determine the IP address of the client. The variables beginning with `HTTP_` can be arbitrarily set by an attacker. Since there is a default entry in the `poller` table with the hostname of the server running Cacti, an attacker can bypass the authentication e.g. by providing the header `Forwarded-For: <TARGETIP>`. This way the function `get_client_addr` returns the IP address of the server running Cacti. The following call to `gethostbyaddr` will resolve this IP address to the hostname of the server, which will pass the `poller` hostname check because of the default entry. After the authorization of the `remote_agent.php` file is bypassed, an attacker can trigger different actions. One of these actions is called `polldata`. The called function `poll_for_data` retrieves a few request parameters and loads the corresponding `poller_item` entries from the database. If the `action` of a `poller_item` equals `POLLER_ACTION_SCRIPT_PHP`, the function `proc_open` is used to execute a PHP script. The attacker-controlled parameter `$poller_id` is retrieved via the function `get_nfilter_request_var`, which allows arbitrary strings. This variable is later inserted into the string passed to `proc_open`, which leads to a command injection vulnerability. By e.g. providing the `poller_id=;id` the `id` command is executed. In order to reach the vulnerable call, the attacker must provide a `host_id` and `local_data_id`, where the `action` of the corresponding `poller_item` is set to `POLLER_ACTION_SCRIPT_PHP`. Both of these ids (`host_id` and `local_data_id`) can easily be bruteforced. The only requirement is that a `poller_item` with an `POLLER_ACTION_SCRIPT_PHP` action exists. This is very likely on a productive instance because this action is added by some predefined templates like `Device - Uptime` or `Device - Polling Time`.  This command injection vulnerability allows an unauthenticated user to execute arbitrary commands if a `poller_item` with the `action` type `POLLER_ACTION_SCRIPT_PHP` (`2`) is configured. The authorization bypass should be prevented by not allowing an attacker to make `get_client_addr` (file `lib/functions.php`) return an arbitrary IP address. This could be done by not honoring the `HTTP_...` `$_SERVER` variables. If these should be kept for compatibility reasons it should at least be prevented to fake the IP address of the server running Cacti. This vulnerability has been addressed in both the 1.2.x and 1.3.x release branches with `1.2.23` being the first release containing the patch.","debianbug":1025648,"scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"1.2.24+ds1-1+deb12u5","bookworm-security":"1.2.24+ds1-1+deb12u5"},"fixed_version":"1.2.22+ds1-3","urgency":"not yet assigned"},"bullseye":{"status":"resolved","repositories":{"bullseye":"1.2.16+ds1-2+deb11u3","bullseye-security":"1.2.16+ds1-2+deb11u5"},"fixed_version":"1.2.16+ds1-2+deb11u1","urgency":"not yet assigned"},"forky":{"status":"resolved","repositories":{"forky":"1.2.30+ds1-1"},"fixed_version":"1.2.22+ds1-3","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"1.2.30+ds1-1"},"fixed_version":"1.2.22+ds1-3","urgency":"not yet assigned"},"trixie":{"status":"resolved","repositories":{"trixie":"1.2.30+ds1-1"},"fixed_version":"1.2.22+ds1-3","urgency":"not yet assigned"}}},"CVE-2022-48538":{"description":"In Cacti 1.2.19, there is an authentication bypass in the web login functionality because of improper validation in the PHP code: cacti_ldap_auth() allows a zero as the password.","scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"1.2.24+ds1-1+deb12u5","bookworm-security":"1.2.24+ds1-1+deb12u5"},"fixed_version":"1.2.23+ds1-1","urgency":"unimportant"},"bullseye":{"status":"open","repositories":{"bullseye":"1.2.16+ds1-2+deb11u3","bullseye-security":"1.2.16+ds1-2+deb11u5"},"urgency":"unimportant"},"forky":{"status":"resolved","repositories":{"forky":"1.2.30+ds1-1"},"fixed_version":"1.2.23+ds1-1","urgency":"unimportant"},"sid":{"status":"resolved","repositories":{"sid":"1.2.30+ds1-1"},"fixed_version":"1.2.23+ds1-1","urgency":"unimportant"},"trixie":{"status":"resolved","repositories":{"trixie":"1.2.30+ds1-1"},"fixed_version":"1.2.23+ds1-1","urgency":"unimportant"}}},"CVE-2022-48547":{"description":"A reflected cross-site scripting (XSS) vulnerability in Cacti 0.8.7g and earlier allows unauthenticated remote attackers to inject arbitrary web script or HTML in the \"ref\" parameter at auth_changepassword.php.","scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"1.2.24+ds1-1+deb12u5","bookworm-security":"1.2.24+ds1-1+deb12u5"},"fixed_version":"0.8.7i-1","urgency":"not yet assigned"},"bullseye":{"status":"resolved","repositories":{"bullseye":"1.2.16+ds1-2+deb11u3","bullseye-security":"1.2.16+ds1-2+deb11u5"},"fixed_version":"0.8.7i-1","urgency":"not yet assigned"},"forky":{"status":"resolved","repositories":{"forky":"1.2.30+ds1-1"},"fixed_version":"0.8.7i-1","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"1.2.30+ds1-1"},"fixed_version":"0.8.7i-1","urgency":"not yet assigned"},"trixie":{"status":"resolved","repositories":{"trixie":"1.2.30+ds1-1"},"fixed_version":"0.8.7i-1","urgency":"not yet assigned"}}},"CVE-2023-30534":{"description":"Cacti is an open source operational monitoring and fault management framework. There are two instances of insecure deserialization in Cacti version 1.2.24. While a viable gadget chain exists in Cacti\u2019s vendor directory (phpseclib), the necessary gadgets are not included, making them inaccessible and the insecure deserializations not exploitable. Each instance of insecure deserialization is due to using the unserialize function without sanitizing the user input. Cacti has a \u201csafe\u201d deserialization that attempts to sanitize the content and check for specific values before calling unserialize, but it isn\u2019t used in these instances. The vulnerable code lies in graphs_new.php, specifically within the host_new_graphs_save function. This issue has been addressed in version 1.2.25. Users are advised to upgrade. There are no known workarounds for this vulnerability.","scope":"local","releases":{"bookworm":{"status":"open","repositories":{"bookworm":"1.2.24+ds1-1+deb12u5","bookworm-security":"1.2.24+ds1-1+deb12u5"},"urgency":"not yet assigned","nodsa":"Minor issue; invasive to fix and introduces regressions","nodsa_reason":"ignored"},"bullseye":{"status":"open","repositories":{"bullseye":"1.2.16+ds1-2+deb11u3","bullseye-security":"1.2.16+ds1-2+deb11u5"},"urgency":"not yet assigned","nodsa":"Minor issue; invasive to fix and introduces regressions","nodsa_reason":"ignored"},"forky":{"status":"resolved","repositories":{"forky":"1.2.30+ds1-1"},"fixed_version":"1.2.25+ds1-1","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"1.2.30+ds1-1"},"fixed_version":"1.2.25+ds1-1","urgency":"not yet assigned"},"trixie":{"status":"resolved","repositories":{"trixie":"1.2.30+ds1-1"},"fixed_version":"1.2.25+ds1-1","urgency":"not yet assigned"}}},"CVE-2023-31132":{"description":"Cacti is an open source operational monitoring and fault management framework. Affected versions are subject to a privilege escalation vulnerability. A low-privileged OS user with access to a Windows host where Cacti is installed can create arbitrary PHP files in a web document directory. The user can then execute the PHP files under the security context of SYSTEM. This allows an attacker to escalate privilege from a normal user account to SYSTEM. This issue has been addressed in version 1.2.25. Users are advised to upgrade. There are no known workarounds for this vulnerability.","scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"1.2.24+ds1-1+deb12u5","bookworm-security":"1.2.24+ds1-1+deb12u5"},"fixed_version":"0","urgency":"unimportant"},"bullseye":{"status":"resolved","repositories":{"bullseye":"1.2.16+ds1-2+deb11u3","bullseye-security":"1.2.16+ds1-2+deb11u5"},"fixed_version":"0","urgency":"unimportant"},"forky":{"status":"resolved","repositories":{"forky":"1.2.30+ds1-1"},"fixed_version":"0","urgency":"unimportant"},"sid":{"status":"resolved","repositories":{"sid":"1.2.30+ds1-1"},"fixed_version":"0","urgency":"unimportant"},"trixie":{"status":"resolved","repositories":{"trixie":"1.2.30+ds1-1"},"fixed_version":"0","urgency":"unimportant"}}},"CVE-2023-37543":{"description":"Cacti before 1.2.6 allows IDOR (Insecure Direct Object Reference) for accessing any graph via a modified local_graph_id parameter to graph_xport.php. This is a different vulnerability than CVE-2019-16723.","scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"1.2.24+ds1-1+deb12u5","bookworm-security":"1.2.24+ds1-1+deb12u5"},"fixed_version":"1.2.6+ds1-1","urgency":"not yet assigned"},"bullseye":{"status":"resolved","repositories":{"bullseye":"1.2.16+ds1-2+deb11u3","bullseye-security":"1.2.16+ds1-2+deb11u5"},"fixed_version":"1.2.6+ds1-1","urgency":"not yet assigned"},"forky":{"status":"resolved","repositories":{"forky":"1.2.30+ds1-1"},"fixed_version":"1.2.6+ds1-1","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"1.2.30+ds1-1"},"fixed_version":"1.2.6+ds1-1","urgency":"not yet assigned"},"trixie":{"status":"resolved","repositories":{"trixie":"1.2.30+ds1-1"},"fixed_version":"1.2.6+ds1-1","urgency":"not yet assigned"}}},"CVE-2023-39357":{"description":"Cacti is an open source operational monitoring and fault management framework. A defect in the sql_save function was discovered. When the column type is numeric, the sql_save function directly utilizes user input. Many files and functions calling the sql_save function do not perform prior validation of user input, leading to the existence of multiple SQL injection vulnerabilities in Cacti. This allows authenticated users to exploit these SQL injection vulnerabilities to perform privilege escalation and remote code execution. This issue has been addressed in version 1.2.25. Users are advised to upgrade. There are no known workarounds for this vulnerability.","scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"1.2.24+ds1-1+deb12u5","bookworm-security":"1.2.24+ds1-1+deb12u5"},"fixed_version":"1.2.24+ds1-1+deb12u1","urgency":"not yet assigned"},"bullseye":{"status":"resolved","repositories":{"bullseye":"1.2.16+ds1-2+deb11u3","bullseye-security":"1.2.16+ds1-2+deb11u5"},"fixed_version":"1.2.16+ds1-2+deb11u2","urgency":"not yet assigned"},"forky":{"status":"resolved","repositories":{"forky":"1.2.30+ds1-1"},"fixed_version":"1.2.25+ds1-1","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"1.2.30+ds1-1"},"fixed_version":"1.2.25+ds1-1","urgency":"not yet assigned"},"trixie":{"status":"resolved","repositories":{"trixie":"1.2.30+ds1-1"},"fixed_version":"1.2.25+ds1-1","urgency":"not yet assigned"}}},"CVE-2023-39358":{"description":"Cacti is an open source operational monitoring and fault management framework. An authenticated SQL injection vulnerability was discovered which allows authenticated users to perform privilege escalation and remote code execution. The vulnerability resides in the `reports_user.php` file. In `ajax_get_branches`, the `tree_id` parameter is passed to the `reports_get_branch_select` function without any validation. This issue has been addressed in version 1.2.25. Users are advised to upgrade. There are no known workarounds for this vulnerability.","scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"1.2.24+ds1-1+deb12u5","bookworm-security":"1.2.24+ds1-1+deb12u5"},"fixed_version":"1.2.24+ds1-1+deb12u1","urgency":"not yet assigned"},"bullseye":{"status":"resolved","repositories":{"bullseye":"1.2.16+ds1-2+deb11u3","bullseye-security":"1.2.16+ds1-2+deb11u5"},"fixed_version":"0","urgency":"unimportant"},"forky":{"status":"resolved","repositories":{"forky":"1.2.30+ds1-1"},"fixed_version":"1.2.25+ds1-1","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"1.2.30+ds1-1"},"fixed_version":"1.2.25+ds1-1","urgency":"not yet assigned"},"trixie":{"status":"resolved","repositories":{"trixie":"1.2.30+ds1-1"},"fixed_version":"1.2.25+ds1-1","urgency":"not yet assigned"}}},"CVE-2023-39359":{"description":"Cacti is an open source operational monitoring and fault management framework. An authenticated SQL injection vulnerability was discovered which allows authenticated users to perform privilege escalation and remote code execution. The vulnerability resides in the `graphs.php` file. When dealing with the cases of ajax_hosts and ajax_hosts_noany, if the `site_id` parameter is greater than 0, it is directly reflected in the WHERE clause of the SQL statement. This creates an SQL injection vulnerability. This issue has been addressed in version 1.2.25. Users are advised to upgrade. There are no known workarounds for this vulnerability.","scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"1.2.24+ds1-1+deb12u5","bookworm-security":"1.2.24+ds1-1+deb12u5"},"fixed_version":"1.2.24+ds1-1+deb12u1","urgency":"not yet assigned"},"bullseye":{"status":"resolved","repositories":{"bullseye":"1.2.16+ds1-2+deb11u3","bullseye-security":"1.2.16+ds1-2+deb11u5"},"fixed_version":"1.2.16+ds1-2+deb11u2","urgency":"not yet assigned"},"forky":{"status":"resolved","repositories":{"forky":"1.2.30+ds1-1"},"fixed_version":"1.2.25+ds1-1","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"1.2.30+ds1-1"},"fixed_version":"1.2.25+ds1-1","urgency":"not yet assigned"},"trixie":{"status":"resolved","repositories":{"trixie":"1.2.30+ds1-1"},"fixed_version":"1.2.25+ds1-1","urgency":"not yet assigned"}}},"CVE-2023-39360":{"description":"Cacti is an open source operational monitoring and fault management framework.Affected versions are subject to a Stored Cross-Site-Scripting (XSS) Vulnerability allows an authenticated user to poison data. The vulnerability is found in `graphs_new.php`. Several validations are performed, but the `returnto` parameter is directly passed to `form_save_button`. In order to bypass this validation, returnto must contain `host.php`. This vulnerability has been addressed in version 1.2.25. Users are advised to upgrade. Users unable to update should manually filter HTML output.","scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"1.2.24+ds1-1+deb12u5","bookworm-security":"1.2.24+ds1-1+deb12u5"},"fixed_version":"1.2.24+ds1-1+deb12u2","urgency":"not yet assigned"},"bullseye":{"status":"resolved","repositories":{"bullseye":"1.2.16+ds1-2+deb11u3","bullseye-security":"1.2.16+ds1-2+deb11u5"},"fixed_version":"1.2.16+ds1-2+deb11u3","urgency":"not yet assigned"},"forky":{"status":"resolved","repositories":{"forky":"1.2.30+ds1-1"},"fixed_version":"1.2.25+ds1-1","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"1.2.30+ds1-1"},"fixed_version":"1.2.25+ds1-1","urgency":"not yet assigned"},"trixie":{"status":"resolved","repositories":{"trixie":"1.2.30+ds1-1"},"fixed_version":"1.2.25+ds1-1","urgency":"not yet assigned"}}},"CVE-2023-39361":{"description":"Cacti is an open source operational monitoring and fault management framework. Affected versions are subject to a SQL injection discovered in graph_view.php. Since guest users can access graph_view.php without authentication by default, if guest users are being utilized in an enabled state, there could be the potential for significant damage. Attackers may exploit this vulnerability, and there may be possibilities for actions such as the usurpation of administrative privileges or remote code execution. This issue has been addressed in version 1.2.25. Users are advised to upgrade. There are no known workarounds for this vulnerability.","scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"1.2.24+ds1-1+deb12u5","bookworm-security":"1.2.24+ds1-1+deb12u5"},"fixed_version":"1.2.24+ds1-1+deb12u1","urgency":"not yet assigned"},"bullseye":{"status":"resolved","repositories":{"bullseye":"1.2.16+ds1-2+deb11u3","bullseye-security":"1.2.16+ds1-2+deb11u5"},"fixed_version":"1.2.16+ds1-2+deb11u2","urgency":"not yet assigned"},"forky":{"status":"resolved","repositories":{"forky":"1.2.30+ds1-1"},"fixed_version":"1.2.25+ds1-1","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"1.2.30+ds1-1"},"fixed_version":"1.2.25+ds1-1","urgency":"not yet assigned"},"trixie":{"status":"resolved","repositories":{"trixie":"1.2.30+ds1-1"},"fixed_version":"1.2.25+ds1-1","urgency":"not yet assigned"}}},"CVE-2023-39362":{"description":"Cacti is an open source operational monitoring and fault management framework. In Cacti 1.2.24, under certain conditions, an authenticated privileged user, can use a malicious string in the SNMP options of a Device, performing command injection and obtaining remote code execution on the underlying server. The `lib/snmp.php` file has a set of functions, with similar behavior, that accept in input some variables and place them into an `exec` call without a proper escape or validation. This issue has been addressed in version 1.2.25. Users are advised to upgrade. There are no known workarounds for this vulnerability.","scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"1.2.24+ds1-1+deb12u5","bookworm-security":"1.2.24+ds1-1+deb12u5"},"fixed_version":"1.2.24+ds1-1+deb12u1","urgency":"not yet assigned"},"bullseye":{"status":"resolved","repositories":{"bullseye":"1.2.16+ds1-2+deb11u3","bullseye-security":"1.2.16+ds1-2+deb11u5"},"fixed_version":"1.2.16+ds1-2+deb11u2","urgency":"not yet assigned"},"forky":{"status":"resolved","repositories":{"forky":"1.2.30+ds1-1"},"fixed_version":"1.2.25+ds1-1","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"1.2.30+ds1-1"},"fixed_version":"1.2.25+ds1-1","urgency":"not yet assigned"},"trixie":{"status":"resolved","repositories":{"trixie":"1.2.30+ds1-1"},"fixed_version":"1.2.25+ds1-1","urgency":"not yet assigned"}}},"CVE-2023-39364":{"description":"Cacti is an open source operational monitoring and fault management framework. In Cacti 1.2.24, users with console access can be redirected to an arbitrary website after a change password performed via a specifically crafted URL. The `auth_changepassword.php` file accepts `ref` as a URL parameter and reflects it in the form used to perform the change password. It's value is used to perform a redirect via `header` PHP function. A user can be tricked in performing the change password operation, e.g., via a phishing message, and then interacting with the malicious website where the redirection has been performed, e.g., downloading malwares, providing credentials, etc. This issue has been addressed in version 1.2.25. Users are advised to upgrade. There are no known workarounds for this vulnerability.","scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"1.2.24+ds1-1+deb12u5","bookworm-security":"1.2.24+ds1-1+deb12u5"},"fixed_version":"1.2.24+ds1-1+deb12u1","urgency":"not yet assigned"},"bullseye":{"status":"resolved","repositories":{"bullseye":"1.2.16+ds1-2+deb11u3","bullseye-security":"1.2.16+ds1-2+deb11u5"},"fixed_version":"1.2.16+ds1-2+deb11u2","urgency":"not yet assigned"},"forky":{"status":"resolved","repositories":{"forky":"1.2.30+ds1-1"},"fixed_version":"1.2.25+ds1-1","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"1.2.30+ds1-1"},"fixed_version":"1.2.25+ds1-1","urgency":"not yet assigned"},"trixie":{"status":"resolved","repositories":{"trixie":"1.2.30+ds1-1"},"fixed_version":"1.2.25+ds1-1","urgency":"not yet assigned"}}},"CVE-2023-39365":{"description":"Cacti is an open source operational monitoring and fault management framework. Issues with Cacti Regular Expression validation combined with the external links feature can lead to limited SQL Injections and subsequent data leakage. This issue has been addressed in version 1.2.25. Users are advised to upgrade. There are no known workarounds for this vulnerability.","scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"1.2.24+ds1-1+deb12u5","bookworm-security":"1.2.24+ds1-1+deb12u5"},"fixed_version":"1.2.24+ds1-1+deb12u1","urgency":"not yet assigned"},"bullseye":{"status":"resolved","repositories":{"bullseye":"1.2.16+ds1-2+deb11u3","bullseye-security":"1.2.16+ds1-2+deb11u5"},"fixed_version":"1.2.16+ds1-2+deb11u2","urgency":"not yet assigned"},"forky":{"status":"resolved","repositories":{"forky":"1.2.30+ds1-1"},"fixed_version":"1.2.25+ds1-1","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"1.2.30+ds1-1"},"fixed_version":"1.2.25+ds1-1","urgency":"not yet assigned"},"trixie":{"status":"resolved","repositories":{"trixie":"1.2.30+ds1-1"},"fixed_version":"1.2.25+ds1-1","urgency":"not yet assigned"}}},"CVE-2023-39366":{"description":"Cacti is an open source operational monitoring and fault management framework. Affected versions are subject to a Stored Cross-Site-Scripting (XSS) Vulnerability allows an authenticated user to poison data stored in the _cacti_'s database. These data will be viewed by administrative _cacti_ accounts and execute JavaScript code in the victim's browser at view-time. The `data_sources.php` script displays the data source management information (e.g. data source path, polling configuration etc.) for different data visualizations of the _cacti_ app.  CENSUS found that an adversary that is able to configure a malicious Device name, can deploy a stored XSS attack against any user of the same (or broader) privileges. A user that possesses the _General Administration>Sites/Devices/Data_ permissions can configure the device names in _cacti_. This configuration occurs through `http://<HOST>/cacti/host.php`, while the rendered malicious payload is exhibited at `http://<HOST>/cacti/data_sources.php`. This vulnerability has been addressed in version 1.2.25. Users are advised to upgrade. Users unable to update should manually filter HTML output.","scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"1.2.24+ds1-1+deb12u5","bookworm-security":"1.2.24+ds1-1+deb12u5"},"fixed_version":"1.2.24+ds1-1+deb12u1","urgency":"not yet assigned"},"bullseye":{"status":"resolved","repositories":{"bullseye":"1.2.16+ds1-2+deb11u3","bullseye-security":"1.2.16+ds1-2+deb11u5"},"fixed_version":"0","urgency":"unimportant"},"forky":{"status":"resolved","repositories":{"forky":"1.2.30+ds1-1"},"fixed_version":"1.2.25+ds1-1","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"1.2.30+ds1-1"},"fixed_version":"1.2.25+ds1-1","urgency":"not yet assigned"},"trixie":{"status":"resolved","repositories":{"trixie":"1.2.30+ds1-1"},"fixed_version":"1.2.25+ds1-1","urgency":"not yet assigned"}}},"CVE-2023-39510":{"description":"Cacti is an open source operational monitoring and fault management framework. Affected versions are subject to a Stored Cross-Site-Scripting (XSS) Vulnerability allows an authenticated user to poison data stored in the _cacti_'s database. These data will be viewed by administrative _cacti_ accounts and execute JavaScript code in the victim's browser at view-time. The`reports_admin.php` script displays reporting information about graphs, devices, data sources etc. CENSUS found that an adversary that is able to configure a malicious Device name, can deploy a stored XSS attack against any user of the same (or broader) privileges. A user that possesses the _General Administration>Sites/Devices/Data_ permissions can configure the device names in _cacti_. This configuration occurs through `http://<HOST>/cacti/host.php`, while the rendered malicious payload is exhibited at `http://<HOST>/cacti/reports_admin.php` when the a graph with the maliciously altered device name is linked to the report. This vulnerability has been addressed in version 1.2.25. Users are advised to upgrade. Users unable to update should manually filter HTML output.","scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"1.2.24+ds1-1+deb12u5","bookworm-security":"1.2.24+ds1-1+deb12u5"},"fixed_version":"1.2.24+ds1-1+deb12u1","urgency":"not yet assigned"},"bullseye":{"status":"resolved","repositories":{"bullseye":"1.2.16+ds1-2+deb11u3","bullseye-security":"1.2.16+ds1-2+deb11u5"},"fixed_version":"0","urgency":"unimportant"},"forky":{"status":"resolved","repositories":{"forky":"1.2.30+ds1-1"},"fixed_version":"1.2.25+ds1-1","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"1.2.30+ds1-1"},"fixed_version":"1.2.25+ds1-1","urgency":"not yet assigned"},"trixie":{"status":"resolved","repositories":{"trixie":"1.2.30+ds1-1"},"fixed_version":"1.2.25+ds1-1","urgency":"not yet assigned"}}},"CVE-2023-39511":{"description":"Cacti is an open source operational monitoring and fault management framework. Affected versions are subject to a Stored Cross-Site-Scripting (XSS) Vulnerability which allows an authenticated user to poison data stored in the _cacti_'s database. These data will be viewed by administrative _cacti_ accounts and execute JavaScript code in the victim's browser at view-time. The script under `reports_admin.php` displays reporting information about graphs, devices, data sources etc. _CENSUS_ found that an adversary that is able to configure a malicious device name, related to a graph attached to a report, can deploy a stored XSS attack against any super user who has privileges of viewing the `reports_admin.php` page, such as administrative accounts. A user that possesses the _General Administration>Sites/Devices/Data_ permissions can configure the device names in _cacti_. This configuration occurs through `http://<HOST>/cacti/host.php`, while the rendered malicious payload is exhibited at `http://<HOST>/cacti/reports_admin.php` when the a graph with the maliciously altered device name is linked to the report. This issue has been addressed in version 1.2.25. Users are advised to upgrade. Users unable to upgrade should manually filter HTML output.","scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"1.2.24+ds1-1+deb12u5","bookworm-security":"1.2.24+ds1-1+deb12u5"},"fixed_version":"1.2.24+ds1-1+deb12u1","urgency":"not yet assigned"},"bullseye":{"status":"resolved","repositories":{"bullseye":"1.2.16+ds1-2+deb11u3","bullseye-security":"1.2.16+ds1-2+deb11u5"},"fixed_version":"0","urgency":"unimportant"},"forky":{"status":"resolved","repositories":{"forky":"1.2.30+ds1-1"},"fixed_version":"1.2.25+ds1-1","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"1.2.30+ds1-1"},"fixed_version":"1.2.25+ds1-1","urgency":"not yet assigned"},"trixie":{"status":"resolved","repositories":{"trixie":"1.2.30+ds1-1"},"fixed_version":"1.2.25+ds1-1","urgency":"not yet assigned"}}},"CVE-2023-39512":{"description":"Cacti is an open source operational monitoring and fault management framework. Affected versions are subject to a Stored Cross-Site-Scripting (XSS) Vulnerability which allows an authenticated user to poison data stored in the _cacti_'s database. These data will be viewed by administrative _cacti_ accounts and execute JavaScript code in the victim's browser at view-time. The script under `data_sources.php` displays the data source management information (e.g. data source path, polling configuration, device name related to the datasource etc.) for different data visualizations of the _cacti_ app. _CENSUS_ found that an adversary that is able to configure a malicious device name, can deploy a stored XSS attack against any user of the same (or broader) privileges. A user that possesses the _General Administration>Sites/Devices/Data_ permissions can configure the device names in _cacti_. This configuration occurs through `http://<HOST>/cacti/host.php`, while the rendered malicious payload is exhibited at `http://<HOST>/cacti/data_sources.php`. This vulnerability has been addressed in version 1.2.25. Users are advised to upgrade. Users unable to update should manually filter HTML output.","scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"1.2.24+ds1-1+deb12u5","bookworm-security":"1.2.24+ds1-1+deb12u5"},"fixed_version":"1.2.24+ds1-1+deb12u1","urgency":"not yet assigned"},"bullseye":{"status":"resolved","repositories":{"bullseye":"1.2.16+ds1-2+deb11u3","bullseye-security":"1.2.16+ds1-2+deb11u5"},"fixed_version":"0","urgency":"unimportant"},"forky":{"status":"resolved","repositories":{"forky":"1.2.30+ds1-1"},"fixed_version":"1.2.25+ds1-1","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"1.2.30+ds1-1"},"fixed_version":"1.2.25+ds1-1","urgency":"not yet assigned"},"trixie":{"status":"resolved","repositories":{"trixie":"1.2.30+ds1-1"},"fixed_version":"1.2.25+ds1-1","urgency":"not yet assigned"}}},"CVE-2023-39513":{"description":"Cacti is an open source operational monitoring and fault management framework. Affected versions are subject to a Stored Cross-Site-Scripting (XSS) Vulnerability which allows an authenticated user to poison data stored in the _cacti_'s database. These data will be viewed by administrative _cacti_ accounts and execute JavaScript code in the victim's browser at view-time. The script under `host.php` is used to monitor and manage hosts in the _cacti_ app, hence displays useful information such as data queries and verbose logs. _CENSUS_ found that an adversary that is able to configure a data-query template with malicious code appended in the template path, in order to deploy a stored XSS attack against any user with the _General Administration>Sites/Devices/Data_ privileges. A user that possesses the _Template Editor>Data Queries_ permissions can configure the data query template path in _cacti_. Please note that such a user may be a low privileged user. This configuration occurs through `http://<HOST>/cacti/data_queries.php` by editing an existing or adding a new data query template. If a template is linked to a device then the formatted template path will be rendered in the device's management page, when a _verbose data query_ is requested. This vulnerability has been addressed in version 1.2.25. Users are advised to upgrade. Users unable to update should manually filter HTML output.","scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"1.2.24+ds1-1+deb12u5","bookworm-security":"1.2.24+ds1-1+deb12u5"},"fixed_version":"1.2.24+ds1-1+deb12u2","urgency":"not yet assigned"},"bullseye":{"status":"resolved","repositories":{"bullseye":"1.2.16+ds1-2+deb11u3","bullseye-security":"1.2.16+ds1-2+deb11u5"},"fixed_version":"1.2.16+ds1-2+deb11u3","urgency":"not yet assigned"},"forky":{"status":"resolved","repositories":{"forky":"1.2.30+ds1-1"},"fixed_version":"1.2.25+ds1-1","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"1.2.30+ds1-1"},"fixed_version":"1.2.25+ds1-1","urgency":"not yet assigned"},"trixie":{"status":"resolved","repositories":{"trixie":"1.2.30+ds1-1"},"fixed_version":"1.2.25+ds1-1","urgency":"not yet assigned"}}},"CVE-2023-39514":{"description":"Cacti is an open source operational monitoring and fault management framework. Affected versions are subject to a Stored Cross-Site-Scripting (XSS) Vulnerability which allows an authenticated user to poison data stored in the _cacti_'s database. These data will be viewed by administrative _cacti_ accounts and execute JavaScript code in the victim's browser at view-time. The script under `graphs.php` displays graph details such as data-source paths, data template information and graph related fields. _CENSUS_ found that an adversary that is able to configure either a data-source template with malicious code appended in the data-source name or a device with a malicious payload injected in the device name, may deploy a stored XSS attack against any user with _General Administration>Graphs_ privileges. A user that possesses the _Template Editor>Data Templates_ permissions can configure the data-source name in _cacti_. Please note that this may be a _low privileged_ user. This configuration occurs through `http://<HOST>/cacti/data_templates.php` by editing an existing or adding a new data template. If a template is linked to a graph then the formatted template name will be rendered in the graph's management page. A user that possesses the _General Administration>Sites/Devices/Data_ permissions can configure the device name in _cacti_. This vulnerability has been addressed in version 1.2.25. Users are advised to upgrade. Users unable to upgrade should add manual HTML escaping.","scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"1.2.24+ds1-1+deb12u5","bookworm-security":"1.2.24+ds1-1+deb12u5"},"fixed_version":"1.2.24+ds1-1+deb12u1","urgency":"not yet assigned"},"bullseye":{"status":"resolved","repositories":{"bullseye":"1.2.16+ds1-2+deb11u3","bullseye-security":"1.2.16+ds1-2+deb11u5"},"fixed_version":"0","urgency":"unimportant"},"forky":{"status":"resolved","repositories":{"forky":"1.2.30+ds1-1"},"fixed_version":"1.2.25+ds1-1","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"1.2.30+ds1-1"},"fixed_version":"1.2.25+ds1-1","urgency":"not yet assigned"},"trixie":{"status":"resolved","repositories":{"trixie":"1.2.30+ds1-1"},"fixed_version":"1.2.25+ds1-1","urgency":"not yet assigned"}}},"CVE-2023-39515":{"description":"Cacti is an open source operational monitoring and fault management framework. Affected versions are subject to a Stored Cross-Site-Scripting (XSS) Vulnerability allows an authenticated user to poison data stored in the cacti's database. These data will be viewed by administrative cacti accounts and execute JavaScript code in the victim's browser at view-time. The script under `data_debug.php` displays data source related debugging information such as _data source paths, polling settings, meta-data on the data source_. _CENSUS_ found that an adversary that is able to configure a malicious data-source path, can deploy a stored XSS attack against any user that has privileges related to viewing the `data_debug.php` information. A user that possesses the _General Administration>Sites/Devices/Data_ permissions can configure the data source path in _cacti_. This configuration occurs through `http://<HOST>/cacti/data_sources.php`. This vulnerability has been addressed in version 1.2.25. Users are advised to upgrade. Users unable to update should manually filter HTML output.","scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"1.2.24+ds1-1+deb12u5","bookworm-security":"1.2.24+ds1-1+deb12u5"},"fixed_version":"1.2.24+ds1-1+deb12u1","urgency":"not yet assigned"},"bullseye":{"status":"resolved","repositories":{"bullseye":"1.2.16+ds1-2+deb11u3","bullseye-security":"1.2.16+ds1-2+deb11u5"},"fixed_version":"1.2.16+ds1-2+deb11u2","urgency":"not yet assigned"},"forky":{"status":"resolved","repositories":{"forky":"1.2.30+ds1-1"},"fixed_version":"1.2.25+ds1-1","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"1.2.30+ds1-1"},"fixed_version":"1.2.25+ds1-1","urgency":"not yet assigned"},"trixie":{"status":"resolved","repositories":{"trixie":"1.2.30+ds1-1"},"fixed_version":"1.2.25+ds1-1","urgency":"not yet assigned"}}},"CVE-2023-39516":{"description":"Cacti is an open source operational monitoring and fault management framework. Affected versions are subject to a Stored Cross-Site-Scripting (XSS) Vulnerability which allows an authenticated user to poison data stored in the _cacti_'s database. These data will be viewed by administrative _cacti_ accounts and execute JavaScript code in the victim's browser at view-time. The script under `data_sources.php` displays the data source management information (e.g. data source path, polling configuration etc.) for different data visualizations of the _cacti_ app. CENSUS found that an adversary that is able to configure a malicious data-source path, can deploy a stored XSS attack against any user of the same (or broader) privileges. A user that possesses the 'General Administration>Sites/Devices/Data' permissions can configure the data source path in Cacti. This configuration occurs through `http://<HOST>/cacti/data_sources.php`. The same page can be used for previewing the data source path. This issue has been addressed in version 1.2.25. Users are advised to upgrade. Users unable to upgrade should manually escape HTML output.","scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"1.2.24+ds1-1+deb12u5","bookworm-security":"1.2.24+ds1-1+deb12u5"},"fixed_version":"1.2.24+ds1-1+deb12u1","urgency":"not yet assigned"},"bullseye":{"status":"resolved","repositories":{"bullseye":"1.2.16+ds1-2+deb11u3","bullseye-security":"1.2.16+ds1-2+deb11u5"},"fixed_version":"1.2.16+ds1-2+deb11u2","urgency":"not yet assigned"},"forky":{"status":"resolved","repositories":{"forky":"1.2.30+ds1-1"},"fixed_version":"1.2.25+ds1-1","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"1.2.30+ds1-1"},"fixed_version":"1.2.25+ds1-1","urgency":"not yet assigned"},"trixie":{"status":"resolved","repositories":{"trixie":"1.2.30+ds1-1"},"fixed_version":"1.2.25+ds1-1","urgency":"not yet assigned"}}},"CVE-2023-46490":{"description":"SQL Injection vulnerability in Cacti v1.2.25 allows a remote attacker to obtain sensitive information via the form_actions() function in the managers.php function.","debianbug":1059286,"scope":"local","releases":{"bookworm":{"status":"open","repositories":{"bookworm":"1.2.24+ds1-1+deb12u5","bookworm-security":"1.2.24+ds1-1+deb12u5"},"urgency":"not yet assigned","nodsa":"Revisit when more details are available","nodsa_reason":""},"bullseye":{"status":"open","repositories":{"bullseye":"1.2.16+ds1-2+deb11u3","bullseye-security":"1.2.16+ds1-2+deb11u5"},"urgency":"not yet assigned","nodsa":"Revisit when more details are available","nodsa_reason":""},"forky":{"status":"resolved","repositories":{"forky":"1.2.30+ds1-1"},"fixed_version":"1.2.26+ds1-1","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"1.2.30+ds1-1"},"fixed_version":"1.2.26+ds1-1","urgency":"not yet assigned"},"trixie":{"status":"resolved","repositories":{"trixie":"1.2.30+ds1-1"},"fixed_version":"1.2.26+ds1-1","urgency":"not yet assigned"}}},"CVE-2023-49084":{"description":"Cacti is a robust performance and fault management framework and a frontend to RRDTool - a Time Series Database (TSDB). While using the detected SQL Injection and insufficient processing of the include file path, it is possible to execute arbitrary code on the server. Exploitation of the vulnerability is possible for an authorized user. The vulnerable component is the `link.php`. Impact of the vulnerability execution of arbitrary code on the server.","debianbug":1059254,"scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"1.2.24+ds1-1+deb12u5","bookworm-security":"1.2.24+ds1-1+deb12u5"},"fixed_version":"1.2.24+ds1-1+deb12u2","urgency":"not yet assigned"},"bullseye":{"status":"resolved","repositories":{"bullseye":"1.2.16+ds1-2+deb11u3","bullseye-security":"1.2.16+ds1-2+deb11u5"},"fixed_version":"1.2.16+ds1-2+deb11u3","urgency":"not yet assigned"},"forky":{"status":"resolved","repositories":{"forky":"1.2.30+ds1-1"},"fixed_version":"1.2.26+ds1-1","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"1.2.30+ds1-1"},"fixed_version":"1.2.26+ds1-1","urgency":"not yet assigned"},"trixie":{"status":"resolved","repositories":{"trixie":"1.2.30+ds1-1"},"fixed_version":"1.2.26+ds1-1","urgency":"not yet assigned"}}},"CVE-2023-49085":{"description":"Cacti provides an operational monitoring and fault management framework. In versions 1.2.25 and prior, it is possible to execute arbitrary SQL code through the `pollers.php` script. An authorized user may be able to execute arbitrary SQL code. The vulnerable component is the `pollers.php`. Impact of the vulnerability - arbitrary SQL code execution. As of time of publication, a patch does not appear to exist.","scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"1.2.24+ds1-1+deb12u5","bookworm-security":"1.2.24+ds1-1+deb12u5"},"fixed_version":"1.2.24+ds1-1+deb12u2","urgency":"not yet assigned"},"bullseye":{"status":"resolved","repositories":{"bullseye":"1.2.16+ds1-2+deb11u3","bullseye-security":"1.2.16+ds1-2+deb11u5"},"fixed_version":"1.2.16+ds1-2+deb11u3","urgency":"not yet assigned"},"forky":{"status":"resolved","repositories":{"forky":"1.2.30+ds1-1"},"fixed_version":"1.2.26+ds1-1","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"1.2.30+ds1-1"},"fixed_version":"1.2.26+ds1-1","urgency":"not yet assigned"},"trixie":{"status":"resolved","repositories":{"trixie":"1.2.30+ds1-1"},"fixed_version":"1.2.26+ds1-1","urgency":"not yet assigned"}}},"CVE-2023-49086":{"description":"Cacti is a robust performance and fault management framework and a frontend to RRDTool - a Time Series Database (TSDB). A vulnerability in versions prior to 1.2.27 bypasses an earlier fix for CVE-2023-39360, therefore leading to a DOM XSS attack. Exploitation of the vulnerability is possible for an authorized user. The vulnerable component is the `graphs_new.php`. The impact of the vulnerability is execution of arbitrary JavaScript code in the attacked user's browser. This issue has been patched in version 1.2.27.","debianbug":1059254,"scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"1.2.24+ds1-1+deb12u5","bookworm-security":"1.2.24+ds1-1+deb12u5"},"fixed_version":"1.2.24+ds1-1+deb12u2","urgency":"not yet assigned"},"bullseye":{"status":"resolved","repositories":{"bullseye":"1.2.16+ds1-2+deb11u3","bullseye-security":"1.2.16+ds1-2+deb11u5"},"fixed_version":"1.2.16+ds1-2+deb11u3","urgency":"not yet assigned"},"forky":{"status":"resolved","repositories":{"forky":"1.2.30+ds1-1"},"fixed_version":"1.2.26+ds1-1","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"1.2.30+ds1-1"},"fixed_version":"1.2.26+ds1-1","urgency":"not yet assigned"},"trixie":{"status":"resolved","repositories":{"trixie":"1.2.30+ds1-1"},"fixed_version":"1.2.26+ds1-1","urgency":"not yet assigned"}}},"CVE-2023-49088":{"description":"Cacti is an open source operational monitoring and fault management framework. The fix applied for CVE-2023-39515 in version 1.2.25 is incomplete as it enables an adversary to have a victim browser execute malicious code when a victim user hovers their mouse over the malicious data source path in `data_debug.php`. To perform the cross-site scripting attack, the adversary needs to be an authorized cacti user with the following permissions: `General Administration>Sites/Devices/Data`. The victim of this attack could be any account with permissions to view `http://<HOST>/cacti/data_debug.php`. As of time of publication, no complete fix has been included in Cacti.","scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"1.2.24+ds1-1+deb12u5","bookworm-security":"1.2.24+ds1-1+deb12u5"},"fixed_version":"1.2.24+ds1-1+deb12u2","urgency":"not yet assigned"},"bullseye":{"status":"resolved","repositories":{"bullseye":"1.2.16+ds1-2+deb11u3","bullseye-security":"1.2.16+ds1-2+deb11u5"},"fixed_version":"1.2.16+ds1-2+deb11u3","urgency":"not yet assigned"},"forky":{"status":"resolved","repositories":{"forky":"1.2.30+ds1-1"},"fixed_version":"1.2.26+ds1-1","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"1.2.30+ds1-1"},"fixed_version":"1.2.26+ds1-1","urgency":"not yet assigned"},"trixie":{"status":"resolved","repositories":{"trixie":"1.2.30+ds1-1"},"fixed_version":"1.2.26+ds1-1","urgency":"not yet assigned"}}},"CVE-2023-50250":{"description":"Cacti is an open source operational monitoring and fault management framework. A reflection cross-site scripting vulnerability was discovered in version 1.2.25. Attackers can exploit this vulnerability to perform actions on behalf of other users. The vulnerability is found in `templates_import.php.` When uploading an xml template file, if the XML file does not pass the check, the server will give a JavaScript pop-up prompt, which contains unfiltered xml template file name, resulting in XSS. An attacker exploiting this vulnerability could execute actions on behalf of other users. This ability to impersonate users could lead to unauthorized changes to settings. As of time of publication, no patched versions are available.","scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"1.2.24+ds1-1+deb12u5","bookworm-security":"1.2.24+ds1-1+deb12u5"},"fixed_version":"1.2.24+ds1-1+deb12u2","urgency":"not yet assigned"},"bullseye":{"status":"resolved","repositories":{"bullseye":"1.2.16+ds1-2+deb11u3","bullseye-security":"1.2.16+ds1-2+deb11u5"},"fixed_version":"0","urgency":"unimportant"},"forky":{"status":"resolved","repositories":{"forky":"1.2.30+ds1-1"},"fixed_version":"1.2.26+ds1-1","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"1.2.30+ds1-1"},"fixed_version":"1.2.26+ds1-1","urgency":"not yet assigned"},"trixie":{"status":"resolved","repositories":{"trixie":"1.2.30+ds1-1"},"fixed_version":"1.2.26+ds1-1","urgency":"not yet assigned"}}},"CVE-2023-51448":{"description":"Cacti provides an operational monitoring and fault management framework. Version 1.2.25 has a Blind SQL Injection (SQLi) vulnerability within the SNMP Notification Receivers feature in the file `\u2018managers.php\u2019`. An authenticated attacker with the \u201cSettings/Utilities\u201d permission can send a crafted HTTP GET request to the endpoint `\u2018/cacti/managers.php\u2019` with an SQLi payload in the `\u2018selected_graphs_array\u2019` HTTP GET parameter. As of time of publication, no patched versions exist.","scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"1.2.24+ds1-1+deb12u5","bookworm-security":"1.2.24+ds1-1+deb12u5"},"fixed_version":"0","urgency":"unimportant"},"bullseye":{"status":"resolved","repositories":{"bullseye":"1.2.16+ds1-2+deb11u3","bullseye-security":"1.2.16+ds1-2+deb11u5"},"fixed_version":"0","urgency":"unimportant"},"forky":{"status":"resolved","repositories":{"forky":"1.2.30+ds1-1"},"fixed_version":"1.2.26+ds1-1","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"1.2.30+ds1-1"},"fixed_version":"1.2.26+ds1-1","urgency":"not yet assigned"},"trixie":{"status":"resolved","repositories":{"trixie":"1.2.30+ds1-1"},"fixed_version":"1.2.26+ds1-1","urgency":"not yet assigned"}}},"CVE-2024-25641":{"description":"Cacti provides an operational monitoring and fault management framework. Prior to version 1.2.27, an arbitrary file write vulnerability, exploitable through the \"Package Import\" feature, allows authenticated users having the \"Import Templates\" permission to execute arbitrary PHP code on the web server. The vulnerability is located within the `import_package()` function defined into the `/lib/import.php` script. The function blindly trusts the filename and file content provided within the XML data, and writes such files into the Cacti base path (or even outside, since path traversal sequences are not filtered). This can be exploited to write or overwrite arbitrary files on the web server, leading to execution of arbitrary PHP code or other security impacts. Version 1.2.27 contains a patch for this issue.","scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"1.2.24+ds1-1+deb12u5","bookworm-security":"1.2.24+ds1-1+deb12u5"},"fixed_version":"1.2.24+ds1-1+deb12u3","urgency":"not yet assigned"},"bullseye":{"status":"resolved","repositories":{"bullseye":"1.2.16+ds1-2+deb11u3","bullseye-security":"1.2.16+ds1-2+deb11u5"},"fixed_version":"1.2.16+ds1-2+deb11u4","urgency":"not yet assigned"},"forky":{"status":"resolved","repositories":{"forky":"1.2.30+ds1-1"},"fixed_version":"1.2.27+ds1-1","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"1.2.30+ds1-1"},"fixed_version":"1.2.27+ds1-1","urgency":"not yet assigned"},"trixie":{"status":"resolved","repositories":{"trixie":"1.2.30+ds1-1"},"fixed_version":"1.2.27+ds1-1","urgency":"not yet assigned"}}},"CVE-2024-27082":{"description":"Cacti provides an operational monitoring and fault management framework. Versions of Cacti prior to 1.2.27 are vulnerable to stored cross-site scripting, a type of cross-site scripting where malicious scripts are permanently stored on a target server and served to users who access a particular page. Version 1.2.27 contains a patch for the issue.","scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"1.2.24+ds1-1+deb12u5","bookworm-security":"1.2.24+ds1-1+deb12u5"},"fixed_version":"1.2.24+ds1-1+deb12u5","urgency":"not yet assigned"},"bullseye":{"status":"resolved","repositories":{"bullseye":"1.2.16+ds1-2+deb11u3","bullseye-security":"1.2.16+ds1-2+deb11u5"},"fixed_version":"0","urgency":"unimportant"},"forky":{"status":"resolved","repositories":{"forky":"1.2.30+ds1-1"},"fixed_version":"1.2.27+ds1-1","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"1.2.30+ds1-1"},"fixed_version":"1.2.27+ds1-1","urgency":"not yet assigned"},"trixie":{"status":"resolved","repositories":{"trixie":"1.2.30+ds1-1"},"fixed_version":"1.2.27+ds1-1","urgency":"not yet assigned"}}},"CVE-2024-29894":{"description":"Cacti provides an operational monitoring and fault management framework. Versions of Cacti prior to 1.2.27 contain a residual cross-site scripting vulnerability caused by an incomplete fix for CVE-2023-50250. `raise_message_javascript` from `lib/functions.php` now uses purify.js to fix CVE-2023-50250 (among others). However, it still generates the code out of unescaped PHP variables `$title` and `$header`. If those variables contain single quotes, they can be used to inject JavaScript code. An attacker exploiting this vulnerability could execute actions on behalf of other users. This ability to impersonate users could lead to unauthorized changes to settings. Version 1.2.27 fixes this issue.","scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"1.2.24+ds1-1+deb12u5","bookworm-security":"1.2.24+ds1-1+deb12u5"},"fixed_version":"1.2.24+ds1-1+deb12u3","urgency":"not yet assigned"},"bullseye":{"status":"resolved","repositories":{"bullseye":"1.2.16+ds1-2+deb11u3","bullseye-security":"1.2.16+ds1-2+deb11u5"},"fixed_version":"0","urgency":"unimportant"},"forky":{"status":"resolved","repositories":{"forky":"1.2.30+ds1-1"},"fixed_version":"1.2.27+ds1-1","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"1.2.30+ds1-1"},"fixed_version":"1.2.27+ds1-1","urgency":"not yet assigned"},"trixie":{"status":"resolved","repositories":{"trixie":"1.2.30+ds1-1"},"fixed_version":"1.2.27+ds1-1","urgency":"not yet assigned"}}},"CVE-2024-29895":{"description":"Cacti provides an operational monitoring and fault management framework. A command injection vulnerability on the 1.3.x DEV branch allows any unauthenticated user to execute arbitrary command on the server when `register_argc_argv` option of PHP is `On`. In `cmd_realtime.php` line 119, the `$poller_id` used as part of the command execution is sourced from `$_SERVER['argv']`, which can be controlled by URL when `register_argc_argv` option of PHP is `On`. And this option is `On` by default in many environments such as the main PHP Docker image for PHP. Commit 53e8014d1f082034e0646edc6286cde3800c683d contains a patch for the issue, but this commit was reverted in commit 99633903cad0de5ace636249de16f77e57a3c8fc.","scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"1.2.24+ds1-1+deb12u5","bookworm-security":"1.2.24+ds1-1+deb12u5"},"fixed_version":"0","urgency":"unimportant"},"bullseye":{"status":"resolved","repositories":{"bullseye":"1.2.16+ds1-2+deb11u3","bullseye-security":"1.2.16+ds1-2+deb11u5"},"fixed_version":"0","urgency":"unimportant"},"forky":{"status":"resolved","repositories":{"forky":"1.2.30+ds1-1"},"fixed_version":"0","urgency":"unimportant"},"sid":{"status":"resolved","repositories":{"sid":"1.2.30+ds1-1"},"fixed_version":"0","urgency":"unimportant"},"trixie":{"status":"resolved","repositories":{"trixie":"1.2.30+ds1-1"},"fixed_version":"0","urgency":"unimportant"}}},"CVE-2024-30268":{"description":"Cacti provides an operational monitoring and fault management framework. A reflected cross-site scripting vulnerability on the 1.3.x DEV branch allows attackers to obtain cookies of administrator and other users and fake their login using obtained cookies. This issue is fixed in commit a38b9046e9772612fda847b46308f9391a49891e.","scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"1.2.24+ds1-1+deb12u5","bookworm-security":"1.2.24+ds1-1+deb12u5"},"fixed_version":"0","urgency":"unimportant"},"bullseye":{"status":"resolved","repositories":{"bullseye":"1.2.16+ds1-2+deb11u3","bullseye-security":"1.2.16+ds1-2+deb11u5"},"fixed_version":"0","urgency":"unimportant"},"forky":{"status":"resolved","repositories":{"forky":"1.2.30+ds1-1"},"fixed_version":"0","urgency":"unimportant"},"sid":{"status":"resolved","repositories":{"sid":"1.2.30+ds1-1"},"fixed_version":"0","urgency":"unimportant"},"trixie":{"status":"resolved","repositories":{"trixie":"1.2.30+ds1-1"},"fixed_version":"0","urgency":"unimportant"}}},"CVE-2024-31443":{"description":"Cacti provides an operational monitoring and fault management framework. Prior to 1.2.27, some of the data stored in `form_save()` function in `data_queries.php` is not thoroughly checked and is used to concatenate the HTML statement in `grow_right_pane_tree()` function from `lib/html.php` , finally resulting in cross-site scripting. Version 1.2.27 contains a patch for the issue.","scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"1.2.24+ds1-1+deb12u5","bookworm-security":"1.2.24+ds1-1+deb12u5"},"fixed_version":"1.2.24+ds1-1+deb12u3","urgency":"not yet assigned"},"bullseye":{"status":"resolved","repositories":{"bullseye":"1.2.16+ds1-2+deb11u3","bullseye-security":"1.2.16+ds1-2+deb11u5"},"fixed_version":"1.2.16+ds1-2+deb11u4","urgency":"not yet assigned"},"forky":{"status":"resolved","repositories":{"forky":"1.2.30+ds1-1"},"fixed_version":"1.2.27+ds1-1","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"1.2.30+ds1-1"},"fixed_version":"1.2.27+ds1-1","urgency":"not yet assigned"},"trixie":{"status":"resolved","repositories":{"trixie":"1.2.30+ds1-1"},"fixed_version":"1.2.27+ds1-1","urgency":"not yet assigned"}}},"CVE-2024-31444":{"description":"Cacti provides an operational monitoring and fault management framework. Prior to version 1.2.27, some of the data stored in `automation_tree_rules_form_save()` function in `automation_tree_rules.php` is not thoroughly checked and is used to concatenate the HTML statement in `form_confirm()` function from `lib/html.php` , finally resulting in cross-site scripting. Version 1.2.27 contains a patch for the issue.","scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"1.2.24+ds1-1+deb12u5","bookworm-security":"1.2.24+ds1-1+deb12u5"},"fixed_version":"1.2.24+ds1-1+deb12u3","urgency":"not yet assigned"},"bullseye":{"status":"resolved","repositories":{"bullseye":"1.2.16+ds1-2+deb11u3","bullseye-security":"1.2.16+ds1-2+deb11u5"},"fixed_version":"1.2.16+ds1-2+deb11u4","urgency":"not yet assigned"},"forky":{"status":"resolved","repositories":{"forky":"1.2.30+ds1-1"},"fixed_version":"1.2.27+ds1-1","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"1.2.30+ds1-1"},"fixed_version":"1.2.27+ds1-1","urgency":"not yet assigned"},"trixie":{"status":"resolved","repositories":{"trixie":"1.2.30+ds1-1"},"fixed_version":"1.2.27+ds1-1","urgency":"not yet assigned"}}},"CVE-2024-31445":{"description":"Cacti provides an operational monitoring and fault management framework. Prior to version 1.2.27, a SQL injection vulnerability in `automation_get_new_graphs_sql` function of `api_automation.php` allows authenticated users to exploit these SQL injection vulnerabilities to perform privilege escalation and remote code execution. In `api_automation.php` line 856, the `get_request_var('filter')` is being concatenated into the SQL statement without any sanitization. In `api_automation.php` line 717, The filter of `'filter'` is `FILTER_DEFAULT`, which means there is no filter for it. Version 1.2.27 contains a patch for the issue.","scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"1.2.24+ds1-1+deb12u5","bookworm-security":"1.2.24+ds1-1+deb12u5"},"fixed_version":"1.2.24+ds1-1+deb12u3","urgency":"not yet assigned"},"bullseye":{"status":"resolved","repositories":{"bullseye":"1.2.16+ds1-2+deb11u3","bullseye-security":"1.2.16+ds1-2+deb11u5"},"fixed_version":"1.2.16+ds1-2+deb11u4","urgency":"not yet assigned"},"forky":{"status":"resolved","repositories":{"forky":"1.2.30+ds1-1"},"fixed_version":"1.2.27+ds1-1","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"1.2.30+ds1-1"},"fixed_version":"1.2.27+ds1-1","urgency":"not yet assigned"},"trixie":{"status":"resolved","repositories":{"trixie":"1.2.30+ds1-1"},"fixed_version":"1.2.27+ds1-1","urgency":"not yet assigned"}}},"CVE-2024-31458":{"description":"Cacti provides an operational monitoring and fault management framework. Prior to version 1.2.27, some of the data stored in `form_save()` function in `graph_template_inputs.php` is not thoroughly checked and is used to concatenate the SQL statement in `draw_nontemplated_fields_graph_item()` function from `lib/html_form_templates.php` , finally resulting in SQL injection. Version 1.2.27 contains a patch for the issue.","scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"1.2.24+ds1-1+deb12u5","bookworm-security":"1.2.24+ds1-1+deb12u5"},"fixed_version":"1.2.24+ds1-1+deb12u3","urgency":"not yet assigned"},"bullseye":{"status":"resolved","repositories":{"bullseye":"1.2.16+ds1-2+deb11u3","bullseye-security":"1.2.16+ds1-2+deb11u5"},"fixed_version":"1.2.16+ds1-2+deb11u4","urgency":"not yet assigned"},"forky":{"status":"resolved","repositories":{"forky":"1.2.30+ds1-1"},"fixed_version":"1.2.27+ds1-1","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"1.2.30+ds1-1"},"fixed_version":"1.2.27+ds1-1","urgency":"not yet assigned"},"trixie":{"status":"resolved","repositories":{"trixie":"1.2.30+ds1-1"},"fixed_version":"1.2.27+ds1-1","urgency":"not yet assigned"}}},"CVE-2024-31459":{"description":"Cacti provides an operational monitoring and fault management framework. Prior to version 1.2.27, there is a file inclusion issue in the `lib/plugin.php` file. Combined with SQL injection vulnerabilities, remote code execution can be implemented. There is a file inclusion issue with the `api_plugin_hook()` function in the `lib/plugin.php` file, which reads the plugin_hooks and plugin_config tables in database. The read data is directly used to concatenate the file path which is used for file inclusion. Version 1.2.27 contains a patch for the issue.","scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"1.2.24+ds1-1+deb12u5","bookworm-security":"1.2.24+ds1-1+deb12u5"},"fixed_version":"1.2.24+ds1-1+deb12u3","urgency":"not yet assigned"},"bullseye":{"status":"resolved","repositories":{"bullseye":"1.2.16+ds1-2+deb11u3","bullseye-security":"1.2.16+ds1-2+deb11u5"},"fixed_version":"1.2.16+ds1-2+deb11u4","urgency":"not yet assigned"},"forky":{"status":"resolved","repositories":{"forky":"1.2.30+ds1-1"},"fixed_version":"1.2.27+ds1-1","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"1.2.30+ds1-1"},"fixed_version":"1.2.27+ds1-1","urgency":"not yet assigned"},"trixie":{"status":"resolved","repositories":{"trixie":"1.2.30+ds1-1"},"fixed_version":"1.2.27+ds1-1","urgency":"not yet assigned"}}},"CVE-2024-31460":{"description":"Cacti provides an operational monitoring and fault management framework. Prior to version 1.2.27, some of the data stored in `automation_tree_rules.php` is not thoroughly checked and is used to concatenate the SQL statement in `create_all_header_nodes()`  function from `lib/api_automation.php` , finally resulting in SQL injection. Using SQL based secondary injection technology, attackers can modify the contents of the Cacti database, and based on the modified content, it may be possible to achieve further impact, such as arbitrary file reading, and even remote code execution through arbitrary file writing. Version 1.2.27 contains a patch for the issue.","scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"1.2.24+ds1-1+deb12u5","bookworm-security":"1.2.24+ds1-1+deb12u5"},"fixed_version":"1.2.24+ds1-1+deb12u3","urgency":"not yet assigned"},"bullseye":{"status":"resolved","repositories":{"bullseye":"1.2.16+ds1-2+deb11u3","bullseye-security":"1.2.16+ds1-2+deb11u5"},"fixed_version":"1.2.16+ds1-2+deb11u4","urgency":"not yet assigned"},"forky":{"status":"resolved","repositories":{"forky":"1.2.30+ds1-1"},"fixed_version":"1.2.27+ds1-1","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"1.2.30+ds1-1"},"fixed_version":"1.2.27+ds1-1","urgency":"not yet assigned"},"trixie":{"status":"resolved","repositories":{"trixie":"1.2.30+ds1-1"},"fixed_version":"1.2.27+ds1-1","urgency":"not yet assigned"}}},"CVE-2024-34340":{"description":"Cacti provides an operational monitoring and fault management framework. Prior to version 1.2.27, Cacti calls `compat_password_hash` when users set their password. `compat_password_hash` use `password_hash` if there is it, else use `md5`. When verifying password, it calls `compat_password_verify`. In `compat_password_verify`, `password_verify` is called if there is it, else use `md5`. `password_verify` and `password_hash` are supported on PHP < 5.5.0, following PHP manual. The vulnerability is in `compat_password_verify`. Md5-hashed user input is compared with correct password in database by `$md5 == $hash`. It is a loose comparison, not `===`. It is a type juggling vulnerability. Version 1.2.27 contains a patch for the issue.","scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"1.2.24+ds1-1+deb12u5","bookworm-security":"1.2.24+ds1-1+deb12u5"},"fixed_version":"1.2.24+ds1-1+deb12u3","urgency":"not yet assigned"},"bullseye":{"status":"resolved","repositories":{"bullseye":"1.2.16+ds1-2+deb11u3","bullseye-security":"1.2.16+ds1-2+deb11u5"},"fixed_version":"1.2.16+ds1-2+deb11u4","urgency":"not yet assigned"},"forky":{"status":"resolved","repositories":{"forky":"1.2.30+ds1-1"},"fixed_version":"1.2.27+ds1-1","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"1.2.30+ds1-1"},"fixed_version":"1.2.27+ds1-1","urgency":"not yet assigned"},"trixie":{"status":"resolved","repositories":{"trixie":"1.2.30+ds1-1"},"fixed_version":"1.2.27+ds1-1","urgency":"not yet assigned"}}},"CVE-2024-43362":{"description":"Cacti is an open source performance and fault management framework. The `fileurl` parameter is not properly sanitized when saving external links in `links.php` . Morever, the said fileurl is placed in some html code which is passed to the `print` function in `link.php` and `index.php`, finally leading to stored XSS. Users with the privilege to create external links can manipulate the `fileurl` parameter in the http post request while creating external links to perform stored XSS attacks. The vulnerability known as XSS (Cross-Site Scripting) occurs when an application allows untrusted user input to be displayed on a web page without proper validation or escaping. This issue has been addressed in release version 1.2.28. All users are advised to upgrade. There are no known workarounds for this issue.","scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"1.2.24+ds1-1+deb12u5","bookworm-security":"1.2.24+ds1-1+deb12u5"},"fixed_version":"1.2.24+ds1-1+deb12u5","urgency":"not yet assigned"},"bullseye":{"status":"resolved","repositories":{"bullseye":"1.2.16+ds1-2+deb11u3","bullseye-security":"1.2.16+ds1-2+deb11u5"},"fixed_version":"1.2.16+ds1-2+deb11u5","urgency":"not yet assigned"},"forky":{"status":"resolved","repositories":{"forky":"1.2.30+ds1-1"},"fixed_version":"1.2.28+ds1-1","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"1.2.30+ds1-1"},"fixed_version":"1.2.28+ds1-1","urgency":"not yet assigned"},"trixie":{"status":"resolved","repositories":{"trixie":"1.2.30+ds1-1"},"fixed_version":"1.2.28+ds1-1","urgency":"not yet assigned"}}},"CVE-2024-43363":{"description":"Cacti is an open source performance and fault management framework. An admin user can create a device with a malicious hostname containing php code and repeat the installation process (completing only step 5 of the installation process is enough, no need to complete the steps before or after it) to use a php file as the cacti log file. After having the malicious hostname end up in the logs (log poisoning), one can simply go to the log file url to execute commands to achieve RCE. This issue has been addressed in version 1.2.28 and all users are advised to upgrade. There are no known workarounds for this vulnerability.","scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"1.2.24+ds1-1+deb12u5","bookworm-security":"1.2.24+ds1-1+deb12u5"},"fixed_version":"1.2.24+ds1-1+deb12u5","urgency":"not yet assigned"},"bullseye":{"status":"resolved","repositories":{"bullseye":"1.2.16+ds1-2+deb11u3","bullseye-security":"1.2.16+ds1-2+deb11u5"},"fixed_version":"1.2.16+ds1-2+deb11u5","urgency":"not yet assigned"},"forky":{"status":"resolved","repositories":{"forky":"1.2.30+ds1-1"},"fixed_version":"1.2.28+ds1-1","urgency":"unimportant"},"sid":{"status":"resolved","repositories":{"sid":"1.2.30+ds1-1"},"fixed_version":"1.2.28+ds1-1","urgency":"unimportant"},"trixie":{"status":"resolved","repositories":{"trixie":"1.2.30+ds1-1"},"fixed_version":"1.2.28+ds1-1","urgency":"unimportant"}}},"CVE-2024-43364":{"description":"Cacti is an open source performance and fault management framework. The `title` parameter is not properly sanitized when saving external links in links.php . Morever, the said title parameter is stored in the database and reflected back to user in index.php, finally leading to stored XSS. Users with the privilege to create external links can manipulate the `title` parameter in the http post request while creating external links to perform stored XSS attacks. The vulnerability known as XSS (Cross-Site Scripting) occurs when an application allows untrusted user input to be displayed on a web page without proper validation or escaping. This issue has been addressed in release version 1.2.28. All users are advised to upgrade. There are no known workarounds for this vulnerability.","scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"1.2.24+ds1-1+deb12u5","bookworm-security":"1.2.24+ds1-1+deb12u5"},"fixed_version":"1.2.24+ds1-1+deb12u5","urgency":"not yet assigned"},"bullseye":{"status":"resolved","repositories":{"bullseye":"1.2.16+ds1-2+deb11u3","bullseye-security":"1.2.16+ds1-2+deb11u5"},"fixed_version":"1.2.16+ds1-2+deb11u5","urgency":"not yet assigned"},"forky":{"status":"resolved","repositories":{"forky":"1.2.30+ds1-1"},"fixed_version":"1.2.28+ds1-1","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"1.2.30+ds1-1"},"fixed_version":"1.2.28+ds1-1","urgency":"not yet assigned"},"trixie":{"status":"resolved","repositories":{"trixie":"1.2.30+ds1-1"},"fixed_version":"1.2.28+ds1-1","urgency":"not yet assigned"}}},"CVE-2024-43365":{"description":"Cacti is an open source performance and fault management framework. The`consolenewsection` parameter is not properly sanitized when saving external links in links.php . Morever, the said consolenewsection parameter is stored in the database and reflected back to user in `index.php`, finally leading to stored XSS. Users with the privilege to create external links can manipulate the \u201cconsolenewsection\u201d parameter in the http post request while creating external links to perform stored XSS attacks. The vulnerability known as XSS (Cross-Site Scripting) occurs when an application allows untrusted user input to be displayed on a web page without proper validation or escaping. This issue has been addressed in release version 1.2.28. All users are advised to upgrade. There are no known workarounds for this vulnerability.","scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"1.2.24+ds1-1+deb12u5","bookworm-security":"1.2.24+ds1-1+deb12u5"},"fixed_version":"1.2.24+ds1-1+deb12u5","urgency":"not yet assigned"},"bullseye":{"status":"resolved","repositories":{"bullseye":"1.2.16+ds1-2+deb11u3","bullseye-security":"1.2.16+ds1-2+deb11u5"},"fixed_version":"1.2.16+ds1-2+deb11u5","urgency":"not yet assigned"},"forky":{"status":"resolved","repositories":{"forky":"1.2.30+ds1-1"},"fixed_version":"1.2.28+ds1-1","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"1.2.30+ds1-1"},"fixed_version":"1.2.28+ds1-1","urgency":"not yet assigned"},"trixie":{"status":"resolved","repositories":{"trixie":"1.2.30+ds1-1"},"fixed_version":"1.2.28+ds1-1","urgency":"not yet assigned"}}},"CVE-2024-45598":{"description":"Cacti is an open source performance and fault management framework. Prior to 1.2.29, an administrator can change the `Poller Standard Error Log Path` parameter in either Installation Step 5 or in Configuration->Settings->Paths tab to a local file inside the server. Then simply going to Logs tab and selecting the name of the local file will show its content on the web UI. This vulnerability is fixed in 1.2.29.","debianbug":1094574,"scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"1.2.24+ds1-1+deb12u5","bookworm-security":"1.2.24+ds1-1+deb12u5"},"fixed_version":"1.2.24+ds1-1+deb12u5","urgency":"not yet assigned"},"bullseye":{"status":"resolved","repositories":{"bullseye":"1.2.16+ds1-2+deb11u3","bullseye-security":"1.2.16+ds1-2+deb11u5"},"fixed_version":"1.2.16+ds1-2+deb11u5","urgency":"not yet assigned"},"forky":{"status":"resolved","repositories":{"forky":"1.2.30+ds1-1"},"fixed_version":"1.2.28+ds1-4","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"1.2.30+ds1-1"},"fixed_version":"1.2.28+ds1-4","urgency":"not yet assigned"},"trixie":{"status":"resolved","repositories":{"trixie":"1.2.30+ds1-1"},"fixed_version":"1.2.28+ds1-4","urgency":"not yet assigned"}}},"CVE-2024-47875":{"description":"DOMPurify is a DOM-only, super-fast, uber-tolerant XSS sanitizer for HTML, MathML and SVG. DOMpurify was vulnerable to nesting-based mXSS. This vulnerability is fixed in 2.5.0 and 3.1.3.","scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"1.2.24+ds1-1+deb12u5","bookworm-security":"1.2.24+ds1-1+deb12u5"},"fixed_version":"1.2.24+ds1-1+deb12u2","urgency":"not yet assigned"},"bullseye":{"status":"resolved","repositories":{"bullseye":"1.2.16+ds1-2+deb11u3","bullseye-security":"1.2.16+ds1-2+deb11u5"},"fixed_version":"1.2.16+ds1-2+deb11u5","urgency":"not yet assigned"},"forky":{"status":"resolved","repositories":{"forky":"1.2.30+ds1-1"},"fixed_version":"1.2.26+ds1-1","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"1.2.30+ds1-1"},"fixed_version":"1.2.26+ds1-1","urgency":"not yet assigned"},"trixie":{"status":"resolved","repositories":{"trixie":"1.2.30+ds1-1"},"fixed_version":"1.2.26+ds1-1","urgency":"not yet assigned"}}},"CVE-2024-48910":{"description":"DOMPurify is a DOM-only, super-fast, uber-tolerant XSS sanitizer for HTML, MathML and SVG. DOMPurify was vulnerable to prototype pollution. This vulnerability is fixed in 2.4.2.","scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"1.2.24+ds1-1+deb12u5","bookworm-security":"1.2.24+ds1-1+deb12u5"},"fixed_version":"1.2.24+ds1-1+deb12u2","urgency":"not yet assigned"},"bullseye":{"status":"resolved","repositories":{"bullseye":"1.2.16+ds1-2+deb11u3","bullseye-security":"1.2.16+ds1-2+deb11u5"},"fixed_version":"1.2.16+ds1-2+deb11u5","urgency":"not yet assigned"},"forky":{"status":"resolved","repositories":{"forky":"1.2.30+ds1-1"},"fixed_version":"1.2.26+ds1-1","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"1.2.30+ds1-1"},"fixed_version":"1.2.26+ds1-1","urgency":"not yet assigned"},"trixie":{"status":"resolved","repositories":{"trixie":"1.2.30+ds1-1"},"fixed_version":"1.2.26+ds1-1","urgency":"not yet assigned"}}},"CVE-2024-54145":{"description":"Cacti is an open source performance and fault management framework. Cacti has a SQL injection vulnerability in the get_discovery_results function of automation_devices.php using the network parameter. This vulnerability is fixed in 1.2.29.","debianbug":1094574,"scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"1.2.24+ds1-1+deb12u5","bookworm-security":"1.2.24+ds1-1+deb12u5"},"fixed_version":"1.2.24+ds1-1+deb12u5","urgency":"not yet assigned"},"bullseye":{"status":"resolved","repositories":{"bullseye":"1.2.16+ds1-2+deb11u3","bullseye-security":"1.2.16+ds1-2+deb11u5"},"fixed_version":"1.2.16+ds1-2+deb11u5","urgency":"not yet assigned"},"forky":{"status":"resolved","repositories":{"forky":"1.2.30+ds1-1"},"fixed_version":"1.2.28+ds1-4","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"1.2.30+ds1-1"},"fixed_version":"1.2.28+ds1-4","urgency":"not yet assigned"},"trixie":{"status":"resolved","repositories":{"trixie":"1.2.30+ds1-1"},"fixed_version":"1.2.28+ds1-4","urgency":"not yet assigned"}}},"CVE-2024-54146":{"description":"Cacti is an open source performance and fault management framework. Cacti has a SQL injection vulnerability in the template function of host_templates.php using the graph_template parameter. This vulnerability is fixed in 1.2.29.","debianbug":1094574,"scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"1.2.24+ds1-1+deb12u5","bookworm-security":"1.2.24+ds1-1+deb12u5"},"fixed_version":"0","urgency":"unimportant"},"bullseye":{"status":"resolved","repositories":{"bullseye":"1.2.16+ds1-2+deb11u3","bullseye-security":"1.2.16+ds1-2+deb11u5"},"fixed_version":"0","urgency":"unimportant"},"forky":{"status":"resolved","repositories":{"forky":"1.2.30+ds1-1"},"fixed_version":"1.2.28+ds1-4","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"1.2.30+ds1-1"},"fixed_version":"1.2.28+ds1-4","urgency":"not yet assigned"},"trixie":{"status":"resolved","repositories":{"trixie":"1.2.30+ds1-1"},"fixed_version":"1.2.28+ds1-4","urgency":"not yet assigned"}}},"CVE-2025-22604":{"description":"Cacti is an open source performance and fault management framework. Due to a flaw in multi-line SNMP result parser, authenticated users can inject malformed OIDs in the response. When processed by ss_net_snmp_disk_io() or ss_net_snmp_disk_bytes(), a part of each OID will be used as a key in an array that is used as part of a system command, causing a command execution vulnerability. This vulnerability is fixed in 1.2.29.","debianbug":1094574,"scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"1.2.24+ds1-1+deb12u5","bookworm-security":"1.2.24+ds1-1+deb12u5"},"fixed_version":"1.2.24+ds1-1+deb12u5","urgency":"not yet assigned"},"bullseye":{"status":"resolved","repositories":{"bullseye":"1.2.16+ds1-2+deb11u3","bullseye-security":"1.2.16+ds1-2+deb11u5"},"fixed_version":"1.2.16+ds1-2+deb11u5","urgency":"not yet assigned"},"forky":{"status":"resolved","repositories":{"forky":"1.2.30+ds1-1"},"fixed_version":"1.2.28+ds1-4","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"1.2.30+ds1-1"},"fixed_version":"1.2.28+ds1-4","urgency":"not yet assigned"},"trixie":{"status":"resolved","repositories":{"trixie":"1.2.30+ds1-1"},"fixed_version":"1.2.28+ds1-4","urgency":"not yet assigned"}}},"CVE-2025-24367":{"description":"Cacti is an open source performance and fault management framework. An authenticated Cacti user can abuse graph creation and graph template functionality to create arbitrary PHP scripts in the web root of the application, leading to remote code execution on the server. This vulnerability is fixed in 1.2.29.","debianbug":1094574,"scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"1.2.24+ds1-1+deb12u5","bookworm-security":"1.2.24+ds1-1+deb12u5"},"fixed_version":"1.2.24+ds1-1+deb12u5","urgency":"not yet assigned"},"bullseye":{"status":"resolved","repositories":{"bullseye":"1.2.16+ds1-2+deb11u3","bullseye-security":"1.2.16+ds1-2+deb11u5"},"fixed_version":"1.2.16+ds1-2+deb11u5","urgency":"not yet assigned"},"forky":{"status":"resolved","repositories":{"forky":"1.2.30+ds1-1"},"fixed_version":"1.2.28+ds1-4","urgency":"unimportant"},"sid":{"status":"resolved","repositories":{"sid":"1.2.30+ds1-1"},"fixed_version":"1.2.28+ds1-4","urgency":"unimportant"},"trixie":{"status":"resolved","repositories":{"trixie":"1.2.30+ds1-1"},"fixed_version":"1.2.28+ds1-4","urgency":"unimportant"}}},"CVE-2025-24368":{"description":"Cacti is an open source performance and fault management framework. Some of the data stored in automation_tree_rules.php is not thoroughly checked and is used to concatenate the SQL statement in build_rule_item_filter() function from lib/api_automation.php, resulting in SQL injection. This vulnerability is fixed in 1.2.29.","debianbug":1094574,"scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"1.2.24+ds1-1+deb12u5","bookworm-security":"1.2.24+ds1-1+deb12u5"},"fixed_version":"1.2.24+ds1-1+deb12u5","urgency":"not yet assigned"},"bullseye":{"status":"resolved","repositories":{"bullseye":"1.2.16+ds1-2+deb11u3","bullseye-security":"1.2.16+ds1-2+deb11u5"},"fixed_version":"1.2.16+ds1-2+deb11u5","urgency":"not yet assigned"},"forky":{"status":"resolved","repositories":{"forky":"1.2.30+ds1-1"},"fixed_version":"1.2.28+ds1-4","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"1.2.30+ds1-1"},"fixed_version":"1.2.28+ds1-4","urgency":"not yet assigned"},"trixie":{"status":"resolved","repositories":{"trixie":"1.2.30+ds1-1"},"fixed_version":"1.2.28+ds1-4","urgency":"not yet assigned"}}},"CVE-2025-26520":{"description":"Cacti through 1.2.29 allows SQL injection in the template function in host_templates.php via the graph_template parameter. NOTE: this issue exists because of an incomplete fix for CVE-2024-54146.","debianbug":1095721,"scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"1.2.24+ds1-1+deb12u5","bookworm-security":"1.2.24+ds1-1+deb12u5"},"fixed_version":"0","urgency":"unimportant"},"bullseye":{"status":"resolved","repositories":{"bullseye":"1.2.16+ds1-2+deb11u3","bullseye-security":"1.2.16+ds1-2+deb11u5"},"fixed_version":"0","urgency":"unimportant"},"forky":{"status":"resolved","repositories":{"forky":"1.2.30+ds1-1"},"fixed_version":"1.2.30+ds1-1","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"1.2.30+ds1-1"},"fixed_version":"1.2.30+ds1-1","urgency":"not yet assigned"},"trixie":{"status":"resolved","repositories":{"trixie":"1.2.30+ds1-1"},"fixed_version":"1.2.30+ds1-1","urgency":"not yet assigned"}}},"CVE-2025-45160":{"description":"A HTML injection vulnerability exists in the file upload functionality of Cacti <= 1.2.29. When a file with an invalid format is uploaded, the application reflects the submitted filename back into an error popup without proper sanitization. As a result, attackers can inject arbitrary HTML elements (e.g., <h1>, <b>, <svg>) into the rendered page. NOTE: Multiple third-parties including the maintainer have stated that they cannot reproduce this issue after 1.2.27.","scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"1.2.24+ds1-1+deb12u5","bookworm-security":"1.2.24+ds1-1+deb12u5"},"fixed_version":"1.2.24+ds1-1+deb12u3","urgency":"not yet assigned"},"bullseye":{"status":"open","repositories":{"bullseye":"1.2.16+ds1-2+deb11u3","bullseye-security":"1.2.16+ds1-2+deb11u5"},"urgency":"not yet assigned","nodsa":"Minor issue, reflected XSS, no JavaScript","nodsa_reason":"postponed"},"forky":{"status":"resolved","repositories":{"forky":"1.2.30+ds1-1"},"fixed_version":"1.2.27+ds1-1","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"1.2.30+ds1-1"},"fixed_version":"1.2.27+ds1-1","urgency":"not yet assigned"},"trixie":{"status":"resolved","repositories":{"trixie":"1.2.30+ds1-1"},"fixed_version":"1.2.27+ds1-1","urgency":"not yet assigned"}}},"CVE-2025-66399":{"description":"Cacti is an open source performance and fault management framework. Prior to 1.2.29, there is an input-validation flaw in the SNMP device configuration functionality. An authenticated Cacti user can supply crafted SNMP community strings containing control characters (including newlines) that are accepted, stored verbatim in the database, and later embedded into backend SNMP operations. In environments where downstream SNMP tooling or wrappers interpret newline-separated tokens as command boundaries, this can lead to unintended command execution with the privileges of the Cacti process. This vulnerability is fixed in 1.2.29.","scope":"local","releases":{"bookworm":{"status":"open","repositories":{"bookworm":"1.2.24+ds1-1+deb12u5","bookworm-security":"1.2.24+ds1-1+deb12u5"},"urgency":"not yet assigned","nodsa":"Minor issue","nodsa_reason":""},"bullseye":{"status":"open","repositories":{"bullseye":"1.2.16+ds1-2+deb11u3","bullseye-security":"1.2.16+ds1-2+deb11u5"},"urgency":"not yet assigned","nodsa":"Minor issue, proactive validation for external tools","nodsa_reason":"postponed"},"forky":{"status":"resolved","repositories":{"forky":"1.2.30+ds1-1"},"fixed_version":"1.2.30+ds1-1","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"1.2.30+ds1-1"},"fixed_version":"1.2.30+ds1-1","urgency":"not yet assigned"},"trixie":{"status":"resolved","repositories":{"trixie":"1.2.30+ds1-1"},"fixed_version":"1.2.30+ds1-1","urgency":"not yet assigned","nodsa":"Minor issue","nodsa_reason":""}}},"TEMP-0000000-018938":{"releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"1.2.24+ds1-1+deb12u5","bookworm-security":"1.2.24+ds1-1+deb12u5"},"fixed_version":"0.8.8e+ds1-1","urgency":"not yet assigned"},"bullseye":{"status":"resolved","repositories":{"bullseye":"1.2.16+ds1-2+deb11u3","bullseye-security":"1.2.16+ds1-2+deb11u5"},"fixed_version":"0.8.8e+ds1-1","urgency":"not yet assigned"},"forky":{"status":"resolved","repositories":{"forky":"1.2.30+ds1-1"},"fixed_version":"0.8.8e+ds1-1","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"1.2.30+ds1-1"},"fixed_version":"0.8.8e+ds1-1","urgency":"not yet assigned"},"trixie":{"status":"resolved","repositories":{"trixie":"1.2.30+ds1-1"},"fixed_version":"0.8.8e+ds1-1","urgency":"not yet assigned"}}},"TEMP-0000000-AA638E":{"releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"1.2.24+ds1-1+deb12u5","bookworm-security":"1.2.24+ds1-1+deb12u5"},"fixed_version":"0.8.8e+ds1-1","urgency":"not yet assigned"},"bullseye":{"status":"resolved","repositories":{"bullseye":"1.2.16+ds1-2+deb11u3","bullseye-security":"1.2.16+ds1-2+deb11u5"},"fixed_version":"0.8.8e+ds1-1","urgency":"not yet assigned"},"forky":{"status":"resolved","repositories":{"forky":"1.2.30+ds1-1"},"fixed_version":"0.8.8e+ds1-1","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"1.2.30+ds1-1"},"fixed_version":"0.8.8e+ds1-1","urgency":"not yet assigned"},"trixie":{"status":"resolved","repositories":{"trixie":"1.2.30+ds1-1"},"fixed_version":"0.8.8e+ds1-1","urgency":"not yet assigned"}}},"TEMP-0000000-E43D47":{"releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"1.2.24+ds1-1+deb12u5","bookworm-security":"1.2.24+ds1-1+deb12u5"},"fixed_version":"0.8.8e+ds1-1","urgency":"not yet assigned"},"bullseye":{"status":"resolved","repositories":{"bullseye":"1.2.16+ds1-2+deb11u3","bullseye-security":"1.2.16+ds1-2+deb11u5"},"fixed_version":"0.8.8e+ds1-1","urgency":"not yet assigned"},"forky":{"status":"resolved","repositories":{"forky":"1.2.30+ds1-1"},"fixed_version":"0.8.8e+ds1-1","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"1.2.30+ds1-1"},"fixed_version":"0.8.8e+ds1-1","urgency":"not yet assigned"},"trixie":{"status":"resolved","repositories":{"trixie":"1.2.30+ds1-1"},"fixed_version":"0.8.8e+ds1-1","urgency":"not yet assigned"}}},"TEMP-0000000-EFA573":{"releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"1.2.24+ds1-1+deb12u5","bookworm-security":"1.2.24+ds1-1+deb12u5"},"fixed_version":"0.8.8e+ds1-1","urgency":"not yet assigned"},"bullseye":{"status":"resolved","repositories":{"bullseye":"1.2.16+ds1-2+deb11u3","bullseye-security":"1.2.16+ds1-2+deb11u5"},"fixed_version":"0.8.8e+ds1-1","urgency":"not yet assigned"},"forky":{"status":"resolved","repositories":{"forky":"1.2.30+ds1-1"},"fixed_version":"0.8.8e+ds1-1","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"1.2.30+ds1-1"},"fixed_version":"0.8.8e+ds1-1","urgency":"not yet assigned"},"trixie":{"status":"resolved","repositories":{"trixie":"1.2.30+ds1-1"},"fixed_version":"0.8.8e+ds1-1","urgency":"not yet assigned"}}},"TEMP-0000000-F32736":{"releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"1.2.24+ds1-1+deb12u5","bookworm-security":"1.2.24+ds1-1+deb12u5"},"fixed_version":"0.8.8e+ds1-1","urgency":"not yet assigned"},"bullseye":{"status":"resolved","repositories":{"bullseye":"1.2.16+ds1-2+deb11u3","bullseye-security":"1.2.16+ds1-2+deb11u5"},"fixed_version":"0.8.8e+ds1-1","urgency":"not yet assigned"},"forky":{"status":"resolved","repositories":{"forky":"1.2.30+ds1-1"},"fixed_version":"0.8.8e+ds1-1","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"1.2.30+ds1-1"},"fixed_version":"0.8.8e+ds1-1","urgency":"not yet assigned"},"trixie":{"status":"resolved","repositories":{"trixie":"1.2.30+ds1-1"},"fixed_version":"0.8.8e+ds1-1","urgency":"not yet assigned"}}},"TEMP-0000000-F6033C":{"releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"1.2.24+ds1-1+deb12u5","bookworm-security":"1.2.24+ds1-1+deb12u5"},"fixed_version":"0.8.8e+ds1-1","urgency":"not yet assigned"},"bullseye":{"status":"resolved","repositories":{"bullseye":"1.2.16+ds1-2+deb11u3","bullseye-security":"1.2.16+ds1-2+deb11u5"},"fixed_version":"0.8.8e+ds1-1","urgency":"not yet assigned"},"forky":{"status":"resolved","repositories":{"forky":"1.2.30+ds1-1"},"fixed_version":"0.8.8e+ds1-1","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"1.2.30+ds1-1"},"fixed_version":"0.8.8e+ds1-1","urgency":"not yet assigned"},"trixie":{"status":"resolved","repositories":{"trixie":"1.2.30+ds1-1"},"fixed_version":"0.8.8e+ds1-1","urgency":"not yet assigned"}}}},"cadaver":{"CVE-2004-0398":{"description":"Heap-based buffer overflow in the ne_rfc1036_parse date parsing function for the neon library (libneon) 0.24.5 and earlier, as used by cadaver before 0.22, allows remote WebDAV servers to execute arbitrary code on the client.","scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"0.24+dfsg-1"},"fixed_version":"0.22.1-3","urgency":"not yet assigned"},"bullseye":{"status":"resolved","repositories":{"bullseye":"0.23.3-2.1"},"fixed_version":"0.22.1-3","urgency":"not yet assigned"},"forky":{"status":"resolved","repositories":{"forky":"0.28+dfsg-2"},"fixed_version":"0.22.1-3","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"0.28+dfsg-2"},"fixed_version":"0.22.1-3","urgency":"not yet assigned"},"trixie":{"status":"resolved","repositories":{"trixie":"0.26+dfsg-2"},"fixed_version":"0.22.1-3","urgency":"not yet assigned"}}},"CVE-2009-3560":{"description":"The big2_toUtf8 function in lib/xmltok.c in libexpat in Expat 2.0.1, as used in the XML-Twig module for Perl, allows context-dependent attackers to cause a denial of service (application crash) via an XML document with malformed UTF-8 sequences that trigger a buffer over-read, related to the doProlog function in lib/xmlparse.c, a different vulnerability than CVE-2009-2625 and CVE-2009-3720.","debianbug":560926,"scope":"local","releases":{"bookworm":{"status":"open","repositories":{"bookworm":"0.24+dfsg-1"},"urgency":"unimportant"},"bullseye":{"status":"open","repositories":{"bullseye":"0.23.3-2.1"},"urgency":"unimportant"},"forky":{"status":"open","repositories":{"forky":"0.28+dfsg-2"},"urgency":"unimportant"},"sid":{"status":"open","repositories":{"sid":"0.28+dfsg-2"},"urgency":"unimportant"},"trixie":{"status":"open","repositories":{"trixie":"0.26+dfsg-2"},"urgency":"unimportant"}}},"CVE-2009-3720":{"description":"The updatePosition function in lib/xmltok_impl.c in libexpat in Expat 2.0.1, as used in Python, PyXML, w3c-libwww, and other software, allows context-dependent attackers to cause a denial of service (application crash) via an XML document with crafted UTF-8 sequences that trigger a buffer over-read, a different vulnerability than CVE-2009-2625.","debianbug":560926,"scope":"local","releases":{"bookworm":{"status":"open","repositories":{"bookworm":"0.24+dfsg-1"},"urgency":"unimportant"},"bullseye":{"status":"open","repositories":{"bullseye":"0.23.3-2.1"},"urgency":"unimportant"},"forky":{"status":"open","repositories":{"forky":"0.28+dfsg-2"},"urgency":"unimportant"},"sid":{"status":"open","repositories":{"sid":"0.28+dfsg-2"},"urgency":"unimportant"},"trixie":{"status":"open","repositories":{"trixie":"0.26+dfsg-2"},"urgency":"unimportant"}}}},"caddy":{"CVE-2018-19148":{"description":"Caddy through 0.11.0 sends incorrect certificates for certain invalid requests, making it easier for attackers to enumerate hostnames. Specifically, when unable to match a Host header with a vhost in its configuration, it serves the X.509 certificate for a randomly selected vhost in its configuration. Repeated requests (with a nonexistent hostname in the Host header) permit full enumeration of all certificates on the server. This generally permits an attacker to easily and accurately discover the existence of and relationships among hostnames that weren't meant to be public, though this information could likely have been discovered via other methods with additional effort.","scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"2.6.2-5"},"fixed_version":"0","urgency":"unimportant"},"sid":{"status":"resolved","repositories":{"sid":"2.6.2-14"},"fixed_version":"0","urgency":"unimportant"},"trixie":{"status":"resolved","repositories":{"trixie":"2.6.2-12"},"fixed_version":"0","urgency":"unimportant"}}},"CVE-2018-21246":{"description":"Caddy before 0.10.13 mishandles TLS client authentication, as demonstrated by an authentication bypass caused by the lack of the StrictHostMatching mode.","scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"2.6.2-5"},"fixed_version":"0","urgency":"unimportant"},"sid":{"status":"resolved","repositories":{"sid":"2.6.2-14"},"fixed_version":"0","urgency":"unimportant"},"trixie":{"status":"resolved","repositories":{"trixie":"2.6.2-12"},"fixed_version":"0","urgency":"unimportant"}}},"CVE-2022-28923":{"description":"Caddy v2.4.6 was discovered to contain an open redirection vulnerability which allows attackers to redirect users to phishing websites via crafted URLs.","scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"2.6.2-5"},"fixed_version":"2.5.2-1","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"2.6.2-14"},"fixed_version":"2.5.2-1","urgency":"not yet assigned"},"trixie":{"status":"resolved","repositories":{"trixie":"2.6.2-12"},"fixed_version":"2.5.2-1","urgency":"not yet assigned"}}},"CVE-2022-29718":{"description":"Caddy v2.4 was discovered to contain an open redirect vulnerability. A remote unauthenticated attacker may exploit this vulnerability to redirect users to arbitrary web URLs by tricking the victim users to click on crafted links.","scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"2.6.2-5"},"fixed_version":"0","urgency":"unimportant"},"sid":{"status":"resolved","repositories":{"sid":"2.6.2-14"},"fixed_version":"0","urgency":"unimportant"},"trixie":{"status":"resolved","repositories":{"trixie":"2.6.2-12"},"fixed_version":"0","urgency":"unimportant"}}},"CVE-2026-27585":{"description":"Caddy is an extensible server platform that uses TLS by default. Prior to version 2.11.1, the path sanitization routine in file matcher doesn't sanitize backslashes which can lead to bypassing path related security protections. It affects users with specific Caddy and environment configurations. Version 2.11.1 fixes the issue.","scope":"local","releases":{"bookworm":{"status":"open","repositories":{"bookworm":"2.6.2-5"},"urgency":"not yet assigned"},"sid":{"status":"open","repositories":{"sid":"2.6.2-14"},"urgency":"not yet assigned"},"trixie":{"status":"open","repositories":{"trixie":"2.6.2-12"},"urgency":"not yet assigned"}}},"CVE-2026-27586":{"description":"Caddy is an extensible server platform that uses TLS by default. Prior to version 2.11.1, two swallowed errors in `ClientAuthentication.provision()` cause mTLS client certificate authentication to silently fail open when a CA certificate file is missing, unreadable, or malformed. The server starts without error but accepts any client certificate signed by any system-trusted CA, completely bypassing the intended private CA trust boundary. Any deployment using `trusted_ca_cert_file` or `trusted_ca_certs_pem_files` for mTLS will silently degrade to accepting any system-trusted client certificate if the CA file becomes unavailable. This can happen due to a typo in the path, file rotation, corruption, or permission changes. The server gives no indication that mTLS is misconfigured. Version 2.11.1 fixes the vulnerability.","scope":"local","releases":{"bookworm":{"status":"open","repositories":{"bookworm":"2.6.2-5"},"urgency":"not yet assigned"},"sid":{"status":"open","repositories":{"sid":"2.6.2-14"},"urgency":"not yet assigned"},"trixie":{"status":"open","repositories":{"trixie":"2.6.2-12"},"urgency":"not yet assigned"}}},"CVE-2026-27587":{"description":"Caddy is an extensible server platform that uses TLS by default. Prior to version 2.11.1, Caddy's HTTP `path` request matcher is intended to be case-insensitive, but when the match pattern contains percent-escape sequences (`%xx`) it compares against the request's escaped path without lowercasing. An attacker can bypass path-based routing and any access controls attached to that route by changing the casing of the request path. Version 2.11.1 contains a fix for the issue.","scope":"local","releases":{"bookworm":{"status":"open","repositories":{"bookworm":"2.6.2-5"},"urgency":"not yet assigned"},"sid":{"status":"open","repositories":{"sid":"2.6.2-14"},"urgency":"not yet assigned"},"trixie":{"status":"open","repositories":{"trixie":"2.6.2-12"},"urgency":"not yet assigned"}}},"CVE-2026-27588":{"description":"Caddy is an extensible server platform that uses TLS by default. Prior to version 2.11.1, Caddy's HTTP `host` request matcher is documented as case-insensitive, but when configured with a large host list (>100 entries) it becomes case-sensitive due to an optimized matching path. An attacker can bypass host-based routing and any access controls attached to that route by changing the casing of the `Host` header. Version 2.11.1 contains a fix for the issue.","scope":"local","releases":{"bookworm":{"status":"open","repositories":{"bookworm":"2.6.2-5"},"urgency":"not yet assigned"},"sid":{"status":"open","repositories":{"sid":"2.6.2-14"},"urgency":"not yet assigned"},"trixie":{"status":"open","repositories":{"trixie":"2.6.2-12"},"urgency":"not yet assigned"}}},"CVE-2026-27589":{"description":"Caddy is an extensible server platform that uses TLS by default. Prior to version 2.11.1, the local caddy admin API (default listen `127.0.0.1:2019`) exposes a state-changing `POST /load` endpoint that replaces the entire running configuration. When origin enforcement is not enabled (`enforce_origin` not configured), the admin endpoint accepts cross-origin requests (e.g., from attacker-controlled web content in a victim browser) and applies an attacker-supplied JSON config. This can change the admin listener settings and alter HTTP server behavior without user intent. Version 2.11.1 contains a fix for the issue.","scope":"local","releases":{"bookworm":{"status":"open","repositories":{"bookworm":"2.6.2-5"},"urgency":"not yet assigned"},"sid":{"status":"open","repositories":{"sid":"2.6.2-14"},"urgency":"not yet assigned"},"trixie":{"status":"open","repositories":{"trixie":"2.6.2-12"},"urgency":"not yet assigned"}}},"CVE-2026-27590":{"description":"Caddy is an extensible server platform that uses TLS by default. Prior to version 2.11.1, Caddy's FastCGI path splitting logic computes the split index on a lowercased copy of the request path and then uses that byte index to slice the original path. This is unsafe for Unicode because `strings.ToLower()` can change UTF-8 byte length for some characters. As a result, Caddy can derive an incorrect `SCRIPT_NAME`/`SCRIPT_FILENAME` and `PATH_INFO`, potentially causing a request that contains `.php` to execute a different on-disk file than intended (path confusion). In setups where an attacker can control file contents (e.g., upload features), this can lead to unintended PHP execution of non-.php files (potential RCE depending on deployment). Version 2.11.1 fixes the issue.","scope":"local","releases":{"bookworm":{"status":"open","repositories":{"bookworm":"2.6.2-5"},"urgency":"not yet assigned"},"sid":{"status":"open","repositories":{"sid":"2.6.2-14"},"urgency":"not yet assigned"},"trixie":{"status":"open","repositories":{"trixie":"2.6.2-12"},"urgency":"not yet assigned"}}},"CVE-2026-30851":{"description":"Caddy is an extensible server platform that uses TLS by default. From version 2.10.0 to before version 2.11.2, forward_auth copy_headers does not strip client-supplied headers, allowing identity injection and privilege escalation. This issue has been patched in version 2.11.2.","scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"2.6.2-5"},"fixed_version":"0","urgency":"unimportant"},"sid":{"status":"resolved","repositories":{"sid":"2.6.2-14"},"fixed_version":"0","urgency":"unimportant"},"trixie":{"status":"resolved","repositories":{"trixie":"2.6.2-12"},"fixed_version":"0","urgency":"unimportant"}}},"CVE-2026-30852":{"description":"Caddy is an extensible server platform that uses TLS by default. From version 2.7.5 to before version 2.11.2, the vars_regexp matcher in vars.go:337 double-expands user-controlled input through the Caddy replacer. When vars_regexp matches against a placeholder like {http.request.header.X-Input}, the header value gets resolved once (expected), then passed through repl.ReplaceAll() again (the bug). This means an attacker can put {env.DATABASE_URL} or {file./etc/passwd} in a request header and the server will evaluate it, leaking environment variables, file contents, and system info. This issue has been patched in version 2.11.2.","scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"2.6.2-5"},"fixed_version":"0","urgency":"unimportant"},"sid":{"status":"resolved","repositories":{"sid":"2.6.2-14"},"fixed_version":"0","urgency":"unimportant"},"trixie":{"status":"resolved","repositories":{"trixie":"2.6.2-12"},"fixed_version":"0","urgency":"unimportant"}}}},"cairo":{"CVE-2009-2044":{"description":"Mozilla Firefox 3.0.10 and earlier on Linux allows remote attackers to cause a denial of service (application crash) via a URI for a large GIF image in the BACKGROUND attribute of a BODY element.","scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"1.16.0-7"},"fixed_version":"1.8.8-2","urgency":"unimportant"},"bullseye":{"status":"resolved","repositories":{"bullseye":"1.16.0-5"},"fixed_version":"1.8.8-2","urgency":"unimportant"},"forky":{"status":"resolved","repositories":{"forky":"1.18.4-3"},"fixed_version":"1.8.8-2","urgency":"unimportant"},"sid":{"status":"resolved","repositories":{"sid":"1.18.4-3"},"fixed_version":"1.8.8-2","urgency":"unimportant"},"trixie":{"status":"resolved","repositories":{"trixie":"1.18.4-1"},"fixed_version":"1.8.8-2","urgency":"unimportant"}}},"CVE-2016-3190":{"description":"The fill_xrgb32_lerp_opaque_spans function in cairo-image-compositor.c in cairo before 1.14.2 allows remote attackers to cause a denial of service (out-of-bounds read and application crash) via a negative span length.","scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"1.16.0-7"},"fixed_version":"1.14.2-2","urgency":"not yet assigned"},"bullseye":{"status":"resolved","repositories":{"bullseye":"1.16.0-5"},"fixed_version":"1.14.2-2","urgency":"not yet assigned"},"forky":{"status":"resolved","repositories":{"forky":"1.18.4-3"},"fixed_version":"1.14.2-2","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"1.18.4-3"},"fixed_version":"1.14.2-2","urgency":"not yet assigned"},"trixie":{"status":"resolved","repositories":{"trixie":"1.18.4-1"},"fixed_version":"1.14.2-2","urgency":"not yet assigned"}}},"CVE-2016-9082":{"description":"Integer overflow in the write_png function in cairo 1.14.6 allows remote attackers to cause a denial of service (invalid pointer dereference) via a large svg file.","debianbug":842289,"scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"1.16.0-7"},"fixed_version":"1.14.6-1.1","urgency":"not yet assigned"},"bullseye":{"status":"resolved","repositories":{"bullseye":"1.16.0-5"},"fixed_version":"1.14.6-1.1","urgency":"not yet assigned"},"forky":{"status":"resolved","repositories":{"forky":"1.18.4-3"},"fixed_version":"1.14.6-1.1","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"1.18.4-3"},"fixed_version":"1.14.6-1.1","urgency":"not yet assigned"},"trixie":{"status":"resolved","repositories":{"trixie":"1.18.4-1"},"fixed_version":"1.14.6-1.1","urgency":"not yet assigned"}}},"CVE-2017-7475":{"description":"Cairo version 1.15.4 is vulnerable to a NULL pointer dereference related to the FT_Load_Glyph and FT_Render_Glyph resulting in an application crash.","debianbug":870264,"scope":"local","releases":{"bookworm":{"status":"open","repositories":{"bookworm":"1.16.0-7"},"urgency":"low","nodsa":"Minor issue","nodsa_reason":"ignored"},"bullseye":{"status":"open","repositories":{"bullseye":"1.16.0-5"},"urgency":"low","nodsa":"Minor issue","nodsa_reason":"ignored"},"forky":{"status":"open","repositories":{"forky":"1.18.4-3"},"urgency":"low"},"sid":{"status":"open","repositories":{"sid":"1.18.4-3"},"urgency":"low"},"trixie":{"status":"open","repositories":{"trixie":"1.18.4-1"},"urgency":"low","nodsa":"Minor issue","nodsa_reason":"ignored"}}},"CVE-2017-9814":{"description":"cairo-truetype-subset.c in cairo 1.15.6 and earlier allows remote attackers to cause a denial of service (out-of-bounds read) because of mishandling of an unexpected malloc(0) call.","debianbug":868580,"scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"1.16.0-7"},"fixed_version":"1.16.0-1","urgency":"low"},"bullseye":{"status":"resolved","repositories":{"bullseye":"1.16.0-5"},"fixed_version":"1.16.0-1","urgency":"low"},"forky":{"status":"resolved","repositories":{"forky":"1.18.4-3"},"fixed_version":"1.16.0-1","urgency":"low"},"sid":{"status":"resolved","repositories":{"sid":"1.18.4-3"},"fixed_version":"1.16.0-1","urgency":"low"},"trixie":{"status":"resolved","repositories":{"trixie":"1.18.4-1"},"fixed_version":"1.16.0-1","urgency":"low"}}},"CVE-2018-18064":{"description":"cairo through 1.15.14 has an out-of-bounds stack-memory write during processing of a crafted document by WebKitGTK+ because of the interaction between cairo-rectangular-scan-converter.c (the generate and render_rows functions) and cairo-image-compositor.c (the _cairo_image_spans_and_zero function).","debianbug":916083,"scope":"local","releases":{"bookworm":{"status":"open","repositories":{"bookworm":"1.16.0-7"},"urgency":"unimportant"},"bullseye":{"status":"open","repositories":{"bullseye":"1.16.0-5"},"urgency":"unimportant"},"forky":{"status":"open","repositories":{"forky":"1.18.4-3"},"urgency":"unimportant"},"sid":{"status":"open","repositories":{"sid":"1.18.4-3"},"urgency":"unimportant"},"trixie":{"status":"open","repositories":{"trixie":"1.18.4-1"},"urgency":"unimportant"}}},"CVE-2018-19876":{"description":"cairo 1.16.0, in cairo_ft_apply_variations() in cairo-ft-font.c, would free memory using a free function incompatible with WebKit's fastMalloc, leading to an application crash with a \"free(): invalid pointer\" error.","debianbug":915801,"scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"1.16.0-7"},"fixed_version":"1.16.0-4","urgency":"not yet assigned"},"bullseye":{"status":"resolved","repositories":{"bullseye":"1.16.0-5"},"fixed_version":"1.16.0-4","urgency":"not yet assigned"},"forky":{"status":"resolved","repositories":{"forky":"1.18.4-3"},"fixed_version":"1.16.0-4","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"1.18.4-3"},"fixed_version":"1.16.0-4","urgency":"not yet assigned"},"trixie":{"status":"resolved","repositories":{"trixie":"1.18.4-1"},"fixed_version":"1.16.0-4","urgency":"not yet assigned"}}},"CVE-2019-6461":{"description":"An issue was discovered in cairo 1.16.0. There is an assertion problem in the function _cairo_arc_in_direction in the file cairo-arc.c.","debianbug":929944,"scope":"local","releases":{"bookworm":{"status":"open","repositories":{"bookworm":"1.16.0-7"},"urgency":"low","nodsa":"Minor issue","nodsa_reason":"ignored"},"bullseye":{"status":"open","repositories":{"bullseye":"1.16.0-5"},"urgency":"low","nodsa":"Minor issue","nodsa_reason":"ignored"},"forky":{"status":"resolved","repositories":{"forky":"1.18.4-3"},"fixed_version":"1.18.0-1","urgency":"low"},"sid":{"status":"resolved","repositories":{"sid":"1.18.4-3"},"fixed_version":"1.18.0-1","urgency":"low"},"trixie":{"status":"resolved","repositories":{"trixie":"1.18.4-1"},"fixed_version":"1.18.0-1","urgency":"low"}}},"CVE-2019-6462":{"description":"An issue was discovered in cairo 1.16.0. There is an infinite loop in the function _arc_error_normalized in the file cairo-arc.c, related to _arc_max_angle_for_tolerance_normalized.","debianbug":929945,"scope":"local","releases":{"bookworm":{"status":"open","repositories":{"bookworm":"1.16.0-7"},"urgency":"low","nodsa":"Minor issue","nodsa_reason":"ignored"},"bullseye":{"status":"open","repositories":{"bullseye":"1.16.0-5"},"urgency":"low","nodsa":"Minor issue","nodsa_reason":"ignored"},"forky":{"status":"resolved","repositories":{"forky":"1.18.4-3"},"fixed_version":"1.17.8-3","urgency":"low"},"sid":{"status":"resolved","repositories":{"sid":"1.18.4-3"},"fixed_version":"1.17.8-3","urgency":"low"},"trixie":{"status":"resolved","repositories":{"trixie":"1.18.4-1"},"fixed_version":"1.17.8-3","urgency":"low"}}},"CVE-2020-35492":{"description":"A flaw was found in cairo's image-compositor.c in all versions prior to 1.17.4. This flaw allows an attacker who can provide a crafted input file to cairo's image-compositor (for example, by convincing a user to open a file in an application using cairo, or if an application uses cairo on untrusted input) to cause a stack buffer overflow -> out-of-bounds WRITE. The highest impact from this vulnerability is to confidentiality, integrity, as well as system availability.","debianbug":978658,"scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"1.16.0-7"},"fixed_version":"1.16.0-5","urgency":"not yet assigned"},"bullseye":{"status":"resolved","repositories":{"bullseye":"1.16.0-5"},"fixed_version":"1.16.0-5","urgency":"not yet assigned"},"forky":{"status":"resolved","repositories":{"forky":"1.18.4-3"},"fixed_version":"1.16.0-5","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"1.18.4-3"},"fixed_version":"1.16.0-5","urgency":"not yet assigned"},"trixie":{"status":"resolved","repositories":{"trixie":"1.18.4-1"},"fixed_version":"1.16.0-5","urgency":"not yet assigned"}}},"CVE-2025-50422":{"description":"Cairo through 1.18.4, as used in Poppler through 25.08.0, has an \"unscaled->face == NULL\" assertion failure for _cairo_ft_unscaled_font_fini in cairo-ft-font.c.","debianbug":1110606,"scope":"local","releases":{"bookworm":{"status":"open","repositories":{"bookworm":"1.16.0-7"},"urgency":"not yet assigned","nodsa":"Minor issue","nodsa_reason":""},"bullseye":{"status":"open","repositories":{"bullseye":"1.16.0-5"},"urgency":"not yet assigned","nodsa":"Minor Issue; need dump right and local access","nodsa_reason":"postponed"},"forky":{"status":"open","repositories":{"forky":"1.18.4-3"},"urgency":"not yet assigned"},"sid":{"status":"open","repositories":{"sid":"1.18.4-3"},"urgency":"not yet assigned"},"trixie":{"status":"open","repositories":{"trixie":"1.18.4-1"},"urgency":"not yet assigned","nodsa":"Minor issue","nodsa_reason":""}}}},"cairosvg":{"CVE-2021-21236":{"description":"CairoSVG is a Python (pypi) package. CairoSVG is an SVG converter based on Cairo. In CairoSVG before version 2.5.1, there is a regular expression denial of service (REDoS) vulnerability. When processing SVG files, the python package CairoSVG uses two regular expressions which are vulnerable to Regular Expression Denial of Service (REDoS). If an attacker provides a malicious SVG, it can make cairosvg get stuck processing the file for a very long time. This is fixed in version 2.5.1. See Referenced GitHub advisory for more information.","debianbug":979597,"scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"2.5.2-1.1+deb12u1"},"fixed_version":"2.5.0-1.1","urgency":"not yet assigned"},"bullseye":{"status":"resolved","repositories":{"bullseye":"2.5.0-1.1+deb11u2","bullseye-security":"2.5.0-1.1+deb11u1"},"fixed_version":"2.5.0-1.1","urgency":"not yet assigned"},"forky":{"status":"resolved","repositories":{"forky":"2.8.2-1"},"fixed_version":"2.5.0-1.1","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"2.8.2-1"},"fixed_version":"2.5.0-1.1","urgency":"not yet assigned"},"trixie":{"status":"resolved","repositories":{"trixie":"2.7.1-2"},"fixed_version":"2.5.0-1.1","urgency":"not yet assigned"}}},"CVE-2023-27586":{"description":"CairoSVG is an SVG converter based on Cairo, a 2D graphics library. Prior to version 2.7.0, Cairo can send requests to external hosts when processing SVG files. A malicious actor could send a specially crafted SVG file that allows them to perform a server-side request forgery or denial of service. Version 2.7.0 disables CairoSVG's ability to access other files online by default.","debianbug":1033295,"scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"2.5.2-1.1+deb12u1"},"fixed_version":"2.5.2-1.1","urgency":"not yet assigned"},"bullseye":{"status":"resolved","repositories":{"bullseye":"2.5.0-1.1+deb11u2","bullseye-security":"2.5.0-1.1+deb11u1"},"fixed_version":"2.5.0-1.1+deb11u1","urgency":"not yet assigned"},"forky":{"status":"resolved","repositories":{"forky":"2.8.2-1"},"fixed_version":"2.5.2-1.1","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"2.8.2-1"},"fixed_version":"2.5.2-1.1","urgency":"not yet assigned"},"trixie":{"status":"resolved","repositories":{"trixie":"2.7.1-2"},"fixed_version":"2.5.2-1.1","urgency":"not yet assigned"}}}},"caja":{"TEMP-0781608-198474":{"debianbug":781608,"releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"1.26.1-1+deb12u1"},"fixed_version":"1.8.2-4","urgency":"not yet assigned"},"bullseye":{"status":"resolved","repositories":{"bullseye":"1.24.0-1"},"fixed_version":"1.8.2-4","urgency":"not yet assigned"},"forky":{"status":"resolved","repositories":{"forky":"1.26.4-3"},"fixed_version":"1.8.2-4","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"1.26.4-3"},"fixed_version":"1.8.2-4","urgency":"not yet assigned"},"trixie":{"status":"resolved","repositories":{"trixie":"1.26.4-1"},"fixed_version":"1.8.2-4","urgency":"not yet assigned"}}}},"cakephp":{"CVE-2006-4067":{"description":"Cross-site scripting (XSS) vulnerability in cake/libs/error.php in CakePHP before 1.1.7.3363 allows remote attackers to inject arbitrary web script or HTML via the URL, which is reflected back in a 404 (\"Not Found\") error page.  NOTE: some of these details are obtained from third party information.","scope":"local","releases":{"bullseye":{"status":"resolved","repositories":{"bullseye":"2.10.11-2.1"},"fixed_version":"1.1.13.4450-1","urgency":"not yet assigned"}}},"CVE-2006-5031":{"description":"Directory traversal vulnerability in app/webroot/js/vendors.php in Cake Software Foundation CakePHP before 1.1.8.3544 allows remote attackers to read arbitrary files via a .. (dot dot) in the file parameter, followed by a filename ending with \"%00\" and a .js filename.","scope":"local","releases":{"bullseye":{"status":"resolved","repositories":{"bullseye":"2.10.11-2.1"},"fixed_version":"1.1.13.4450-1","urgency":"not yet assigned"}}},"CVE-2010-4335":{"description":"The _validatePost function in libs/controller/components/security.php in CakePHP 1.3.x through 1.3.5 and 1.2.8 allows remote attackers to modify the internal Cake cache and execute arbitrary code via a crafted data[_Token][fields] value that is processed by the unserialize function, as demonstrated by modifying the file_map cache to execute arbitrary local files.","debianbug":606386,"scope":"local","releases":{"bullseye":{"status":"resolved","repositories":{"bullseye":"2.10.11-2.1"},"fixed_version":"1.3.2-1.1","urgency":"not yet assigned"}}},"CVE-2012-4399":{"description":"The Xml class in CakePHP 2.1.x before 2.1.5 and 2.2.x before 2.2.1 allows remote attackers to read arbitrary files via XML data containing external entity references, aka an XML external entity (XXE) injection attack.","scope":"local","releases":{"bullseye":{"status":"resolved","repositories":{"bullseye":"2.10.11-2.1"},"fixed_version":"0","urgency":"unimportant"}}},"CVE-2015-8379":{"description":"CakePHP 2.x and 3.x before 3.1.5 might allow remote attackers to bypass the CSRF protection mechanism via the _method parameter.","debianbug":832316,"scope":"local","releases":{"bullseye":{"status":"resolved","repositories":{"bullseye":"2.10.11-2.1"},"fixed_version":"2.8.0-1","urgency":"not yet assigned"}}},"CVE-2016-4793":{"description":"The clientIp function in CakePHP 3.2.4 and earlier allows remote attackers to spoof their IP via the CLIENT-IP HTTP header.","scope":"local","releases":{"bullseye":{"status":"resolved","repositories":{"bullseye":"2.10.11-2.1"},"fixed_version":"2.8.3-1","urgency":"not yet assigned"}}},"CVE-2019-11458":{"description":"An issue was discovered in SmtpTransport in CakePHP 3.7.6. An unserialized object with modified internal properties can trigger arbitrary file overwriting upon destruction.","scope":"local","releases":{"bullseye":{"status":"resolved","repositories":{"bullseye":"2.10.11-2.1"},"fixed_version":"0","urgency":"unimportant"}}},"CVE-2020-15400":{"description":"CakePHP before 4.0.6 mishandles CSRF token generation. This might be remotely exploitable in conjunction with XSS.","debianbug":985673,"scope":"local","releases":{"bullseye":{"status":"open","repositories":{"bullseye":"2.10.11-2.1"},"urgency":"not yet assigned","nodsa":"Minor issue","nodsa_reason":"ignored"}}},"CVE-2020-35239":{"description":"A vulnerability exists in CakePHP versions 4.0.x through 4.1.3. The CsrfProtectionMiddleware component allows method override parameters to bypass CSRF checks by changing the HTTP request method to an arbitrary string that is not in the list of request methods that CakePHP checks. Additionally, the route middleware does not verify that this overriden method (which can be an arbitrary string) is actually an HTTP method.","scope":"local","releases":{"bullseye":{"status":"resolved","repositories":{"bullseye":"2.10.11-2.1"},"fixed_version":"0","urgency":"unimportant"}}},"CVE-2023-22727":{"description":"CakePHP is a development framework for PHP web apps. In affected versions the `Cake\\Database\\Query::limit()` and `Cake\\Database\\Query::offset()` methods are vulnerable to SQL injection if passed un-sanitized user request data. This issue has been fixed in 4.2.12, 4.3.11, 4.4.10. Users are advised to upgrade. Users unable to upgrade may mitigate this issue by using CakePHP's Pagination library. Manually validating or casting parameters to these methods will also mitigate the issue.","scope":"local","releases":{"bullseye":{"status":"resolved","repositories":{"bullseye":"2.10.11-2.1"},"fixed_version":"0","urgency":"unimportant"}}},"CVE-2026-23643":{"description":"CakePHP is a rapid development framework for PHP. The PaginatorHelper::limitControl() method has a cross-site-scripting vulnerability via query string parameter manipulation. This issue has been fixed in 5.2.12 and 5.3.1.","scope":"local","releases":{"bullseye":{"status":"resolved","repositories":{"bullseye":"2.10.11-2.1"},"fixed_version":"0","urgency":"unimportant"}}},"TEMP-0000000-CFFE57":{"releases":{"bullseye":{"status":"resolved","repositories":{"bullseye":"2.10.11-2.1"},"fixed_version":"0","urgency":"unimportant"}}},"TEMP-0832283-698CF7":{"debianbug":832283,"releases":{"bullseye":{"status":"resolved","repositories":{"bullseye":"2.10.11-2.1"},"fixed_version":"2.6.7-1","urgency":"not yet assigned"}}}},"calamares":{"CVE-2019-13178":{"description":"modules/luksbootkeyfile/main.py in Calamares versions 3.1 through 3.2.10 has a race condition between the time when the LUKS encryption keyfile is created and when secure permissions are set.","debianbug":931391,"scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"3.2.61-1"},"fixed_version":"3.2.11-1","urgency":"unimportant"},"bullseye":{"status":"resolved","repositories":{"bullseye":"3.2.36-1"},"fixed_version":"3.2.11-1","urgency":"unimportant"},"forky":{"status":"resolved","repositories":{"forky":"3.3.14-6"},"fixed_version":"3.2.11-1","urgency":"unimportant"},"sid":{"status":"resolved","repositories":{"sid":"3.4.2-1"},"fixed_version":"3.2.11-1","urgency":"unimportant"},"trixie":{"status":"resolved","repositories":{"trixie":"3.3.14-1"},"fixed_version":"3.2.11-1","urgency":"unimportant"}}},"CVE-2019-13179":{"description":"Calamares versions 3.1 through 3.2.10 copies a LUKS encryption keyfile from /crypto_keyfile.bin (mode 0600 owned by root) to /boot within a globally readable initramfs image with insecure permissions, which allows this originally protected file to be read by any user, thereby disclosing decryption keys for LUKS containers created with Full Disk Encryption.","debianbug":931392,"scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"3.2.61-1"},"fixed_version":"3.2.11-1","urgency":"not yet assigned"},"bullseye":{"status":"resolved","repositories":{"bullseye":"3.2.36-1"},"fixed_version":"3.2.11-1","urgency":"not yet assigned"},"forky":{"status":"resolved","repositories":{"forky":"3.3.14-6"},"fixed_version":"3.2.11-1","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"3.4.2-1"},"fixed_version":"3.2.11-1","urgency":"not yet assigned"},"trixie":{"status":"resolved","repositories":{"trixie":"3.3.14-1"},"fixed_version":"3.2.11-1","urgency":"not yet assigned"}}}},"calamares-settings-debian":{"CVE-2019-13179":{"description":"Calamares versions 3.1 through 3.2.10 copies a LUKS encryption keyfile from /crypto_keyfile.bin (mode 0600 owned by root) to /boot within a globally readable initramfs image with insecure permissions, which allows this originally protected file to be read by any user, thereby disclosing decryption keys for LUKS containers created with Full Disk Encryption.","debianbug":931373,"scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"12.0.9-1+deb12u2"},"fixed_version":"10.0.23-1","urgency":"not yet assigned"},"bullseye":{"status":"resolved","repositories":{"bullseye":"11.0.5-2"},"fixed_version":"10.0.23-1","urgency":"not yet assigned"},"forky":{"status":"resolved","repositories":{"forky":"14.0.2-1"},"fixed_version":"10.0.23-1","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"14.0.2-1"},"fixed_version":"10.0.23-1","urgency":"not yet assigned"},"trixie":{"status":"resolved","repositories":{"trixie":"13.0.13-1"},"fixed_version":"10.0.23-1","urgency":"not yet assigned"}}}},"calibre":{"CVE-2010-1028":{"description":"Integer overflow in the decompression functionality in the Web Open Fonts Format (WOFF) decoder in Mozilla Firefox 3.6 before 3.6.2 and 3.7 before 3.7 alpha 3 allows remote attackers to execute arbitrary code via a crafted WOFF file that triggers a buffer overflow, as demonstrated by the vd_ff module in VulnDisco 9.0.","debianbug":787085,"scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"6.13.0+repack-2+deb12u5"},"fixed_version":"2.38.0+dfsg-1","urgency":"not yet assigned"},"bullseye":{"status":"resolved","repositories":{"bullseye":"5.12.0+dfsg-1+deb11u2","bullseye-security":"5.12.0+dfsg-1+deb11u3"},"fixed_version":"2.38.0+dfsg-1","urgency":"not yet assigned"},"forky":{"status":"resolved","repositories":{"forky":"8.16.2+ds+~0.10.5-3"},"fixed_version":"2.38.0+dfsg-1","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"9.4.0+ds+~0.10.5-1"},"fixed_version":"2.38.0+dfsg-1","urgency":"not yet assigned"},"trixie":{"status":"resolved","repositories":{"trixie":"8.5.0+ds-1+deb13u1"},"fixed_version":"2.38.0+dfsg-1","urgency":"not yet assigned"}}},"CVE-2011-4124":{"description":"Input validation issues were found in Calibre at devices/linux_mount_helper.c which can lead to argument injection and elevation of privileges.","debianbug":584915,"scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"6.13.0+repack-2+deb12u5"},"fixed_version":"1.5.0+dfsg-1","urgency":"not yet assigned"},"bullseye":{"status":"resolved","repositories":{"bullseye":"5.12.0+dfsg-1+deb11u2","bullseye-security":"5.12.0+dfsg-1+deb11u3"},"fixed_version":"1.5.0+dfsg-1","urgency":"not yet assigned"},"forky":{"status":"resolved","repositories":{"forky":"8.16.2+ds+~0.10.5-3"},"fixed_version":"1.5.0+dfsg-1","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"9.4.0+ds+~0.10.5-1"},"fixed_version":"1.5.0+dfsg-1","urgency":"not yet assigned"},"trixie":{"status":"resolved","repositories":{"trixie":"8.5.0+ds-1+deb13u1"},"fixed_version":"1.5.0+dfsg-1","urgency":"not yet assigned"}}},"CVE-2011-4125":{"description":"A untrusted search path issue was found in Calibre at devices/linux_mount_helper.c leading to the ability of unprivileged users to execute any program as root.","debianbug":584915,"scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"6.13.0+repack-2+deb12u5"},"fixed_version":"1.5.0+dfsg-1","urgency":"not yet assigned"},"bullseye":{"status":"resolved","repositories":{"bullseye":"5.12.0+dfsg-1+deb11u2","bullseye-security":"5.12.0+dfsg-1+deb11u3"},"fixed_version":"1.5.0+dfsg-1","urgency":"not yet assigned"},"forky":{"status":"resolved","repositories":{"forky":"8.16.2+ds+~0.10.5-3"},"fixed_version":"1.5.0+dfsg-1","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"9.4.0+ds+~0.10.5-1"},"fixed_version":"1.5.0+dfsg-1","urgency":"not yet assigned"},"trixie":{"status":"resolved","repositories":{"trixie":"8.5.0+ds-1+deb13u1"},"fixed_version":"1.5.0+dfsg-1","urgency":"not yet assigned"}}},"CVE-2011-4126":{"description":"Race condition issues were found in Calibre at devices/linux_mount_helper.c allowing unprivileged users the ability to mount any device to anywhere.","debianbug":584915,"scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"6.13.0+repack-2+deb12u5"},"fixed_version":"1.5.0+dfsg-1","urgency":"not yet assigned"},"bullseye":{"status":"resolved","repositories":{"bullseye":"5.12.0+dfsg-1+deb11u2","bullseye-security":"5.12.0+dfsg-1+deb11u3"},"fixed_version":"1.5.0+dfsg-1","urgency":"not yet assigned"},"forky":{"status":"resolved","repositories":{"forky":"8.16.2+ds+~0.10.5-3"},"fixed_version":"1.5.0+dfsg-1","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"9.4.0+ds+~0.10.5-1"},"fixed_version":"1.5.0+dfsg-1","urgency":"not yet assigned"},"trixie":{"status":"resolved","repositories":{"trixie":"8.5.0+ds-1+deb13u1"},"fixed_version":"1.5.0+dfsg-1","urgency":"not yet assigned"}}},"CVE-2016-10187":{"description":"The E-book viewer in calibre before 2.75 allows remote attackers to read arbitrary files via a crafted epub file with JavaScript.","debianbug":853004,"scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"6.13.0+repack-2+deb12u5"},"fixed_version":"2.75.1+dfsg-1","urgency":"low"},"bullseye":{"status":"resolved","repositories":{"bullseye":"5.12.0+dfsg-1+deb11u2","bullseye-security":"5.12.0+dfsg-1+deb11u3"},"fixed_version":"2.75.1+dfsg-1","urgency":"low"},"forky":{"status":"resolved","repositories":{"forky":"8.16.2+ds+~0.10.5-3"},"fixed_version":"2.75.1+dfsg-1","urgency":"low"},"sid":{"status":"resolved","repositories":{"sid":"9.4.0+ds+~0.10.5-1"},"fixed_version":"2.75.1+dfsg-1","urgency":"low"},"trixie":{"status":"resolved","repositories":{"trixie":"8.5.0+ds-1+deb13u1"},"fixed_version":"2.75.1+dfsg-1","urgency":"low"}}},"CVE-2018-7889":{"description":"gui2/viewer/bookmarkmanager.py in Calibre 3.18 calls cPickle.load on imported bookmark data, which allows remote attackers to execute arbitrary code via a crafted .pickle file, as demonstrated by Python code that contains an os.system call.","debianbug":892242,"scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"6.13.0+repack-2+deb12u5"},"fixed_version":"3.19.0+dfsg-1","urgency":"not yet assigned"},"bullseye":{"status":"resolved","repositories":{"bullseye":"5.12.0+dfsg-1+deb11u2","bullseye-security":"5.12.0+dfsg-1+deb11u3"},"fixed_version":"3.19.0+dfsg-1","urgency":"not yet assigned"},"forky":{"status":"resolved","repositories":{"forky":"8.16.2+ds+~0.10.5-3"},"fixed_version":"3.19.0+dfsg-1","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"9.4.0+ds+~0.10.5-1"},"fixed_version":"3.19.0+dfsg-1","urgency":"not yet assigned"},"trixie":{"status":"resolved","repositories":{"trixie":"8.5.0+ds-1+deb13u1"},"fixed_version":"3.19.0+dfsg-1","urgency":"not yet assigned"}}},"CVE-2021-44686":{"description":"calibre before 5.32.0 contains a regular expression that is vulnerable to ReDoS (Regular Expression Denial of Service) in html_preprocess_rules in ebooks/conversion/preprocess.py.","scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"6.13.0+repack-2+deb12u5"},"fixed_version":"5.33.0+dfsg-1","urgency":"not yet assigned"},"bullseye":{"status":"resolved","repositories":{"bullseye":"5.12.0+dfsg-1+deb11u2","bullseye-security":"5.12.0+dfsg-1+deb11u3"},"fixed_version":"5.12.0+dfsg-1+deb11u3","urgency":"not yet assigned"},"forky":{"status":"resolved","repositories":{"forky":"8.16.2+ds+~0.10.5-3"},"fixed_version":"5.33.0+dfsg-1","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"9.4.0+ds+~0.10.5-1"},"fixed_version":"5.33.0+dfsg-1","urgency":"not yet assigned"},"trixie":{"status":"resolved","repositories":{"trixie":"8.5.0+ds-1+deb13u1"},"fixed_version":"5.33.0+dfsg-1","urgency":"not yet assigned"}}},"CVE-2023-46303":{"description":"link_to_local_path in ebooks/conversion/plugins/html_input.py in calibre before 6.19.0 can, by default, add resources outside of the document root.","scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"6.13.0+repack-2+deb12u5"},"fixed_version":"6.13.0+repack-2+deb12u3","urgency":"not yet assigned"},"bullseye":{"status":"resolved","repositories":{"bullseye":"5.12.0+dfsg-1+deb11u2","bullseye-security":"5.12.0+dfsg-1+deb11u3"},"fixed_version":"5.12.0+dfsg-1+deb11u3","urgency":"not yet assigned"},"forky":{"status":"resolved","repositories":{"forky":"8.16.2+ds+~0.10.5-3"},"fixed_version":"6.19.1-1","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"9.4.0+ds+~0.10.5-1"},"fixed_version":"6.19.1-1","urgency":"not yet assigned"},"trixie":{"status":"resolved","repositories":{"trixie":"8.5.0+ds-1+deb13u1"},"fixed_version":"6.19.1-1","urgency":"not yet assigned"}}},"CVE-2024-6781":{"description":"Path traversal in Calibre <= 7.14.0 allow unauthenticated attackers to achieve arbitrary file read.","scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"6.13.0+repack-2+deb12u5"},"fixed_version":"0","urgency":"unimportant"},"bullseye":{"status":"resolved","repositories":{"bullseye":"5.12.0+dfsg-1+deb11u2","bullseye-security":"5.12.0+dfsg-1+deb11u3"},"fixed_version":"0","urgency":"unimportant"},"forky":{"status":"resolved","repositories":{"forky":"8.16.2+ds+~0.10.5-3"},"fixed_version":"7.16.0+ds-1","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"9.4.0+ds+~0.10.5-1"},"fixed_version":"7.16.0+ds-1","urgency":"not yet assigned"},"trixie":{"status":"resolved","repositories":{"trixie":"8.5.0+ds-1+deb13u1"},"fixed_version":"7.16.0+ds-1","urgency":"not yet assigned"}}},"CVE-2024-6782":{"description":"Improper access control in Calibre 6.9.0 ~ 7.14.0 allow unauthenticated attackers to achieve remote code execution.","scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"6.13.0+repack-2+deb12u5"},"fixed_version":"6.13.0+repack-2+deb12u4","urgency":"not yet assigned"},"bullseye":{"status":"resolved","repositories":{"bullseye":"5.12.0+dfsg-1+deb11u2","bullseye-security":"5.12.0+dfsg-1+deb11u3"},"fixed_version":"0","urgency":"unimportant"},"forky":{"status":"resolved","repositories":{"forky":"8.16.2+ds+~0.10.5-3"},"fixed_version":"7.16.0+ds-1","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"9.4.0+ds+~0.10.5-1"},"fixed_version":"7.16.0+ds-1","urgency":"not yet assigned"},"trixie":{"status":"resolved","repositories":{"trixie":"8.5.0+ds-1+deb13u1"},"fixed_version":"7.16.0+ds-1","urgency":"not yet assigned"}}},"CVE-2024-7008":{"description":"Unsanitized user-input in Calibre <= 7.15.0 allow attackers to perform reflected cross-site scripting.","scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"6.13.0+repack-2+deb12u5"},"fixed_version":"6.13.0+repack-2+deb12u4","urgency":"not yet assigned"},"bullseye":{"status":"resolved","repositories":{"bullseye":"5.12.0+dfsg-1+deb11u2","bullseye-security":"5.12.0+dfsg-1+deb11u3"},"fixed_version":"5.12.0+dfsg-1+deb11u2","urgency":"not yet assigned"},"forky":{"status":"resolved","repositories":{"forky":"8.16.2+ds+~0.10.5-3"},"fixed_version":"7.16.0+ds-1","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"9.4.0+ds+~0.10.5-1"},"fixed_version":"7.16.0+ds-1","urgency":"not yet assigned"},"trixie":{"status":"resolved","repositories":{"trixie":"8.5.0+ds-1+deb13u1"},"fixed_version":"7.16.0+ds-1","urgency":"not yet assigned"}}},"CVE-2024-7009":{"description":"Unsanitized user-input in Calibre <= 7.15.0 allow users with permissions to perform full-text searches to achieve SQL injection on the SQLite database.","scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"6.13.0+repack-2+deb12u5"},"fixed_version":"6.13.0+repack-2+deb12u4","urgency":"not yet assigned"},"bullseye":{"status":"resolved","repositories":{"bullseye":"5.12.0+dfsg-1+deb11u2","bullseye-security":"5.12.0+dfsg-1+deb11u3"},"fixed_version":"5.12.0+dfsg-1+deb11u2","urgency":"not yet assigned"},"forky":{"status":"resolved","repositories":{"forky":"8.16.2+ds+~0.10.5-3"},"fixed_version":"7.16.0+ds-1","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"9.4.0+ds+~0.10.5-1"},"fixed_version":"7.16.0+ds-1","urgency":"not yet assigned"},"trixie":{"status":"resolved","repositories":{"trixie":"8.5.0+ds-1+deb13u1"},"fixed_version":"7.16.0+ds-1","urgency":"not yet assigned"}}},"CVE-2025-64486":{"description":"calibre is an e-book manager. In versions 8.13.0 and prior, calibre does not validate filenames when handling binary assets in FB2 files, allowing an attacker to write arbitrary files on the filesystem when viewing or converting a malicious FictionBook file. This can be leveraged to achieve arbitrary code execution. This issue is fixed in version 8.14.0.","scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"6.13.0+repack-2+deb12u5"},"fixed_version":"6.13.0+repack-2+deb12u5","urgency":"not yet assigned"},"bullseye":{"status":"open","repositories":{"bullseye":"5.12.0+dfsg-1+deb11u2","bullseye-security":"5.12.0+dfsg-1+deb11u3"},"urgency":"not yet assigned","nodsa":"Minor issue; fix after bookworm","nodsa_reason":"postponed"},"forky":{"status":"resolved","repositories":{"forky":"8.16.2+ds+~0.10.5-3"},"fixed_version":"8.14.0+ds+~0.10.5-1","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"9.4.0+ds+~0.10.5-1"},"fixed_version":"8.14.0+ds+~0.10.5-1","urgency":"not yet assigned"},"trixie":{"status":"resolved","repositories":{"trixie":"8.5.0+ds-1+deb13u1"},"fixed_version":"8.5.0+ds-1+deb13u1","urgency":"not yet assigned"}}},"CVE-2026-25635":{"description":"calibre is an e-book manager. Prior to 9.2.0, Calibre's CHM reader contains a path traversal vulnerability that allows arbitrary file writes anywhere the user has write permissions. On Windows (haven't tested on other OS's), this can lead to Remote Code Execution by writing a payload to the Startup folder, which executes on next login. This vulnerability is fixed in 9.2.0.","scope":"local","releases":{"bookworm":{"status":"open","repositories":{"bookworm":"6.13.0+repack-2+deb12u5"},"urgency":"not yet assigned","nodsa":"Will be fixed via point update","nodsa_reason":"","next_point_update":true},"bullseye":{"status":"open","repositories":{"bullseye":"5.12.0+dfsg-1+deb11u2","bullseye-security":"5.12.0+dfsg-1+deb11u3"},"urgency":"not yet assigned","nodsa":"Can be piggy-back'd with future DLA","nodsa_reason":"postponed"},"forky":{"status":"open","repositories":{"forky":"8.16.2+ds+~0.10.5-3"},"urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"9.4.0+ds+~0.10.5-1"},"fixed_version":"9.2.0+ds+~0.10.5-1","urgency":"not yet assigned"},"trixie":{"status":"open","repositories":{"trixie":"8.5.0+ds-1+deb13u1"},"urgency":"not yet assigned","nodsa":"Will be fixed via point update","nodsa_reason":""}}},"CVE-2026-25636":{"description":"calibre is an e-book manager. In 9.1.0 and earlier, a path traversal vulnerability in Calibre's EPUB conversion allows a malicious EPUB file to corrupt arbitrary existing files writable by the Calibre process. During conversion, Calibre resolves CipherReference URI from META-INF/encryption.xml to an absolute filesystem path and opens it in read-write mode, even when it points outside the conversion extraction directory. This vulnerability is fixed in 9.2.0.","scope":"local","releases":{"bookworm":{"status":"open","repositories":{"bookworm":"6.13.0+repack-2+deb12u5"},"urgency":"not yet assigned","nodsa":"Will be fixed via point update","nodsa_reason":"","next_point_update":true},"bullseye":{"status":"open","repositories":{"bullseye":"5.12.0+dfsg-1+deb11u2","bullseye-security":"5.12.0+dfsg-1+deb11u3"},"urgency":"not yet assigned","nodsa":"Can be piggy-back'd with future DLA","nodsa_reason":"postponed"},"forky":{"status":"open","repositories":{"forky":"8.16.2+ds+~0.10.5-3"},"urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"9.4.0+ds+~0.10.5-1"},"fixed_version":"9.2.0+ds+~0.10.5-1","urgency":"not yet assigned"},"trixie":{"status":"open","repositories":{"trixie":"8.5.0+ds-1+deb13u1"},"urgency":"not yet assigned","nodsa":"Will be fixed via point update","nodsa_reason":""}}},"CVE-2026-25731":{"description":"calibre is an e-book manager. Prior to 9.2.0, a Server-Side Template Injection (SSTI) vulnerability in Calibre's Templite templating engine allows arbitrary code execution when a user converts an ebook using a malicious custom template file via the --template-html or --template-html-index command-line options. This vulnerability is fixed in 9.2.0.","scope":"local","releases":{"bookworm":{"status":"open","repositories":{"bookworm":"6.13.0+repack-2+deb12u5"},"urgency":"not yet assigned","nodsa":"Will be fixed via point update","nodsa_reason":"","next_point_update":true},"bullseye":{"status":"open","repositories":{"bullseye":"5.12.0+dfsg-1+deb11u2","bullseye-security":"5.12.0+dfsg-1+deb11u3"},"urgency":"not yet assigned","nodsa":"Too intrusive to backport","nodsa_reason":"ignored"},"forky":{"status":"open","repositories":{"forky":"8.16.2+ds+~0.10.5-3"},"urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"9.4.0+ds+~0.10.5-1"},"fixed_version":"9.2.0+ds+~0.10.5-1","urgency":"not yet assigned"},"trixie":{"status":"open","repositories":{"trixie":"8.5.0+ds-1+deb13u1"},"urgency":"not yet assigned","nodsa":"Will be fixed via point update","nodsa_reason":""}}},"CVE-2026-26064":{"description":"calibre is a cross-platform e-book manager for viewing, converting, editing, and cataloging e-books. Versions 9.2.1 and below contain a Path Traversal vulnerability that allows arbitrary file writes anywhere the user has write permissions. On Windows, this leads to Remote Code Execution by writing a payload to the Startup folder, which executes on next login. Function extract_pictures only checks startswith('Pictures'), and does not sanitize '..' sequences. calibre's own ZipFile.extractall() in utils/zipfile.py does sanitize '..' via _get_targetpath(), but extract_pictures() bypasses this by using manual zf.read() + open(). This issue has been fixed in version 9.3.0.","scope":"local","releases":{"bookworm":{"status":"open","repositories":{"bookworm":"6.13.0+repack-2+deb12u5"},"urgency":"not yet assigned","nodsa":"Minor issue","nodsa_reason":"","next_point_update":true},"bullseye":{"status":"open","repositories":{"bullseye":"5.12.0+dfsg-1+deb11u2","bullseye-security":"5.12.0+dfsg-1+deb11u3"},"urgency":"not yet assigned"},"forky":{"status":"open","repositories":{"forky":"8.16.2+ds+~0.10.5-3"},"urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"9.4.0+ds+~0.10.5-1"},"fixed_version":"9.3.0+ds+~0.10.5-1","urgency":"not yet assigned"},"trixie":{"status":"open","repositories":{"trixie":"8.5.0+ds-1+deb13u1"},"urgency":"not yet assigned","nodsa":"Minor issue","nodsa_reason":""}}},"CVE-2026-26065":{"description":"calibre is a cross-platform e-book manager for viewing, converting, editing, and cataloging e-books. Versions 9.2.1 and below are vulnerable to Path Traversal through PDB readers (both 132-byte and 202-byte header variants) that allow arbitrary file writes with arbitrary extension and arbitrary content anywhere the user has write permissions. Files are written in 'wb' mode, silently overwriting existing files. This can lead to potential code execution and Denial of Service through file corruption. This issue has been fixed in version 9.3.0.","scope":"local","releases":{"bookworm":{"status":"open","repositories":{"bookworm":"6.13.0+repack-2+deb12u5"},"urgency":"not yet assigned","nodsa":"Minor issue","nodsa_reason":"","next_point_update":true},"bullseye":{"status":"open","repositories":{"bullseye":"5.12.0+dfsg-1+deb11u2","bullseye-security":"5.12.0+dfsg-1+deb11u3"},"urgency":"not yet assigned"},"forky":{"status":"open","repositories":{"forky":"8.16.2+ds+~0.10.5-3"},"urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"9.4.0+ds+~0.10.5-1"},"fixed_version":"9.3.0+ds+~0.10.5-1","urgency":"not yet assigned"},"trixie":{"status":"open","repositories":{"trixie":"8.5.0+ds-1+deb13u1"},"urgency":"not yet assigned","nodsa":"Minor issue","nodsa_reason":""}}},"CVE-2026-27810":{"description":"calibre is a cross-platform e-book manager for viewing, converting, editing, and cataloging e-books. Prior to version 9.4.0, an HTTP Response Header Injection vulnerability in the calibre Content Server allows any authenticated user to inject arbitrary HTTP headers into server responses via an unsanitized `content_disposition` query parameter in the `/get/` and `/data-files/get/` endpoints. All users running the calibre Content Server with authentication enabled are affected. The vulnerability is exploitable by any authenticated user and can also be triggered by tricking an authenticated victim into clicking a crafted link. Version 9.4.0 contains a fix for the issue.","scope":"local","releases":{"bookworm":{"status":"open","repositories":{"bookworm":"6.13.0+repack-2+deb12u5"},"urgency":"not yet assigned","nodsa":"Minor issue","nodsa_reason":"","next_point_update":true},"bullseye":{"status":"open","repositories":{"bullseye":"5.12.0+dfsg-1+deb11u2","bullseye-security":"5.12.0+dfsg-1+deb11u3"},"urgency":"not yet assigned"},"forky":{"status":"open","repositories":{"forky":"8.16.2+ds+~0.10.5-3"},"urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"9.4.0+ds+~0.10.5-1"},"fixed_version":"9.4.0+ds+~0.10.5-1","urgency":"not yet assigned"},"trixie":{"status":"open","repositories":{"trixie":"8.5.0+ds-1+deb13u1"},"urgency":"not yet assigned","nodsa":"Minor issue","nodsa_reason":""}}},"CVE-2026-27824":{"description":"calibre is a cross-platform e-book manager for viewing, converting, editing, and cataloging e-books. Prior to version 9.4.0, the calibre Content Server's brute-force protection mechanism uses a ban key derived from both `remote_addr` and the `X-Forwarded-For` header. Since the `X-Forwarded-For` header is read directly from the HTTP request without any validation or trusted-proxy configuration, an attacker can bypass IP-based bans by simply changing or adding this header, rendering the brute-force protection completely ineffective. This is particularly dangerous for calibre servers exposed to the internet, where brute-force protection is the primary defense against credential stuffing and password guessing attacks. Version 9.4.0 contains a fix for the issue.","scope":"local","releases":{"bookworm":{"status":"open","repositories":{"bookworm":"6.13.0+repack-2+deb12u5"},"urgency":"not yet assigned","nodsa":"Minor issue","nodsa_reason":"","next_point_update":true},"bullseye":{"status":"open","repositories":{"bullseye":"5.12.0+dfsg-1+deb11u2","bullseye-security":"5.12.0+dfsg-1+deb11u3"},"urgency":"not yet assigned"},"forky":{"status":"open","repositories":{"forky":"8.16.2+ds+~0.10.5-3"},"urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"9.4.0+ds+~0.10.5-1"},"fixed_version":"9.4.0+ds+~0.10.5-1","urgency":"not yet assigned"},"trixie":{"status":"open","repositories":{"trixie":"8.5.0+ds-1+deb13u1"},"urgency":"not yet assigned","nodsa":"Minor issue","nodsa_reason":""}}},"TEMP-0608822-E0260C":{"debianbug":608822,"releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"6.13.0+repack-2+deb12u5"},"fixed_version":"0.7.38+dfsg-1","urgency":"not yet assigned"},"bullseye":{"status":"resolved","repositories":{"bullseye":"5.12.0+dfsg-1+deb11u2","bullseye-security":"5.12.0+dfsg-1+deb11u3"},"fixed_version":"0.7.38+dfsg-1","urgency":"not yet assigned"},"forky":{"status":"resolved","repositories":{"forky":"8.16.2+ds+~0.10.5-3"},"fixed_version":"0.7.38+dfsg-1","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"9.4.0+ds+~0.10.5-1"},"fixed_version":"0.7.38+dfsg-1","urgency":"not yet assigned"},"trixie":{"status":"resolved","repositories":{"trixie":"8.5.0+ds-1+deb13u1"},"fixed_version":"0.7.38+dfsg-1","urgency":"not yet assigned"}}},"TEMP-0608822-EF2F16":{"debianbug":608822,"releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"6.13.0+repack-2+deb12u5"},"fixed_version":"0.7.38+dfsg-1","urgency":"not yet assigned"},"bullseye":{"status":"resolved","repositories":{"bullseye":"5.12.0+dfsg-1+deb11u2","bullseye-security":"5.12.0+dfsg-1+deb11u3"},"fixed_version":"0.7.38+dfsg-1","urgency":"not yet assigned"},"forky":{"status":"resolved","repositories":{"forky":"8.16.2+ds+~0.10.5-3"},"fixed_version":"0.7.38+dfsg-1","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"9.4.0+ds+~0.10.5-1"},"fixed_version":"0.7.38+dfsg-1","urgency":"not yet assigned"},"trixie":{"status":"resolved","repositories":{"trixie":"8.5.0+ds-1+deb13u1"},"fixed_version":"0.7.38+dfsg-1","urgency":"not yet assigned"}}}},"calife":{"CVE-2004-0188":{"description":"Heap-based buffer overflow in Calife 2.8.5 and earlier may allow local users to execute arbitrary code via a long password.","debianbug":235157,"scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"1:3.0.1-6"},"fixed_version":"2.8.6-1","urgency":"not yet assigned"},"bullseye":{"status":"resolved","repositories":{"bullseye":"1:3.0.1-6"},"fixed_version":"2.8.6-1","urgency":"not yet assigned"},"forky":{"status":"resolved","repositories":{"forky":"1:3.0.6-2"},"fixed_version":"2.8.6-1","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"1:3.0.6-2"},"fixed_version":"2.8.6-1","urgency":"not yet assigned"},"trixie":{"status":"resolved","repositories":{"trixie":"1:3.0.1-6"},"fixed_version":"2.8.6-1","urgency":"not yet assigned"}}}},"calligra":{"CVE-2012-3456":{"description":"Heap-based buffer overflow in the read function in filters/words/msword-odf/wv2/src/styles.cpp in the Microsoft import filter in Calligra 2.4.3 and earlier allows remote attackers to cause a denial of service (application crash) and possibly execute arbitrary code via a crafted ODF style in an ODF document.  NOTE: this is the same vulnerability as CVE-2012-3455, but it was SPLIT by the CNA even though Calligra and KOffice share the same codebase.","debianbug":684004,"scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"1:3.2.1+dfsg-6"},"fixed_version":"1:2.4.3-2","urgency":"not yet assigned"},"bullseye":{"status":"resolved","repositories":{"bullseye":"1:3.2.1+dfsg-2"},"fixed_version":"1:2.4.3-2","urgency":"not yet assigned"},"forky":{"status":"resolved","repositories":{"forky":"1:25.11.90-1"},"fixed_version":"1:2.4.3-2","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"1:25.11.90-1"},"fixed_version":"1:2.4.3-2","urgency":"not yet assigned"},"trixie":{"status":"resolved","repositories":{"trixie":"1:25.04.2+dfsg-1"},"fixed_version":"1:2.4.3-2","urgency":"not yet assigned"}}}},"camlimages":{"CVE-2009-2295":{"description":"Multiple integer overflows in CamlImages 2.2 and earlier might allow context-dependent attackers to execute arbitrary code via a crafted PNG image with large width and height values that trigger a heap-based buffer overflow in the (1) read_png_file or (2) read_png_file_as_rgb24 function.","debianbug":535909,"scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"1:5.0.4-2"},"fixed_version":"1:3.0.1-2","urgency":"low"},"bullseye":{"status":"resolved","repositories":{"bullseye":"1:5.0.4-1"},"fixed_version":"1:3.0.1-2","urgency":"low"},"forky":{"status":"resolved","repositories":{"forky":"1:5.0.5-2"},"fixed_version":"1:3.0.1-2","urgency":"low"},"sid":{"status":"resolved","repositories":{"sid":"1:5.0.5-2"},"fixed_version":"1:3.0.1-2","urgency":"low"},"trixie":{"status":"resolved","repositories":{"trixie":"1:5.0.5-2"},"fixed_version":"1:3.0.1-2","urgency":"low"}}},"CVE-2009-2660":{"description":"Multiple integer overflows in CamlImages 2.2 might allow context-dependent attackers to execute arbitrary code via images containing large width and height values that trigger a heap-based buffer overflow, related to (1) crafted GIF files (gifread.c) and (2) crafted JPEG files (jpegread.c), a different vulnerability than CVE-2009-2295.","debianbug":540146,"scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"1:5.0.4-2"},"fixed_version":"1:3.0.1-3","urgency":"low"},"bullseye":{"status":"resolved","repositories":{"bullseye":"1:5.0.4-1"},"fixed_version":"1:3.0.1-3","urgency":"low"},"forky":{"status":"resolved","repositories":{"forky":"1:5.0.5-2"},"fixed_version":"1:3.0.1-3","urgency":"low"},"sid":{"status":"resolved","repositories":{"sid":"1:5.0.5-2"},"fixed_version":"1:3.0.1-3","urgency":"low"},"trixie":{"status":"resolved","repositories":{"trixie":"1:5.0.5-2"},"fixed_version":"1:3.0.1-3","urgency":"low"}}},"CVE-2009-3296":{"description":"Multiple integer overflows in tiffread.c in CamlImages 2.2 might allow remote attackers to execute arbitrary code via TIFF images containing large width and height values that trigger heap-based buffer overflows.","scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"1:5.0.4-2"},"fixed_version":"1:3.0.1-5","urgency":"low"},"bullseye":{"status":"resolved","repositories":{"bullseye":"1:5.0.4-1"},"fixed_version":"1:3.0.1-5","urgency":"low"},"forky":{"status":"resolved","repositories":{"forky":"1:5.0.5-2"},"fixed_version":"1:3.0.1-5","urgency":"low"},"sid":{"status":"resolved","repositories":{"sid":"1:5.0.5-2"},"fixed_version":"1:3.0.1-5","urgency":"low"},"trixie":{"status":"resolved","repositories":{"trixie":"1:5.0.5-2"},"fixed_version":"1:3.0.1-5","urgency":"low"}}}},"canna":{"CVE-2002-1158":{"description":"Buffer overflow in the irw_through function for Canna 3.5b2 and earlier allows local users to execute arbitrary code as the bin user.","scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"3.7p3-20"},"fixed_version":"3.6p1-1","urgency":"not yet assigned"},"bullseye":{"status":"resolved","repositories":{"bullseye":"3.7p3-16"},"fixed_version":"3.6p1-1","urgency":"not yet assigned"},"forky":{"status":"resolved","repositories":{"forky":"3.7p3-26"},"fixed_version":"3.6p1-1","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"3.7p3-26"},"fixed_version":"3.6p1-1","urgency":"not yet assigned"},"trixie":{"status":"resolved","repositories":{"trixie":"3.7p3-25"},"fixed_version":"3.6p1-1","urgency":"not yet assigned"}}},"CVE-2002-1159":{"description":"Canna 3.6 and earlier does not properly validate requests, which allows remote attackers to cause a denial of service or information leak.","scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"3.7p3-20"},"fixed_version":"3.6p1-1","urgency":"not yet assigned"},"bullseye":{"status":"resolved","repositories":{"bullseye":"3.7p3-16"},"fixed_version":"3.6p1-1","urgency":"not yet assigned"},"forky":{"status":"resolved","repositories":{"forky":"3.7p3-26"},"fixed_version":"3.6p1-1","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"3.7p3-26"},"fixed_version":"3.6p1-1","urgency":"not yet assigned"},"trixie":{"status":"resolved","repositories":{"trixie":"3.7p3-25"},"fixed_version":"3.6p1-1","urgency":"not yet assigned"}}}},"cantata":{"CVE-2013-7300":{"description":"Absolute path traversal vulnerability in cantata before 1.2.2 allows local users to read arbitrary files via a full pathname in a request to the internal httpd server.  NOTE: this vulnerability can be leveraged by remote attackers using CVE-2013-7301.","scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"2.5.0.ds1-1"},"fixed_version":"0","urgency":"unimportant"},"bullseye":{"status":"resolved","repositories":{"bullseye":"2.4.2.ds1-1"},"fixed_version":"0","urgency":"unimportant"},"forky":{"status":"resolved","repositories":{"forky":"3.4.0.ds1-1"},"fixed_version":"0","urgency":"unimportant"},"sid":{"status":"resolved","repositories":{"sid":"3.4.0.ds1-1"},"fixed_version":"0","urgency":"unimportant"},"trixie":{"status":"resolved","repositories":{"trixie":"2.5.0.ds1-4"},"fixed_version":"0","urgency":"unimportant"}}},"CVE-2013-7301":{"description":"Cantata before 1.2.2 does not restrict access to files in the play queue, which allows remote attackers to obtain sensitive information by reading the songs in the queue.","scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"2.5.0.ds1-1"},"fixed_version":"0","urgency":"unimportant"},"bullseye":{"status":"resolved","repositories":{"bullseye":"2.4.2.ds1-1"},"fixed_version":"0","urgency":"unimportant"},"forky":{"status":"resolved","repositories":{"forky":"3.4.0.ds1-1"},"fixed_version":"0","urgency":"unimportant"},"sid":{"status":"resolved","repositories":{"sid":"3.4.0.ds1-1"},"fixed_version":"0","urgency":"unimportant"},"trixie":{"status":"resolved","repositories":{"trixie":"2.5.0.ds1-4"},"fixed_version":"0","urgency":"unimportant"}}},"CVE-2018-12559":{"description":"An issue was discovered in the cantata-mounter D-Bus service in Cantata through 2.3.1. The mount target path check in mounter.cpp `mpOk()` is insufficient. A regular user can consequently mount a CIFS filesystem anywhere (e.g., outside of the /home directory tree) by passing directory traversal sequences such as a home/../usr substring.","debianbug":901798,"scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"2.5.0.ds1-1"},"fixed_version":"2.3.0.ds1-2","urgency":"unimportant"},"bullseye":{"status":"resolved","repositories":{"bullseye":"2.4.2.ds1-1"},"fixed_version":"2.3.0.ds1-2","urgency":"unimportant"},"forky":{"status":"resolved","repositories":{"forky":"3.4.0.ds1-1"},"fixed_version":"2.3.0.ds1-2","urgency":"unimportant"},"sid":{"status":"resolved","repositories":{"sid":"3.4.0.ds1-1"},"fixed_version":"2.3.0.ds1-2","urgency":"unimportant"},"trixie":{"status":"resolved","repositories":{"trixie":"2.5.0.ds1-4"},"fixed_version":"2.3.0.ds1-2","urgency":"unimportant"}}},"CVE-2018-12560":{"description":"An issue was discovered in the cantata-mounter D-Bus service in Cantata through 2.3.1. Arbitrary unmounts can be performed by regular users via directory traversal sequences such as a home/../sys/kernel substring.","debianbug":901798,"scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"2.5.0.ds1-1"},"fixed_version":"2.3.0.ds1-2","urgency":"unimportant"},"bullseye":{"status":"resolved","repositories":{"bullseye":"2.4.2.ds1-1"},"fixed_version":"2.3.0.ds1-2","urgency":"unimportant"},"forky":{"status":"resolved","repositories":{"forky":"3.4.0.ds1-1"},"fixed_version":"2.3.0.ds1-2","urgency":"unimportant"},"sid":{"status":"resolved","repositories":{"sid":"3.4.0.ds1-1"},"fixed_version":"2.3.0.ds1-2","urgency":"unimportant"},"trixie":{"status":"resolved","repositories":{"trixie":"2.5.0.ds1-4"},"fixed_version":"2.3.0.ds1-2","urgency":"unimportant"}}},"CVE-2018-12561":{"description":"An issue was discovered in the cantata-mounter D-Bus service in Cantata through 2.3.1. A regular user can inject additional mount options such as file_mode= by manipulating (for example) the domain parameter of the samba URL.","debianbug":901798,"scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"2.5.0.ds1-1"},"fixed_version":"2.3.0.ds1-2","urgency":"unimportant"},"bullseye":{"status":"resolved","repositories":{"bullseye":"2.4.2.ds1-1"},"fixed_version":"2.3.0.ds1-2","urgency":"unimportant"},"forky":{"status":"resolved","repositories":{"forky":"3.4.0.ds1-1"},"fixed_version":"2.3.0.ds1-2","urgency":"unimportant"},"sid":{"status":"resolved","repositories":{"sid":"3.4.0.ds1-1"},"fixed_version":"2.3.0.ds1-2","urgency":"unimportant"},"trixie":{"status":"resolved","repositories":{"trixie":"2.5.0.ds1-4"},"fixed_version":"2.3.0.ds1-2","urgency":"unimportant"}}},"CVE-2018-12562":{"description":"An issue was discovered in the cantata-mounter D-Bus service in Cantata through 2.3.1. The wrapper script 'mount.cifs.wrapper' uses the shell to forward the arguments to the actual mount.cifs binary. The shell evaluates wildcards (such as in an injected string:/home/../tmp/* string).","debianbug":901798,"scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"2.5.0.ds1-1"},"fixed_version":"2.3.0.ds1-2","urgency":"unimportant"},"bullseye":{"status":"resolved","repositories":{"bullseye":"2.4.2.ds1-1"},"fixed_version":"2.3.0.ds1-2","urgency":"unimportant"},"forky":{"status":"resolved","repositories":{"forky":"3.4.0.ds1-1"},"fixed_version":"2.3.0.ds1-2","urgency":"unimportant"},"sid":{"status":"resolved","repositories":{"sid":"3.4.0.ds1-1"},"fixed_version":"2.3.0.ds1-2","urgency":"unimportant"},"trixie":{"status":"resolved","repositories":{"trixie":"2.5.0.ds1-4"},"fixed_version":"2.3.0.ds1-2","urgency":"unimportant"}}}},"capnproto":{"CVE-2015-2310":{"description":"Integer overflow in layout.c++ in Sandstorm Cap'n Proto before 0.4.1.1 and 0.5.x before 0.5.1.1 allows remote peers to cause a denial of service or possibly obtain sensitive information from memory via a crafted message, related to pointer validation.","debianbug":780565,"scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"0.9.2-2"},"fixed_version":"0.4.1-3","urgency":"not yet assigned"},"bullseye":{"status":"resolved","repositories":{"bullseye":"0.7.0-7"},"fixed_version":"0.4.1-3","urgency":"not yet assigned"},"forky":{"status":"resolved","repositories":{"forky":"1.1.0-2.1"},"fixed_version":"0.4.1-3","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"1.1.0-2.1"},"fixed_version":"0.4.1-3","urgency":"not yet assigned"},"trixie":{"status":"resolved","repositories":{"trixie":"1.1.0-2"},"fixed_version":"0.4.1-3","urgency":"not yet assigned"}}},"CVE-2015-2311":{"description":"Integer underflow in Sandstorm Cap'n Proto before 0.4.1.1 and 0.5.x before 0.5.1.1 might allow remote peers to cause a denial of service or possibly obtain sensitive information from memory or execute arbitrary code via a crafted message.","debianbug":780566,"scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"0.9.2-2"},"fixed_version":"0.4.1-3","urgency":"not yet assigned"},"bullseye":{"status":"resolved","repositories":{"bullseye":"0.7.0-7"},"fixed_version":"0.4.1-3","urgency":"not yet assigned"},"forky":{"status":"resolved","repositories":{"forky":"1.1.0-2.1"},"fixed_version":"0.4.1-3","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"1.1.0-2.1"},"fixed_version":"0.4.1-3","urgency":"not yet assigned"},"trixie":{"status":"resolved","repositories":{"trixie":"1.1.0-2"},"fixed_version":"0.4.1-3","urgency":"not yet assigned"}}},"CVE-2015-2312":{"description":"Sandstorm Cap'n Proto before 0.4.1.1 and 0.5.x before 0.5.1.1 allows remote peers to cause a denial of service (CPU and possibly general resource consumption) via a list with a large number of elements.","debianbug":780567,"scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"0.9.2-2"},"fixed_version":"0.4.1-3","urgency":"not yet assigned"},"bullseye":{"status":"resolved","repositories":{"bullseye":"0.7.0-7"},"fixed_version":"0.4.1-3","urgency":"not yet assigned"},"forky":{"status":"resolved","repositories":{"forky":"1.1.0-2.1"},"fixed_version":"0.4.1-3","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"1.1.0-2.1"},"fixed_version":"0.4.1-3","urgency":"not yet assigned"},"trixie":{"status":"resolved","repositories":{"trixie":"1.1.0-2"},"fixed_version":"0.4.1-3","urgency":"not yet assigned"}}},"CVE-2015-2313":{"description":"Sandstorm Cap'n Proto before 0.4.1.1 and 0.5.x before 0.5.1.2, when an application invokes the totalSize method on an object reader, allows remote peers to cause a denial of service (CPU consumption) via a crafted small message, which triggers a \"tight\" for loop.  NOTE: this vulnerability exists because of an incomplete fix for CVE-2015-2312.","debianbug":780568,"scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"0.9.2-2"},"fixed_version":"0.4.1-3","urgency":"not yet assigned"},"bullseye":{"status":"resolved","repositories":{"bullseye":"0.7.0-7"},"fixed_version":"0.4.1-3","urgency":"not yet assigned"},"forky":{"status":"resolved","repositories":{"forky":"1.1.0-2.1"},"fixed_version":"0.4.1-3","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"1.1.0-2.1"},"fixed_version":"0.4.1-3","urgency":"not yet assigned"},"trixie":{"status":"resolved","repositories":{"trixie":"1.1.0-2"},"fixed_version":"0.4.1-3","urgency":"not yet assigned"}}},"CVE-2017-7892":{"description":"Sandstorm Cap'n Proto before 0.5.3.1 allows remote crashes related to a compiler optimization. A remote attacker can trigger a segfault in a 32-bit libcapnp application because Cap'n Proto relies on pointer arithmetic calculations that overflow. An example compiler with optimization that elides a bounds check in such calculations is Apple LLVM version 8.1.0 (clang-802.0.41). The attack vector is a crafted far pointer within a message.","debianbug":860960,"scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"0.9.2-2"},"fixed_version":"0.6.1-1","urgency":"unimportant"},"bullseye":{"status":"resolved","repositories":{"bullseye":"0.7.0-7"},"fixed_version":"0.6.1-1","urgency":"unimportant"},"forky":{"status":"resolved","repositories":{"forky":"1.1.0-2.1"},"fixed_version":"0.6.1-1","urgency":"unimportant"},"sid":{"status":"resolved","repositories":{"sid":"1.1.0-2.1"},"fixed_version":"0.6.1-1","urgency":"unimportant"},"trixie":{"status":"resolved","repositories":{"trixie":"1.1.0-2"},"fixed_version":"0.6.1-1","urgency":"unimportant"}}},"CVE-2022-46149":{"description":"Cap'n Proto is a data interchange format and remote procedure call (RPC) system. Cap'n Proro prior to versions 0.7.1, 0.8.1, 0.9.2, and 0.10.3, as well as versions of Cap'n Proto's Rust implementation prior to 0.13.7, 0.14.11, and 0.15.2 are vulnerable to out-of-bounds read due to logic error handling list-of-list. This issue may lead someone to remotely segfault a peer by sending it a malicious message, if the victim performs certain actions on a list-of-pointer type. Exfiltration of memory is possible if the victim performs additional certain actions on a list-of-pointer type. To be vulnerable, an application must perform a specific sequence of actions, described in the GitHub Security Advisory. The bug is present in inlined code, therefore the fix will require rebuilding dependent applications. Cap'n Proto has C++ fixes available in versions 0.7.1, 0.8.1, 0.9.2, and 0.10.3. The `capnp` Rust crate has fixes available in versions 0.13.7, 0.14.11, and 0.15.2.","scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"0.9.2-2"},"fixed_version":"0.9.2-2","urgency":"not yet assigned"},"bullseye":{"status":"open","repositories":{"bullseye":"0.7.0-7"},"urgency":"not yet assigned","nodsa":"Breaks API and requires rebuilds, possibly via point release","nodsa_reason":""},"forky":{"status":"resolved","repositories":{"forky":"1.1.0-2.1"},"fixed_version":"0.9.2-2","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"1.1.0-2.1"},"fixed_version":"0.9.2-2","urgency":"not yet assigned"},"trixie":{"status":"resolved","repositories":{"trixie":"1.1.0-2"},"fixed_version":"0.9.2-2","urgency":"not yet assigned"}}},"CVE-2023-48230":{"description":"Cap'n Proto is a data interchange format and capability-based RPC system. In versions 1.0 and 1.0.1, when using the KJ HTTP library with WebSocket compression enabled, a buffer underrun can be caused by a remote peer. The underrun always writes a constant value that is not attacker-controlled, likely resulting in a crash, enabling a remote denial-of-service attack. Most Cap'n Proto and KJ users are unlikely to have this functionality enabled and so unlikely to be affected. Maintainers suspect only the Cloudflare Workers Runtime is affected.  If KJ HTTP is used with WebSocket compression enabled, a malicious peer may be able to cause a buffer underrun on a heap-allocated buffer. KJ HTTP is an optional library bundled with Cap'n Proto, but is not directly used by Cap'n Proto. WebSocket compression is disabled by default. It must be enabled via a setting passed to the KJ HTTP library via `HttpClientSettings` or `HttpServerSettings`. The bytes written out-of-bounds are always a specific constant 4-byte string `{ 0x00, 0x00, 0xFF, 0xFF }`. Because this string is not controlled by the attacker, maintainers believe it is unlikely that remote code execution is possible. However, it cannot be ruled out. This functionality first appeared in Cap'n Proto 1.0. Previous versions are not affected.  This issue is fixed in Cap'n Proto 1.0.1.1.","debianbug":1056615,"scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"0.9.2-2"},"fixed_version":"0","urgency":"unimportant"},"bullseye":{"status":"resolved","repositories":{"bullseye":"0.7.0-7"},"fixed_version":"0","urgency":"unimportant"},"forky":{"status":"resolved","repositories":{"forky":"1.1.0-2.1"},"fixed_version":"1.0.1-3","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"1.1.0-2.1"},"fixed_version":"1.0.1-3","urgency":"not yet assigned"},"trixie":{"status":"resolved","repositories":{"trixie":"1.1.0-2"},"fixed_version":"1.0.1-3","urgency":"not yet assigned"}}}},"capstone":{"CVE-2016-7151":{"description":"Capstone 3.0.4 has an out-of-bounds vulnerability (SEGV caused by a read memory access) in X86_insn_reg_intel in arch/X86/X86Mapping.c.","debianbug":930002,"scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"4.0.2-5"},"fixed_version":"4.0.2-2","urgency":"low"},"bullseye":{"status":"resolved","repositories":{"bullseye":"4.0.2-3"},"fixed_version":"4.0.2-2","urgency":"low"},"forky":{"status":"resolved","repositories":{"forky":"5.0.7-2"},"fixed_version":"4.0.2-2","urgency":"low"},"sid":{"status":"resolved","repositories":{"sid":"5.0.7-2"},"fixed_version":"4.0.2-2","urgency":"low"},"trixie":{"status":"resolved","repositories":{"trixie":"5.0.6-1"},"fixed_version":"4.0.2-2","urgency":"low"}}},"CVE-2017-6952":{"description":"Integer overflow in the cs_winkernel_malloc function in winkernel_mm.c in Capstone 3.0.4 and earlier allows attackers to cause a denial of service (heap-based buffer overflow in a kernel driver) or possibly have unspecified other impact via a large value.","scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"4.0.2-5"},"fixed_version":"0","urgency":"unimportant"},"bullseye":{"status":"resolved","repositories":{"bullseye":"4.0.2-3"},"fixed_version":"0","urgency":"unimportant"},"forky":{"status":"resolved","repositories":{"forky":"5.0.7-2"},"fixed_version":"0","urgency":"unimportant"},"sid":{"status":"resolved","repositories":{"sid":"5.0.7-2"},"fixed_version":"0","urgency":"unimportant"},"trixie":{"status":"resolved","repositories":{"trixie":"5.0.6-1"},"fixed_version":"0","urgency":"unimportant"}}},"CVE-2025-67873":{"description":"Capstone is a disassembly framework. In versions 6.0.0-Alpha5 and prior, Skipdata length is not bounds-checked, so a user-provided skipdata callback can make cs_disasm/cs_disasm_iter memcpy more than 24 bytes into cs_insn.bytes, causing a heap buffer overflow in the disassembly path. Commit cbef767ab33b82166d263895f24084b75b316df3 fixes the issue.","debianbug":1123740,"scope":"local","releases":{"bookworm":{"status":"open","repositories":{"bookworm":"4.0.2-5"},"urgency":"not yet assigned","nodsa":"Minor issue","nodsa_reason":""},"bullseye":{"status":"open","repositories":{"bullseye":"4.0.2-3"},"urgency":"not yet assigned","nodsa":"Minor issue","nodsa_reason":"postponed"},"forky":{"status":"resolved","repositories":{"forky":"5.0.7-2"},"fixed_version":"5.0.7-1","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"5.0.7-2"},"fixed_version":"5.0.7-1","urgency":"not yet assigned"},"trixie":{"status":"open","repositories":{"trixie":"5.0.6-1"},"urgency":"not yet assigned","nodsa":"Minor issue","nodsa_reason":"","next_point_update":true}}},"CVE-2025-68114":{"description":"Capstone is a disassembly framework. In versions 6.0.0-Alpha5 and prior, an unchecked vsnprintf return in SStream_concat lets a malicious cs_opt_mem.vsnprintf drive SStream\u2019s index negative or past the end, leading to a stack buffer underflow/overflow when the next write occurs. Commit 2c7797182a1618be12017d7d41e0b6581d5d529e fixes the issue.","debianbug":1123739,"scope":"local","releases":{"bookworm":{"status":"open","repositories":{"bookworm":"4.0.2-5"},"urgency":"not yet assigned","nodsa":"Minor issue","nodsa_reason":""},"bullseye":{"status":"open","repositories":{"bullseye":"4.0.2-3"},"urgency":"not yet assigned","nodsa":"Minor issue","nodsa_reason":"postponed"},"forky":{"status":"resolved","repositories":{"forky":"5.0.7-2"},"fixed_version":"5.0.7-1","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"5.0.7-2"},"fixed_version":"5.0.7-1","urgency":"not yet assigned"},"trixie":{"status":"open","repositories":{"trixie":"5.0.6-1"},"urgency":"not yet assigned","nodsa":"Minor issue","nodsa_reason":"","next_point_update":true}}}},"cargo":{"CVE-2016-10128":{"description":"Buffer overflow in the git_pkt_parse_line function in transports/smart_pkt.c in the Git Smart Protocol support in libgit2 before 0.24.6 and 0.25.x before 0.25.1 allows remote attackers to have unspecified impact via a crafted non-flush packet.","debianbug":860990,"scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"0.66.0+ds1-1"},"fixed_version":"0.17.0-1","urgency":"not yet assigned"},"bullseye":{"status":"resolved","repositories":{"bullseye":"0.47.0-3"},"fixed_version":"0.17.0-1","urgency":"not yet assigned"}}},"CVE-2016-10129":{"description":"The Git Smart Protocol support in libgit2 before 0.24.6 and 0.25.x before 0.25.1 allows remote attackers to cause a denial of service (NULL pointer dereference) via an empty packet line.","debianbug":860990,"scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"0.66.0+ds1-1"},"fixed_version":"0.17.0-1","urgency":"not yet assigned"},"bullseye":{"status":"resolved","repositories":{"bullseye":"0.47.0-3"},"fixed_version":"0.17.0-1","urgency":"not yet assigned"}}},"CVE-2016-10130":{"description":"The http_connect function in transports/http.c in libgit2 before 0.24.6 and 0.25.x before 0.25.1 might allow man-in-the-middle attackers to spoof servers by leveraging clobbering of the error variable.","debianbug":860990,"scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"0.66.0+ds1-1"},"fixed_version":"0.17.0-1","urgency":"not yet assigned"},"bullseye":{"status":"resolved","repositories":{"bullseye":"0.47.0-3"},"fixed_version":"0.17.0-1","urgency":"not yet assigned"}}},"CVE-2016-8568":{"description":"The git_commit_message function in oid.c in libgit2 before 0.24.3 allows remote attackers to cause a denial of service (out-of-bounds read) via a cat-file command with a crafted object file.","debianbug":860989,"scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"0.66.0+ds1-1"},"fixed_version":"0.17.0-1","urgency":"not yet assigned"},"bullseye":{"status":"resolved","repositories":{"bullseye":"0.47.0-3"},"fixed_version":"0.17.0-1","urgency":"not yet assigned"}}},"CVE-2016-8569":{"description":"The git_oid_nfmt function in commit.c in libgit2 before 0.24.3 allows remote attackers to cause a denial of service (NULL pointer dereference) via a cat-file command with a crafted object file.","debianbug":860989,"scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"0.66.0+ds1-1"},"fixed_version":"0.17.0-1","urgency":"not yet assigned"},"bullseye":{"status":"resolved","repositories":{"bullseye":"0.47.0-3"},"fixed_version":"0.17.0-1","urgency":"not yet assigned"}}},"CVE-2019-16760":{"description":"Cargo prior to Rust 1.26.0 may download the wrong dependency if your package.toml file uses the `package` configuration key. Usage of the `package` key to rename dependencies in `Cargo.toml` is ignored in Rust 1.25.0 and prior. When Rust 1.25.0 and prior is used Cargo may download the wrong dependency, which could be squatted on crates.io to be a malicious package. This not only affects manifests that you write locally yourself, but also manifests published to crates.io. Rust 1.0.0 through Rust 1.25.0 is affected by this advisory because Cargo will ignore the `package` key in manifests. Rust 1.26.0 through Rust 1.30.0 are not affected and typically will emit an error because the `package` key is unstable. Rust 1.31.0 and after are not affected because Cargo understands the `package` key. Users of the affected versions are strongly encouraged to update their compiler to the latest available one. Preventing this issue from happening requires updating your compiler to be either Rust 1.26.0 or newer. There will be no point release for Rust versions prior to 1.26.0. Users of Rust 1.19.0 to Rust 1.25.0 can instead apply linked patches to mitigate the issue.","scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"0.66.0+ds1-1"},"fixed_version":"0.27.0-1","urgency":"not yet assigned"},"bullseye":{"status":"resolved","repositories":{"bullseye":"0.47.0-3"},"fixed_version":"0.27.0-1","urgency":"not yet assigned"}}},"CVE-2022-36113":{"description":"Cargo is a package manager for the rust programming language. After a package is downloaded, Cargo extracts its source code in the ~/.cargo folder on disk, making it available to the Rust projects it builds. To record when an extraction is successful, Cargo writes \"ok\" to the .cargo-ok file at the root of the extracted source code once it extracted all the files. It was discovered that Cargo allowed packages to contain a .cargo-ok symbolic link, which Cargo would extract. Then, when Cargo attempted to write \"ok\" into .cargo-ok, it would actually replace the first two bytes of the file the symlink pointed to with ok. This would allow an attacker to corrupt one file on the machine using Cargo to extract the package. Note that by design Cargo allows code execution at build time, due to build scripts and procedural macros. The vulnerabilities in this advisory allow performing a subset of the possible damage in a harder to track down way. Your dependencies must still be trusted if you want to be protected from attacks, as it's possible to perform the same attacks with build scripts and procedural macros. The vulnerability is present in all versions of Cargo. Rust 1.64, to be released on September 22nd, will include a fix for it. Since the vulnerability is just a more limited way to accomplish what a malicious build scripts or procedural macros can do, we decided not to publish Rust point releases backporting the security fix. Patch files are available for Rust 1.63.0 are available in the wg-security-response repository for people building their own toolchain. Mitigations We recommend users of alternate registries to exercise care in which package they download, by only including trusted dependencies in their projects. Please note that even with these vulnerabilities fixed, by design Cargo allows arbitrary code execution at build time thanks to build scripts and procedural macros: a malicious dependency will be able to cause damage regardless of these vulnerabilities. crates.io implemented server-side checks to reject these kinds of packages years ago, and there are no packages on crates.io exploiting these vulnerabilities. crates.io users still need to exercise care in choosing their dependencies though, as remote code execution is allowed by design there as well.","debianbug":1021142,"scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"0.66.0+ds1-1"},"fixed_version":"0.63.1-1","urgency":"not yet assigned"},"bullseye":{"status":"open","repositories":{"bullseye":"0.47.0-3"},"urgency":"not yet assigned","nodsa":"Minor issue","nodsa_reason":""}}},"CVE-2022-36114":{"description":"Cargo is a package manager for the rust programming language. It was discovered that Cargo did not limit the amount of data extracted from compressed archives. An attacker could upload to an alternate registry a specially crafted package that extracts way more data than its size (also known as a \"zip bomb\"), exhausting the disk space on the machine using Cargo to download the package. Note that by design Cargo allows code execution at build time, due to build scripts and procedural macros. The vulnerabilities in this advisory allow performing a subset of the possible damage in a harder to track down way. Your dependencies must still be trusted if you want to be protected from attacks, as it's possible to perform the same attacks with build scripts and procedural macros. The vulnerability is present in all versions of Cargo. Rust 1.64, to be released on September 22nd, will include a fix for it. Since the vulnerability is just a more limited way to accomplish what a malicious build scripts or procedural macros can do, we decided not to publish Rust point releases backporting the security fix. Patch files are available for Rust 1.63.0 are available in the wg-security-response repository for people building their own toolchain. We recommend users of alternate registries to excercise care in which package they download, by only including trusted dependencies in their projects. Please note that even with these vulnerabilities fixed, by design Cargo allows arbitrary code execution at build time thanks to build scripts and procedural macros: a malicious dependency will be able to cause damage regardless of these vulnerabilities. crates.io implemented server-side checks to reject these kinds of packages years ago, and there are no packages on crates.io exploiting these vulnerabilities. crates.io users still need to excercise care in choosing their dependencies though, as the same concerns about build scripts and procedural macros apply here.","debianbug":1021142,"scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"0.66.0+ds1-1"},"fixed_version":"0.63.1-1","urgency":"not yet assigned"},"bullseye":{"status":"open","repositories":{"bullseye":"0.47.0-3"},"urgency":"not yet assigned","nodsa":"Minor issue","nodsa_reason":""}}},"CVE-2022-46176":{"description":"Cargo is a Rust package manager. The Rust Security Response WG was notified that Cargo did not perform SSH host key verification when cloning indexes and dependencies via SSH. An attacker could exploit this to perform man-in-the-middle (MITM) attacks. This vulnerability has been assigned CVE-2022-46176. All Rust versions containing Cargo before 1.66.1 are vulnerable. Note that even if you don't explicitly use SSH for alternate registry indexes or crate dependencies, you might be affected by this vulnerability if you have configured git to replace HTTPS connections to GitHub with SSH (through git's [`url.<base>.insteadOf`][1] setting), as that'd cause you to clone the crates.io index through SSH. Rust 1.66.1 will ensure Cargo checks the SSH host key and abort the connection if the server's public key is not already trusted. We recommend everyone to upgrade as soon as possible.","scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"0.66.0+ds1-1"},"fixed_version":"0.66.0+ds1-1","urgency":"not yet assigned"},"bullseye":{"status":"open","repositories":{"bullseye":"0.47.0-3"},"urgency":"not yet assigned","nodsa":"Minor issue","nodsa_reason":""}}},"CVE-2023-38497":{"description":"Cargo downloads the Rust project\u2019s dependencies and compiles the project. Cargo prior to version 0.72.2, bundled with Rust prior to version 1.71.1, did not respect the umask when extracting crate archives on UNIX-like systems. If the user downloaded a crate containing files writeable by any local user, another local user could exploit this to change the source code compiled and executed by the current user. To prevent existing cached extractions from being exploitable, the Cargo binary version 0.72.2 included in Rust 1.71.1 or later will purge caches generated by older Cargo versions automatically. As a workaround, configure one's system to prevent other local users from accessing the Cargo directory, usually located in `~/.cargo`.","debianbug":1043553,"scope":"local","releases":{"bookworm":{"status":"open","repositories":{"bookworm":"0.66.0+ds1-1"},"urgency":"not yet assigned","nodsa":"Minor issue","nodsa_reason":"ignored"},"bullseye":{"status":"open","repositories":{"bullseye":"0.47.0-3"},"urgency":"not yet assigned","nodsa":"Minor issue","nodsa_reason":""}}},"CVE-2023-40030":{"description":"Cargo downloads a Rust project\u2019s dependencies and compiles the project. Starting in Rust 1.60.0 and prior to 1.72, Cargo did not escape Cargo feature names when including them in the report generated by `cargo build --timings`. A malicious package included as a dependency may inject nearly arbitrary HTML here, potentially leading to cross-site scripting if the report is subsequently uploaded somewhere. The vulnerability affects users relying on dependencies from git, local paths, or alternative registries. Users who solely depend on crates.io are unaffected.  Rust 1.60.0 introduced `cargo build --timings`, which produces a report of how long the different steps of the build process took. It includes lists of Cargo features for each crate. Prior to Rust 1.72, Cargo feature names were allowed to contain almost any characters (with some exceptions as used by the feature syntax), but it would produce a future incompatibility warning about them since Rust 1.49. crates.io is far more stringent about what it considers a valid feature name and has not allowed such feature names. As the feature names were included unescaped in the timings report, they could be used to inject Javascript into the page, for example with a feature name like `features = [\"<img src='' onerror=alert(0)\"]`. If this report were subsequently uploaded to a domain that uses credentials, the injected Javascript could access resources from the website visitor.  This issue was fixed in Rust 1.72 by turning the future incompatibility warning into an error. Users should still exercise care in which package they download, by only including trusted dependencies in their projects. Please note that even with these vulnerabilities fixed, by design Cargo allows arbitrary code execution at build time thanks to build scripts and procedural macros: a malicious dependency will be able to cause damage regardless of these vulnerabilities. crates.io has server-side checks preventing this attack, and there are no packages on crates.io exploiting these vulnerabilities. crates.io users still need to excercise care in choosing their dependencies though, as remote code execution is allowed by design there as well.","debianbug":1059305,"scope":"local","releases":{"bookworm":{"status":"open","repositories":{"bookworm":"0.66.0+ds1-1"},"urgency":"not yet assigned","nodsa":"Minor issue","nodsa_reason":"ignored"},"bullseye":{"status":"open","repositories":{"bullseye":"0.47.0-3"},"urgency":"not yet assigned","nodsa":"Minor issue","nodsa_reason":""}}}},"caribou":{"CVE-2021-3567":{"description":"A flaw was found in Caribou due to a regression of CVE-2020-25712 fix. An attacker could use this flaw to bypass screen-locking applications that leverage Caribou as an input mechanism. The highest threat from this vulnerability is to system availability.","debianbug":980061,"scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"0.4.21-8"},"fixed_version":"0.4.21-7.1","urgency":"not yet assigned"},"bullseye":{"status":"resolved","repositories":{"bullseye":"0.4.21-7.1"},"fixed_version":"0.4.21-7.1","urgency":"not yet assigned"},"forky":{"status":"resolved","repositories":{"forky":"0.4.21-11"},"fixed_version":"0.4.21-7.1","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"0.4.21-11"},"fixed_version":"0.4.21-7.1","urgency":"not yet assigned"},"trixie":{"status":"resolved","repositories":{"trixie":"0.4.21-10"},"fixed_version":"0.4.21-7.1","urgency":"not yet assigned"}}}},"catdoc":{"CVE-2003-0193":{"description":"msxlsview.sh in xlsview for catdoc 0.91 and earlier allows local users to overwrite arbitrary files via a symlink attack on predictable temporary file names (\"word$$.html\").","scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"1:0.95-6~deb12u1","bookworm-security":"1:0.95-6~deb12u1"},"fixed_version":"0.91.5-2","urgency":"not yet assigned"},"bullseye":{"status":"resolved","repositories":{"bullseye":"1:0.95-4.1","bullseye-security":"1:0.95-4.1+deb11u1"},"fixed_version":"0.91.5-2","urgency":"not yet assigned"},"forky":{"status":"resolved","repositories":{"forky":"1:0.95-6"},"fixed_version":"0.91.5-2","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"1:0.95-6"},"fixed_version":"0.91.5-2","urgency":"not yet assigned"},"trixie":{"status":"resolved","repositories":{"trixie":"1:0.95-6"},"fixed_version":"0.91.5-2","urgency":"not yet assigned"}}},"CVE-2017-11110":{"description":"The ole_init function in ole.c in catdoc 0.95 allows remote attackers to cause a denial of service (heap-based buffer underflow and application crash) or possibly have unspecified other impact via a crafted file, i.e., data is written to memory addresses before the beginning of the tmpBuf buffer.","debianbug":867717,"scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"1:0.95-6~deb12u1","bookworm-security":"1:0.95-6~deb12u1"},"fixed_version":"1:0.95-3","urgency":"not yet assigned"},"bullseye":{"status":"resolved","repositories":{"bullseye":"1:0.95-4.1","bullseye-security":"1:0.95-4.1+deb11u1"},"fixed_version":"1:0.95-3","urgency":"not yet assigned"},"forky":{"status":"resolved","repositories":{"forky":"1:0.95-6"},"fixed_version":"1:0.95-3","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"1:0.95-6"},"fixed_version":"1:0.95-3","urgency":"not yet assigned"},"trixie":{"status":"resolved","repositories":{"trixie":"1:0.95-6"},"fixed_version":"1:0.95-3","urgency":"not yet assigned"}}},"CVE-2018-20451":{"description":"The process_file function in reader.c in libdoc through 2017-10-23 has a heap-based buffer over-read that allows attackers to cause a denial of service (application crash) via a crafted file.","debianbug":919526,"scope":"local","releases":{"bookworm":{"status":"open","repositories":{"bookworm":"1:0.95-6~deb12u1","bookworm-security":"1:0.95-6~deb12u1"},"urgency":"unimportant"},"bullseye":{"status":"open","repositories":{"bullseye":"1:0.95-4.1","bullseye-security":"1:0.95-4.1+deb11u1"},"urgency":"unimportant"},"forky":{"status":"open","repositories":{"forky":"1:0.95-6"},"urgency":"unimportant"},"sid":{"status":"open","repositories":{"sid":"1:0.95-6"},"urgency":"unimportant"},"trixie":{"status":"open","repositories":{"trixie":"1:0.95-6"},"urgency":"unimportant"}}},"CVE-2018-20453":{"description":"The getlong function in numutils.c in libdoc through 2017-10-23 has a heap-based buffer over-read that allows attackers to cause a denial of service (application crash) via a crafted file.","debianbug":919526,"scope":"local","releases":{"bookworm":{"status":"open","repositories":{"bookworm":"1:0.95-6~deb12u1","bookworm-security":"1:0.95-6~deb12u1"},"urgency":"unimportant"},"bullseye":{"status":"open","repositories":{"bullseye":"1:0.95-4.1","bullseye-security":"1:0.95-4.1+deb11u1"},"urgency":"unimportant"},"forky":{"status":"open","repositories":{"forky":"1:0.95-6"},"urgency":"unimportant"},"sid":{"status":"open","repositories":{"sid":"1:0.95-6"},"urgency":"unimportant"},"trixie":{"status":"open","repositories":{"trixie":"1:0.95-6"},"urgency":"unimportant"}}},"CVE-2019-7156":{"description":"In libdoc through 2019-01-28, calcFileBlockOffset in ole.c allows division by zero.","scope":"local","releases":{"bookworm":{"status":"open","repositories":{"bookworm":"1:0.95-6~deb12u1","bookworm-security":"1:0.95-6~deb12u1"},"urgency":"unimportant"},"bullseye":{"status":"open","repositories":{"bullseye":"1:0.95-4.1","bullseye-security":"1:0.95-4.1+deb11u1"},"urgency":"unimportant"},"forky":{"status":"open","repositories":{"forky":"1:0.95-6"},"urgency":"unimportant"},"sid":{"status":"open","repositories":{"sid":"1:0.95-6"},"urgency":"unimportant"},"trixie":{"status":"open","repositories":{"trixie":"1:0.95-6"},"urgency":"unimportant"}}},"CVE-2019-7233":{"description":"In libdoc through 2019-01-28, doc2text in catdoc.c has a NULL pointer dereference.","scope":"local","releases":{"bookworm":{"status":"open","repositories":{"bookworm":"1:0.95-6~deb12u1","bookworm-security":"1:0.95-6~deb12u1"},"urgency":"unimportant"},"bullseye":{"status":"open","repositories":{"bullseye":"1:0.95-4.1","bullseye-security":"1:0.95-4.1+deb11u1"},"urgency":"unimportant"},"forky":{"status":"open","repositories":{"forky":"1:0.95-6"},"urgency":"unimportant"},"sid":{"status":"open","repositories":{"sid":"1:0.95-6"},"urgency":"unimportant"},"trixie":{"status":"open","repositories":{"trixie":"1:0.95-6"},"urgency":"unimportant"}}},"CVE-2023-31979":{"description":"Catdoc v0.95 was discovered to contain a global buffer overflow via the function process_file at /src/reader.c.","scope":"local","releases":{"bookworm":{"status":"open","repositories":{"bookworm":"1:0.95-6~deb12u1","bookworm-security":"1:0.95-6~deb12u1"},"urgency":"unimportant"},"bullseye":{"status":"open","repositories":{"bullseye":"1:0.95-4.1","bullseye-security":"1:0.95-4.1+deb11u1"},"urgency":"unimportant"},"forky":{"status":"open","repositories":{"forky":"1:0.95-6"},"urgency":"unimportant"},"sid":{"status":"open","repositories":{"sid":"1:0.95-6"},"urgency":"unimportant"},"trixie":{"status":"open","repositories":{"trixie":"1:0.95-6"},"urgency":"unimportant"}}},"CVE-2023-41633":{"description":"Catdoc v0.95 was discovered to contain a NULL pointer dereference via the component xls2csv at src/fileutil.c.","scope":"local","releases":{"bookworm":{"status":"open","repositories":{"bookworm":"1:0.95-6~deb12u1","bookworm-security":"1:0.95-6~deb12u1"},"urgency":"unimportant"},"bullseye":{"status":"open","repositories":{"bullseye":"1:0.95-4.1","bullseye-security":"1:0.95-4.1+deb11u1"},"urgency":"unimportant"},"forky":{"status":"open","repositories":{"forky":"1:0.95-6"},"urgency":"unimportant"},"sid":{"status":"open","repositories":{"sid":"1:0.95-6"},"urgency":"unimportant"},"trixie":{"status":"open","repositories":{"trixie":"1:0.95-6"},"urgency":"unimportant"}}},"CVE-2023-46345":{"description":"Catdoc v0.95 was discovered to contain a NULL pointer dereference via the component xls2csv at src/xlsparse.c.","scope":"local","releases":{"bookworm":{"status":"open","repositories":{"bookworm":"1:0.95-6~deb12u1","bookworm-security":"1:0.95-6~deb12u1"},"urgency":"unimportant"},"bullseye":{"status":"open","repositories":{"bullseye":"1:0.95-4.1","bullseye-security":"1:0.95-4.1+deb11u1"},"urgency":"unimportant"},"forky":{"status":"open","repositories":{"forky":"1:0.95-6"},"urgency":"unimportant"},"sid":{"status":"open","repositories":{"sid":"1:0.95-6"},"urgency":"unimportant"},"trixie":{"status":"open","repositories":{"trixie":"1:0.95-6"},"urgency":"unimportant"}}},"CVE-2024-48877":{"description":"A memory corruption vulnerability exists in the Shared String Table Record Parser implementation in xls2csv utility version 0.95. A specially crafted malformed file can lead to a heap buffer overflow. An attacker can provide a malicious file to trigger this vulnerability.","debianbug":1107168,"scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"1:0.95-6~deb12u1","bookworm-security":"1:0.95-6~deb12u1"},"fixed_version":"1:0.95-6~deb12u1","urgency":"not yet assigned"},"bullseye":{"status":"resolved","repositories":{"bullseye":"1:0.95-4.1","bullseye-security":"1:0.95-4.1+deb11u1"},"fixed_version":"1:0.95-4.1+deb11u1","urgency":"not yet assigned"},"forky":{"status":"resolved","repositories":{"forky":"1:0.95-6"},"fixed_version":"1:0.95-6","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"1:0.95-6"},"fixed_version":"1:0.95-6","urgency":"not yet assigned"},"trixie":{"status":"resolved","repositories":{"trixie":"1:0.95-6"},"fixed_version":"1:0.95-6","urgency":"not yet assigned"}}},"CVE-2024-52035":{"description":"An integer overflow vulnerability exists in the OLE Document File Allocation Table Parser functionality of catdoc 0.95. A specially crafted malformed file can lead to heap-based memory corruption. An attacker can provide a malicious file to trigger this vulnerability.","debianbug":1107168,"scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"1:0.95-6~deb12u1","bookworm-security":"1:0.95-6~deb12u1"},"fixed_version":"1:0.95-6~deb12u1","urgency":"not yet assigned"},"bullseye":{"status":"resolved","repositories":{"bullseye":"1:0.95-4.1","bullseye-security":"1:0.95-4.1+deb11u1"},"fixed_version":"1:0.95-4.1+deb11u1","urgency":"not yet assigned"},"forky":{"status":"resolved","repositories":{"forky":"1:0.95-6"},"fixed_version":"1:0.95-6","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"1:0.95-6"},"fixed_version":"1:0.95-6","urgency":"not yet assigned"},"trixie":{"status":"resolved","repositories":{"trixie":"1:0.95-6"},"fixed_version":"1:0.95-6","urgency":"not yet assigned"}}},"CVE-2024-54028":{"description":"An integer underflow vulnerability exists in the OLE Document DIFAT Parser functionality of catdoc 0.95. A specially crafted malformed file can lead to heap-based memory corruption. An attacker can provide a malicious file to trigger this vulnerability.","debianbug":1107168,"scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"1:0.95-6~deb12u1","bookworm-security":"1:0.95-6~deb12u1"},"fixed_version":"1:0.95-6~deb12u1","urgency":"not yet assigned"},"bullseye":{"status":"resolved","repositories":{"bullseye":"1:0.95-4.1","bullseye-security":"1:0.95-4.1+deb11u1"},"fixed_version":"1:0.95-4.1+deb11u1","urgency":"not yet assigned"},"forky":{"status":"resolved","repositories":{"forky":"1:0.95-6"},"fixed_version":"1:0.95-6","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"1:0.95-6"},"fixed_version":"1:0.95-6","urgency":"not yet assigned"},"trixie":{"status":"resolved","repositories":{"trixie":"1:0.95-6"},"fixed_version":"1:0.95-6","urgency":"not yet assigned"}}}},"catfish":{"CVE-2014-2093":{"description":"Untrusted search path vulnerability in Catfish through 0.4.0.3 allows local users to gain privileges via a Trojan horse catfish.py in the current working directory.","debianbug":739958,"scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"4.16.4-2"},"fixed_version":"1.0.1-1","urgency":"low"},"bullseye":{"status":"resolved","repositories":{"bullseye":"4.16.0-1"},"fixed_version":"1.0.1-1","urgency":"low"},"forky":{"status":"resolved","repositories":{"forky":"4.20.0-2"},"fixed_version":"1.0.1-1","urgency":"low"},"sid":{"status":"resolved","repositories":{"sid":"4.20.0-2"},"fixed_version":"1.0.1-1","urgency":"low"},"trixie":{"status":"resolved","repositories":{"trixie":"4.20.0-2"},"fixed_version":"1.0.1-1","urgency":"low"}}},"CVE-2014-2094":{"description":"Untrusted search path vulnerability in Catfish through 0.4.0.3, when a Fedora package such as 0.4.0.2-2 is not used, allows local users to gain privileges via a Trojan horse catfish.pyc in the current working directory.","debianbug":739958,"scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"4.16.4-2"},"fixed_version":"1.0.1-1","urgency":"low"},"bullseye":{"status":"resolved","repositories":{"bullseye":"4.16.0-1"},"fixed_version":"1.0.1-1","urgency":"low"},"forky":{"status":"resolved","repositories":{"forky":"4.20.0-2"},"fixed_version":"1.0.1-1","urgency":"low"},"sid":{"status":"resolved","repositories":{"sid":"4.20.0-2"},"fixed_version":"1.0.1-1","urgency":"low"},"trixie":{"status":"resolved","repositories":{"trixie":"4.20.0-2"},"fixed_version":"1.0.1-1","urgency":"low"}}},"CVE-2014-2095":{"description":"Untrusted search path vulnerability in Catfish 0.6.0 through 1.0.0, when a Fedora package such as 0.8.2-1 is not used, allows local users to gain privileges via a Trojan horse bin/catfish.pyc under the current working directory.","debianbug":739958,"scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"4.16.4-2"},"fixed_version":"1.0.1-1","urgency":"low"},"bullseye":{"status":"resolved","repositories":{"bullseye":"4.16.0-1"},"fixed_version":"1.0.1-1","urgency":"low"},"forky":{"status":"resolved","repositories":{"forky":"4.20.0-2"},"fixed_version":"1.0.1-1","urgency":"low"},"sid":{"status":"resolved","repositories":{"sid":"4.20.0-2"},"fixed_version":"1.0.1-1","urgency":"low"},"trixie":{"status":"resolved","repositories":{"trixie":"4.20.0-2"},"fixed_version":"1.0.1-1","urgency":"low"}}},"CVE-2014-2096":{"description":"Untrusted search path vulnerability in Catfish 0.6.0 through 1.0.0 allows local users to gain privileges via a Trojan horse bin/catfish.py under the current working directory.","debianbug":739958,"scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"4.16.4-2"},"fixed_version":"1.0.1-1","urgency":"low"},"bullseye":{"status":"resolved","repositories":{"bullseye":"4.16.0-1"},"fixed_version":"1.0.1-1","urgency":"low"},"forky":{"status":"resolved","repositories":{"forky":"4.20.0-2"},"fixed_version":"1.0.1-1","urgency":"low"},"sid":{"status":"resolved","repositories":{"sid":"4.20.0-2"},"fixed_version":"1.0.1-1","urgency":"low"},"trixie":{"status":"resolved","repositories":{"trixie":"4.20.0-2"},"fixed_version":"1.0.1-1","urgency":"low"}}}},"catimg":{"CVE-2018-13794":{"description":"A heap-based buffer overflow exists in stbi__bmp_load_cont in stb_image.h in catimg 2.4.0.","debianbug":903711,"scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"2.7.0-2"},"fixed_version":"2.5.0-1","urgency":"not yet assigned"},"bullseye":{"status":"resolved","repositories":{"bullseye":"2.7.0-1"},"fixed_version":"2.5.0-1","urgency":"not yet assigned"},"forky":{"status":"resolved","repositories":{"forky":"2.7.0-4.1"},"fixed_version":"2.5.0-1","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"2.7.0-4.1"},"fixed_version":"2.5.0-1","urgency":"not yet assigned"},"trixie":{"status":"resolved","repositories":{"trixie":"2.7.0-4"},"fixed_version":"2.5.0-1","urgency":"not yet assigned"}}}},"cbor2":{"CVE-2024-26134":{"description":"cbor2 provides encoding and decoding for the Concise Binary Object Representation (CBOR) (RFC 8949) serialization format. Starting in version 5.5.1 and prior to version 5.6.2, an attacker can crash a service using cbor2 to parse a CBOR binary by sending a long enough object. Version 5.6.2 contains a patch for this issue.","debianbug":1064416,"scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"5.4.6-1"},"fixed_version":"0","urgency":"unimportant"},"bullseye":{"status":"resolved","repositories":{"bullseye":"5.2.0-4"},"fixed_version":"0","urgency":"unimportant"},"forky":{"status":"resolved","repositories":{"forky":"5.8.0-1"},"fixed_version":"5.6.2-1","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"5.8.0-3"},"fixed_version":"5.6.2-1","urgency":"not yet assigned"},"trixie":{"status":"resolved","repositories":{"trixie":"5.6.5-1"},"fixed_version":"5.6.2-1","urgency":"not yet assigned"}}},"CVE-2025-64076":{"description":"Multiple vulnerabilities exist in cbor2 through version 5.7.0 in the decode_definite_long_string() function of the C extension decoder (source/decoder.c): (1) Integer Underflow Leading to Out-of-Bounds Read (CWE-191, CWE-125): An incorrect variable reference and missing state reset in the chunk processing loop causes buffer_length to not be reset to zero after UTF-8 character consumption. This results in subsequent chunk_length calculations producing negative values (e.g., chunk_length = 65536 - buffer_length), which are passed as signed integers to the read() method, potentially triggering unlimited read operations and resource exhaustion. (2) Memory Leak via Missing Reference Count Release (CWE-401): The main processing loop fails to release Python object references (Py_DECREF) for chunk objects allocated in each iteration. For CBOR strings longer than 65536 bytes, this causes cumulative memory leaks proportional to the payload size, enabling memory exhaustion attacks through repeated processing of large CBOR payloads. Both vulnerabilities can be exploited remotely without authentication by sending specially-crafted CBOR data containing definite-length text strings with multi-byte UTF-8 characters positioned at 65536-byte chunk boundaries. Successful exploitation results in denial of service through process crashes (CBORDecodeEOF exceptions) or memory exhaustion. The vulnerabilities affect all applications using cbor2's C extension to process untrusted CBOR data, including web APIs, IoT data collectors, and message queue processors. Fixed in commit 851473490281f82d82560b2368284ef33cf6e8f9 pushed with released version 5.7.1.","scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"5.4.6-1"},"fixed_version":"0","urgency":"unimportant"},"bullseye":{"status":"resolved","repositories":{"bullseye":"5.2.0-4"},"fixed_version":"0","urgency":"unimportant"},"forky":{"status":"resolved","repositories":{"forky":"5.8.0-1"},"fixed_version":"5.7.1-1","urgency":"unimportant"},"sid":{"status":"resolved","repositories":{"sid":"5.8.0-3"},"fixed_version":"5.7.1-1","urgency":"unimportant"},"trixie":{"status":"open","repositories":{"trixie":"5.6.5-1"},"urgency":"unimportant"}}},"CVE-2025-68131":{"description":"cbor2 provides encoding and decoding for the Concise Binary Object Representation (CBOR) serialization format. Starting in version 3.0.0 and prior to version 5.8.0, whhen a CBORDecoder instance is reused across multiple decode operations, values marked with the shareable tag (28) persist in memory and can be accessed by subsequent CBOR messages using the sharedref tag (29). This allows an attacker-controlled message to read data from previously decoded messages if the decoder is reused across trust boundaries. Version 5.8.0 patches the issue.","scope":"local","releases":{"bookworm":{"status":"open","repositories":{"bookworm":"5.4.6-1"},"urgency":"unimportant"},"bullseye":{"status":"open","repositories":{"bullseye":"5.2.0-4"},"urgency":"unimportant"},"forky":{"status":"resolved","repositories":{"forky":"5.8.0-1"},"fixed_version":"5.8.0-1","urgency":"unimportant"},"sid":{"status":"resolved","repositories":{"sid":"5.8.0-3"},"fixed_version":"5.8.0-1","urgency":"unimportant"},"trixie":{"status":"open","repositories":{"trixie":"5.6.5-1"},"urgency":"unimportant"}}}},"ccextractor":{"CVE-2018-21015":{"description":"AVC_DuplicateConfig() at isomedia/avc_ext.c in GPAC 0.7.1 allows remote attackers to cause a denial of service (NULL pointer dereference and application crash) via a crafted file. There is \"cfg_new->AVCLevelIndication = cfg->AVCLevelIndication;\" but cfg could be NULL.","debianbug":994746,"scope":"local","releases":{"bullseye":{"status":"open","repositories":{"bullseye":"0.88+ds1-1"},"urgency":"not yet assigned","nodsa":"Minor issue","nodsa_reason":""}}},"CVE-2019-12481":{"description":"An issue was discovered in GPAC 0.7.1. There is a NULL pointer dereference in the function GetESD at isomedia/track.c in libgpac.a, as demonstrated by MP4Box.","debianbug":994746,"scope":"local","releases":{"bullseye":{"status":"open","repositories":{"bullseye":"0.88+ds1-1"},"urgency":"not yet assigned","nodsa":"Minor issue","nodsa_reason":""}}},"CVE-2019-12482":{"description":"An issue was discovered in GPAC 0.7.1. There is a NULL pointer dereference in the function gf_isom_get_original_format_type at isomedia/drm_sample.c in libgpac.a, as demonstrated by MP4Box.","debianbug":994746,"scope":"local","releases":{"bullseye":{"status":"open","repositories":{"bullseye":"0.88+ds1-1"},"urgency":"not yet assigned","nodsa":"Minor issue","nodsa_reason":""}}},"CVE-2019-12483":{"description":"An issue was discovered in GPAC 0.7.1. There is a heap-based buffer overflow in the function ReadGF_IPMPX_RemoveToolNotificationListener in odf/ipmpx_code.c in libgpac.a, as demonstrated by MP4Box.","debianbug":994746,"scope":"local","releases":{"bullseye":{"status":"open","repositories":{"bullseye":"0.88+ds1-1"},"urgency":"not yet assigned","nodsa":"Minor issue","nodsa_reason":""}}},"CVE-2019-13618":{"description":"In GPAC before 0.8.0, isomedia/isom_read.c in libgpac.a has a heap-based buffer over-read, as demonstrated by a crash in gf_m2ts_sync in media_tools/mpegts.c.","debianbug":994746,"scope":"local","releases":{"bullseye":{"status":"open","repositories":{"bullseye":"0.88+ds1-1"},"urgency":"not yet assigned","nodsa":"Minor issue","nodsa_reason":""}}},"CVE-2019-20161":{"description":"An issue was discovered in GPAC version 0.8.0 and 0.9.0-development-20191109. There is heap-based buffer overflow in the function ReadGF_IPMPX_WatermarkingInit() in odf/ipmpx_code.c.","debianbug":994746,"scope":"local","releases":{"bullseye":{"status":"open","repositories":{"bullseye":"0.88+ds1-1"},"urgency":"not yet assigned","nodsa":"Minor issue","nodsa_reason":""}}},"CVE-2019-20162":{"description":"An issue was discovered in GPAC version 0.8.0 and 0.9.0-development-20191109. There is heap-based buffer overflow in the function gf_isom_box_parse_ex() in isomedia/box_funcs.c.","debianbug":994746,"scope":"local","releases":{"bullseye":{"status":"open","repositories":{"bullseye":"0.88+ds1-1"},"urgency":"not yet assigned","nodsa":"Minor issue","nodsa_reason":""}}},"CVE-2019-20170":{"description":"An issue was discovered in GPAC version 0.8.0 and 0.9.0-development-20191109. There is an invalid pointer dereference in the function GF_IPMPX_AUTH_Delete() in odf/ipmpx_code.c.","debianbug":994746,"scope":"local","releases":{"bullseye":{"status":"open","repositories":{"bullseye":"0.88+ds1-1"},"urgency":"not yet assigned","nodsa":"Minor issue","nodsa_reason":""}}},"CVE-2019-20171":{"description":"An issue was discovered in GPAC version 0.5.2 and 0.9.0-development-20191109. There are memory leaks in metx_New in isomedia/box_code_base.c and abst_Read in isomedia/box_code_adobe.c.","debianbug":994746,"scope":"local","releases":{"bullseye":{"status":"open","repositories":{"bullseye":"0.88+ds1-1"},"urgency":"not yet assigned","nodsa":"Minor issue","nodsa_reason":""}}},"CVE-2019-20208":{"description":"dimC_Read in isomedia/box_code_3gpp.c in GPAC from 0.5.2 to 0.8.0 has a stack-based buffer overflow.","debianbug":994746,"scope":"local","releases":{"bullseye":{"status":"open","repositories":{"bullseye":"0.88+ds1-1"},"urgency":"not yet assigned","nodsa":"Minor issue","nodsa_reason":""}}},"CVE-2020-19751":{"description":"An issue was discovered in gpac 0.8.0. The gf_odf_del_ipmp_tool function in odf_code.c has a heap-based buffer over-read.","debianbug":994746,"scope":"local","releases":{"bullseye":{"status":"open","repositories":{"bullseye":"0.88+ds1-1"},"urgency":"not yet assigned","nodsa":"Minor issue","nodsa_reason":""}}},"CVE-2020-24829":{"description":"An issue was discovered in GPAC from v0.5.2 to v0.8.0, as demonstrated by MP4Box. It contains a heap-based buffer overflow in gf_m2ts_section_complete in media_tools/mpegts.c that can cause a denial of service (DOS) via a crafted MP4 file.","debianbug":994746,"scope":"local","releases":{"bullseye":{"status":"open","repositories":{"bullseye":"0.88+ds1-1"},"urgency":"not yet assigned","nodsa":"Minor issue","nodsa_reason":""}}},"CVE-2020-35980":{"description":"An issue was discovered in GPAC version 0.8.0 and 1.0.1. There is a use-after-free in the function gf_isom_box_del() in isomedia/box_funcs.c.","debianbug":994746,"scope":"local","releases":{"bullseye":{"status":"resolved","repositories":{"bullseye":"0.88+ds1-1"},"fixed_version":"0","urgency":"unimportant"}}},"CVE-2020-35981":{"description":"An issue was discovered in GPAC version 0.8.0 and 1.0.1. There is an invalid pointer dereference in the function SetupWriters() in isomedia/isom_store.c.","debianbug":994746,"scope":"local","releases":{"bullseye":{"status":"open","repositories":{"bullseye":"0.88+ds1-1"},"urgency":"not yet assigned","nodsa":"Minor issue","nodsa_reason":""}}},"CVE-2020-6630":{"description":"An issue was discovered in GPAC version 0.8.0. There is a NULL pointer dereference in the function gf_isom_get_media_data_size() in isomedia/isom_read.c.","debianbug":994746,"scope":"local","releases":{"bullseye":{"status":"open","repositories":{"bullseye":"0.88+ds1-1"},"urgency":"not yet assigned","nodsa":"Minor issue","nodsa_reason":""}}},"CVE-2020-6631":{"description":"An issue was discovered in GPAC version 0.8.0. There is a NULL pointer dereference in the function gf_m2ts_stream_process_pmt() in media_tools/m2ts_mux.c.","debianbug":994746,"scope":"local","releases":{"bullseye":{"status":"open","repositories":{"bullseye":"0.88+ds1-1"},"urgency":"not yet assigned","nodsa":"Minor issue","nodsa_reason":""}}},"CVE-2021-21852":{"description":"Multiple exploitable integer overflow vulnerabilities exist within the MPEG-4 decoding functionality of the GPAC Project on Advanced Content library v1.0.1. A specially crafted MPEG-4 input at \u201cstss\u201d decoder can cause an integer overflow due to unchecked arithmetic resulting in a heap-based buffer overflow that causes memory corruption. An attacker can convince a user to open a video to trigger this vulnerability.","debianbug":994746,"scope":"local","releases":{"bullseye":{"status":"open","repositories":{"bullseye":"0.88+ds1-1"},"urgency":"not yet assigned","nodsa":"Minor issue","nodsa_reason":""}}},"CVE-2021-28300":{"description":"NULL Pointer Dereference in the \"isomedia/track.c\" module's \"MergeTrack()\" function of GPAC v0.5.2 allows attackers to execute arbitrary code or cause a Denial-of-Service (DoS) by uploading a malicious MP4 file.","debianbug":994746,"scope":"local","releases":{"bullseye":{"status":"open","repositories":{"bullseye":"0.88+ds1-1"},"urgency":"not yet assigned","nodsa":"Minor issue","nodsa_reason":""}}},"CVE-2021-30014":{"description":"There is a integer overflow in media_tools/av_parsers.c in the hevc_parse_slice_segment function in GPAC from v0.9.0-preview to 1.0.1 which results in a crash.","debianbug":994746,"scope":"local","releases":{"bullseye":{"status":"open","repositories":{"bullseye":"0.88+ds1-1"},"urgency":"not yet assigned","nodsa":"Minor issue","nodsa_reason":""}}},"CVE-2021-31258":{"description":"The gf_isom_set_extraction_slc function in GPAC 1.0.1 allows attackers to cause a denial of service (NULL pointer dereference) via a crafted file in the MP4Box command.","debianbug":994746,"scope":"local","releases":{"bullseye":{"status":"open","repositories":{"bullseye":"0.88+ds1-1"},"urgency":"not yet assigned","nodsa":"Minor issue","nodsa_reason":""}}},"CVE-2021-31260":{"description":"The MergeTrack function in GPAC 1.0.1 allows attackers to cause a denial of service (NULL pointer dereference) via a crafted file in the MP4Box command.","debianbug":994746,"scope":"local","releases":{"bullseye":{"status":"open","repositories":{"bullseye":"0.88+ds1-1"},"urgency":"not yet assigned","nodsa":"Minor issue","nodsa_reason":""}}},"CVE-2021-32134":{"description":"The gf_odf_desc_copy function in GPAC 1.0.1 allows attackers to cause a denial of service (NULL pointer dereference) via a crafted file in the MP4Box command.","debianbug":994746,"scope":"local","releases":{"bullseye":{"status":"resolved","repositories":{"bullseye":"0.88+ds1-1"},"fixed_version":"0","urgency":"unimportant"}}},"CVE-2021-32137":{"description":"Heap buffer overflow in the URL_GetProtocolType function in MP4Box in GPAC 1.0.1 allows attackers to cause a denial of service or execute arbitrary code via a crafted file.","debianbug":994746,"scope":"local","releases":{"bullseye":{"status":"open","repositories":{"bullseye":"0.88+ds1-1"},"urgency":"not yet assigned","nodsa":"Minor issue","nodsa_reason":""}}},"CVE-2021-32139":{"description":"The gf_isom_vp_config_get function in GPAC 1.0.1 allows attackers to cause a denial of service (NULL pointer dereference) via a crafted file in the MP4Box command.","debianbug":994746,"scope":"local","releases":{"bullseye":{"status":"resolved","repositories":{"bullseye":"0.88+ds1-1"},"fixed_version":"0","urgency":"unimportant"}}},"CVE-2021-32440":{"description":"The Media_RewriteODFrame function in GPAC 1.0.1 allows attackers to cause a denial of service (NULL pointer dereference) via a crafted file in the MP4Box command.","debianbug":994746,"scope":"local","releases":{"bullseye":{"status":"open","repositories":{"bullseye":"0.88+ds1-1"},"urgency":"not yet assigned","nodsa":"Minor issue","nodsa_reason":""}}},"CVE-2021-33362":{"description":"Stack buffer overflow in the hevc_parse_vps_extension function in MP4Box in GPAC 1.0.1 allows attackers to cause a denial of service or execute arbitrary code via a crafted file.","debianbug":994746,"scope":"local","releases":{"bullseye":{"status":"open","repositories":{"bullseye":"0.88+ds1-1"},"urgency":"not yet assigned","nodsa":"Minor issue","nodsa_reason":""}}},"CVE-2026-2245":{"description":"A vulnerability was identified in CCExtractor up to 183. This affects the function parse_PAT/parse_PMT in the library src/lib_ccx/ts_tables.c of the component MPEG-TS File Parser. Such manipulation leads to out-of-bounds read. The attack can only be performed from a local environment. The exploit is publicly available and might be used. The name of the patch is fd7271bae238ccb3ae8a71304ea64f0886324925. It is best practice to apply a patch to resolve this issue.","scope":"local","releases":{"bullseye":{"status":"open","repositories":{"bullseye":"0.88+ds1-1"},"urgency":"not yet assigned"}}},"CVE-2026-2889":{"description":"A vulnerability was detected in CCExtractor up to 0.96.5. Affected is the function processmp4 in the library src/lib_ccx/mp4.c. Performing a manipulation results in use after free. The attack is only possible with local access. The exploit is now public and may be used. Upgrading to version 0.96.6 is able to address this issue. The patch is named fd7271bae238ccb3ae8a71304ea64f0886324925. You should upgrade the affected component.","scope":"local","releases":{"bullseye":{"status":"open","repositories":{"bullseye":"0.88+ds1-1"},"urgency":"not yet assigned"}}}},"ccid":{"CVE-2010-4530":{"description":"Signedness error in ccid_serial.c in libccid in the USB Chip/Smart Card Interface Devices (CCID) driver, as used in pcscd in PCSC-Lite 1.5.3 and possibly other products, allows physically proximate attackers to execute arbitrary code via a smart card with a crafted serial number that causes a negative value to be used in a memcpy operation, which triggers a buffer overflow.  NOTE: some sources refer to this issue as an integer overflow.","debianbug":607780,"scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"1.5.2-1"},"fixed_version":"1.3.11-2","urgency":"unimportant"},"bullseye":{"status":"resolved","repositories":{"bullseye":"1.4.34-1"},"fixed_version":"1.3.11-2","urgency":"unimportant"},"forky":{"status":"resolved","repositories":{"forky":"1.7.1-1"},"fixed_version":"1.3.11-2","urgency":"unimportant"},"sid":{"status":"resolved","repositories":{"sid":"1.7.1-1"},"fixed_version":"1.3.11-2","urgency":"unimportant"},"trixie":{"status":"resolved","repositories":{"trixie":"1.6.2-1"},"fixed_version":"1.3.11-2","urgency":"unimportant"}}}},"cecilia":{"CVE-2008-1832":{"description":"lib/prefs.tcl in Cecilia 2.0.5 allows local users to overwrite arbitrary files via a symlink attack on the csvers temporary file.","debianbug":476321,"scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"5.4.1-1"},"fixed_version":"2.0.5-2.1","urgency":"low"},"bullseye":{"status":"resolved","repositories":{"bullseye":"5.4.1-1"},"fixed_version":"2.0.5-2.1","urgency":"low"},"forky":{"status":"resolved","repositories":{"forky":"5.4.1+4bf519e-1"},"fixed_version":"2.0.5-2.1","urgency":"low"},"sid":{"status":"resolved","repositories":{"sid":"5.4.1+4bf519e-1"},"fixed_version":"2.0.5-2.1","urgency":"low"}}}},"ceilometer":{"CVE-2013-6384":{"description":"(1) impl_db2.py and (2) impl_mongodb.py in OpenStack Ceilometer 2013.2 and earlier, when the logging level is set to INFO, logs the connection string from ceilometer.conf, which allows local users to obtain sensitive information (the DB2 or MongoDB password) by reading the log file.","debianbug":730227,"scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"1:19.0.0-3"},"fixed_version":"2013.2-4","urgency":"not yet assigned"},"bullseye":{"status":"resolved","repositories":{"bullseye":"1:15.0.0-3"},"fixed_version":"2013.2-4","urgency":"not yet assigned"},"forky":{"status":"resolved","repositories":{"forky":"1:25.0.0-3"},"fixed_version":"2013.2-4","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"1:25.0.0-3"},"fixed_version":"2013.2-4","urgency":"not yet assigned"},"trixie":{"status":"resolved","repositories":{"trixie":"1:24.0.0-2"},"fixed_version":"2013.2-4","urgency":"not yet assigned"}}},"CVE-2014-4615":{"description":"The notifier middleware in OpenStack PyCADF 0.5.0 and earlier, Telemetry (Ceilometer) 2013.2 before 2013.2.4 and 2014.x before 2014.1.2, Neutron 2014.x before 2014.1.2 and Juno before Juno-2, and Oslo allows remote authenticated users to obtain X_AUTH_TOKEN values by reading the message queue (v2/meters/http.request).","scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"1:19.0.0-3"},"fixed_version":"2014.1.2-1","urgency":"not yet assigned"},"bullseye":{"status":"resolved","repositories":{"bullseye":"1:15.0.0-3"},"fixed_version":"2014.1.2-1","urgency":"not yet assigned"},"forky":{"status":"resolved","repositories":{"forky":"1:25.0.0-3"},"fixed_version":"2014.1.2-1","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"1:25.0.0-3"},"fixed_version":"2014.1.2-1","urgency":"not yet assigned"},"trixie":{"status":"resolved","repositories":{"trixie":"1:24.0.0-2"},"fixed_version":"2014.1.2-1","urgency":"not yet assigned"}}},"CVE-2019-3830":{"description":"A vulnerability was found in ceilometer before version 12.0.0.0rc1. An Information Exposure in ceilometer-agent prints sensitive configuration data to log files without DEBUG logging being activated.","debianbug":925298,"scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"1:19.0.0-3"},"fixed_version":"1:11.0.1-5","urgency":"not yet assigned"},"bullseye":{"status":"resolved","repositories":{"bullseye":"1:15.0.0-3"},"fixed_version":"1:11.0.1-5","urgency":"not yet assigned"},"forky":{"status":"resolved","repositories":{"forky":"1:25.0.0-3"},"fixed_version":"1:11.0.1-5","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"1:25.0.0-3"},"fixed_version":"1:11.0.1-5","urgency":"not yet assigned"},"trixie":{"status":"resolved","repositories":{"trixie":"1:24.0.0-2"},"fixed_version":"1:11.0.1-5","urgency":"not yet assigned"}}}},"celery":{"CVE-2011-4356":{"description":"Celery 2.1 and 2.2 before 2.2.8, 2.3 before 2.3.4, and 2.4 before 2.4.4 changes the effective id but not the real id during processing of the --uid and --gid arguments to celerybeat, celeryd_detach, celeryd-multi, and celeryev, which allows local users to gain privileges via vectors involving crafted code that is executed by the worker process.","scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"5.2.6-5"},"fixed_version":"2.4.6-1","urgency":"not yet assigned"},"bullseye":{"status":"resolved","repositories":{"bullseye":"5.0.0-3"},"fixed_version":"2.4.6-1","urgency":"not yet assigned"},"forky":{"status":"resolved","repositories":{"forky":"5.6.2-3"},"fixed_version":"2.4.6-1","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"5.6.2-3"},"fixed_version":"2.4.6-1","urgency":"not yet assigned"},"trixie":{"status":"resolved","repositories":{"trixie":"5.5.2-2"},"fixed_version":"2.4.6-1","urgency":"not yet assigned"}}},"CVE-2021-23727":{"description":"This affects the package celery before 5.2.2. It by default trusts the messages and metadata stored in backends (result stores). When reading task metadata from the backend, the data is deserialized. Given that an attacker can gain access to, or somehow manipulate the metadata within a celery backend, they could trigger a stored command injection vulnerability and potentially gain further access to the system.","scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"5.2.6-5"},"fixed_version":"5.2.3-1","urgency":"not yet assigned"},"bullseye":{"status":"open","repositories":{"bullseye":"5.0.0-3"},"urgency":"not yet assigned","nodsa":"Minor issue","nodsa_reason":""},"forky":{"status":"resolved","repositories":{"forky":"5.6.2-3"},"fixed_version":"5.2.3-1","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"5.6.2-3"},"fixed_version":"5.2.3-1","urgency":"not yet assigned"},"trixie":{"status":"resolved","repositories":{"trixie":"5.5.2-2"},"fixed_version":"5.2.3-1","urgency":"not yet assigned"}}}},"ceph":{"CVE-2015-5245":{"description":"CRLF injection vulnerability in the Ceph Object Gateway (aka radosgw or RGW) in Ceph before 0.94.4 allows remote attackers to inject arbitrary HTTP headers and conduct HTTP response splitting attacks via a crafted bucket name.","debianbug":798567,"scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"16.2.15+ds-0+deb12u1","bookworm-security":"16.2.15+ds-0+deb12u1"},"fixed_version":"0.80.10-1","urgency":"not yet assigned"},"bullseye":{"status":"resolved","repositories":{"bullseye":"14.2.21-1","bullseye-security":"14.2.21-1+deb11u3"},"fixed_version":"0.80.10-1","urgency":"not yet assigned"},"forky":{"status":"resolved","repositories":{"forky":"18.2.7+ds-1.1"},"fixed_version":"0.80.10-1","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"18.2.7+ds-1.1"},"fixed_version":"0.80.10-1","urgency":"not yet assigned"},"trixie":{"status":"resolved","repositories":{"trixie":"18.2.7+ds-1"},"fixed_version":"0.80.10-1","urgency":"not yet assigned"}}},"CVE-2016-5009":{"description":"The handle_command function in mon/Monitor.cc in Ceph allows remote authenticated users to cause a denial of service (segmentation fault and ceph monitor crash) via an (1) empty or (2) crafted prefix.","debianbug":829661,"scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"16.2.15+ds-0+deb12u1","bookworm-security":"16.2.15+ds-0+deb12u1"},"fixed_version":"10.2.5-1","urgency":"not yet assigned"},"bullseye":{"status":"resolved","repositories":{"bullseye":"14.2.21-1","bullseye-security":"14.2.21-1+deb11u3"},"fixed_version":"10.2.5-1","urgency":"not yet assigned"},"forky":{"status":"resolved","repositories":{"forky":"18.2.7+ds-1.1"},"fixed_version":"10.2.5-1","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"18.2.7+ds-1.1"},"fixed_version":"10.2.5-1","urgency":"not yet assigned"},"trixie":{"status":"resolved","repositories":{"trixie":"18.2.7+ds-1"},"fixed_version":"10.2.5-1","urgency":"not yet assigned"}}},"CVE-2016-7031":{"description":"The RGW code in Ceph before 10.0.1, when authenticated-read ACL is applied to a bucket, allows remote attackers to list the bucket contents via a URL.","debianbug":838026,"scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"16.2.15+ds-0+deb12u1","bookworm-security":"16.2.15+ds-0+deb12u1"},"fixed_version":"10.2.5-1","urgency":"not yet assigned"},"bullseye":{"status":"resolved","repositories":{"bullseye":"14.2.21-1","bullseye-security":"14.2.21-1+deb11u3"},"fixed_version":"10.2.5-1","urgency":"not yet assigned"},"forky":{"status":"resolved","repositories":{"forky":"18.2.7+ds-1.1"},"fixed_version":"10.2.5-1","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"18.2.7+ds-1.1"},"fixed_version":"10.2.5-1","urgency":"not yet assigned"},"trixie":{"status":"resolved","repositories":{"trixie":"18.2.7+ds-1"},"fixed_version":"10.2.5-1","urgency":"not yet assigned"}}},"CVE-2016-8626":{"description":"A flaw was found in Red Hat Ceph before 0.94.9-8. The way Ceph Object Gateway handles POST object requests permits an authenticated attacker to launch a denial of service attack by sending null or specially crafted POST object requests.","debianbug":844200,"scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"16.2.15+ds-0+deb12u1","bookworm-security":"16.2.15+ds-0+deb12u1"},"fixed_version":"10.2.5-1","urgency":"not yet assigned"},"bullseye":{"status":"resolved","repositories":{"bullseye":"14.2.21-1","bullseye-security":"14.2.21-1+deb11u3"},"fixed_version":"10.2.5-1","urgency":"not yet assigned"},"forky":{"status":"resolved","repositories":{"forky":"18.2.7+ds-1.1"},"fixed_version":"10.2.5-1","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"18.2.7+ds-1.1"},"fixed_version":"10.2.5-1","urgency":"not yet assigned"},"trixie":{"status":"resolved","repositories":{"trixie":"18.2.7+ds-1"},"fixed_version":"10.2.5-1","urgency":"not yet assigned"}}},"CVE-2016-9579":{"description":"A flaw was found in the way Ceph Object Gateway would process cross-origin HTTP requests if the CORS policy was set to allow origin on a bucket. A remote unauthenticated attacker could use this flaw to cause denial of service by sending a specially-crafted cross-origin HTTP request. Ceph branches 1.3.x and 2.x are affected.","debianbug":849048,"scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"16.2.15+ds-0+deb12u1","bookworm-security":"16.2.15+ds-0+deb12u1"},"fixed_version":"10.2.5-2","urgency":"not yet assigned"},"bullseye":{"status":"resolved","repositories":{"bullseye":"14.2.21-1","bullseye-security":"14.2.21-1+deb11u3"},"fixed_version":"10.2.5-2","urgency":"not yet assigned"},"forky":{"status":"resolved","repositories":{"forky":"18.2.7+ds-1.1"},"fixed_version":"10.2.5-2","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"18.2.7+ds-1.1"},"fixed_version":"10.2.5-2","urgency":"not yet assigned"},"trixie":{"status":"resolved","repositories":{"trixie":"18.2.7+ds-1"},"fixed_version":"10.2.5-2","urgency":"not yet assigned"}}},"CVE-2017-16818":{"description":"RADOS Gateway in Ceph 12.1.0 through 12.2.1 allows remote authenticated users to cause a denial of service (assertion failure and application exit) by leveraging \"full\" (not necessarily admin) privileges to post an invalid profile to the admin API, related to rgw/rgw_iam_policy.cc, rgw/rgw_basic_types.h, and rgw/rgw_iam_types.h.","scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"16.2.15+ds-0+deb12u1","bookworm-security":"16.2.15+ds-0+deb12u1"},"fixed_version":"0","urgency":"unimportant"},"bullseye":{"status":"resolved","repositories":{"bullseye":"14.2.21-1","bullseye-security":"14.2.21-1+deb11u3"},"fixed_version":"0","urgency":"unimportant"},"forky":{"status":"resolved","repositories":{"forky":"18.2.7+ds-1.1"},"fixed_version":"0","urgency":"unimportant"},"sid":{"status":"resolved","repositories":{"sid":"18.2.7+ds-1.1"},"fixed_version":"0","urgency":"unimportant"},"trixie":{"status":"resolved","repositories":{"trixie":"18.2.7+ds-1"},"fixed_version":"0","urgency":"unimportant"}}},"CVE-2017-7519":{"description":"In Ceph, a format string flaw was found in the way libradosstriper parses input from user. A user could crash an application or service using the libradosstriper library.","debianbug":864535,"scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"16.2.15+ds-0+deb12u1","bookworm-security":"16.2.15+ds-0+deb12u1"},"fixed_version":"12.2.8+dfsg1-1","urgency":"not yet assigned"},"bullseye":{"status":"resolved","repositories":{"bullseye":"14.2.21-1","bullseye-security":"14.2.21-1+deb11u3"},"fixed_version":"12.2.8+dfsg1-1","urgency":"not yet assigned"},"forky":{"status":"resolved","repositories":{"forky":"18.2.7+ds-1.1"},"fixed_version":"12.2.8+dfsg1-1","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"18.2.7+ds-1.1"},"fixed_version":"12.2.8+dfsg1-1","urgency":"not yet assigned"},"trixie":{"status":"resolved","repositories":{"trixie":"18.2.7+ds-1"},"fixed_version":"12.2.8+dfsg1-1","urgency":"not yet assigned"}}},"CVE-2018-10861":{"description":"A flaw was found in the way ceph mon handles user requests. Any authenticated ceph user having read access to ceph can delete, create ceph storage pools and corrupt snapshot images. Ceph branches master, mimic, luminous and jewel are believed to be affected.","debianbug":913470,"scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"16.2.15+ds-0+deb12u1","bookworm-security":"16.2.15+ds-0+deb12u1"},"fixed_version":"12.2.8+dfsg1-1","urgency":"not yet assigned"},"bullseye":{"status":"resolved","repositories":{"bullseye":"14.2.21-1","bullseye-security":"14.2.21-1+deb11u3"},"fixed_version":"12.2.8+dfsg1-1","urgency":"not yet assigned"},"forky":{"status":"resolved","repositories":{"forky":"18.2.7+ds-1.1"},"fixed_version":"12.2.8+dfsg1-1","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"18.2.7+ds-1.1"},"fixed_version":"12.2.8+dfsg1-1","urgency":"not yet assigned"},"trixie":{"status":"resolved","repositories":{"trixie":"18.2.7+ds-1"},"fixed_version":"12.2.8+dfsg1-1","urgency":"not yet assigned"}}},"CVE-2018-1128":{"description":"It was found that cephx authentication protocol did not verify ceph clients correctly and was vulnerable to replay attack. Any attacker having access to ceph cluster network who is able to sniff packets on network can use this vulnerability to authenticate with ceph service and perform actions allowed by ceph service. Ceph branches master, mimic, luminous and jewel are believed to be vulnerable.","debianbug":913471,"scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"16.2.15+ds-0+deb12u1","bookworm-security":"16.2.15+ds-0+deb12u1"},"fixed_version":"12.2.8+dfsg1-1","urgency":"not yet assigned"},"bullseye":{"status":"resolved","repositories":{"bullseye":"14.2.21-1","bullseye-security":"14.2.21-1+deb11u3"},"fixed_version":"12.2.8+dfsg1-1","urgency":"not yet assigned"},"forky":{"status":"resolved","repositories":{"forky":"18.2.7+ds-1.1"},"fixed_version":"12.2.8+dfsg1-1","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"18.2.7+ds-1.1"},"fixed_version":"12.2.8+dfsg1-1","urgency":"not yet assigned"},"trixie":{"status":"resolved","repositories":{"trixie":"18.2.7+ds-1"},"fixed_version":"12.2.8+dfsg1-1","urgency":"not yet assigned"}}},"CVE-2018-1129":{"description":"A flaw was found in the way signature calculation was handled by cephx authentication protocol. An attacker having access to ceph cluster network who is able to alter the message payload was able to bypass signature checks done by cephx protocol. Ceph branches master, mimic, luminous and jewel are believed to be vulnerable.","debianbug":913472,"scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"16.2.15+ds-0+deb12u1","bookworm-security":"16.2.15+ds-0+deb12u1"},"fixed_version":"12.2.8+dfsg1-1","urgency":"not yet assigned"},"bullseye":{"status":"resolved","repositories":{"bullseye":"14.2.21-1","bullseye-security":"14.2.21-1+deb11u3"},"fixed_version":"12.2.8+dfsg1-1","urgency":"not yet assigned"},"forky":{"status":"resolved","repositories":{"forky":"18.2.7+ds-1.1"},"fixed_version":"12.2.8+dfsg1-1","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"18.2.7+ds-1.1"},"fixed_version":"12.2.8+dfsg1-1","urgency":"not yet assigned"},"trixie":{"status":"resolved","repositories":{"trixie":"18.2.7+ds-1"},"fixed_version":"12.2.8+dfsg1-1","urgency":"not yet assigned"}}},"CVE-2018-14662":{"description":"It was found Ceph versions before 13.2.4 that authenticated ceph users with read only permissions could steal dm-crypt encryption keys used in ceph disk encryption.","debianbug":921948,"scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"16.2.15+ds-0+deb12u1","bookworm-security":"16.2.15+ds-0+deb12u1"},"fixed_version":"12.2.11+dfsg1-1","urgency":"not yet assigned"},"bullseye":{"status":"resolved","repositories":{"bullseye":"14.2.21-1","bullseye-security":"14.2.21-1+deb11u3"},"fixed_version":"12.2.11+dfsg1-1","urgency":"not yet assigned"},"forky":{"status":"resolved","repositories":{"forky":"18.2.7+ds-1.1"},"fixed_version":"12.2.11+dfsg1-1","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"18.2.7+ds-1.1"},"fixed_version":"12.2.11+dfsg1-1","urgency":"not yet assigned"},"trixie":{"status":"resolved","repositories":{"trixie":"18.2.7+ds-1"},"fixed_version":"12.2.11+dfsg1-1","urgency":"not yet assigned"}}},"CVE-2018-16846":{"description":"It was found in Ceph versions before 13.2.4 that authenticated ceph RGW users can cause a denial of service against OMAPs holding bucket indices.","debianbug":921947,"scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"16.2.15+ds-0+deb12u1","bookworm-security":"16.2.15+ds-0+deb12u1"},"fixed_version":"12.2.11+dfsg1-1","urgency":"not yet assigned"},"bullseye":{"status":"resolved","repositories":{"bullseye":"14.2.21-1","bullseye-security":"14.2.21-1+deb11u3"},"fixed_version":"12.2.11+dfsg1-1","urgency":"not yet assigned"},"forky":{"status":"resolved","repositories":{"forky":"18.2.7+ds-1.1"},"fixed_version":"12.2.11+dfsg1-1","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"18.2.7+ds-1.1"},"fixed_version":"12.2.11+dfsg1-1","urgency":"not yet assigned"},"trixie":{"status":"resolved","repositories":{"trixie":"18.2.7+ds-1"},"fixed_version":"12.2.11+dfsg1-1","urgency":"not yet assigned"}}},"CVE-2018-16889":{"description":"Ceph does not properly sanitize encryption keys in debug logging for v4 auth. This results in the leaking of encryption key information in log files via plaintext. Versions up to v13.2.4 are vulnerable.","debianbug":918969,"scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"16.2.15+ds-0+deb12u1","bookworm-security":"16.2.15+ds-0+deb12u1"},"fixed_version":"12.2.11+dfsg1-1","urgency":"low"},"bullseye":{"status":"resolved","repositories":{"bullseye":"14.2.21-1","bullseye-security":"14.2.21-1+deb11u3"},"fixed_version":"12.2.11+dfsg1-1","urgency":"low"},"forky":{"status":"resolved","repositories":{"forky":"18.2.7+ds-1.1"},"fixed_version":"12.2.11+dfsg1-1","urgency":"low"},"sid":{"status":"resolved","repositories":{"sid":"18.2.7+ds-1.1"},"fixed_version":"12.2.11+dfsg1-1","urgency":"low"},"trixie":{"status":"resolved","repositories":{"trixie":"18.2.7+ds-1"},"fixed_version":"12.2.11+dfsg1-1","urgency":"low"}}},"CVE-2018-7262":{"description":"In Ceph before 12.2.3 and 13.x through 13.0.1, the rgw_civetweb.cc RGWCivetWeb::init_env function in radosgw doesn't handle malformed HTTP headers properly, allowing for denial of service.","scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"16.2.15+ds-0+deb12u1","bookworm-security":"16.2.15+ds-0+deb12u1"},"fixed_version":"0","urgency":"unimportant"},"bullseye":{"status":"resolved","repositories":{"bullseye":"14.2.21-1","bullseye-security":"14.2.21-1+deb11u3"},"fixed_version":"0","urgency":"unimportant"},"forky":{"status":"resolved","repositories":{"forky":"18.2.7+ds-1.1"},"fixed_version":"0","urgency":"unimportant"},"sid":{"status":"resolved","repositories":{"sid":"18.2.7+ds-1.1"},"fixed_version":"0","urgency":"unimportant"},"trixie":{"status":"resolved","repositories":{"trixie":"18.2.7+ds-1"},"fixed_version":"0","urgency":"unimportant"}}},"CVE-2019-10222":{"description":"A flaw was found in the Ceph RGW configuration with Beast as the front end handling client requests. An unauthenticated attacker could crash the Ceph RGW server by sending valid HTTP headers and terminating the connection, resulting in a remote denial of service for Ceph RGW clients.","debianbug":936015,"scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"16.2.15+ds-0+deb12u1","bookworm-security":"16.2.15+ds-0+deb12u1"},"fixed_version":"14.2.4-1","urgency":"not yet assigned"},"bullseye":{"status":"resolved","repositories":{"bullseye":"14.2.21-1","bullseye-security":"14.2.21-1+deb11u3"},"fixed_version":"14.2.4-1","urgency":"not yet assigned"},"forky":{"status":"resolved","repositories":{"forky":"18.2.7+ds-1.1"},"fixed_version":"14.2.4-1","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"18.2.7+ds-1.1"},"fixed_version":"14.2.4-1","urgency":"not yet assigned"},"trixie":{"status":"resolved","repositories":{"trixie":"18.2.7+ds-1"},"fixed_version":"14.2.4-1","urgency":"not yet assigned"}}},"CVE-2019-19337":{"description":"A flaw was found in Red Hat Ceph Storage version 3 in the way the Ceph RADOS Gateway daemon handles S3 requests. An authenticated attacker can abuse this flaw by causing a remote denial of service by sending a specially crafted HTTP Content-Length header to the Ceph RADOS Gateway server.","scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"16.2.15+ds-0+deb12u1","bookworm-security":"16.2.15+ds-0+deb12u1"},"fixed_version":"0","urgency":"unimportant"},"bullseye":{"status":"resolved","repositories":{"bullseye":"14.2.21-1","bullseye-security":"14.2.21-1+deb11u3"},"fixed_version":"0","urgency":"unimportant"},"forky":{"status":"resolved","repositories":{"forky":"18.2.7+ds-1.1"},"fixed_version":"0","urgency":"unimportant"},"sid":{"status":"resolved","repositories":{"sid":"18.2.7+ds-1.1"},"fixed_version":"0","urgency":"unimportant"},"trixie":{"status":"resolved","repositories":{"trixie":"18.2.7+ds-1"},"fixed_version":"0","urgency":"unimportant"}}},"CVE-2019-3821":{"description":"A flaw was found in the way civetweb frontend was handling requests for ceph RGW server with SSL enabled. An unauthenticated attacker could create multiple connections to ceph RADOS gateway to exhaust file descriptors for ceph-radosgw service resulting in a remote denial of service.","scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"16.2.15+ds-0+deb12u1","bookworm-security":"16.2.15+ds-0+deb12u1"},"fixed_version":"0","urgency":"unimportant"},"bullseye":{"status":"resolved","repositories":{"bullseye":"14.2.21-1","bullseye-security":"14.2.21-1+deb11u3"},"fixed_version":"0","urgency":"unimportant"},"forky":{"status":"resolved","repositories":{"forky":"18.2.7+ds-1.1"},"fixed_version":"0","urgency":"unimportant"},"sid":{"status":"resolved","repositories":{"sid":"18.2.7+ds-1.1"},"fixed_version":"0","urgency":"unimportant"},"trixie":{"status":"resolved","repositories":{"trixie":"18.2.7+ds-1"},"fixed_version":"0","urgency":"unimportant"}}},"CVE-2020-10736":{"description":"An authorization bypass vulnerability was found in Ceph versions 15.2.0 before 15.2.2, where the ceph-mon and ceph-mgr daemons do not properly restrict access, resulting in gaining access to unauthorized resources. This flaw allows an authenticated client to modify the configuration and possibly conduct further attacks.","scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"16.2.15+ds-0+deb12u1","bookworm-security":"16.2.15+ds-0+deb12u1"},"fixed_version":"0","urgency":"unimportant"},"bullseye":{"status":"resolved","repositories":{"bullseye":"14.2.21-1","bullseye-security":"14.2.21-1+deb11u3"},"fixed_version":"0","urgency":"unimportant"},"forky":{"status":"resolved","repositories":{"forky":"18.2.7+ds-1.1"},"fixed_version":"0","urgency":"unimportant"},"sid":{"status":"resolved","repositories":{"sid":"18.2.7+ds-1.1"},"fixed_version":"0","urgency":"unimportant"},"trixie":{"status":"resolved","repositories":{"trixie":"18.2.7+ds-1"},"fixed_version":"0","urgency":"unimportant"}}},"CVE-2020-10753":{"description":"A flaw was found in the Red Hat Ceph Storage RadosGW (Ceph Object Gateway). The vulnerability is related to the injection of HTTP headers via a CORS ExposeHeader tag. The newline character in the ExposeHeader tag in the CORS configuration file generates a header injection in the response when the CORS request is made. Ceph versions 3.x and 4.x are vulnerable to this issue.","debianbug":975300,"scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"16.2.15+ds-0+deb12u1","bookworm-security":"16.2.15+ds-0+deb12u1"},"fixed_version":"14.2.15-1","urgency":"not yet assigned"},"bullseye":{"status":"resolved","repositories":{"bullseye":"14.2.21-1","bullseye-security":"14.2.21-1+deb11u3"},"fixed_version":"14.2.15-1","urgency":"not yet assigned"},"forky":{"status":"resolved","repositories":{"forky":"18.2.7+ds-1.1"},"fixed_version":"14.2.15-1","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"18.2.7+ds-1.1"},"fixed_version":"14.2.15-1","urgency":"not yet assigned"},"trixie":{"status":"resolved","repositories":{"trixie":"18.2.7+ds-1"},"fixed_version":"14.2.15-1","urgency":"not yet assigned"}}},"CVE-2020-12059":{"description":"An issue was discovered in Ceph through 13.2.9. A POST request with an invalid tagging XML can crash the RGW process by triggering a NULL pointer exception.","scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"16.2.15+ds-0+deb12u1","bookworm-security":"16.2.15+ds-0+deb12u1"},"fixed_version":"14.2.4-1","urgency":"not yet assigned"},"bullseye":{"status":"resolved","repositories":{"bullseye":"14.2.21-1","bullseye-security":"14.2.21-1+deb11u3"},"fixed_version":"14.2.4-1","urgency":"not yet assigned"},"forky":{"status":"resolved","repositories":{"forky":"18.2.7+ds-1.1"},"fixed_version":"14.2.4-1","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"18.2.7+ds-1.1"},"fixed_version":"14.2.4-1","urgency":"not yet assigned"},"trixie":{"status":"resolved","repositories":{"trixie":"18.2.7+ds-1"},"fixed_version":"14.2.4-1","urgency":"not yet assigned"}}},"CVE-2020-1699":{"description":"A path traversal flaw was found in the Ceph dashboard implemented in upstream versions v14.2.5, v14.2.6, v15.0.0 of Ceph storage and has been fixed in versions 14.2.7 and 15.1.0. An unauthenticated attacker could use this flaw to cause information disclosure on the host machine running the Ceph dashboard.","debianbug":949206,"scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"16.2.15+ds-0+deb12u1","bookworm-security":"16.2.15+ds-0+deb12u1"},"fixed_version":"14.2.6-4","urgency":"not yet assigned"},"bullseye":{"status":"resolved","repositories":{"bullseye":"14.2.21-1","bullseye-security":"14.2.21-1+deb11u3"},"fixed_version":"14.2.6-4","urgency":"not yet assigned"},"forky":{"status":"resolved","repositories":{"forky":"18.2.7+ds-1.1"},"fixed_version":"14.2.6-4","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"18.2.7+ds-1.1"},"fixed_version":"14.2.6-4","urgency":"not yet assigned"},"trixie":{"status":"resolved","repositories":{"trixie":"18.2.7+ds-1"},"fixed_version":"14.2.6-4","urgency":"not yet assigned"}}},"CVE-2020-1700":{"description":"A flaw was found in the way the Ceph RGW Beast front-end handles unexpected disconnects. An authenticated attacker can abuse this flaw by making multiple disconnect attempts resulting in a permanent leak of a socket connection by radosgw. This flaw could lead to a denial of service condition by pile up of CLOSE_WAIT sockets, eventually leading to the exhaustion of available resources, preventing legitimate users from connecting to the system.","scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"16.2.15+ds-0+deb12u1","bookworm-security":"16.2.15+ds-0+deb12u1"},"fixed_version":"14.2.7-1","urgency":"not yet assigned"},"bullseye":{"status":"resolved","repositories":{"bullseye":"14.2.21-1","bullseye-security":"14.2.21-1+deb11u3"},"fixed_version":"14.2.7-1","urgency":"not yet assigned"},"forky":{"status":"resolved","repositories":{"forky":"18.2.7+ds-1.1"},"fixed_version":"14.2.7-1","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"18.2.7+ds-1.1"},"fixed_version":"14.2.7-1","urgency":"not yet assigned"},"trixie":{"status":"resolved","repositories":{"trixie":"18.2.7+ds-1"},"fixed_version":"14.2.7-1","urgency":"not yet assigned"}}},"CVE-2020-1759":{"description":"A vulnerability was found in Red Hat Ceph Storage 4 and Red Hat Openshift Container Storage 4.2 where, A nonce reuse vulnerability was discovered in the secure mode of the messenger v2 protocol, which can allow an attacker to forge auth tags and potentially manipulate the data by leveraging the reuse of a nonce in a session. Messages encrypted using a reused nonce value are susceptible to serious confidentiality and integrity attacks.","debianbug":956139,"scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"16.2.15+ds-0+deb12u1","bookworm-security":"16.2.15+ds-0+deb12u1"},"fixed_version":"14.2.9-1","urgency":"not yet assigned"},"bullseye":{"status":"resolved","repositories":{"bullseye":"14.2.21-1","bullseye-security":"14.2.21-1+deb11u3"},"fixed_version":"14.2.9-1","urgency":"not yet assigned"},"forky":{"status":"resolved","repositories":{"forky":"18.2.7+ds-1.1"},"fixed_version":"14.2.9-1","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"18.2.7+ds-1.1"},"fixed_version":"14.2.9-1","urgency":"not yet assigned"},"trixie":{"status":"resolved","repositories":{"trixie":"18.2.7+ds-1"},"fixed_version":"14.2.9-1","urgency":"not yet assigned"}}},"CVE-2020-1760":{"description":"A flaw was found in the Ceph Object Gateway, where it supports request sent by an anonymous user in Amazon S3. This flaw could lead to potential XSS attacks due to the lack of proper neutralization of untrusted input.","debianbug":956142,"scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"16.2.15+ds-0+deb12u1","bookworm-security":"16.2.15+ds-0+deb12u1"},"fixed_version":"14.2.9-1","urgency":"not yet assigned"},"bullseye":{"status":"resolved","repositories":{"bullseye":"14.2.21-1","bullseye-security":"14.2.21-1+deb11u3"},"fixed_version":"14.2.9-1","urgency":"not yet assigned"},"forky":{"status":"resolved","repositories":{"forky":"18.2.7+ds-1.1"},"fixed_version":"14.2.9-1","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"18.2.7+ds-1.1"},"fixed_version":"14.2.9-1","urgency":"not yet assigned"},"trixie":{"status":"resolved","repositories":{"trixie":"18.2.7+ds-1"},"fixed_version":"14.2.9-1","urgency":"not yet assigned"}}},"CVE-2020-25660":{"description":"A flaw was found in the Cephx authentication protocol in versions before 15.2.6 and before 14.2.14, where it does not verify Ceph clients correctly and is then vulnerable to replay attacks in Nautilus. This flaw allows an attacker with access to the Ceph cluster network to authenticate with the Ceph service via a packet sniffer and perform actions allowed by the Ceph service. This issue is a reintroduction of CVE-2018-1128, affecting the msgr2 protocol. The msgr 2 protocol is used for all communication except older clients that do not support the msgr2 protocol. The msgr1 protocol is not affected. The highest threat from this vulnerability is to confidentiality, integrity, and system availability.","debianbug":975275,"scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"16.2.15+ds-0+deb12u1","bookworm-security":"16.2.15+ds-0+deb12u1"},"fixed_version":"14.2.15-1","urgency":"not yet assigned"},"bullseye":{"status":"resolved","repositories":{"bullseye":"14.2.21-1","bullseye-security":"14.2.21-1+deb11u3"},"fixed_version":"14.2.15-1","urgency":"not yet assigned"},"forky":{"status":"resolved","repositories":{"forky":"18.2.7+ds-1.1"},"fixed_version":"14.2.15-1","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"18.2.7+ds-1.1"},"fixed_version":"14.2.15-1","urgency":"not yet assigned"},"trixie":{"status":"resolved","repositories":{"trixie":"18.2.7+ds-1"},"fixed_version":"14.2.15-1","urgency":"not yet assigned"}}},"CVE-2020-25678":{"description":"A flaw was found in ceph in versions prior to 16.y.z where ceph stores mgr module passwords in clear text. This can be found by searching the mgr logs for grafana and dashboard, with passwords visible.","scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"16.2.15+ds-0+deb12u1","bookworm-security":"16.2.15+ds-0+deb12u1"},"fixed_version":"14.2.18-1","urgency":"not yet assigned"},"bullseye":{"status":"resolved","repositories":{"bullseye":"14.2.21-1","bullseye-security":"14.2.21-1+deb11u3"},"fixed_version":"14.2.18-1","urgency":"not yet assigned"},"forky":{"status":"resolved","repositories":{"forky":"18.2.7+ds-1.1"},"fixed_version":"14.2.18-1","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"18.2.7+ds-1.1"},"fixed_version":"14.2.18-1","urgency":"not yet assigned"},"trixie":{"status":"resolved","repositories":{"trixie":"18.2.7+ds-1"},"fixed_version":"14.2.18-1","urgency":"not yet assigned"}}},"CVE-2020-27781":{"description":"User credentials can be manipulated and stolen by Native CephFS consumers of OpenStack Manila, resulting in potential privilege escalation. An Open Stack Manila user can request access to a share to an arbitrary cephx user, including existing users. The access key is retrieved via the interface drivers. Then, all users of the requesting OpenStack project can view the access key. This enables the attacker to target any resource that the user has access to. This can be done to even \"admin\" users, compromising the ceph administrator. This flaw affects Ceph versions prior to 14.2.16, 15.x prior to 15.2.8, and 16.x prior to 16.2.0.","debianbug":985670,"scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"16.2.15+ds-0+deb12u1","bookworm-security":"16.2.15+ds-0+deb12u1"},"fixed_version":"14.2.16-1","urgency":"not yet assigned"},"bullseye":{"status":"resolved","repositories":{"bullseye":"14.2.21-1","bullseye-security":"14.2.21-1+deb11u3"},"fixed_version":"14.2.16-1","urgency":"not yet assigned"},"forky":{"status":"resolved","repositories":{"forky":"18.2.7+ds-1.1"},"fixed_version":"14.2.16-1","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"18.2.7+ds-1.1"},"fixed_version":"14.2.16-1","urgency":"not yet assigned"},"trixie":{"status":"resolved","repositories":{"trixie":"18.2.7+ds-1"},"fixed_version":"14.2.16-1","urgency":"not yet assigned"}}},"CVE-2020-27839":{"description":"A flaw was found in ceph-dashboard. The JSON Web Token (JWT) used for user authentication is stored by the frontend application in the browser\u2019s localStorage which is potentially vulnerable to attackers via XSS attacks. The highest threat from this vulnerability is to data confidentiality and integrity.","debianbug":985670,"scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"16.2.15+ds-0+deb12u1","bookworm-security":"16.2.15+ds-0+deb12u1"},"fixed_version":"14.2.18-1","urgency":"not yet assigned"},"bullseye":{"status":"resolved","repositories":{"bullseye":"14.2.21-1","bullseye-security":"14.2.21-1+deb11u3"},"fixed_version":"14.2.18-1","urgency":"not yet assigned"},"forky":{"status":"resolved","repositories":{"forky":"18.2.7+ds-1.1"},"fixed_version":"14.2.18-1","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"18.2.7+ds-1.1"},"fixed_version":"14.2.18-1","urgency":"not yet assigned"},"trixie":{"status":"resolved","repositories":{"trixie":"18.2.7+ds-1"},"fixed_version":"14.2.18-1","urgency":"not yet assigned"}}},"CVE-2021-20288":{"description":"An authentication flaw was found in ceph in versions before 14.2.20. When the monitor handles CEPHX_GET_AUTH_SESSION_KEY requests, it doesn't sanitize other_keys, allowing key reuse. An attacker who can request a global_id can exploit the ability of any user to request a global_id previously associated with another user, as ceph does not force the reuse of old keys to generate new ones. The highest threat from this vulnerability is to data confidentiality and integrity as well as system availability.","debianbug":986974,"scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"16.2.15+ds-0+deb12u1","bookworm-security":"16.2.15+ds-0+deb12u1"},"fixed_version":"14.2.20-1","urgency":"not yet assigned"},"bullseye":{"status":"resolved","repositories":{"bullseye":"14.2.21-1","bullseye-security":"14.2.21-1+deb11u3"},"fixed_version":"14.2.20-1","urgency":"not yet assigned"},"forky":{"status":"resolved","repositories":{"forky":"18.2.7+ds-1.1"},"fixed_version":"14.2.20-1","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"18.2.7+ds-1.1"},"fixed_version":"14.2.20-1","urgency":"not yet assigned"},"trixie":{"status":"resolved","repositories":{"trixie":"18.2.7+ds-1"},"fixed_version":"14.2.20-1","urgency":"not yet assigned"}}},"CVE-2021-3509":{"description":"A flaw was found in Red Hat Ceph Storage 4, in the Dashboard component. In response to CVE-2020-27839, the JWT token was moved from localStorage to an httpOnly cookie. However, token cookies are used in the body of the HTTP response for the documentation, which again makes it available to XSS.The greatest threat to the system is for confidentiality, integrity, and availability.","debianbug":988888,"scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"16.2.15+ds-0+deb12u1","bookworm-security":"16.2.15+ds-0+deb12u1"},"fixed_version":"14.2.21-1","urgency":"not yet assigned"},"bullseye":{"status":"resolved","repositories":{"bullseye":"14.2.21-1","bullseye-security":"14.2.21-1+deb11u3"},"fixed_version":"14.2.21-1","urgency":"not yet assigned"},"forky":{"status":"resolved","repositories":{"forky":"18.2.7+ds-1.1"},"fixed_version":"14.2.21-1","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"18.2.7+ds-1.1"},"fixed_version":"14.2.21-1","urgency":"not yet assigned"},"trixie":{"status":"resolved","repositories":{"trixie":"18.2.7+ds-1"},"fixed_version":"14.2.21-1","urgency":"not yet assigned"}}},"CVE-2021-3524":{"description":"A flaw was found in the Red Hat Ceph Storage RadosGW (Ceph Object Gateway) in versions before 14.2.21. The vulnerability is related to the injection of HTTP headers via a CORS ExposeHeader tag. The newline character in the ExposeHeader tag in the CORS configuration file generates a header injection in the response when the CORS request is made. In addition, the prior bug fix for CVE-2020-10753 did not account for the use of \\r as a header separator, thus a new flaw has been created.","debianbug":988889,"scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"16.2.15+ds-0+deb12u1","bookworm-security":"16.2.15+ds-0+deb12u1"},"fixed_version":"14.2.21-1","urgency":"not yet assigned"},"bullseye":{"status":"resolved","repositories":{"bullseye":"14.2.21-1","bullseye-security":"14.2.21-1+deb11u3"},"fixed_version":"14.2.21-1","urgency":"not yet assigned"},"forky":{"status":"resolved","repositories":{"forky":"18.2.7+ds-1.1"},"fixed_version":"14.2.21-1","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"18.2.7+ds-1.1"},"fixed_version":"14.2.21-1","urgency":"not yet assigned"},"trixie":{"status":"resolved","repositories":{"trixie":"18.2.7+ds-1"},"fixed_version":"14.2.21-1","urgency":"not yet assigned"}}},"CVE-2021-3531":{"description":"A flaw was found in the Red Hat Ceph Storage RGW in versions before 14.2.21. When processing a GET Request for a swift URL that ends with two slashes it can cause the rgw to crash, resulting in a denial of service. The greatest threat to the system is of availability.","debianbug":988890,"scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"16.2.15+ds-0+deb12u1","bookworm-security":"16.2.15+ds-0+deb12u1"},"fixed_version":"14.2.21-1","urgency":"not yet assigned"},"bullseye":{"status":"resolved","repositories":{"bullseye":"14.2.21-1","bullseye-security":"14.2.21-1+deb11u3"},"fixed_version":"14.2.21-1","urgency":"not yet assigned"},"forky":{"status":"resolved","repositories":{"forky":"18.2.7+ds-1.1"},"fixed_version":"14.2.21-1","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"18.2.7+ds-1.1"},"fixed_version":"14.2.21-1","urgency":"not yet assigned"},"trixie":{"status":"resolved","repositories":{"trixie":"18.2.7+ds-1"},"fixed_version":"14.2.21-1","urgency":"not yet assigned"}}},"CVE-2021-3979":{"description":"A key length flaw was found in Red Hat Ceph Storage. An attacker can exploit the fact that the key length is incorrectly passed in an encryption algorithm to create a non random key, which is weaker and can be exploited for loss of confidentiality and integrity on encrypted disks.","scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"16.2.15+ds-0+deb12u1","bookworm-security":"16.2.15+ds-0+deb12u1"},"fixed_version":"16.2.9+ds-1","urgency":"not yet assigned"},"bullseye":{"status":"resolved","repositories":{"bullseye":"14.2.21-1","bullseye-security":"14.2.21-1+deb11u3"},"fixed_version":"14.2.21-1+deb11u1","urgency":"not yet assigned"},"forky":{"status":"resolved","repositories":{"forky":"18.2.7+ds-1.1"},"fixed_version":"16.2.9+ds-1","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"18.2.7+ds-1.1"},"fixed_version":"16.2.9+ds-1","urgency":"not yet assigned"},"trixie":{"status":"resolved","repositories":{"trixie":"18.2.7+ds-1"},"fixed_version":"16.2.9+ds-1","urgency":"not yet assigned"}}},"CVE-2022-0670":{"description":"A flaw was found in Openstack manilla owning a Ceph File system \"share\", which enables the owner to read/write any manilla share or entire file system. The vulnerability is due to a bug in the \"volumes\" plugin in Ceph Manager. This allows an attacker to compromise Confidentiality and Integrity of a file system. Fixed in RHCS 5.2 and Ceph 17.2.2.","debianbug":1016069,"scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"16.2.15+ds-0+deb12u1","bookworm-security":"16.2.15+ds-0+deb12u1"},"fixed_version":"16.2.10+ds-1","urgency":"not yet assigned"},"bullseye":{"status":"resolved","repositories":{"bullseye":"14.2.21-1","bullseye-security":"14.2.21-1+deb11u3"},"fixed_version":"14.2.21-1+deb11u2","urgency":"not yet assigned"},"forky":{"status":"resolved","repositories":{"forky":"18.2.7+ds-1.1"},"fixed_version":"16.2.10+ds-1","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"18.2.7+ds-1.1"},"fixed_version":"16.2.10+ds-1","urgency":"not yet assigned"},"trixie":{"status":"resolved","repositories":{"trixie":"18.2.7+ds-1"},"fixed_version":"16.2.10+ds-1","urgency":"not yet assigned"}}},"CVE-2022-3650":{"description":"A privilege escalation flaw was found in Ceph. Ceph-crash.service allows a local attacker to escalate privileges to root in the form of a crash dump, and dump privileged information.","debianbug":1024932,"scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"16.2.15+ds-0+deb12u1","bookworm-security":"16.2.15+ds-0+deb12u1"},"fixed_version":"16.2.10+ds-4","urgency":"not yet assigned"},"bullseye":{"status":"resolved","repositories":{"bullseye":"14.2.21-1","bullseye-security":"14.2.21-1+deb11u3"},"fixed_version":"14.2.21-1+deb11u1","urgency":"not yet assigned"},"forky":{"status":"resolved","repositories":{"forky":"18.2.7+ds-1.1"},"fixed_version":"16.2.10+ds-4","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"18.2.7+ds-1.1"},"fixed_version":"16.2.10+ds-4","urgency":"not yet assigned"},"trixie":{"status":"resolved","repositories":{"trixie":"18.2.7+ds-1"},"fixed_version":"16.2.10+ds-4","urgency":"not yet assigned"}}},"CVE-2022-3854":{"description":"A flaw was found in Ceph, relating to the URL processing on RGW backends. An attacker can exploit the URL processing by providing a null URL to crash the RGW, causing a denial of service.","debianbug":1027151,"scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"16.2.15+ds-0+deb12u1","bookworm-security":"16.2.15+ds-0+deb12u1"},"fixed_version":"16.2.10+ds-5","urgency":"not yet assigned"},"bullseye":{"status":"resolved","repositories":{"bullseye":"14.2.21-1","bullseye-security":"14.2.21-1+deb11u3"},"fixed_version":"0","urgency":"unimportant"},"forky":{"status":"resolved","repositories":{"forky":"18.2.7+ds-1.1"},"fixed_version":"16.2.10+ds-5","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"18.2.7+ds-1.1"},"fixed_version":"16.2.10+ds-5","urgency":"not yet assigned"},"trixie":{"status":"resolved","repositories":{"trixie":"18.2.7+ds-1"},"fixed_version":"16.2.10+ds-5","urgency":"not yet assigned"}}},"CVE-2023-43040":{"description":"IBM Spectrum Fusion HCI 2.5.2 through 2.7.2 could allow an attacker to perform unauthorized actions in RGW for Ceph due to improper bucket access.  IBM X-Force ID:  266807.","debianbug":1053690,"scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"16.2.15+ds-0+deb12u1","bookworm-security":"16.2.15+ds-0+deb12u1"},"fixed_version":"16.2.15+ds-0+deb12u1","urgency":"not yet assigned"},"bullseye":{"status":"resolved","repositories":{"bullseye":"14.2.21-1","bullseye-security":"14.2.21-1+deb11u3"},"fixed_version":"14.2.21-1+deb11u1","urgency":"not yet assigned"},"forky":{"status":"resolved","repositories":{"forky":"18.2.7+ds-1.1"},"fixed_version":"16.2.11+ds-5","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"18.2.7+ds-1.1"},"fixed_version":"16.2.11+ds-5","urgency":"not yet assigned"},"trixie":{"status":"resolved","repositories":{"trixie":"18.2.7+ds-1"},"fixed_version":"16.2.11+ds-5","urgency":"not yet assigned"}}},"CVE-2024-31884":{"debianbug":1126573,"releases":{"bookworm":{"status":"open","repositories":{"bookworm":"16.2.15+ds-0+deb12u1","bookworm-security":"16.2.15+ds-0+deb12u1"},"urgency":"not yet assigned"},"bullseye":{"status":"resolved","repositories":{"bullseye":"14.2.21-1","bullseye-security":"14.2.21-1+deb11u3"},"fixed_version":"14.2.21-1+deb11u3","urgency":"not yet assigned"},"forky":{"status":"open","repositories":{"forky":"18.2.7+ds-1.1"},"urgency":"not yet assigned"},"sid":{"status":"open","repositories":{"sid":"18.2.7+ds-1.1"},"urgency":"not yet assigned"},"trixie":{"status":"open","repositories":{"trixie":"18.2.7+ds-1"},"urgency":"not yet assigned"}}},"CVE-2024-47866":{"description":"Ceph is a distributed object, block, and file storage platform. In versions up to and including 19.2.3, using the argument `x-amz-copy-source` to put an object and specifying an empty string as its content leads to the RGW daemon crashing, resulting in a DoS attack. As of time of publication, no known patched versions exist.","debianbug":1120797,"scope":"local","releases":{"bookworm":{"status":"open","repositories":{"bookworm":"16.2.15+ds-0+deb12u1","bookworm-security":"16.2.15+ds-0+deb12u1"},"urgency":"not yet assigned"},"bullseye":{"status":"resolved","repositories":{"bullseye":"14.2.21-1","bullseye-security":"14.2.21-1+deb11u3"},"fixed_version":"14.2.21-1+deb11u2","urgency":"not yet assigned"},"forky":{"status":"resolved","repositories":{"forky":"18.2.7+ds-1.1"},"fixed_version":"18.2.7+ds-1.1","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"18.2.7+ds-1.1"},"fixed_version":"18.2.7+ds-1.1","urgency":"not yet assigned"},"trixie":{"status":"open","repositories":{"trixie":"18.2.7+ds-1"},"urgency":"not yet assigned"}}},"CVE-2024-48916":{"description":"Ceph is a distributed object, block, and file storage platform. In versions 19.2.3 and below, it is possible to send an JWT that has \"none\" as JWT alg. And by doing so the JWT signature is not checked. The vulnerability is most likely in the RadosGW OIDC provider. As of time of publication, a known patched version has yet to be published.","debianbug":1088993,"scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"16.2.15+ds-0+deb12u1","bookworm-security":"16.2.15+ds-0+deb12u1"},"fixed_version":"16.2.15+ds-0+deb12u1","urgency":"not yet assigned"},"bullseye":{"status":"resolved","repositories":{"bullseye":"14.2.21-1","bullseye-security":"14.2.21-1+deb11u3"},"fixed_version":"0","urgency":"unimportant"},"forky":{"status":"resolved","repositories":{"forky":"18.2.7+ds-1.1"},"fixed_version":"18.2.4+ds-11","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"18.2.7+ds-1.1"},"fixed_version":"18.2.4+ds-11","urgency":"not yet assigned"},"trixie":{"status":"resolved","repositories":{"trixie":"18.2.7+ds-1"},"fixed_version":"18.2.4+ds-11","urgency":"not yet assigned"}}},"CVE-2025-52555":{"description":"Ceph is a distributed object, block, and file storage platform. In versions 17.2.7, 18.2.1 through 18.2.4, and 19.0.0 through 19.2.2, an unprivileged user can escalate to root privileges in a ceph-fuse mounted CephFS by chmod 777 a directory owned by root to gain access. The result of this is that a user could read, write and execute to any directory owned by root as long as they chmod 777 it. This impacts confidentiality, integrity, and availability. It is patched in versions 17.2.8, 18.2.5, and 19.2.3.","debianbug":1108410,"scope":"local","releases":{"bookworm":{"status":"open","repositories":{"bookworm":"16.2.15+ds-0+deb12u1","bookworm-security":"16.2.15+ds-0+deb12u1"},"urgency":"not yet assigned","nodsa":"Minor issue","nodsa_reason":""},"bullseye":{"status":"resolved","repositories":{"bullseye":"14.2.21-1","bullseye-security":"14.2.21-1+deb11u3"},"fixed_version":"14.2.21-1+deb11u1","urgency":"not yet assigned"},"forky":{"status":"resolved","repositories":{"forky":"18.2.7+ds-1.1"},"fixed_version":"18.2.6-1","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"18.2.7+ds-1.1"},"fixed_version":"18.2.6-1","urgency":"not yet assigned"},"trixie":{"status":"resolved","repositories":{"trixie":"18.2.7+ds-1"},"fixed_version":"18.2.6-1","urgency":"not yet assigned"}}}},"cfengine3":{"CVE-2019-9929":{"description":"Northern.tech CFEngine Enterprise 3.12.1 has Insecure Permissions.","scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"3.21.0-2"},"fixed_version":"0","urgency":"unimportant"},"bullseye":{"status":"resolved","repositories":{"bullseye":"3.15.2-3"},"fixed_version":"0","urgency":"unimportant"},"forky":{"status":"resolved","repositories":{"forky":"3.24.2-1"},"fixed_version":"0","urgency":"unimportant"},"sid":{"status":"resolved","repositories":{"sid":"3.24.2-1"},"fixed_version":"0","urgency":"unimportant"},"trixie":{"status":"resolved","repositories":{"trixie":"3.24.1-2"},"fixed_version":"0","urgency":"unimportant"}}},"CVE-2023-45684":{"description":"Northern.tech CFEngine Enterprise before 3.21.3 allows SQL Injection. The fixed versions are 3.18.6 and 3.21.3. The earliest affected version is 3.6.0. The issue is in the Mission Portal login page in the CFEngine hub.","scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"3.21.0-2"},"fixed_version":"0","urgency":"unimportant"},"bullseye":{"status":"resolved","repositories":{"bullseye":"3.15.2-3"},"fixed_version":"0","urgency":"unimportant"},"forky":{"status":"resolved","repositories":{"forky":"3.24.2-1"},"fixed_version":"0","urgency":"unimportant"},"sid":{"status":"resolved","repositories":{"sid":"3.24.2-1"},"fixed_version":"0","urgency":"unimportant"},"trixie":{"status":"resolved","repositories":{"trixie":"3.24.1-2"},"fixed_version":"0","urgency":"unimportant"}}}},"cfingerd":{"CVE-2001-0735":{"description":"Buffer overflow in cfingerd 1.4.3 and earlier with the ALLOW_LINE_PARSING option enabled allows local users to execute arbitrary code via a long line in the .nofinger file.","debianbug":104394,"scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"1.4.3-7"},"fixed_version":"1.4.3-1.1","urgency":"not yet assigned"},"bullseye":{"status":"resolved","repositories":{"bullseye":"1.4.3-5"},"fixed_version":"1.4.3-1.1","urgency":"not yet assigned"},"forky":{"status":"resolved","repositories":{"forky":"1.4.3-10"},"fixed_version":"1.4.3-1.1","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"1.4.3-10"},"fixed_version":"1.4.3-1.1","urgency":"not yet assigned"},"trixie":{"status":"resolved","repositories":{"trixie":"1.4.3-8"},"fixed_version":"1.4.3-1.1","urgency":"not yet assigned"}}},"CVE-2013-1049":{"description":"Buffer overflow in the RFC1413 (ident) client in cfingerd 1.4.3-3 allows remote IDENT servers to cause a denial of service (crash) and possibly execute arbitrary code via a crafted response.","debianbug":700098,"scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"1.4.3-7"},"fixed_version":"1.4.3-3.1","urgency":"not yet assigned"},"bullseye":{"status":"resolved","repositories":{"bullseye":"1.4.3-5"},"fixed_version":"1.4.3-3.1","urgency":"not yet assigned"},"forky":{"status":"resolved","repositories":{"forky":"1.4.3-10"},"fixed_version":"1.4.3-3.1","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"1.4.3-10"},"fixed_version":"1.4.3-3.1","urgency":"not yet assigned"},"trixie":{"status":"resolved","repositories":{"trixie":"1.4.3-8"},"fixed_version":"1.4.3-3.1","urgency":"not yet assigned"}}}},"cfitsio":{"CVE-2018-3846":{"description":"In the ffgphd and ffgtkn functions in NASA CFITSIO 3.42, specially crafted images parsed via the library can cause a stack-based buffer overflow overwriting arbitrary data. An attacker can deliver an FIT image to trigger this vulnerability and potentially gain code execution.","debianbug":892458,"scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"4.2.0-3"},"fixed_version":"3.430-1","urgency":"low"},"bullseye":{"status":"resolved","repositories":{"bullseye":"3.490-3"},"fixed_version":"3.430-1","urgency":"low"},"forky":{"status":"resolved","repositories":{"forky":"4.6.3-1"},"fixed_version":"3.430-1","urgency":"low"},"sid":{"status":"resolved","repositories":{"sid":"4.6.3-1"},"fixed_version":"3.430-1","urgency":"low"},"trixie":{"status":"resolved","repositories":{"trixie":"4.6.2-2"},"fixed_version":"3.430-1","urgency":"low"}}},"CVE-2018-3847":{"description":"Multiple exploitable buffer overflow vulnerabilities exist in image parsing functionality of the CFITSIO library version 3.42. Specially crafted images parsed via the library, can cause a stack-based buffer overflow overwriting arbitrary data. An attacker can deliver an FIT image to trigger this vulnerability and potentially gain code execution.","debianbug":892458,"scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"4.2.0-3"},"fixed_version":"3.430-1","urgency":"low"},"bullseye":{"status":"resolved","repositories":{"bullseye":"3.490-3"},"fixed_version":"3.430-1","urgency":"low"},"forky":{"status":"resolved","repositories":{"forky":"4.6.3-1"},"fixed_version":"3.430-1","urgency":"low"},"sid":{"status":"resolved","repositories":{"sid":"4.6.3-1"},"fixed_version":"3.430-1","urgency":"low"},"trixie":{"status":"resolved","repositories":{"trixie":"4.6.2-2"},"fixed_version":"3.430-1","urgency":"low"}}},"CVE-2018-3848":{"description":"In the ffghbn function in NASA CFITSIO 3.42, specially crafted images parsed via the library can cause a stack-based buffer overflow overwriting arbitrary data. An attacker can deliver an FIT image to trigger this vulnerability and potentially gain code execution.","debianbug":892458,"scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"4.2.0-3"},"fixed_version":"3.430-1","urgency":"low"},"bullseye":{"status":"resolved","repositories":{"bullseye":"3.490-3"},"fixed_version":"3.430-1","urgency":"low"},"forky":{"status":"resolved","repositories":{"forky":"4.6.3-1"},"fixed_version":"3.430-1","urgency":"low"},"sid":{"status":"resolved","repositories":{"sid":"4.6.3-1"},"fixed_version":"3.430-1","urgency":"low"},"trixie":{"status":"resolved","repositories":{"trixie":"4.6.2-2"},"fixed_version":"3.430-1","urgency":"low"}}},"CVE-2018-3849":{"description":"In the ffghtb function in NASA CFITSIO 3.42, specially crafted images parsed via the library can cause a stack-based buffer overflow overwriting arbitrary data. An attacker can deliver an FIT image to trigger this vulnerability and potentially gain code execution.","debianbug":892458,"scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"4.2.0-3"},"fixed_version":"3.430-1","urgency":"low"},"bullseye":{"status":"resolved","repositories":{"bullseye":"3.490-3"},"fixed_version":"3.430-1","urgency":"low"},"forky":{"status":"resolved","repositories":{"forky":"4.6.3-1"},"fixed_version":"3.430-1","urgency":"low"},"sid":{"status":"resolved","repositories":{"sid":"4.6.3-1"},"fixed_version":"3.430-1","urgency":"low"},"trixie":{"status":"resolved","repositories":{"trixie":"4.6.2-2"},"fixed_version":"3.430-1","urgency":"low"}}},"CVE-2019-1010060":{"description":"NASA CFITSIO prior to 3.43 is affected by: Buffer Overflow. The impact is: arbitrary code execution. The component is: over 40 source code files were changed. The attack vector is: remote unauthenticated attacker. The fixed version is: 3.43. NOTE: this CVE refers to the issues not covered by CVE-2018-3846, CVE-2018-3847, CVE-2018-3848, and CVE-2018-3849. One example is ftp_status in drvrnet.c mishandling a long string beginning with a '4' character.","debianbug":892458,"scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"4.2.0-3"},"fixed_version":"3.430-1","urgency":"low"},"bullseye":{"status":"resolved","repositories":{"bullseye":"3.490-3"},"fixed_version":"3.430-1","urgency":"low"},"forky":{"status":"resolved","repositories":{"forky":"4.6.3-1"},"fixed_version":"3.430-1","urgency":"low"},"sid":{"status":"resolved","repositories":{"sid":"4.6.3-1"},"fixed_version":"3.430-1","urgency":"low"},"trixie":{"status":"resolved","repositories":{"trixie":"4.6.2-2"},"fixed_version":"3.430-1","urgency":"low"}}}},"cflow":{"CVE-2019-16165":{"description":"GNU cflow through 1.6 has a use-after-free in the reference function in parser.c.","debianbug":939915,"scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"1:1.7-4"},"fixed_version":"1:1.6-6","urgency":"unimportant"},"bullseye":{"status":"open","repositories":{"bullseye":"1:1.6-4"},"urgency":"unimportant"},"forky":{"status":"resolved","repositories":{"forky":"1:1.8-1"},"fixed_version":"1:1.6-6","urgency":"unimportant"},"sid":{"status":"resolved","repositories":{"sid":"1:1.8-1"},"fixed_version":"1:1.6-6","urgency":"unimportant"},"trixie":{"status":"resolved","repositories":{"trixie":"1:1.7-5"},"fixed_version":"1:1.6-6","urgency":"unimportant"}}},"CVE-2019-16166":{"description":"GNU cflow through 1.6 has a heap-based buffer over-read in the nexttoken function in parser.c.","debianbug":939916,"scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"1:1.7-4"},"fixed_version":"1:1.6-6","urgency":"unimportant"},"bullseye":{"status":"open","repositories":{"bullseye":"1:1.6-4"},"urgency":"unimportant"},"forky":{"status":"resolved","repositories":{"forky":"1:1.8-1"},"fixed_version":"1:1.6-6","urgency":"unimportant"},"sid":{"status":"resolved","repositories":{"sid":"1:1.8-1"},"fixed_version":"1:1.6-6","urgency":"unimportant"},"trixie":{"status":"resolved","repositories":{"trixie":"1:1.7-5"},"fixed_version":"1:1.6-6","urgency":"unimportant"}}},"CVE-2020-23856":{"description":"Use-after-Free vulnerability in cflow 1.6 in the void call(char *name, int line) function at src/parser.c, which could cause a denial of service via the pointer variable caller->callee.","debianbug":988985,"scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"1:1.7-4"},"fixed_version":"1:1.6-6","urgency":"unimportant"},"bullseye":{"status":"open","repositories":{"bullseye":"1:1.6-4"},"urgency":"unimportant"},"forky":{"status":"resolved","repositories":{"forky":"1:1.8-1"},"fixed_version":"1:1.6-6","urgency":"unimportant"},"sid":{"status":"resolved","repositories":{"sid":"1:1.8-1"},"fixed_version":"1:1.6-6","urgency":"unimportant"},"trixie":{"status":"resolved","repositories":{"trixie":"1:1.7-5"},"fixed_version":"1:1.6-6","urgency":"unimportant"}}},"CVE-2023-2789":{"description":"A vulnerability was found in GNU cflow 1.7. It has been rated as problematic. This issue affects the function func_body/parse_variable_declaration of the file parser.c. The manipulation leads to denial of service. The exploit has been disclosed to the public and may be used. The identifier VDB-229373 was assigned to this vulnerability. NOTE: The vendor was contacted early about this disclosure but did not respond in any way.","scope":"local","releases":{"bookworm":{"status":"open","repositories":{"bookworm":"1:1.7-4"},"urgency":"unimportant"},"bullseye":{"status":"open","repositories":{"bullseye":"1:1.6-4"},"urgency":"unimportant"},"forky":{"status":"open","repositories":{"forky":"1:1.8-1"},"urgency":"unimportant"},"sid":{"status":"open","repositories":{"sid":"1:1.8-1"},"urgency":"unimportant"},"trixie":{"status":"open","repositories":{"trixie":"1:1.7-5"},"urgency":"unimportant"}}},"CVE-2025-8735":{"description":"A vulnerability classified as problematic was found in GNU cflow up to 1.8. Affected by this vulnerability is the function yylex of the file c.c of the component Lexer. The manipulation leads to null pointer dereference. An attack has to be approached locally. The exploit has been disclosed to the public and may be used.","scope":"local","releases":{"bookworm":{"status":"open","repositories":{"bookworm":"1:1.7-4"},"urgency":"unimportant"},"bullseye":{"status":"open","repositories":{"bullseye":"1:1.6-4"},"urgency":"unimportant"},"forky":{"status":"open","repositories":{"forky":"1:1.8-1"},"urgency":"unimportant"},"sid":{"status":"open","repositories":{"sid":"1:1.8-1"},"urgency":"unimportant"},"trixie":{"status":"open","repositories":{"trixie":"1:1.7-5"},"urgency":"unimportant"}}},"CVE-2025-8736":{"description":"A vulnerability, which was classified as critical, has been found in GNU cflow up to 1.8. Affected by this issue is the function yylex of the file c.c of the component Lexer. The manipulation leads to buffer overflow. Local access is required to approach this attack. The exploit has been disclosed to the public and may be used.","scope":"local","releases":{"bookworm":{"status":"open","repositories":{"bookworm":"1:1.7-4"},"urgency":"unimportant"},"bullseye":{"status":"open","repositories":{"bullseye":"1:1.6-4"},"urgency":"unimportant"},"forky":{"status":"open","repositories":{"forky":"1:1.8-1"},"urgency":"unimportant"},"sid":{"status":"open","repositories":{"sid":"1:1.8-1"},"urgency":"unimportant"},"trixie":{"status":"open","repositories":{"trixie":"1:1.7-5"},"urgency":"unimportant"}}}},"cfrpki":{"CVE-2021-3761":{"description":"Any CA issuer in the RPKI can trick OctoRPKI prior to 1.3.0 into emitting an invalid VRP \"MaxLength\" value, causing RTR sessions to terminate. An attacker can use this to disable RPKI Origin Validation in a victim network (for example AS 13335 - Cloudflare) prior to launching a BGP hijack which during normal operations would be rejected as \"RPKI invalid\". Additionally, in certain deployments RTR session flapping in and of itself also could cause BGP routing churn, causing availability issues.","debianbug":994572,"scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"1.4.4-1"},"fixed_version":"1.3.0-1","urgency":"not yet assigned"},"bullseye":{"status":"resolved","repositories":{"bullseye":"1.4.2-1~deb11u1","bullseye-security":"1.4.2-1~deb11u1"},"fixed_version":"1.4.2-1~deb11u1","urgency":"not yet assigned"}}},"CVE-2021-3907":{"description":"OctoRPKI does not escape a URI with a filename containing \"..\", this allows a repository to create a file, (ex. rsync://example.org/repo/../../etc/cron.daily/evil.roa), which would then be written to disk outside the base cache folder. This could allow for remote code execution on the host machine OctoRPKI is running on.","scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"1.4.4-1"},"fixed_version":"1.4.0-1","urgency":"not yet assigned"},"bullseye":{"status":"resolved","repositories":{"bullseye":"1.4.2-1~deb11u1","bullseye-security":"1.4.2-1~deb11u1"},"fixed_version":"1.4.2-1~deb11u1","urgency":"not yet assigned"}}},"CVE-2021-3908":{"description":"OctoRPKI does not limit the depth of a certificate chain, allowing for a CA to create children in an ad-hoc fashion, thereby making tree traversal never end.","scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"1.4.4-1"},"fixed_version":"1.4.0-1","urgency":"not yet assigned"},"bullseye":{"status":"resolved","repositories":{"bullseye":"1.4.2-1~deb11u1","bullseye-security":"1.4.2-1~deb11u1"},"fixed_version":"1.4.2-1~deb11u1","urgency":"not yet assigned"}}},"CVE-2021-3909":{"description":"OctoRPKI does not limit the length of a connection, allowing for a slowloris DOS attack to take place which makes OctoRPKI wait forever. Specifically, the repository that OctoRPKI sends HTTP requests to will keep the connection open for a day before a response is returned, but does keep drip feeding new bytes to keep the connection alive.","scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"1.4.4-1"},"fixed_version":"1.4.0-1","urgency":"not yet assigned"},"bullseye":{"status":"resolved","repositories":{"bullseye":"1.4.2-1~deb11u1","bullseye-security":"1.4.2-1~deb11u1"},"fixed_version":"1.4.2-1~deb11u1","urgency":"not yet assigned"}}},"CVE-2021-3910":{"description":"OctoRPKI crashes when encountering a repository that returns an invalid ROA (just an encoded NUL (\\0) character).","scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"1.4.4-1"},"fixed_version":"1.4.0-1","urgency":"not yet assigned"},"bullseye":{"status":"resolved","repositories":{"bullseye":"1.4.2-1~deb11u1","bullseye-security":"1.4.2-1~deb11u1"},"fixed_version":"1.4.2-1~deb11u1","urgency":"not yet assigned"}}},"CVE-2021-3911":{"description":"If the ROA that a repository returns contains too many bits for the IP address then OctoRPKI will crash.","scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"1.4.4-1"},"fixed_version":"1.4.0-1","urgency":"not yet assigned"},"bullseye":{"status":"resolved","repositories":{"bullseye":"1.4.2-1~deb11u1","bullseye-security":"1.4.2-1~deb11u1"},"fixed_version":"1.4.2-1~deb11u1","urgency":"not yet assigned"}}},"CVE-2021-3912":{"description":"OctoRPKI tries to load the entire contents of a repository in memory, and in the case of a GZIP bomb, unzip it in memory, making it possible to create a repository that makes OctoRPKI run out of memory (and thus crash).","scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"1.4.4-1"},"fixed_version":"1.4.0-1","urgency":"not yet assigned"},"bullseye":{"status":"resolved","repositories":{"bullseye":"1.4.2-1~deb11u1","bullseye-security":"1.4.2-1~deb11u1"},"fixed_version":"1.4.2-1~deb11u1","urgency":"not yet assigned"}}},"CVE-2021-3978":{"description":"When copying files with rsync, octorpki uses the \"-a\" flag 0, which forces rsync to copy binaries with the suid bit set as root. Since the provided service definition defaults to root ( https://github.com/cloudflare/cfrpki/blob/master/package/octorpki.service ) this could allow for a vector, when combined with another vulnerability that causes octorpki to process a malicious TAL file, for a local privilege escalation.","scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"1.4.4-1"},"fixed_version":"1.4.2-1","urgency":"not yet assigned"},"bullseye":{"status":"resolved","repositories":{"bullseye":"1.4.2-1~deb11u1","bullseye-security":"1.4.2-1~deb11u1"},"fixed_version":"1.4.2-1~deb11u1","urgency":"not yet assigned"}}},"CVE-2021-43173":{"description":"In NLnet Labs Routinator prior to 0.10.2, a validation run can be delayed significantly by an RRDP repository by not answering but slowly drip-feeding bytes to keep the connection alive. This can be used to effectively stall validation. While Routinator has a configurable time-out value for RRDP connections, this time-out was only applied to individual read or write operations rather than the complete request. Thus, if an RRDP repository sends a little bit of data before that time-out expired, it can continuously extend the time it takes for the request to finish. Since validation will only continue once the update of an RRDP repository has concluded, this delay will cause validation to stall, leading to Routinator continuing to serve the old data set or, if in the initial validation run directly after starting, never serve any data at all.","scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"1.4.4-1"},"fixed_version":"1.4.0-1","urgency":"not yet assigned"},"bullseye":{"status":"resolved","repositories":{"bullseye":"1.4.2-1~deb11u1","bullseye-security":"1.4.2-1~deb11u1"},"fixed_version":"1.4.2-1~deb11u1","urgency":"not yet assigned"}}},"CVE-2021-43174":{"description":"NLnet Labs Routinator versions 0.9.0 up to and including 0.10.1, support the gzip transfer encoding when querying RRDP repositories. This encoding can be used by an RRDP repository to cause an out-of-memory crash in these versions of Routinator. RRDP uses XML which allows arbitrary amounts of white space in the encoded data. The gzip scheme compresses such white space extremely well, leading to very small compressed files that become huge when being decompressed for further processing, big enough that Routinator runs out of memory when parsing input data waiting for the next XML element.","scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"1.4.4-1"},"fixed_version":"1.4.0-1","urgency":"not yet assigned"},"bullseye":{"status":"resolved","repositories":{"bullseye":"1.4.2-1~deb11u1","bullseye-security":"1.4.2-1~deb11u1"},"fixed_version":"1.4.2-1~deb11u1","urgency":"not yet assigned"}}},"CVE-2022-3616":{"description":"Attackers can create long chains of CAs that would lead to OctoRPKI exceeding its max iterations parameter. In consequence it would cause the program to crash, preventing it from finishing the validation and leading to a denial of service. Credits to\u00a0Donika Mirdita and\u00a0Haya Shulman - Fraunhofer SIT, ATHENE, who discovered and reported this vulnerability.","scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"1.4.4-1"},"fixed_version":"1.4.4-1","urgency":"not yet assigned"},"bullseye":{"status":"open","repositories":{"bullseye":"1.4.2-1~deb11u1","bullseye-security":"1.4.2-1~deb11u1"},"urgency":"not yet assigned","nodsa":"Minor issue","nodsa_reason":""}}}},"cgal":{"CVE-2020-28601":{"description":"A code execution vulnerability exists in the Nef polygon-parsing functionality of CGAL libcgal CGAL-5.1.1. An oob read vulnerability exists in Nef_2/PM_io_parser.h PM_io_parser::read_vertex() Face_of[] OOB read. An attacker can provide malicious input to trigger this vulnerability.","debianbug":985671,"scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"5.5.1-2"},"fixed_version":"5.2-3","urgency":"not yet assigned"},"bullseye":{"status":"resolved","repositories":{"bullseye":"5.2-3"},"fixed_version":"5.2-3","urgency":"not yet assigned"},"forky":{"status":"resolved","repositories":{"forky":"6.1.1-2"},"fixed_version":"5.2-3","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"6.1.1-2"},"fixed_version":"5.2-3","urgency":"not yet assigned"},"trixie":{"status":"resolved","repositories":{"trixie":"6.0.1-1"},"fixed_version":"5.2-3","urgency":"not yet assigned"}}},"CVE-2020-28602":{"description":"Multiple code execution vulnerabilities exists in the Nef polygon-parsing functionality of CGAL libcgal CGAL-5.1.1. A specially crafted malformed file can lead to an out-of-bounds read and type confusion, which could lead to code execution. An attacker can provide malicious input to trigger any of these vulnerabilities. An oob read vulnerability exists in Nef_2/PM_io_parser.h PM_io_parser<PMDEC>::read_vertex() Halfedge_of[].","debianbug":985671,"scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"5.5.1-2"},"fixed_version":"5.2-3","urgency":"not yet assigned"},"bullseye":{"status":"resolved","repositories":{"bullseye":"5.2-3"},"fixed_version":"5.2-3","urgency":"not yet assigned"},"forky":{"status":"resolved","repositories":{"forky":"6.1.1-2"},"fixed_version":"5.2-3","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"6.1.1-2"},"fixed_version":"5.2-3","urgency":"not yet assigned"},"trixie":{"status":"resolved","repositories":{"trixie":"6.0.1-1"},"fixed_version":"5.2-3","urgency":"not yet assigned"}}},"CVE-2020-28603":{"description":"Multiple code execution vulnerabilities exists in the Nef polygon-parsing functionality of CGAL libcgal CGAL-5.1.1. A specially crafted malformed file can lead to an out-of-bounds read and type confusion, which could lead to code execution. An attacker can provide malicious input to trigger any of these vulnerabilities. An oob read vulnerability exists in Nef_2/PM_io_parser.h PM_io_parser<PMDEC>::read_hedge() e->set_prev().","debianbug":985671,"scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"5.5.1-2"},"fixed_version":"5.2-3","urgency":"not yet assigned"},"bullseye":{"status":"resolved","repositories":{"bullseye":"5.2-3"},"fixed_version":"5.2-3","urgency":"not yet assigned"},"forky":{"status":"resolved","repositories":{"forky":"6.1.1-2"},"fixed_version":"5.2-3","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"6.1.1-2"},"fixed_version":"5.2-3","urgency":"not yet assigned"},"trixie":{"status":"resolved","repositories":{"trixie":"6.0.1-1"},"fixed_version":"5.2-3","urgency":"not yet assigned"}}},"CVE-2020-28604":{"description":"Multiple code execution vulnerabilities exists in the Nef polygon-parsing functionality of CGAL libcgal CGAL-5.1.1. A specially crafted malformed file can lead to an out-of-bounds read and type confusion, which could lead to code execution. An attacker can provide malicious input to trigger any of these vulnerabilities. An oob read vulnerability exists in Nef_2/PM_io_parser.h PM_io_parser<PMDEC>::read_hedge() e->set_next().","debianbug":985671,"scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"5.5.1-2"},"fixed_version":"5.2-3","urgency":"not yet assigned"},"bullseye":{"status":"resolved","repositories":{"bullseye":"5.2-3"},"fixed_version":"5.2-3","urgency":"not yet assigned"},"forky":{"status":"resolved","repositories":{"forky":"6.1.1-2"},"fixed_version":"5.2-3","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"6.1.1-2"},"fixed_version":"5.2-3","urgency":"not yet assigned"},"trixie":{"status":"resolved","repositories":{"trixie":"6.0.1-1"},"fixed_version":"5.2-3","urgency":"not yet assigned"}}},"CVE-2020-28605":{"description":"Multiple code execution vulnerabilities exists in the Nef polygon-parsing functionality of CGAL libcgal CGAL-5.1.1. A specially crafted malformed file can lead to an out-of-bounds read and type confusion, which could lead to code execution. An attacker can provide malicious input to trigger any of these vulnerabilities. An oob read exists in Nef_2/PM_io_parser.h PM_io_parser<PMDEC>::read_hedge() e->set_vertex().","debianbug":985671,"scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"5.5.1-2"},"fixed_version":"5.2-3","urgency":"not yet assigned"},"bullseye":{"status":"resolved","repositories":{"bullseye":"5.2-3"},"fixed_version":"5.2-3","urgency":"not yet assigned"},"forky":{"status":"resolved","repositories":{"forky":"6.1.1-2"},"fixed_version":"5.2-3","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"6.1.1-2"},"fixed_version":"5.2-3","urgency":"not yet assigned"},"trixie":{"status":"resolved","repositories":{"trixie":"6.0.1-1"},"fixed_version":"5.2-3","urgency":"not yet assigned"}}},"CVE-2020-28606":{"description":"Multiple code execution vulnerabilities exists in the Nef polygon-parsing functionality of CGAL libcgal CGAL-5.1.1. A specially crafted malformed file can lead to an out-of-bounds read and type confusion, which could lead to code execution. An attacker can provide malicious input to trigger any of these vulnerabilities. An oob read vulnerability exists in Nef_2/PM_io_parser.h PM_io_parser<PMDEC>::read_hedge() e->set_face().","debianbug":985671,"scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"5.5.1-2"},"fixed_version":"5.2-3","urgency":"not yet assigned"},"bullseye":{"status":"resolved","repositories":{"bullseye":"5.2-3"},"fixed_version":"5.2-3","urgency":"not yet assigned"},"forky":{"status":"resolved","repositories":{"forky":"6.1.1-2"},"fixed_version":"5.2-3","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"6.1.1-2"},"fixed_version":"5.2-3","urgency":"not yet assigned"},"trixie":{"status":"resolved","repositories":{"trixie":"6.0.1-1"},"fixed_version":"5.2-3","urgency":"not yet assigned"}}},"CVE-2020-28607":{"description":"Multiple code execution vulnerabilities exists in the Nef polygon-parsing functionality of CGAL libcgal CGAL-5.1.1. A specially crafted malformed file can lead to an out-of-bounds read and type confusion, which could lead to code execution. An attacker can provide malicious input to trigger any of these vulnerabilities. An oob read vulnerability exists in Nef_2/PM_io_parser.h PM_io_parser<PMDEC>::read_face() set_halfedge().","debianbug":985671,"scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"5.5.1-2"},"fixed_version":"5.2-3","urgency":"not yet assigned"},"bullseye":{"status":"resolved","repositories":{"bullseye":"5.2-3"},"fixed_version":"5.2-3","urgency":"not yet assigned"},"forky":{"status":"resolved","repositories":{"forky":"6.1.1-2"},"fixed_version":"5.2-3","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"6.1.1-2"},"fixed_version":"5.2-3","urgency":"not yet assigned"},"trixie":{"status":"resolved","repositories":{"trixie":"6.0.1-1"},"fixed_version":"5.2-3","urgency":"not yet assigned"}}},"CVE-2020-28608":{"description":"Multiple code execution vulnerabilities exists in the Nef polygon-parsing functionality of CGAL libcgal CGAL-5.1.1. A specially crafted malformed file can lead to an out-of-bounds read and type confusion, which could lead to code execution. An attacker can provide malicious input to trigger any of these vulnerabilities. An oob read vulnerability exists in Nef_2/PM_io_parser.h PM_io_parser<PMDEC>::read_face() store_fc().","debianbug":985671,"scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"5.5.1-2"},"fixed_version":"5.2-3","urgency":"not yet assigned"},"bullseye":{"status":"resolved","repositories":{"bullseye":"5.2-3"},"fixed_version":"5.2-3","urgency":"not yet assigned"},"forky":{"status":"resolved","repositories":{"forky":"6.1.1-2"},"fixed_version":"5.2-3","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"6.1.1-2"},"fixed_version":"5.2-3","urgency":"not yet assigned"},"trixie":{"status":"resolved","repositories":{"trixie":"6.0.1-1"},"fixed_version":"5.2-3","urgency":"not yet assigned"}}},"CVE-2020-28609":{"description":"Multiple code execution vulnerabilities exists in the Nef polygon-parsing functionality of CGAL libcgal CGAL-5.1.1. A specially crafted malformed file can lead to an out-of-bounds read and type confusion, which could lead to code execution. An attacker can provide malicious input to trigger any of these vulnerabilities. An oob read vulnerability exists in Nef_2/PM_io_parser.h PM_io_parser<PMDEC>::read_face() store_iv().","debianbug":985671,"scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"5.5.1-2"},"fixed_version":"5.2-3","urgency":"not yet assigned"},"bullseye":{"status":"resolved","repositories":{"bullseye":"5.2-3"},"fixed_version":"5.2-3","urgency":"not yet assigned"},"forky":{"status":"resolved","repositories":{"forky":"6.1.1-2"},"fixed_version":"5.2-3","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"6.1.1-2"},"fixed_version":"5.2-3","urgency":"not yet assigned"},"trixie":{"status":"resolved","repositories":{"trixie":"6.0.1-1"},"fixed_version":"5.2-3","urgency":"not yet assigned"}}},"CVE-2020-28610":{"description":"Multiple code execution vulnerabilities exists in the Nef polygon-parsing functionality of CGAL libcgal CGAL-5.1.1. A specially crafted malformed file can lead to an out-of-bounds read and type confusion, which could lead to code execution. An attacker can provide malicious input to trigger any of these vulnerabilities. An oob read vulnerability exists in Nef_S2/SM_io_parser.h SM_io_parser<Decorator_>::read_vertex() set_face().","debianbug":985671,"scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"5.5.1-2"},"fixed_version":"5.2-3","urgency":"not yet assigned"},"bullseye":{"status":"resolved","repositories":{"bullseye":"5.2-3"},"fixed_version":"5.2-3","urgency":"not yet assigned"},"forky":{"status":"resolved","repositories":{"forky":"6.1.1-2"},"fixed_version":"5.2-3","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"6.1.1-2"},"fixed_version":"5.2-3","urgency":"not yet assigned"},"trixie":{"status":"resolved","repositories":{"trixie":"6.0.1-1"},"fixed_version":"5.2-3","urgency":"not yet assigned"}}},"CVE-2020-28611":{"description":"Multiple code execution vulnerabilities exists in the Nef polygon-parsing functionality of CGAL libcgal CGAL-5.1.1. A specially crafted malformed file can lead to an out-of-bounds read and type confusion, which could lead to code execution. An attacker can provide malicious input to trigger any of these vulnerabilities. An oob read vulnerability exists in Nef_S2/SM_io_parser.h SM_io_parser<Decorator_>::read_vertex() set_first_out_edge().","debianbug":985671,"scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"5.5.1-2"},"fixed_version":"5.2-3","urgency":"not yet assigned"},"bullseye":{"status":"resolved","repositories":{"bullseye":"5.2-3"},"fixed_version":"5.2-3","urgency":"not yet assigned"},"forky":{"status":"resolved","repositories":{"forky":"6.1.1-2"},"fixed_version":"5.2-3","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"6.1.1-2"},"fixed_version":"5.2-3","urgency":"not yet assigned"},"trixie":{"status":"resolved","repositories":{"trixie":"6.0.1-1"},"fixed_version":"5.2-3","urgency":"not yet assigned"}}},"CVE-2020-28612":{"description":"Multiple code execution vulnerabilities exists in the Nef polygon-parsing functionality of CGAL libcgal CGAL-5.1.1. A specially crafted malformed file can lead to an out-of-bounds read and type confusion, which could lead to code execution. An attacker can provide malicious input to trigger any of these vulnerabilities. An oob read vulnerability exists in Nef_S2/SNC_io_parser.h SNC_io_parser<EW>::read_vertex() vh->svertices_begin().","debianbug":985671,"scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"5.5.1-2"},"fixed_version":"5.2-3","urgency":"not yet assigned"},"bullseye":{"status":"resolved","repositories":{"bullseye":"5.2-3"},"fixed_version":"5.2-3","urgency":"not yet assigned"},"forky":{"status":"resolved","repositories":{"forky":"6.1.1-2"},"fixed_version":"5.2-3","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"6.1.1-2"},"fixed_version":"5.2-3","urgency":"not yet assigned"},"trixie":{"status":"resolved","repositories":{"trixie":"6.0.1-1"},"fixed_version":"5.2-3","urgency":"not yet assigned"}}},"CVE-2020-28613":{"description":"Multiple code execution vulnerabilities exists in the Nef polygon-parsing functionality of CGAL libcgal CGAL-5.1.1. A specially crafted malformed file can lead to an out-of-bounds read and type confusion, which could lead to code execution. An attacker can provide malicious input to trigger any of these vulnerabilities. An oob read vulnerability exists in Nef_S2/SNC_io_parser.h SNC_io_parser<EW>::read_vertex() vh->svertices_last().","debianbug":985671,"scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"5.5.1-2"},"fixed_version":"5.2-3","urgency":"not yet assigned"},"bullseye":{"status":"resolved","repositories":{"bullseye":"5.2-3"},"fixed_version":"5.2-3","urgency":"not yet assigned"},"forky":{"status":"resolved","repositories":{"forky":"6.1.1-2"},"fixed_version":"5.2-3","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"6.1.1-2"},"fixed_version":"5.2-3","urgency":"not yet assigned"},"trixie":{"status":"resolved","repositories":{"trixie":"6.0.1-1"},"fixed_version":"5.2-3","urgency":"not yet assigned"}}},"CVE-2020-28614":{"description":"Multiple code execution vulnerabilities exists in the Nef polygon-parsing functionality of CGAL libcgal CGAL-5.1.1. A specially crafted malformed file can lead to an out-of-bounds read and type confusion, which could lead to code execution. An attacker can provide malicious input to trigger any of these vulnerabilities. An oob read vulnerability exists in Nef_S2/SNC_io_parser.h SNC_io_parser<EW>::read_vertex() vh->shalfedges_begin().","debianbug":985671,"scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"5.5.1-2"},"fixed_version":"5.2-3","urgency":"not yet assigned"},"bullseye":{"status":"resolved","repositories":{"bullseye":"5.2-3"},"fixed_version":"5.2-3","urgency":"not yet assigned"},"forky":{"status":"resolved","repositories":{"forky":"6.1.1-2"},"fixed_version":"5.2-3","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"6.1.1-2"},"fixed_version":"5.2-3","urgency":"not yet assigned"},"trixie":{"status":"resolved","repositories":{"trixie":"6.0.1-1"},"fixed_version":"5.2-3","urgency":"not yet assigned"}}},"CVE-2020-28615":{"description":"Multiple code execution vulnerabilities exists in the Nef polygon-parsing functionality of CGAL libcgal CGAL-5.1.1. A specially crafted malformed file can lead to an out-of-bounds read and type confusion, which could lead to code execution. An attacker can provide malicious input to trigger any of these vulnerabilities. An oob read vulnerability exists in Nef_S2/SNC_io_parser.h SNC_io_parser<EW>::read_vertex() vh->shalfedges_last().","debianbug":985671,"scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"5.5.1-2"},"fixed_version":"5.2-3","urgency":"not yet assigned"},"bullseye":{"status":"resolved","repositories":{"bullseye":"5.2-3"},"fixed_version":"5.2-3","urgency":"not yet assigned"},"forky":{"status":"resolved","repositories":{"forky":"6.1.1-2"},"fixed_version":"5.2-3","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"6.1.1-2"},"fixed_version":"5.2-3","urgency":"not yet assigned"},"trixie":{"status":"resolved","repositories":{"trixie":"6.0.1-1"},"fixed_version":"5.2-3","urgency":"not yet assigned"}}},"CVE-2020-28616":{"description":"Multiple code execution vulnerabilities exists in the Nef polygon-parsing functionality of CGAL libcgal CGAL-5.1.1. A specially crafted malformed file can lead to an out-of-bounds read and type confusion, which could lead to code execution. An attacker can provide malicious input to trigger any of these vulnerabilities. An oob read vulnerability exists in Nef_S2/SNC_io_parser.h SNC_io_parser<EW>::read_vertex() vh->sfaces_begin().","debianbug":985671,"scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"5.5.1-2"},"fixed_version":"5.2-3","urgency":"not yet assigned"},"bullseye":{"status":"resolved","repositories":{"bullseye":"5.2-3"},"fixed_version":"5.2-3","urgency":"not yet assigned"},"forky":{"status":"resolved","repositories":{"forky":"6.1.1-2"},"fixed_version":"5.2-3","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"6.1.1-2"},"fixed_version":"5.2-3","urgency":"not yet assigned"},"trixie":{"status":"resolved","repositories":{"trixie":"6.0.1-1"},"fixed_version":"5.2-3","urgency":"not yet assigned"}}},"CVE-2020-28617":{"description":"Multiple code execution vulnerabilities exists in the Nef polygon-parsing functionality of CGAL libcgal CGAL-5.1.1. A specially crafted malformed file can lead to an out-of-bounds read and type confusion, which could lead to code execution. An attacker can provide malicious input to trigger any of these vulnerabilities. An oob read vulnerability exists in Nef_S2/SNC_io_parser.h SNC_io_parser<EW>::read_vertex() vh->sfaces_last().","debianbug":985671,"scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"5.5.1-2"},"fixed_version":"5.2-3","urgency":"not yet assigned"},"bullseye":{"status":"resolved","repositories":{"bullseye":"5.2-3"},"fixed_version":"5.2-3","urgency":"not yet assigned"},"forky":{"status":"resolved","repositories":{"forky":"6.1.1-2"},"fixed_version":"5.2-3","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"6.1.1-2"},"fixed_version":"5.2-3","urgency":"not yet assigned"},"trixie":{"status":"resolved","repositories":{"trixie":"6.0.1-1"},"fixed_version":"5.2-3","urgency":"not yet assigned"}}},"CVE-2020-28618":{"description":"Multiple code execution vulnerabilities exists in the Nef polygon-parsing functionality of CGAL libcgal CGAL-5.1.1. A specially crafted malformed file can lead to an out-of-bounds read and type confusion, which could lead to code execution. An attacker can provide malicious input to trigger any of these vulnerabilities. An oob read vulnerability exists in Nef_S2/SNC_io_parser.h SNC_io_parser<EW>::read_vertex() vh->shalfloop().","debianbug":985671,"scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"5.5.1-2"},"fixed_version":"5.2-3","urgency":"not yet assigned"},"bullseye":{"status":"resolved","repositories":{"bullseye":"5.2-3"},"fixed_version":"5.2-3","urgency":"not yet assigned"},"forky":{"status":"resolved","repositories":{"forky":"6.1.1-2"},"fixed_version":"5.2-3","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"6.1.1-2"},"fixed_version":"5.2-3","urgency":"not yet assigned"},"trixie":{"status":"resolved","repositories":{"trixie":"6.0.1-1"},"fixed_version":"5.2-3","urgency":"not yet assigned"}}},"CVE-2020-28619":{"description":"Multiple code execution vulnerabilities exists in the Nef polygon-parsing functionality of CGAL libcgal CGAL-5.1.1. A specially crafted malformed file can lead to an out-of-bounds read and type confusion, which could lead to code execution. An attacker can provide malicious input to trigger any of these vulnerabilities. An oob read vulnerability exists in Nef_S2/SNC_io_parser.h SNC_io_parser<EW>::read_edge() eh->twin().","debianbug":985671,"scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"5.5.1-2"},"fixed_version":"5.2-3","urgency":"not yet assigned"},"bullseye":{"status":"resolved","repositories":{"bullseye":"5.2-3"},"fixed_version":"5.2-3","urgency":"not yet assigned"},"forky":{"status":"resolved","repositories":{"forky":"6.1.1-2"},"fixed_version":"5.2-3","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"6.1.1-2"},"fixed_version":"5.2-3","urgency":"not yet assigned"},"trixie":{"status":"resolved","repositories":{"trixie":"6.0.1-1"},"fixed_version":"5.2-3","urgency":"not yet assigned"}}},"CVE-2020-28620":{"description":"Multiple code execution vulnerabilities exists in the Nef polygon-parsing functionality of CGAL libcgal CGAL-5.1.1. A specially crafted malformed file can lead to an out-of-bounds read and type confusion, which could lead to code execution. An attacker can provide malicious input to trigger any of these vulnerabilities. An oob read vulnerability exists in Nef_S2/SNC_io_parser.h SNC_io_parser<EW>::read_edge() eh->center_vertex():.","debianbug":985671,"scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"5.5.1-2"},"fixed_version":"5.2-3","urgency":"not yet assigned"},"bullseye":{"status":"resolved","repositories":{"bullseye":"5.2-3"},"fixed_version":"5.2-3","urgency":"not yet assigned"},"forky":{"status":"resolved","repositories":{"forky":"6.1.1-2"},"fixed_version":"5.2-3","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"6.1.1-2"},"fixed_version":"5.2-3","urgency":"not yet assigned"},"trixie":{"status":"resolved","repositories":{"trixie":"6.0.1-1"},"fixed_version":"5.2-3","urgency":"not yet assigned"}}},"CVE-2020-28621":{"description":"Multiple code execution vulnerabilities exists in the Nef polygon-parsing functionality of CGAL libcgal CGAL-5.1.1. A specially crafted malformed file can lead to an out-of-bounds read and type confusion, which could lead to code execution. An attacker can provide malicious input to trigger any of these vulnerabilities. An oob read vulnerability exists in Nef_S2/SNC_io_parser.h SNC_io_parser<EW>::read_edge() eh->out_sedge().","debianbug":985671,"scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"5.5.1-2"},"fixed_version":"5.2-3","urgency":"not yet assigned"},"bullseye":{"status":"resolved","repositories":{"bullseye":"5.2-3"},"fixed_version":"5.2-3","urgency":"not yet assigned"},"forky":{"status":"resolved","repositories":{"forky":"6.1.1-2"},"fixed_version":"5.2-3","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"6.1.1-2"},"fixed_version":"5.2-3","urgency":"not yet assigned"},"trixie":{"status":"resolved","repositories":{"trixie":"6.0.1-1"},"fixed_version":"5.2-3","urgency":"not yet assigned"}}},"CVE-2020-28622":{"description":"Multiple code execution vulnerabilities exists in the Nef polygon-parsing functionality of CGAL libcgal CGAL-5.1.1. A specially crafted malformed file can lead to an out-of-bounds read and type confusion, which could lead to code execution. An attacker can provide malicious input to trigger any of these vulnerabilities. An oob read vulnerability exists in Nef_S2/SNC_io_parser.h SNC_io_parser<EW>::read_edge() eh->incident_sface().","debianbug":985671,"scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"5.5.1-2"},"fixed_version":"5.2-3","urgency":"not yet assigned"},"bullseye":{"status":"resolved","repositories":{"bullseye":"5.2-3"},"fixed_version":"5.2-3","urgency":"not yet assigned"},"forky":{"status":"resolved","repositories":{"forky":"6.1.1-2"},"fixed_version":"5.2-3","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"6.1.1-2"},"fixed_version":"5.2-3","urgency":"not yet assigned"},"trixie":{"status":"resolved","repositories":{"trixie":"6.0.1-1"},"fixed_version":"5.2-3","urgency":"not yet assigned"}}},"CVE-2020-28623":{"description":"Multiple code execution vulnerabilities exists in the Nef polygon-parsing functionality of CGAL libcgal CGAL-5.1.1. A specially crafted malformed file can lead to an out-of-bounds read and type confusion, which could lead to code execution. An attacker can provide malicious input to trigger any of these vulnerabilities. An oob read vulnerability exists in Nef_S2/SNC_io_parser.h SNC_io_parser<EW>::read_facet() fh->twin().","debianbug":985671,"scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"5.5.1-2"},"fixed_version":"5.2-3","urgency":"not yet assigned"},"bullseye":{"status":"resolved","repositories":{"bullseye":"5.2-3"},"fixed_version":"5.2-3","urgency":"not yet assigned"},"forky":{"status":"resolved","repositories":{"forky":"6.1.1-2"},"fixed_version":"5.2-3","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"6.1.1-2"},"fixed_version":"5.2-3","urgency":"not yet assigned"},"trixie":{"status":"resolved","repositories":{"trixie":"6.0.1-1"},"fixed_version":"5.2-3","urgency":"not yet assigned"}}},"CVE-2020-28624":{"description":"Multiple code execution vulnerabilities exists in the Nef polygon-parsing functionality of CGAL libcgal CGAL-5.1.1. A specially crafted malformed file can lead to an out-of-bounds read and type confusion, which could lead to code execution. An attacker can provide malicious input to trigger any of these vulnerabilities. An oob read vulnerability exists in Nef_S2/SNC_io_parser.h SNC_io_parser<EW>::read_facet() fh->boundary_entry_objects SEdge_of.","debianbug":985671,"scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"5.5.1-2"},"fixed_version":"5.2-3","urgency":"not yet assigned"},"bullseye":{"status":"resolved","repositories":{"bullseye":"5.2-3"},"fixed_version":"5.2-3","urgency":"not yet assigned"},"forky":{"status":"resolved","repositories":{"forky":"6.1.1-2"},"fixed_version":"5.2-3","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"6.1.1-2"},"fixed_version":"5.2-3","urgency":"not yet assigned"},"trixie":{"status":"resolved","repositories":{"trixie":"6.0.1-1"},"fixed_version":"5.2-3","urgency":"not yet assigned"}}},"CVE-2020-28625":{"description":"Multiple code execution vulnerabilities exists in the Nef polygon-parsing functionality of CGAL libcgal CGAL-5.1.1. A specially crafted malformed file can lead to an out-of-bounds read and type confusion, which could lead to code execution. An attacker can provide malicious input to trigger any of these vulnerabilities. An oob read vulnerability exists in Nef_S2/SNC_io_parser.h SNC_io_parser<EW>::read_facet() fh->boundary_entry_objects SLoop_of.","debianbug":985671,"scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"5.5.1-2"},"fixed_version":"5.2-3","urgency":"not yet assigned"},"bullseye":{"status":"resolved","repositories":{"bullseye":"5.2-3"},"fixed_version":"5.2-3","urgency":"not yet assigned"},"forky":{"status":"resolved","repositories":{"forky":"6.1.1-2"},"fixed_version":"5.2-3","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"6.1.1-2"},"fixed_version":"5.2-3","urgency":"not yet assigned"},"trixie":{"status":"resolved","repositories":{"trixie":"6.0.1-1"},"fixed_version":"5.2-3","urgency":"not yet assigned"}}},"CVE-2020-28626":{"description":"Multiple code execution vulnerabilities exists in the Nef polygon-parsing functionality of CGAL libcgal CGAL-5.1.1. A specially crafted malformed file can lead to an out-of-bounds read and type confusion, which could lead to code execution. An attacker can provide malicious input to trigger any of these vulnerabilities. An oob read vulnerability exists in Nef_S2/SNC_io_parser.h SNC_io_parser<EW>::read_facet() fh->incident_volume().","debianbug":985671,"scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"5.5.1-2"},"fixed_version":"5.2-3","urgency":"not yet assigned"},"bullseye":{"status":"resolved","repositories":{"bullseye":"5.2-3"},"fixed_version":"5.2-3","urgency":"not yet assigned"},"forky":{"status":"resolved","repositories":{"forky":"6.1.1-2"},"fixed_version":"5.2-3","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"6.1.1-2"},"fixed_version":"5.2-3","urgency":"not yet assigned"},"trixie":{"status":"resolved","repositories":{"trixie":"6.0.1-1"},"fixed_version":"5.2-3","urgency":"not yet assigned"}}},"CVE-2020-28627":{"description":"Multiple code execution vulnerabilities exists in the Nef polygon-parsing functionality of CGAL libcgal CGAL-5.1.1. A specially crafted malformed file can lead to an out-of-bounds read and type confusion, which could lead to code execution. An attacker can provide malicious input to trigger any of these vulnerabilities. An oob read vulnerability exists in Nef_S2/SNC_io_parser.h SNC_io_parser<EW>::read_volume() ch->shell_entry_objects().","debianbug":985671,"scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"5.5.1-2"},"fixed_version":"5.2-3","urgency":"not yet assigned"},"bullseye":{"status":"resolved","repositories":{"bullseye":"5.2-3"},"fixed_version":"5.2-3","urgency":"not yet assigned"},"forky":{"status":"resolved","repositories":{"forky":"6.1.1-2"},"fixed_version":"5.2-3","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"6.1.1-2"},"fixed_version":"5.2-3","urgency":"not yet assigned"},"trixie":{"status":"resolved","repositories":{"trixie":"6.0.1-1"},"fixed_version":"5.2-3","urgency":"not yet assigned"}}},"CVE-2020-28628":{"description":"Multiple code execution vulnerabilities exists in the Nef polygon-parsing functionality of CGAL libcgal CGAL-5.1.1. A specially crafted malformed file can lead to an out-of-bounds read and type confusion, which could lead to code execution. An attacker can provide malicious input to trigger any of these vulnerabilities. An oob read vulnerability exists in Nef_S2/SNC_io_parser.h SNC_io_parser<EW>::read_volume() seh->twin().","debianbug":985671,"scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"5.5.1-2"},"fixed_version":"5.2-3","urgency":"not yet assigned"},"bullseye":{"status":"resolved","repositories":{"bullseye":"5.2-3"},"fixed_version":"5.2-3","urgency":"not yet assigned"},"forky":{"status":"resolved","repositories":{"forky":"6.1.1-2"},"fixed_version":"5.2-3","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"6.1.1-2"},"fixed_version":"5.2-3","urgency":"not yet assigned"},"trixie":{"status":"resolved","repositories":{"trixie":"6.0.1-1"},"fixed_version":"5.2-3","urgency":"not yet assigned"}}},"CVE-2020-28629":{"description":"Multiple code execution vulnerabilities exists in the Nef polygon-parsing functionality of CGAL libcgal CGAL-5.1.1. A specially crafted malformed file can lead to an out-of-bounds read and type confusion, which could lead to code execution. An attacker can provide malicious input to trigger any of these vulnerabilities. An oob read vulnerability exists in Nef_S2/SNC_io_parser.h SNC_io_parser<EW>::read_sedge() seh->sprev().","debianbug":985671,"scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"5.5.1-2"},"fixed_version":"5.2-3","urgency":"not yet assigned"},"bullseye":{"status":"resolved","repositories":{"bullseye":"5.2-3"},"fixed_version":"5.2-3","urgency":"not yet assigned"},"forky":{"status":"resolved","repositories":{"forky":"6.1.1-2"},"fixed_version":"5.2-3","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"6.1.1-2"},"fixed_version":"5.2-3","urgency":"not yet assigned"},"trixie":{"status":"resolved","repositories":{"trixie":"6.0.1-1"},"fixed_version":"5.2-3","urgency":"not yet assigned"}}},"CVE-2020-28630":{"description":"Multiple code execution vulnerabilities exists in the Nef polygon-parsing functionality of CGAL libcgal CGAL-5.1.1. A specially crafted malformed file can lead to an out-of-bounds read and type confusion, which could lead to code execution. An attacker can provide malicious input to trigger any of these vulnerabilities. An oob read vulnerability exists in Nef_S2/SNC_io_parser.h SNC_io_parser<EW>::read_sedge() seh->snext().","debianbug":985671,"scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"5.5.1-2"},"fixed_version":"5.2-3","urgency":"not yet assigned"},"bullseye":{"status":"resolved","repositories":{"bullseye":"5.2-3"},"fixed_version":"5.2-3","urgency":"not yet assigned"},"forky":{"status":"resolved","repositories":{"forky":"6.1.1-2"},"fixed_version":"5.2-3","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"6.1.1-2"},"fixed_version":"5.2-3","urgency":"not yet assigned"},"trixie":{"status":"resolved","repositories":{"trixie":"6.0.1-1"},"fixed_version":"5.2-3","urgency":"not yet assigned"}}},"CVE-2020-28631":{"description":"Multiple code execution vulnerabilities exists in the Nef polygon-parsing functionality of CGAL libcgal CGAL-5.1.1. A specially crafted malformed file can lead to an out-of-bounds read and type confusion, which could lead to code execution. An attacker can provide malicious input to trigger any of these vulnerabilities. An oob read vulnerability exists in Nef_S2/SNC_io_parser.h SNC_io_parser<EW>::read_sedge() seh->source().","debianbug":985671,"scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"5.5.1-2"},"fixed_version":"5.2-3","urgency":"not yet assigned"},"bullseye":{"status":"resolved","repositories":{"bullseye":"5.2-3"},"fixed_version":"5.2-3","urgency":"not yet assigned"},"forky":{"status":"resolved","repositories":{"forky":"6.1.1-2"},"fixed_version":"5.2-3","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"6.1.1-2"},"fixed_version":"5.2-3","urgency":"not yet assigned"},"trixie":{"status":"resolved","repositories":{"trixie":"6.0.1-1"},"fixed_version":"5.2-3","urgency":"not yet assigned"}}},"CVE-2020-28632":{"description":"Multiple code execution vulnerabilities exists in the Nef polygon-parsing functionality of CGAL libcgal CGAL-5.1.1. A specially crafted malformed file can lead to an out-of-bounds read and type confusion, which could lead to code execution. An attacker can provide malicious input to trigger any of these vulnerabilities. An oob read vulnerability exists in Nef_S2/SNC_io_parser.h SNC_io_parser<EW>::read_sedge() seh->incident_sface().","debianbug":985671,"scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"5.5.1-2"},"fixed_version":"5.2-3","urgency":"not yet assigned"},"bullseye":{"status":"resolved","repositories":{"bullseye":"5.2-3"},"fixed_version":"5.2-3","urgency":"not yet assigned"},"forky":{"status":"resolved","repositories":{"forky":"6.1.1-2"},"fixed_version":"5.2-3","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"6.1.1-2"},"fixed_version":"5.2-3","urgency":"not yet assigned"},"trixie":{"status":"resolved","repositories":{"trixie":"6.0.1-1"},"fixed_version":"5.2-3","urgency":"not yet assigned"}}},"CVE-2020-28633":{"description":"Multiple code execution vulnerabilities exists in the Nef polygon-parsing functionality of CGAL libcgal CGAL-5.1.1. A specially crafted malformed file can lead to an out-of-bounds read and type confusion, which could lead to code execution. An attacker can provide malicious input to trigger any of these vulnerabilities. An oob read vulnerability exists in Nef_S2/SNC_io_parser.h SNC_io_parser<EW>::read_sedge() seh->prev().","debianbug":985671,"scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"5.5.1-2"},"fixed_version":"5.2-3","urgency":"not yet assigned"},"bullseye":{"status":"resolved","repositories":{"bullseye":"5.2-3"},"fixed_version":"5.2-3","urgency":"not yet assigned"},"forky":{"status":"resolved","repositories":{"forky":"6.1.1-2"},"fixed_version":"5.2-3","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"6.1.1-2"},"fixed_version":"5.2-3","urgency":"not yet assigned"},"trixie":{"status":"resolved","repositories":{"trixie":"6.0.1-1"},"fixed_version":"5.2-3","urgency":"not yet assigned"}}},"CVE-2020-28634":{"description":"Multiple code execution vulnerabilities exists in the Nef polygon-parsing functionality of CGAL libcgal CGAL-5.1.1. A specially crafted malformed file can lead to an out-of-bounds read and type confusion, which could lead to code execution. An attacker can provide malicious input to trigger any of these vulnerabilities. An oob read vulnerability exists in Nef_S2/SNC_io_parser.h SNC_io_parser<EW>::read_sedge() seh->next().","debianbug":985671,"scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"5.5.1-2"},"fixed_version":"5.2-3","urgency":"not yet assigned"},"bullseye":{"status":"resolved","repositories":{"bullseye":"5.2-3"},"fixed_version":"5.2-3","urgency":"not yet assigned"},"forky":{"status":"resolved","repositories":{"forky":"6.1.1-2"},"fixed_version":"5.2-3","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"6.1.1-2"},"fixed_version":"5.2-3","urgency":"not yet assigned"},"trixie":{"status":"resolved","repositories":{"trixie":"6.0.1-1"},"fixed_version":"5.2-3","urgency":"not yet assigned"}}},"CVE-2020-28635":{"description":"Multiple code execution vulnerabilities exists in the Nef polygon-parsing functionality of CGAL libcgal CGAL-5.1.1. A specially crafted malformed file can lead to an out-of-bounds read and type confusion, which could lead to code execution. An attacker can provide malicious input to trigger any of these vulnerabilities. An oob read vulnerability exists in Nef_S2/SNC_io_parser.h SNC_io_parser<EW>::read_sedge() seh->facet().","debianbug":985671,"scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"5.5.1-2"},"fixed_version":"5.2-3","urgency":"not yet assigned"},"bullseye":{"status":"resolved","repositories":{"bullseye":"5.2-3"},"fixed_version":"5.2-3","urgency":"not yet assigned"},"forky":{"status":"resolved","repositories":{"forky":"6.1.1-2"},"fixed_version":"5.2-3","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"6.1.1-2"},"fixed_version":"5.2-3","urgency":"not yet assigned"},"trixie":{"status":"resolved","repositories":{"trixie":"6.0.1-1"},"fixed_version":"5.2-3","urgency":"not yet assigned"}}},"CVE-2020-28636":{"description":"A code execution vulnerability exists in the Nef polygon-parsing functionality of CGAL libcgal CGAL-5.1.1. An oob read vulnerability exists in Nef_S2/SNC_io_parser.h SNC_io_parser::read_sloop() slh->twin() An attacker can provide malicious input to trigger this vulnerability.","debianbug":985671,"scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"5.5.1-2"},"fixed_version":"5.2-3","urgency":"not yet assigned"},"bullseye":{"status":"resolved","repositories":{"bullseye":"5.2-3"},"fixed_version":"5.2-3","urgency":"not yet assigned"},"forky":{"status":"resolved","repositories":{"forky":"6.1.1-2"},"fixed_version":"5.2-3","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"6.1.1-2"},"fixed_version":"5.2-3","urgency":"not yet assigned"},"trixie":{"status":"resolved","repositories":{"trixie":"6.0.1-1"},"fixed_version":"5.2-3","urgency":"not yet assigned"}}},"CVE-2020-35628":{"description":"A code execution vulnerability exists in the Nef polygon-parsing functionality of CGAL libcgal CGAL-5.1.1. An oob read vulnerability exists in Nef_S2/SNC_io_parser.h SNC_io_parser::read_sloop() slh->incident_sface. An attacker can provide malicious input to trigger this vulnerability.","debianbug":985671,"scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"5.5.1-2"},"fixed_version":"5.2-3","urgency":"not yet assigned"},"bullseye":{"status":"resolved","repositories":{"bullseye":"5.2-3"},"fixed_version":"5.2-3","urgency":"not yet assigned"},"forky":{"status":"resolved","repositories":{"forky":"6.1.1-2"},"fixed_version":"5.2-3","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"6.1.1-2"},"fixed_version":"5.2-3","urgency":"not yet assigned"},"trixie":{"status":"resolved","repositories":{"trixie":"6.0.1-1"},"fixed_version":"5.2-3","urgency":"not yet assigned"}}},"CVE-2020-35629":{"description":"Multiple code execution vulnerabilities exists in the Nef polygon-parsing functionality of CGAL libcgal CGAL-5.1.1. A specially crafted malformed file can lead to an out-of-bounds read and type confusion, which could lead to code execution. An attacker can provide malicious input to trigger any of these vulnerabilities. An oob read vulnerability exists in Nef_S2/SNC_io_parser.h SNC_io_parser<EW>::read_sloop() slh->facet().","debianbug":985671,"scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"5.5.1-2"},"fixed_version":"5.2-3","urgency":"not yet assigned"},"bullseye":{"status":"resolved","repositories":{"bullseye":"5.2-3"},"fixed_version":"5.2-3","urgency":"not yet assigned"},"forky":{"status":"resolved","repositories":{"forky":"6.1.1-2"},"fixed_version":"5.2-3","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"6.1.1-2"},"fixed_version":"5.2-3","urgency":"not yet assigned"},"trixie":{"status":"resolved","repositories":{"trixie":"6.0.1-1"},"fixed_version":"5.2-3","urgency":"not yet assigned"}}},"CVE-2020-35630":{"description":"Multiple code execution vulnerabilities exists in the Nef polygon-parsing functionality of CGAL libcgal CGAL-5.1.1. A specially crafted malformed file can lead to an out-of-bounds read and type confusion, which could lead to code execution. An attacker can provide malicious input to trigger any of these vulnerabilities. An oob read vulnerability exists in Nef_S2/SNC_io_parser.h SNC_io_parser<EW>::read_sface() sfh->center_vertex().","debianbug":985671,"scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"5.5.1-2"},"fixed_version":"5.2-3","urgency":"not yet assigned"},"bullseye":{"status":"resolved","repositories":{"bullseye":"5.2-3"},"fixed_version":"5.2-3","urgency":"not yet assigned"},"forky":{"status":"resolved","repositories":{"forky":"6.1.1-2"},"fixed_version":"5.2-3","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"6.1.1-2"},"fixed_version":"5.2-3","urgency":"not yet assigned"},"trixie":{"status":"resolved","repositories":{"trixie":"6.0.1-1"},"fixed_version":"5.2-3","urgency":"not yet assigned"}}},"CVE-2020-35631":{"description":"Multiple code execution vulnerabilities exists in the Nef polygon-parsing functionality of CGAL libcgal CGAL-5.1.1. A specially crafted malformed file can lead to an out-of-bounds read and type confusion, which could lead to code execution. An attacker can provide malicious input to trigger any of these vulnerabilities. An oob read vulnerability exists in Nef_S2/SNC_io_parser.h SNC_io_parser<EW>::read_sface() SD.link_as_face_cycle().","debianbug":985671,"scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"5.5.1-2"},"fixed_version":"5.2-3","urgency":"not yet assigned"},"bullseye":{"status":"resolved","repositories":{"bullseye":"5.2-3"},"fixed_version":"5.2-3","urgency":"not yet assigned"},"forky":{"status":"resolved","repositories":{"forky":"6.1.1-2"},"fixed_version":"5.2-3","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"6.1.1-2"},"fixed_version":"5.2-3","urgency":"not yet assigned"},"trixie":{"status":"resolved","repositories":{"trixie":"6.0.1-1"},"fixed_version":"5.2-3","urgency":"not yet assigned"}}},"CVE-2020-35632":{"description":"Multiple code execution vulnerabilities exists in the Nef polygon-parsing functionality of CGAL libcgal CGAL-5.1.1. A specially crafted malformed file can lead to an out-of-bounds read and type confusion, which could lead to code execution. An attacker can provide malicious input to trigger any of these vulnerabilities. An oob read vulnerability exists in Nef_S2/SNC_io_parser.h SNC_io_parser<EW>::read_sface() sfh->boundary_entry_objects Edge_of.","debianbug":985671,"scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"5.5.1-2"},"fixed_version":"5.2-3","urgency":"not yet assigned"},"bullseye":{"status":"resolved","repositories":{"bullseye":"5.2-3"},"fixed_version":"5.2-3","urgency":"not yet assigned"},"forky":{"status":"resolved","repositories":{"forky":"6.1.1-2"},"fixed_version":"5.2-3","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"6.1.1-2"},"fixed_version":"5.2-3","urgency":"not yet assigned"},"trixie":{"status":"resolved","repositories":{"trixie":"6.0.1-1"},"fixed_version":"5.2-3","urgency":"not yet assigned"}}},"CVE-2020-35633":{"description":"A code execution vulnerability exists in the Nef polygon-parsing functionality of CGAL libcgal CGAL-5.1.1. An oob read vulnerability exists in Nef_S2/SNC_io_parser.h SNC_io_parser<EW>::read_sface() store_sm_boundary_item() Edge_of.A specially crafted malformed file can lead to an out-of-bounds read and type confusion, which could lead to code execution. An attacker can provide malicious input to trigger this vulnerability.","debianbug":985671,"scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"5.5.1-2"},"fixed_version":"5.2-3","urgency":"not yet assigned"},"bullseye":{"status":"resolved","repositories":{"bullseye":"5.2-3"},"fixed_version":"5.2-3","urgency":"not yet assigned"},"forky":{"status":"resolved","repositories":{"forky":"6.1.1-2"},"fixed_version":"5.2-3","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"6.1.1-2"},"fixed_version":"5.2-3","urgency":"not yet assigned"},"trixie":{"status":"resolved","repositories":{"trixie":"6.0.1-1"},"fixed_version":"5.2-3","urgency":"not yet assigned"}}},"CVE-2020-35634":{"description":"A code execution vulnerability exists in the Nef polygon-parsing functionality of CGAL libcgal CGAL-5.1.1. An oob read vulnerability exists in Nef_S2/SNC_io_parser.h SNC_io_parser<EW>::read_sface() sfh->boundary_entry_objects Sloop_of. A specially crafted malformed file can lead to an out-of-bounds read and type confusion, which could lead to code execution. An attacker can provide malicious input to trigger this vulnerability.","debianbug":985671,"scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"5.5.1-2"},"fixed_version":"5.2-3","urgency":"not yet assigned"},"bullseye":{"status":"resolved","repositories":{"bullseye":"5.2-3"},"fixed_version":"5.2-3","urgency":"not yet assigned"},"forky":{"status":"resolved","repositories":{"forky":"6.1.1-2"},"fixed_version":"5.2-3","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"6.1.1-2"},"fixed_version":"5.2-3","urgency":"not yet assigned"},"trixie":{"status":"resolved","repositories":{"trixie":"6.0.1-1"},"fixed_version":"5.2-3","urgency":"not yet assigned"}}},"CVE-2020-35635":{"description":"A code execution vulnerability exists in the Nef polygon-parsing functionality of CGAL libcgal CGAL-5.1.1 in Nef_S2/SNC_io_parser.h SNC_io_parser::read_sface() store_sm_boundary_item() Sloop_of OOB read. A specially crafted malformed file can lead to an out-of-bounds read and type confusion, which could lead to code execution. An attacker can provide malicious input to trigger this vulnerability.","debianbug":985671,"scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"5.5.1-2"},"fixed_version":"5.2-3","urgency":"not yet assigned"},"bullseye":{"status":"resolved","repositories":{"bullseye":"5.2-3"},"fixed_version":"5.2-3","urgency":"not yet assigned"},"forky":{"status":"resolved","repositories":{"forky":"6.1.1-2"},"fixed_version":"5.2-3","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"6.1.1-2"},"fixed_version":"5.2-3","urgency":"not yet assigned"},"trixie":{"status":"resolved","repositories":{"trixie":"6.0.1-1"},"fixed_version":"5.2-3","urgency":"not yet assigned"}}},"CVE-2020-35636":{"description":"A code execution vulnerability exists in the Nef polygon-parsing functionality of CGAL libcgal CGAL-5.1.1 in Nef_S2/SNC_io_parser.h SNC_io_parser::read_sface() sfh->volume() OOB read. A specially crafted malformed file can lead to an out-of-bounds read and type confusion, which could lead to code execution. An attacker can provide malicious input to trigger this vulnerability.","debianbug":985671,"scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"5.5.1-2"},"fixed_version":"5.2-3","urgency":"not yet assigned"},"bullseye":{"status":"resolved","repositories":{"bullseye":"5.2-3"},"fixed_version":"5.2-3","urgency":"not yet assigned"},"forky":{"status":"resolved","repositories":{"forky":"6.1.1-2"},"fixed_version":"5.2-3","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"6.1.1-2"},"fixed_version":"5.2-3","urgency":"not yet assigned"},"trixie":{"status":"resolved","repositories":{"trixie":"6.0.1-1"},"fixed_version":"5.2-3","urgency":"not yet assigned"}}}},"cgit":{"CVE-2012-4465":{"description":"Heap-based buffer overflow in the substr function in parsing.c in cgit 0.9.0.3 and earlier allows remote authenticated users to cause a denial of service (crash) and possibly execute arbitrary code via an empty username in the \"Author\" field in a commit.","scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"1.2.3+git20221219.50.91f2590+git2.39.1-1"},"fixed_version":"0","urgency":"unimportant"},"bullseye":{"status":"resolved","repositories":{"bullseye":"1.2.3+git2.25.1-1"},"fixed_version":"0","urgency":"unimportant"},"forky":{"status":"resolved","repositories":{"forky":"1.2.3+git20250818.80.3346409+git2.51.0-1"},"fixed_version":"0","urgency":"unimportant"},"sid":{"status":"resolved","repositories":{"sid":"1.2.3+git20250818.80.3346409+git2.51.0-1"},"fixed_version":"0","urgency":"unimportant"},"trixie":{"status":"resolved","repositories":{"trixie":"1.2.3+git20240802.70.09d24d7+git2.46.0-1"},"fixed_version":"0","urgency":"unimportant"}}},"CVE-2012-4548":{"description":"Argument injection vulnerability in syntax-highlighting.sh in cgit 9.0.3 and earlier allows remote authenticated users with permissions to add files to execute arbitrary commands via the --plug-in argument to the highlight command.","scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"1.2.3+git20221219.50.91f2590+git2.39.1-1"},"fixed_version":"0","urgency":"unimportant"},"bullseye":{"status":"resolved","repositories":{"bullseye":"1.2.3+git2.25.1-1"},"fixed_version":"0","urgency":"unimportant"},"forky":{"status":"resolved","repositories":{"forky":"1.2.3+git20250818.80.3346409+git2.51.0-1"},"fixed_version":"0","urgency":"unimportant"},"sid":{"status":"resolved","repositories":{"sid":"1.2.3+git20250818.80.3346409+git2.51.0-1"},"fixed_version":"0","urgency":"unimportant"},"trixie":{"status":"resolved","repositories":{"trixie":"1.2.3+git20240802.70.09d24d7+git2.46.0-1"},"fixed_version":"0","urgency":"unimportant"}}},"CVE-2013-2117":{"description":"Directory traversal vulnerability in the cgit_parse_readme function in ui-summary.c in cgit before 0.9.2, when a readme file is set to a filesystem path, allows remote attackers to read arbitrary files via a .. (dot dot) in the url parameter.","scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"1.2.3+git20221219.50.91f2590+git2.39.1-1"},"fixed_version":"0","urgency":"unimportant"},"bullseye":{"status":"resolved","repositories":{"bullseye":"1.2.3+git2.25.1-1"},"fixed_version":"0","urgency":"unimportant"},"forky":{"status":"resolved","repositories":{"forky":"1.2.3+git20250818.80.3346409+git2.51.0-1"},"fixed_version":"0","urgency":"unimportant"},"sid":{"status":"resolved","repositories":{"sid":"1.2.3+git20250818.80.3346409+git2.51.0-1"},"fixed_version":"0","urgency":"unimportant"},"trixie":{"status":"resolved","repositories":{"trixie":"1.2.3+git20240802.70.09d24d7+git2.46.0-1"},"fixed_version":"0","urgency":"unimportant"}}},"CVE-2016-1899":{"description":"CRLF injection vulnerability in the ui-blob handler in CGit before 0.12 allows remote attackers to inject arbitrary HTTP headers and conduct HTTP response splitting attacks or cross-site scripting (XSS) attacks via CRLF sequences in the mimetype parameter, as demonstrated by a request to blob/cgit.c.","debianbug":812411,"scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"1.2.3+git20221219.50.91f2590+git2.39.1-1"},"fixed_version":"0.11.2.git2.3.2-1.1","urgency":"not yet assigned"},"bullseye":{"status":"resolved","repositories":{"bullseye":"1.2.3+git2.25.1-1"},"fixed_version":"0.11.2.git2.3.2-1.1","urgency":"not yet assigned"},"forky":{"status":"resolved","repositories":{"forky":"1.2.3+git20250818.80.3346409+git2.51.0-1"},"fixed_version":"0.11.2.git2.3.2-1.1","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"1.2.3+git20250818.80.3346409+git2.51.0-1"},"fixed_version":"0.11.2.git2.3.2-1.1","urgency":"not yet assigned"},"trixie":{"status":"resolved","repositories":{"trixie":"1.2.3+git20240802.70.09d24d7+git2.46.0-1"},"fixed_version":"0.11.2.git2.3.2-1.1","urgency":"not yet assigned"}}},"CVE-2016-1900":{"description":"CRLF injection vulnerability in the cgit_print_http_headers function in ui-shared.c in CGit before 0.12 allows remote attackers with permission to write to a repository to inject arbitrary HTTP headers and conduct HTTP response splitting attacks or cross-site scripting (XSS) attacks via newline characters in a filename.","debianbug":812411,"scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"1.2.3+git20221219.50.91f2590+git2.39.1-1"},"fixed_version":"0.11.2.git2.3.2-1.1","urgency":"not yet assigned"},"bullseye":{"status":"resolved","repositories":{"bullseye":"1.2.3+git2.25.1-1"},"fixed_version":"0.11.2.git2.3.2-1.1","urgency":"not yet assigned"},"forky":{"status":"resolved","repositories":{"forky":"1.2.3+git20250818.80.3346409+git2.51.0-1"},"fixed_version":"0.11.2.git2.3.2-1.1","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"1.2.3+git20250818.80.3346409+git2.51.0-1"},"fixed_version":"0.11.2.git2.3.2-1.1","urgency":"not yet assigned"},"trixie":{"status":"resolved","repositories":{"trixie":"1.2.3+git20240802.70.09d24d7+git2.46.0-1"},"fixed_version":"0.11.2.git2.3.2-1.1","urgency":"not yet assigned"}}},"CVE-2016-1901":{"description":"Integer overflow in the authenticate_post function in CGit before 0.12 allows remote attackers to have unspecified impact via a large value in the Content-Length HTTP header, which triggers a buffer overflow.","debianbug":812411,"scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"1.2.3+git20221219.50.91f2590+git2.39.1-1"},"fixed_version":"0.11.2.git2.3.2-1.1","urgency":"not yet assigned"},"bullseye":{"status":"resolved","repositories":{"bullseye":"1.2.3+git2.25.1-1"},"fixed_version":"0.11.2.git2.3.2-1.1","urgency":"not yet assigned"},"forky":{"status":"resolved","repositories":{"forky":"1.2.3+git20250818.80.3346409+git2.51.0-1"},"fixed_version":"0.11.2.git2.3.2-1.1","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"1.2.3+git20250818.80.3346409+git2.51.0-1"},"fixed_version":"0.11.2.git2.3.2-1.1","urgency":"not yet assigned"},"trixie":{"status":"resolved","repositories":{"trixie":"1.2.3+git20240802.70.09d24d7+git2.46.0-1"},"fixed_version":"0.11.2.git2.3.2-1.1","urgency":"not yet assigned"}}},"CVE-2016-2315":{"description":"revision.c in git before 2.7.4 uses an incorrect integer data type, which allows remote attackers to execute arbitrary code via a (1) long filename or (2) many nested trees, leading to a heap-based buffer overflow.","scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"1.2.3+git20221219.50.91f2590+git2.39.1-1"},"fixed_version":"0","urgency":"unimportant"},"bullseye":{"status":"resolved","repositories":{"bullseye":"1.2.3+git2.25.1-1"},"fixed_version":"0","urgency":"unimportant"},"forky":{"status":"resolved","repositories":{"forky":"1.2.3+git20250818.80.3346409+git2.51.0-1"},"fixed_version":"0","urgency":"unimportant"},"sid":{"status":"resolved","repositories":{"sid":"1.2.3+git20250818.80.3346409+git2.51.0-1"},"fixed_version":"0","urgency":"unimportant"},"trixie":{"status":"resolved","repositories":{"trixie":"1.2.3+git20240802.70.09d24d7+git2.46.0-1"},"fixed_version":"0","urgency":"unimportant"}}},"CVE-2016-2324":{"description":"Integer overflow in Git before 2.7.4 allows remote attackers to execute arbitrary code via a (1) long filename or (2) many nested trees, which triggers a heap-based buffer overflow.","scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"1.2.3+git20221219.50.91f2590+git2.39.1-1"},"fixed_version":"0","urgency":"unimportant"},"bullseye":{"status":"resolved","repositories":{"bullseye":"1.2.3+git2.25.1-1"},"fixed_version":"0","urgency":"unimportant"},"forky":{"status":"resolved","repositories":{"forky":"1.2.3+git20250818.80.3346409+git2.51.0-1"},"fixed_version":"0","urgency":"unimportant"},"sid":{"status":"resolved","repositories":{"sid":"1.2.3+git20250818.80.3346409+git2.51.0-1"},"fixed_version":"0","urgency":"unimportant"},"trixie":{"status":"resolved","repositories":{"trixie":"1.2.3+git20240802.70.09d24d7+git2.46.0-1"},"fixed_version":"0","urgency":"unimportant"}}},"CVE-2018-14912":{"description":"cgit_clone_objects in CGit before 1.2.1 has a directory traversal vulnerability when `enable-http-clone=1` is not turned off, as demonstrated by a cgit/cgit.cgi/git/objects/?path=../ request.","debianbug":905382,"scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"1.2.3+git20221219.50.91f2590+git2.39.1-1"},"fixed_version":"1.1+git2.10.2-3.1","urgency":"not yet assigned"},"bullseye":{"status":"resolved","repositories":{"bullseye":"1.2.3+git2.25.1-1"},"fixed_version":"1.1+git2.10.2-3.1","urgency":"not yet assigned"},"forky":{"status":"resolved","repositories":{"forky":"1.2.3+git20250818.80.3346409+git2.51.0-1"},"fixed_version":"1.1+git2.10.2-3.1","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"1.2.3+git20250818.80.3346409+git2.51.0-1"},"fixed_version":"1.1+git2.10.2-3.1","urgency":"not yet assigned"},"trixie":{"status":"resolved","repositories":{"trixie":"1.2.3+git20240802.70.09d24d7+git2.46.0-1"},"fixed_version":"1.1+git2.10.2-3.1","urgency":"not yet assigned"}}},"TEMP-0000000-1CC548":{"releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"1.2.3+git20221219.50.91f2590+git2.39.1-1"},"fixed_version":"0.12.0.git2.7.0-1","urgency":"not yet assigned"},"bullseye":{"status":"resolved","repositories":{"bullseye":"1.2.3+git2.25.1-1"},"fixed_version":"0.12.0.git2.7.0-1","urgency":"not yet assigned"},"forky":{"status":"resolved","repositories":{"forky":"1.2.3+git20250818.80.3346409+git2.51.0-1"},"fixed_version":"0.12.0.git2.7.0-1","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"1.2.3+git20250818.80.3346409+git2.51.0-1"},"fixed_version":"0.12.0.git2.7.0-1","urgency":"not yet assigned"},"trixie":{"status":"resolved","repositories":{"trixie":"1.2.3+git20240802.70.09d24d7+git2.46.0-1"},"fixed_version":"0.12.0.git2.7.0-1","urgency":"not yet assigned"}}}},"chafa":{"CVE-2022-1507":{"description":"chafa: NULL Pointer Dereference in function gif_internal_decode_frame at libnsgif.c:599 allows attackers to cause a denial of service (crash) via a crafted input file. in GitHub repository hpjansson/chafa prior to 1.10.2. chafa: NULL Pointer Dereference in function gif_internal_decode_frame at libnsgif.c:599 allows attackers to cause a denial of service (crash) via a crafted input file.","scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"1.12.4-1"},"fixed_version":"1.10.2-1","urgency":"unimportant"},"bullseye":{"status":"open","repositories":{"bullseye":"1.6.0-1"},"urgency":"unimportant"},"forky":{"status":"resolved","repositories":{"forky":"1.18.1-1"},"fixed_version":"1.10.2-1","urgency":"unimportant"},"sid":{"status":"resolved","repositories":{"sid":"1.18.1-1"},"fixed_version":"1.10.2-1","urgency":"unimportant"},"trixie":{"status":"resolved","repositories":{"trixie":"1.14.5-1"},"fixed_version":"1.10.2-1","urgency":"unimportant"}}},"CVE-2022-2061":{"description":"Heap-based Buffer Overflow in GitHub repository hpjansson/chafa prior to 1.12.0.","scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"1.12.4-1"},"fixed_version":"1.12.1-1","urgency":"unimportant"},"bullseye":{"status":"open","repositories":{"bullseye":"1.6.0-1"},"urgency":"unimportant"},"forky":{"status":"resolved","repositories":{"forky":"1.18.1-1"},"fixed_version":"1.12.1-1","urgency":"unimportant"},"sid":{"status":"resolved","repositories":{"sid":"1.18.1-1"},"fixed_version":"1.12.1-1","urgency":"unimportant"},"trixie":{"status":"resolved","repositories":{"trixie":"1.14.5-1"},"fixed_version":"1.12.1-1","urgency":"unimportant"}}},"CVE-2022-2301":{"description":"Buffer Over-read in GitHub repository hpjansson/chafa prior to 1.10.3.","scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"1.12.4-1"},"fixed_version":"1.10.3-1","urgency":"unimportant"},"bullseye":{"status":"open","repositories":{"bullseye":"1.6.0-1"},"urgency":"unimportant"},"forky":{"status":"resolved","repositories":{"forky":"1.18.1-1"},"fixed_version":"1.10.3-1","urgency":"unimportant"},"sid":{"status":"resolved","repositories":{"sid":"1.18.1-1"},"fixed_version":"1.10.3-1","urgency":"unimportant"},"trixie":{"status":"resolved","repositories":{"trixie":"1.14.5-1"},"fixed_version":"1.10.3-1","urgency":"unimportant"}}}},"changetrack":{"CVE-2009-3233":{"description":"changetrack 4.3 allows local users to execute arbitrary commands via CRLF sequences and shell metacharacters in a filename in a directory that is checked by changetrack.","debianbug":546791,"scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"4.7-8"},"fixed_version":"4.5-2","urgency":"medium"},"bullseye":{"status":"resolved","repositories":{"bullseye":"4.7-8"},"fixed_version":"4.5-2","urgency":"medium"},"forky":{"status":"resolved","repositories":{"forky":"4.7-10"},"fixed_version":"4.5-2","urgency":"medium"},"sid":{"status":"resolved","repositories":{"sid":"4.7-10"},"fixed_version":"4.5-2","urgency":"medium"},"trixie":{"status":"resolved","repositories":{"trixie":"4.7-9"},"fixed_version":"4.5-2","urgency":"medium"}}}},"chartkick.js":{"CVE-2019-18841":{"description":"Chartkick.js 3.1.0 through 3.1.3, as used in the Chartkick gem before 3.3.0 for Ruby, allows prototype pollution.","scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"4.1.0-2"},"fixed_version":"0","urgency":"unimportant"},"bullseye":{"status":"resolved","repositories":{"bullseye":"2.1.0-2.1"},"fixed_version":"0","urgency":"unimportant"},"forky":{"status":"resolved","repositories":{"forky":"4.1.0-2"},"fixed_version":"0","urgency":"unimportant"},"sid":{"status":"resolved","repositories":{"sid":"4.1.0-2"},"fixed_version":"0","urgency":"unimportant"},"trixie":{"status":"resolved","repositories":{"trixie":"4.1.0-2"},"fixed_version":"0","urgency":"unimportant"}}}},"chasen":{"CVE-2011-4000":{"description":"Buffer overflow in ChaSen 2.4.x allows remote attackers to execute arbitrary code via a crafted string.","debianbug":648359,"scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"2.4.5-44"},"fixed_version":"2.4.4-17","urgency":"medium"},"bullseye":{"status":"resolved","repositories":{"bullseye":"2.4.5-44"},"fixed_version":"2.4.4-17","urgency":"medium"},"forky":{"status":"resolved","repositories":{"forky":"2.4.5-46.1"},"fixed_version":"2.4.4-17","urgency":"medium"},"sid":{"status":"resolved","repositories":{"sid":"2.4.5-46.1"},"fixed_version":"2.4.4-17","urgency":"medium"},"trixie":{"status":"resolved","repositories":{"trixie":"2.4.5-46"},"fixed_version":"2.4.4-17","urgency":"medium"}}}},"chasquid":{"CVE-2023-52354":{"description":"chasquid before 1.13 allows SMTP smuggling because LF-terminated lines are accepted.","scope":"local","releases":{"bookworm":{"status":"open","repositories":{"bookworm":"1.11-2"},"urgency":"not yet assigned","nodsa":"Minor issue","nodsa_reason":""},"bullseye":{"status":"open","repositories":{"bullseye":"1.6-1"},"urgency":"not yet assigned","nodsa":"Minor issue","nodsa_reason":""},"forky":{"status":"resolved","repositories":{"forky":"1.16.0-1"},"fixed_version":"1.13-1","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"1.16.0-1"},"fixed_version":"1.13-1","urgency":"not yet assigned"},"trixie":{"status":"resolved","repositories":{"trixie":"1.15.0-1"},"fixed_version":"1.13-1","urgency":"not yet assigned"}}}},"checkinstall":{"CVE-2008-2958":{"description":"Race condition in (1) checkinstall 1.6.1 and (2) installwatch allows local users to overwrite arbitrary files and have other impacts via symlink and possibly other attacks on temporary working directories.","debianbug":488140,"scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"1.6.2+git20170426.d24a630-3"},"fixed_version":"1.6.1-7","urgency":"low"},"bullseye":{"status":"resolved","repositories":{"bullseye":"1.6.2+git20170426.d24a630-2"},"fixed_version":"1.6.1-7","urgency":"low"},"forky":{"status":"resolved","repositories":{"forky":"1.6.2+git20170426.d24a630-5.1"},"fixed_version":"1.6.1-7","urgency":"low"},"sid":{"status":"resolved","repositories":{"sid":"1.6.2+git20170426.d24a630-5.1"},"fixed_version":"1.6.1-7","urgency":"low"},"trixie":{"status":"resolved","repositories":{"trixie":"1.6.2+git20170426.d24a630-5.1"},"fixed_version":"1.6.1-7","urgency":"low"}}},"CVE-2020-25031":{"description":"checkinstall 1.6.2, when used to create a package that contains a symlink, may trigger the creation of a mode 0777 executable file.","scope":"local","releases":{"bookworm":{"status":"open","repositories":{"bookworm":"1.6.2+git20170426.d24a630-3"},"urgency":"unimportant"},"bullseye":{"status":"open","repositories":{"bullseye":"1.6.2+git20170426.d24a630-2"},"urgency":"unimportant"},"forky":{"status":"open","repositories":{"forky":"1.6.2+git20170426.d24a630-5.1"},"urgency":"unimportant"},"sid":{"status":"open","repositories":{"sid":"1.6.2+git20170426.d24a630-5.1"},"urgency":"unimportant"},"trixie":{"status":"open","repositories":{"trixie":"1.6.2+git20170426.d24a630-5.1"},"urgency":"unimportant"}}}},"checkpw":{"CVE-2015-0885":{"description":"checkpw 1.02 and earlier allows remote attackers to cause a denial of service (infinite loop) via a -- (dash dash) in a username.","debianbug":780139,"scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"1.02-3"},"fixed_version":"1.02-1.1","urgency":"not yet assigned"},"bullseye":{"status":"resolved","repositories":{"bullseye":"1.02-1.1"},"fixed_version":"1.02-1.1","urgency":"not yet assigned"},"trixie":{"status":"resolved","repositories":{"trixie":"1.02-5"},"fixed_version":"1.02-1.1","urgency":"not yet assigned"}}}},"checkstyle":{"CVE-2019-10782":{"description":"All versions of com.puppycrawl.tools:checkstyle before 8.29 are vulnerable to XML External Entity (XXE) Injection due to an incomplete fix for CVE-2019-9658.","scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"8.36.1-1"},"fixed_version":"8.29-1","urgency":"not yet assigned"},"bullseye":{"status":"resolved","repositories":{"bullseye":"8.36.1-1"},"fixed_version":"8.29-1","urgency":"not yet assigned"},"forky":{"status":"resolved","repositories":{"forky":"8.36.1-1"},"fixed_version":"8.29-1","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"8.36.1-1"},"fixed_version":"8.29-1","urgency":"not yet assigned"},"trixie":{"status":"resolved","repositories":{"trixie":"8.36.1-1"},"fixed_version":"8.29-1","urgency":"not yet assigned"}}},"CVE-2019-9658":{"description":"Checkstyle before 8.18 loads external DTDs by default.","debianbug":924598,"scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"8.36.1-1"},"fixed_version":"8.26-1","urgency":"low"},"bullseye":{"status":"resolved","repositories":{"bullseye":"8.36.1-1"},"fixed_version":"8.26-1","urgency":"low"},"forky":{"status":"resolved","repositories":{"forky":"8.36.1-1"},"fixed_version":"8.26-1","urgency":"low"},"sid":{"status":"resolved","repositories":{"sid":"8.36.1-1"},"fixed_version":"8.26-1","urgency":"low"},"trixie":{"status":"resolved","repositories":{"trixie":"8.36.1-1"},"fixed_version":"8.26-1","urgency":"low"}}}},"cheetah":{"CVE-2005-1632":{"description":"Cheetah 0.9.15 and 0.9.16 searches the /tmp directory for modules before using the paths in the PYTHONPATH variable, which allows local users to execute arbitrary code via a malicious module in /tmp/.","scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"3.3.1-1"},"fixed_version":"0.9.16-1","urgency":"not yet assigned"},"bullseye":{"status":"resolved","repositories":{"bullseye":"3.2.6-1"},"fixed_version":"0.9.16-1","urgency":"not yet assigned"},"forky":{"status":"resolved","repositories":{"forky":"3.4.0-1"},"fixed_version":"0.9.16-1","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"3.4.0-1"},"fixed_version":"0.9.16-1","urgency":"not yet assigned"},"trixie":{"status":"resolved","repositories":{"trixie":"3.4.0-1"},"fixed_version":"0.9.16-1","urgency":"not yet assigned"}}}},"cherrypy3":{"CVE-2008-0252":{"description":"Directory traversal vulnerability in the _get_file_path function in (1) lib/sessions.py in CherryPy 3.0.x up to 3.0.2, (2) filter/sessionfilter.py in CherryPy 2.1, and (3) filter/sessionfilter.py in CherryPy 2.x allows remote attackers to create or delete arbitrary files, and possibly read and write portions of arbitrary files, via a crafted session id in a cookie.","scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"18.8.0-2"},"fixed_version":"3.0.2-2","urgency":"not yet assigned"},"bullseye":{"status":"resolved","repositories":{"bullseye":"8.9.1-8"},"fixed_version":"3.0.2-2","urgency":"not yet assigned"},"forky":{"status":"resolved","repositories":{"forky":"18.10.0-2"},"fixed_version":"3.0.2-2","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"18.10.0-3"},"fixed_version":"3.0.2-2","urgency":"not yet assigned"},"trixie":{"status":"resolved","repositories":{"trixie":"18.10.0-1"},"fixed_version":"3.0.2-2","urgency":"not yet assigned"}}}},"cherrytree":{"CVE-2022-35133":{"description":"A cross-site scripting (XSS) vulnerability in CherryTree v0.99.30 allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the Name text field when creating a node.","scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"0.99.48+dfsg-1"},"fixed_version":"0","urgency":"unimportant"},"bullseye":{"status":"resolved","repositories":{"bullseye":"0.99.30+dfsg-1"},"fixed_version":"0","urgency":"unimportant"},"forky":{"status":"resolved","repositories":{"forky":"1.2.0+dfsg-1"},"fixed_version":"0","urgency":"unimportant"},"sid":{"status":"resolved","repositories":{"sid":"1.2.0+dfsg-1"},"fixed_version":"0","urgency":"unimportant"},"trixie":{"status":"resolved","repositories":{"trixie":"1.2.0+dfsg-1"},"fixed_version":"0","urgency":"unimportant"}}}},"chicken":{"CVE-2012-6122":{"description":"Buffer overflow in the thread scheduler in Chicken before 4.8.0.1 allows attackers to cause a denial of service (crash) by opening a file descriptor with a large integer value.","debianbug":702410,"scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"5.3.0-1"},"fixed_version":"4.8.0.3-1","urgency":"low"},"bullseye":{"status":"resolved","repositories":{"bullseye":"5.2.0-2"},"fixed_version":"4.8.0.3-1","urgency":"low"},"forky":{"status":"resolved","repositories":{"forky":"5.3.0-2"},"fixed_version":"4.8.0.3-1","urgency":"low"},"sid":{"status":"resolved","repositories":{"sid":"5.3.0-2"},"fixed_version":"4.8.0.3-1","urgency":"low"},"trixie":{"status":"resolved","repositories":{"trixie":"5.3.0-2"},"fixed_version":"4.8.0.3-1","urgency":"low"}}},"CVE-2012-6123":{"description":"Chicken before 4.8.0 does not properly handle NUL bytes in certain strings, which allows an attacker to conduct \"poisoned NUL byte attack.\"","debianbug":702410,"scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"5.3.0-1"},"fixed_version":"4.8.0-1","urgency":"low"},"bullseye":{"status":"resolved","repositories":{"bullseye":"5.2.0-2"},"fixed_version":"4.8.0-1","urgency":"low"},"forky":{"status":"resolved","repositories":{"forky":"5.3.0-2"},"fixed_version":"4.8.0-1","urgency":"low"},"sid":{"status":"resolved","repositories":{"sid":"5.3.0-2"},"fixed_version":"4.8.0-1","urgency":"low"},"trixie":{"status":"resolved","repositories":{"trixie":"5.3.0-2"},"fixed_version":"4.8.0-1","urgency":"low"}}},"CVE-2012-6124":{"description":"A casting error in Chicken before 4.8.0 on 64-bit platform caused the random number generator to return a constant value. NOTE: the vendor states \"This function wasn't used for security purposes (and is advertised as being unsuitable).\"","debianbug":702410,"scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"5.3.0-1"},"fixed_version":"4.8.0-1","urgency":"low"},"bullseye":{"status":"resolved","repositories":{"bullseye":"5.2.0-2"},"fixed_version":"4.8.0-1","urgency":"low"},"forky":{"status":"resolved","repositories":{"forky":"5.3.0-2"},"fixed_version":"4.8.0-1","urgency":"low"},"sid":{"status":"resolved","repositories":{"sid":"5.3.0-2"},"fixed_version":"4.8.0-1","urgency":"low"},"trixie":{"status":"resolved","repositories":{"trixie":"5.3.0-2"},"fixed_version":"4.8.0-1","urgency":"low"}}},"CVE-2012-6125":{"description":"Chicken before 4.8.0 is susceptible to algorithmic complexity attacks related to hash table collisions.","debianbug":702410,"scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"5.3.0-1"},"fixed_version":"4.8.0-1","urgency":"low"},"bullseye":{"status":"resolved","repositories":{"bullseye":"5.2.0-2"},"fixed_version":"4.8.0-1","urgency":"low"},"forky":{"status":"resolved","repositories":{"forky":"5.3.0-2"},"fixed_version":"4.8.0-1","urgency":"low"},"sid":{"status":"resolved","repositories":{"sid":"5.3.0-2"},"fixed_version":"4.8.0-1","urgency":"low"},"trixie":{"status":"resolved","repositories":{"trixie":"5.3.0-2"},"fixed_version":"4.8.0-1","urgency":"low"}}},"CVE-2013-1874":{"description":"Untrusted search path vulnerability in csi in Chicken before 4.8.2 allows local users to execute arbitrary code via a Trojan horse .csirc in the current working directory.","debianbug":702410,"scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"5.3.0-1"},"fixed_version":"4.8.0.3-1","urgency":"low"},"bullseye":{"status":"resolved","repositories":{"bullseye":"5.2.0-2"},"fixed_version":"4.8.0.3-1","urgency":"low"},"forky":{"status":"resolved","repositories":{"forky":"5.3.0-2"},"fixed_version":"4.8.0.3-1","urgency":"low"},"sid":{"status":"resolved","repositories":{"sid":"5.3.0-2"},"fixed_version":"4.8.0.3-1","urgency":"low"},"trixie":{"status":"resolved","repositories":{"trixie":"5.3.0-2"},"fixed_version":"4.8.0.3-1","urgency":"low"}}},"CVE-2013-2024":{"description":"OS command injection vulnerability in the \"qs\" procedure from the \"utils\" module in Chicken before 4.9.0.","debianbug":706525,"scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"5.3.0-1"},"fixed_version":"4.8.0.3-1","urgency":"not yet assigned"},"bullseye":{"status":"resolved","repositories":{"bullseye":"5.2.0-2"},"fixed_version":"4.8.0.3-1","urgency":"not yet assigned"},"forky":{"status":"resolved","repositories":{"forky":"5.3.0-2"},"fixed_version":"4.8.0.3-1","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"5.3.0-2"},"fixed_version":"4.8.0.3-1","urgency":"not yet assigned"},"trixie":{"status":"resolved","repositories":{"trixie":"5.3.0-2"},"fixed_version":"4.8.0.3-1","urgency":"not yet assigned"}}},"CVE-2013-2075":{"description":"Multiple buffer overflows in the (1) R5RS char-ready, (2) tcp-accept-ready, and (3) file-select procedures in Chicken through 4.8.0.3 allows attackers to cause a denial of service (crash) by opening a file descriptor with a large integer value. NOTE: this issue exists because of an incomplete fix for CVE-2012-6122.","scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"5.3.0-1"},"fixed_version":"0","urgency":"unimportant"},"bullseye":{"status":"resolved","repositories":{"bullseye":"5.2.0-2"},"fixed_version":"0","urgency":"unimportant"},"forky":{"status":"resolved","repositories":{"forky":"5.3.0-2"},"fixed_version":"0","urgency":"unimportant"},"sid":{"status":"resolved","repositories":{"sid":"5.3.0-2"},"fixed_version":"0","urgency":"unimportant"},"trixie":{"status":"resolved","repositories":{"trixie":"5.3.0-2"},"fixed_version":"0","urgency":"unimportant"}}},"CVE-2013-4385":{"description":"Buffer overflow in the \"read-string!\" procedure in the \"extras\" unit in CHICKEN stable before 4.8.0.5 and development snapshots before 4.8.3 allows remote attackers to cause a denial of service (memory corruption and application crash) and possibly execute arbitrary code via a \"#f\" value in the NUM argument.","debianbug":724740,"scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"5.3.0-1"},"fixed_version":"4.8.0.5-1","urgency":"low"},"bullseye":{"status":"resolved","repositories":{"bullseye":"5.2.0-2"},"fixed_version":"4.8.0.5-1","urgency":"low"},"forky":{"status":"resolved","repositories":{"forky":"5.3.0-2"},"fixed_version":"4.8.0.5-1","urgency":"low"},"sid":{"status":"resolved","repositories":{"sid":"5.3.0-2"},"fixed_version":"4.8.0.5-1","urgency":"low"},"trixie":{"status":"resolved","repositories":{"trixie":"5.3.0-2"},"fixed_version":"4.8.0.5-1","urgency":"low"}}},"CVE-2014-3776":{"description":"Buffer overflow in the \"read-u8vector!\" procedure in the srfi-4 unit in CHICKEN stable 4.8.0.7 and development snapshots before 4.9.1 allows remote attackers to cause a denial of service (memory corruption and application crash) and possibly execute arbitrary code via a \"#f\" value in the NUM argument.","debianbug":748904,"scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"5.3.0-1"},"fixed_version":"4.9.0-1","urgency":"not yet assigned"},"bullseye":{"status":"resolved","repositories":{"bullseye":"5.2.0-2"},"fixed_version":"4.9.0-1","urgency":"not yet assigned"},"forky":{"status":"resolved","repositories":{"forky":"5.3.0-2"},"fixed_version":"4.9.0-1","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"5.3.0-2"},"fixed_version":"4.9.0-1","urgency":"not yet assigned"},"trixie":{"status":"resolved","repositories":{"trixie":"5.3.0-2"},"fixed_version":"4.9.0-1","urgency":"not yet assigned"}}},"CVE-2014-6310":{"description":"Buffer overflow in CHICKEN 4.9.0 and 4.9.0.1 may allow remote attackers to execute arbitrary code via the 'select' function.","scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"5.3.0-1"},"fixed_version":"0","urgency":"unimportant"},"bullseye":{"status":"resolved","repositories":{"bullseye":"5.2.0-2"},"fixed_version":"0","urgency":"unimportant"},"forky":{"status":"resolved","repositories":{"forky":"5.3.0-2"},"fixed_version":"0","urgency":"unimportant"},"sid":{"status":"resolved","repositories":{"sid":"5.3.0-2"},"fixed_version":"0","urgency":"unimportant"},"trixie":{"status":"resolved","repositories":{"trixie":"5.3.0-2"},"fixed_version":"0","urgency":"unimportant"}}},"CVE-2014-9651":{"description":"Buffer overflow in CHICKEN 4.9.0.x before 4.9.0.2, 4.9.x before 4.9.1, and before 5.0 allows attackers to have unspecified impact via a positive START argument to the \"substring-index[-ci] procedures.\"","debianbug":775346,"scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"5.3.0-1"},"fixed_version":"4.10.0-1","urgency":"not yet assigned"},"bullseye":{"status":"resolved","repositories":{"bullseye":"5.2.0-2"},"fixed_version":"4.10.0-1","urgency":"not yet assigned"},"forky":{"status":"resolved","repositories":{"forky":"5.3.0-2"},"fixed_version":"4.10.0-1","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"5.3.0-2"},"fixed_version":"4.10.0-1","urgency":"not yet assigned"},"trixie":{"status":"resolved","repositories":{"trixie":"5.3.0-2"},"fixed_version":"4.10.0-1","urgency":"not yet assigned"}}},"CVE-2015-4556":{"description":"The string-translate* procedure in the data-structures unit in CHICKEN before 4.10.0 allows remote attackers to cause a denial of service (crash).","debianbug":788833,"scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"5.3.0-1"},"fixed_version":"4.10.0-1","urgency":"not yet assigned"},"bullseye":{"status":"resolved","repositories":{"bullseye":"5.2.0-2"},"fixed_version":"4.10.0-1","urgency":"not yet assigned"},"forky":{"status":"resolved","repositories":{"forky":"5.3.0-2"},"fixed_version":"4.10.0-1","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"5.3.0-2"},"fixed_version":"4.10.0-1","urgency":"not yet assigned"},"trixie":{"status":"resolved","repositories":{"trixie":"5.3.0-2"},"fixed_version":"4.10.0-1","urgency":"not yet assigned"}}},"CVE-2015-8235":{"description":"Directory traversal vulnerability in Spiffy before 5.4.","scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"5.3.0-1"},"fixed_version":"4.10.0-1","urgency":"not yet assigned"},"bullseye":{"status":"resolved","repositories":{"bullseye":"5.2.0-2"},"fixed_version":"4.10.0-1","urgency":"not yet assigned"},"forky":{"status":"resolved","repositories":{"forky":"5.3.0-2"},"fixed_version":"4.10.0-1","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"5.3.0-2"},"fixed_version":"4.10.0-1","urgency":"not yet assigned"},"trixie":{"status":"resolved","repositories":{"trixie":"5.3.0-2"},"fixed_version":"4.10.0-1","urgency":"not yet assigned"}}},"CVE-2016-6830":{"description":"The \"process-execute\" and \"process-spawn\" procedures in CHICKEN Scheme used fixed-size buffers for holding the arguments and environment variables to use in its execve() call. This would allow user-supplied argument/environment variable lists to trigger a buffer overrun. This affects all releases of CHICKEN up to and including 4.11 (it will be fixed in 4.12 and 5.0, which are not yet released).","debianbug":834845,"scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"5.3.0-1"},"fixed_version":"4.12.0-0.2","urgency":"not yet assigned"},"bullseye":{"status":"resolved","repositories":{"bullseye":"5.2.0-2"},"fixed_version":"4.12.0-0.2","urgency":"not yet assigned"},"forky":{"status":"resolved","repositories":{"forky":"5.3.0-2"},"fixed_version":"4.12.0-0.2","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"5.3.0-2"},"fixed_version":"4.12.0-0.2","urgency":"not yet assigned"},"trixie":{"status":"resolved","repositories":{"trixie":"5.3.0-2"},"fixed_version":"4.12.0-0.2","urgency":"not yet assigned"}}},"CVE-2016-6831":{"description":"The \"process-execute\" and \"process-spawn\" procedures did not free memory correctly when the execve() call failed, resulting in a memory leak. This could be abused by an attacker to cause resource exhaustion or a denial of service. This affects all releases of CHICKEN up to and including 4.11 (it will be fixed in 4.12 and 5.0, which are not yet released).","debianbug":834845,"scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"5.3.0-1"},"fixed_version":"4.12.0-0.2","urgency":"not yet assigned"},"bullseye":{"status":"resolved","repositories":{"bullseye":"5.2.0-2"},"fixed_version":"4.12.0-0.2","urgency":"not yet assigned"},"forky":{"status":"resolved","repositories":{"forky":"5.3.0-2"},"fixed_version":"4.12.0-0.2","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"5.3.0-2"},"fixed_version":"4.12.0-0.2","urgency":"not yet assigned"},"trixie":{"status":"resolved","repositories":{"trixie":"5.3.0-2"},"fixed_version":"4.12.0-0.2","urgency":"not yet assigned"}}},"CVE-2016-9954":{"description":"The backtrack compilation code in the Irregex package (aka IrRegular Expressions) before 0.9.6 for Scheme allows remote attackers to cause a denial of service (memory consumption) via a crafted regular expression with a repeating pattern.","debianbug":851278,"scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"5.3.0-1"},"fixed_version":"4.12.0-0.2","urgency":"low"},"bullseye":{"status":"resolved","repositories":{"bullseye":"5.2.0-2"},"fixed_version":"4.12.0-0.2","urgency":"low"},"forky":{"status":"resolved","repositories":{"forky":"5.3.0-2"},"fixed_version":"4.12.0-0.2","urgency":"low"},"sid":{"status":"resolved","repositories":{"sid":"5.3.0-2"},"fixed_version":"4.12.0-0.2","urgency":"low"},"trixie":{"status":"resolved","repositories":{"trixie":"5.3.0-2"},"fixed_version":"4.12.0-0.2","urgency":"low"}}},"CVE-2017-11343":{"description":"Due to an incomplete fix for CVE-2012-6125, all versions of CHICKEN Scheme up to and including 4.12.0 are vulnerable to an algorithmic complexity attack. An attacker can provide crafted input which, when inserted into the symbol table, will result in O(n) lookup time.","debianbug":870266,"scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"5.3.0-1"},"fixed_version":"4.12.0-0.2","urgency":"not yet assigned"},"bullseye":{"status":"resolved","repositories":{"bullseye":"5.2.0-2"},"fixed_version":"4.12.0-0.2","urgency":"not yet assigned"},"forky":{"status":"resolved","repositories":{"forky":"5.3.0-2"},"fixed_version":"4.12.0-0.2","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"5.3.0-2"},"fixed_version":"4.12.0-0.2","urgency":"not yet assigned"},"trixie":{"status":"resolved","repositories":{"trixie":"5.3.0-2"},"fixed_version":"4.12.0-0.2","urgency":"not yet assigned"}}},"CVE-2017-6949":{"description":"An issue was discovered in CHICKEN Scheme through 4.12.0. When using a nonstandard CHICKEN-specific extension to allocate an SRFI-4 vector in unmanaged memory, the vector size would be used in unsanitised form as an argument to malloc(). With an unexpected size, the impact may have been a segfault or buffer overflow.","debianbug":858057,"scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"5.3.0-1"},"fixed_version":"4.12.0-0.2","urgency":"not yet assigned"},"bullseye":{"status":"resolved","repositories":{"bullseye":"5.2.0-2"},"fixed_version":"4.12.0-0.2","urgency":"not yet assigned"},"forky":{"status":"resolved","repositories":{"forky":"5.3.0-2"},"fixed_version":"4.12.0-0.2","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"5.3.0-2"},"fixed_version":"4.12.0-0.2","urgency":"not yet assigned"},"trixie":{"status":"resolved","repositories":{"trixie":"5.3.0-2"},"fixed_version":"4.12.0-0.2","urgency":"not yet assigned"}}},"CVE-2017-9334":{"description":"An incorrect \"pair?\" check in the Scheme \"length\" procedure results in an unsafe pointer dereference in all CHICKEN Scheme versions prior to 4.13, which allows an attacker to cause a denial of service by passing an improper list to an application that calls \"length\" on it.","debianbug":863884,"scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"5.3.0-1"},"fixed_version":"4.12.0-0.2","urgency":"low"},"bullseye":{"status":"resolved","repositories":{"bullseye":"5.2.0-2"},"fixed_version":"4.12.0-0.2","urgency":"low"},"forky":{"status":"resolved","repositories":{"forky":"5.3.0-2"},"fixed_version":"4.12.0-0.2","urgency":"low"},"sid":{"status":"resolved","repositories":{"sid":"5.3.0-2"},"fixed_version":"4.12.0-0.2","urgency":"low"},"trixie":{"status":"resolved","repositories":{"trixie":"5.3.0-2"},"fixed_version":"4.12.0-0.2","urgency":"low"}}},"CVE-2022-45145":{"description":"egg-compile.scm in CHICKEN 5.x before 5.3.1 allows arbitrary OS command execution during package installation via escape characters in a .egg file.","scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"5.3.0-1"},"fixed_version":"0","urgency":"unimportant"},"bullseye":{"status":"resolved","repositories":{"bullseye":"5.2.0-2"},"fixed_version":"0","urgency":"unimportant"},"forky":{"status":"resolved","repositories":{"forky":"5.3.0-2"},"fixed_version":"0","urgency":"unimportant"},"sid":{"status":"resolved","repositories":{"sid":"5.3.0-2"},"fixed_version":"0","urgency":"unimportant"},"trixie":{"status":"resolved","repositories":{"trixie":"5.3.0-2"},"fixed_version":"0","urgency":"unimportant"}}}},"chkrootkit":{"CVE-2014-0476":{"description":"The slapper function in chkrootkit before 0.50 does not properly quote file paths, which allows local users to execute arbitrary code via a Trojan horse executable.  NOTE: this is only a vulnerability when /tmp is not mounted with the noexec option.","scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"0.57-2"},"fixed_version":"0.49-5","urgency":"not yet assigned"},"bullseye":{"status":"resolved","repositories":{"bullseye":"0.54-1"},"fixed_version":"0.49-5","urgency":"not yet assigned"},"forky":{"status":"resolved","repositories":{"forky":"0.58b-6"},"fixed_version":"0.49-5","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"0.58b-6"},"fixed_version":"0.49-5","urgency":"not yet assigned"},"trixie":{"status":"resolved","repositories":{"trixie":"0.58b-5"},"fixed_version":"0.49-5","urgency":"not yet assigned"}}}},"chmlib":{"CVE-2005-2659":{"description":"Buffer overflow in the LZX decompression in CHM Lib (chmlib) 0.35, as used in products such as KchmViewer, has unknown impact and attack vectors.","scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"2:0.40a-8"},"fixed_version":"0.37-2","urgency":"medium"},"bullseye":{"status":"resolved","repositories":{"bullseye":"2:0.40a-7"},"fixed_version":"0.37-2","urgency":"medium"},"forky":{"status":"resolved","repositories":{"forky":"2:0.40a-9"},"fixed_version":"0.37-2","urgency":"medium"},"sid":{"status":"resolved","repositories":{"sid":"2:0.40a-9"},"fixed_version":"0.37-2","urgency":"medium"},"trixie":{"status":"resolved","repositories":{"trixie":"2:0.40a-8.1"},"fixed_version":"0.37-2","urgency":"medium"}}},"CVE-2005-2930":{"description":"Stack-based buffer overflow in the _chm_find_in_PMGL function in chm_lib.c for chmlib before 0.36, as used in products such as KchmViewer, allows user-assisted attackers to execute arbitrary code via a CHM file containing a long element, a different vulnerability than CVE-2005-3318.","debianbug":327431,"scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"2:0.40a-8"},"fixed_version":"0.36-1","urgency":"medium"},"bullseye":{"status":"resolved","repositories":{"bullseye":"2:0.40a-7"},"fixed_version":"0.36-1","urgency":"medium"},"forky":{"status":"resolved","repositories":{"forky":"2:0.40a-9"},"fixed_version":"0.36-1","urgency":"medium"},"sid":{"status":"resolved","repositories":{"sid":"2:0.40a-9"},"fixed_version":"0.36-1","urgency":"medium"},"trixie":{"status":"resolved","repositories":{"trixie":"2:0.40a-8.1"},"fixed_version":"0.36-1","urgency":"medium"}}},"CVE-2005-3318":{"description":"Buffer overflow in the _chm_decompress_block function in CHM lib (chmlib) before 0.37, as used in products such as KchmViewer, allows attackers to execute arbitrary code, a different vulnerability than CVE-2005-2930.","debianbug":335931,"scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"2:0.40a-8"},"fixed_version":"0.37-1","urgency":"medium"},"bullseye":{"status":"resolved","repositories":{"bullseye":"2:0.40a-7"},"fixed_version":"0.37-1","urgency":"medium"},"forky":{"status":"resolved","repositories":{"forky":"2:0.40a-9"},"fixed_version":"0.37-1","urgency":"medium"},"sid":{"status":"resolved","repositories":{"sid":"2:0.40a-9"},"fixed_version":"0.37-1","urgency":"medium"},"trixie":{"status":"resolved","repositories":{"trixie":"2:0.40a-8.1"},"fixed_version":"0.37-1","urgency":"medium"}}},"CVE-2006-3178":{"description":"Directory traversal vulnerability in extract_chmLib example program in CHM Lib (chmlib) before 0.38 allows remote attackers to overwrite arbitrary files via a CHM archive containing files with a .. (dot dot) in their filename.","debianbug":374085,"scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"2:0.40a-8"},"fixed_version":"0.38-1","urgency":"low"},"bullseye":{"status":"resolved","repositories":{"bullseye":"2:0.40a-7"},"fixed_version":"0.38-1","urgency":"low"},"forky":{"status":"resolved","repositories":{"forky":"2:0.40a-9"},"fixed_version":"0.38-1","urgency":"low"},"sid":{"status":"resolved","repositories":{"sid":"2:0.40a-9"},"fixed_version":"0.38-1","urgency":"low"},"trixie":{"status":"resolved","repositories":{"trixie":"2:0.40a-8.1"},"fixed_version":"0.38-1","urgency":"low"}}},"CVE-2007-0619":{"description":"chmlib before 0.39 allows user-assisted remote attackers to execute arbitrary code via a crafted page block length in a CHM file, which triggers memory corruption.","debianbug":408603,"scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"2:0.40a-8"},"fixed_version":"2:0.39-1","urgency":"medium"},"bullseye":{"status":"resolved","repositories":{"bullseye":"2:0.40a-7"},"fixed_version":"2:0.39-1","urgency":"medium"},"forky":{"status":"resolved","repositories":{"forky":"2:0.40a-9"},"fixed_version":"2:0.39-1","urgency":"medium"},"sid":{"status":"resolved","repositories":{"sid":"2:0.40a-9"},"fixed_version":"2:0.39-1","urgency":"medium"},"trixie":{"status":"resolved","repositories":{"trixie":"2:0.40a-8.1"},"fixed_version":"2:0.39-1","urgency":"medium"}}},"CVE-2025-48172":{"description":"CHMLib through 2bef8d0, as used in SumatraPDF and other products, has a chm_lib.c _chm_decompress_block integer overflow. There is a resultant heap-based buffer overflow in _chm_fetch_bytes.","scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"2:0.40a-8"},"fixed_version":"0","urgency":"unimportant"},"bullseye":{"status":"resolved","repositories":{"bullseye":"2:0.40a-7"},"fixed_version":"0","urgency":"unimportant"},"forky":{"status":"resolved","repositories":{"forky":"2:0.40a-9"},"fixed_version":"0","urgency":"unimportant"},"sid":{"status":"resolved","repositories":{"sid":"2:0.40a-9"},"fixed_version":"0","urgency":"unimportant"},"trixie":{"status":"resolved","repositories":{"trixie":"2:0.40a-8.1"},"fixed_version":"0","urgency":"unimportant"}}}},"chocolate-doom":{"CVE-2020-14983":{"description":"The server in Chocolate Doom 3.0.0 and Crispy Doom 5.8.0 doesn't validate the user-controlled num_players value, leading to a buffer overflow. A malicious user can overwrite the server's stack.","scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"3.0.1+really3.0.0+git1471-1"},"fixed_version":"3.0.1-1","urgency":"not yet assigned"},"bullseye":{"status":"resolved","repositories":{"bullseye":"3.0.1-1"},"fixed_version":"3.0.1-1","urgency":"not yet assigned"},"forky":{"status":"resolved","repositories":{"forky":"3.1.1-1"},"fixed_version":"3.0.1-1","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"3.1.1-1"},"fixed_version":"3.0.1-1","urgency":"not yet assigned"},"trixie":{"status":"resolved","repositories":{"trixie":"3.1.0-1"},"fixed_version":"3.0.1-1","urgency":"not yet assigned"}}}},"chromium":{"CVE-2018-17480":{"description":"Execution of user supplied Javascript during array deserialization leading to an out of bounds write in V8 in Google Chrome prior to 71.0.3578.80 allowed a remote attacker to execute arbitrary code inside a sandbox via a crafted HTML page.","scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"143.0.7499.169-1~deb12u1","bookworm-security":"145.0.7632.159-1~deb12u1"},"fixed_version":"71.0.3578.80-1","urgency":"not yet assigned"},"bullseye":{"status":"resolved","repositories":{"bullseye":"120.0.6099.224-1~deb11u1","bullseye-security":"120.0.6099.224-1~deb11u1"},"fixed_version":"71.0.3578.80-1","urgency":"not yet assigned"},"forky":{"status":"resolved","repositories":{"forky":"145.0.7632.159-1"},"fixed_version":"71.0.3578.80-1","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"146.0.7680.71-1"},"fixed_version":"71.0.3578.80-1","urgency":"not yet assigned"},"trixie":{"status":"resolved","repositories":{"trixie":"143.0.7499.169-1~deb13u1","trixie-security":"145.0.7632.159-1~deb13u1"},"fixed_version":"71.0.3578.80-1","urgency":"not yet assigned"}}},"CVE-2018-17481":{"description":"Incorrect object lifecycle handling in PDFium in Google Chrome prior to 71.0.3578.98 allowed a remote attacker to potentially exploit heap corruption via a crafted PDF file.","scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"143.0.7499.169-1~deb12u1","bookworm-security":"145.0.7632.159-1~deb12u1"},"fixed_version":"71.0.3578.80-1","urgency":"not yet assigned"},"bullseye":{"status":"resolved","repositories":{"bullseye":"120.0.6099.224-1~deb11u1","bullseye-security":"120.0.6099.224-1~deb11u1"},"fixed_version":"71.0.3578.80-1","urgency":"not yet assigned"},"forky":{"status":"resolved","repositories":{"forky":"145.0.7632.159-1"},"fixed_version":"71.0.3578.80-1","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"146.0.7680.71-1"},"fixed_version":"71.0.3578.80-1","urgency":"not yet assigned"},"trixie":{"status":"resolved","repositories":{"trixie":"143.0.7499.169-1~deb13u1","trixie-security":"145.0.7632.159-1~deb13u1"},"fixed_version":"71.0.3578.80-1","urgency":"not yet assigned"}}},"CVE-2018-18335":{"description":"Heap buffer overflow in Skia in Google Chrome prior to 71.0.3578.80 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page.","scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"143.0.7499.169-1~deb12u1","bookworm-security":"145.0.7632.159-1~deb12u1"},"fixed_version":"71.0.3578.80-1","urgency":"not yet assigned"},"bullseye":{"status":"resolved","repositories":{"bullseye":"120.0.6099.224-1~deb11u1","bullseye-security":"120.0.6099.224-1~deb11u1"},"fixed_version":"71.0.3578.80-1","urgency":"not yet assigned"},"forky":{"status":"resolved","repositories":{"forky":"145.0.7632.159-1"},"fixed_version":"71.0.3578.80-1","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"146.0.7680.71-1"},"fixed_version":"71.0.3578.80-1","urgency":"not yet assigned"},"trixie":{"status":"resolved","repositories":{"trixie":"143.0.7499.169-1~deb13u1","trixie-security":"145.0.7632.159-1~deb13u1"},"fixed_version":"71.0.3578.80-1","urgency":"not yet assigned"}}},"CVE-2018-18336":{"description":"Incorrect object lifecycle in PDFium in Google Chrome prior to 71.0.3578.80 allowed a remote attacker to potentially exploit heap corruption via a crafted PDF file.","scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"143.0.7499.169-1~deb12u1","bookworm-security":"145.0.7632.159-1~deb12u1"},"fixed_version":"71.0.3578.80-1","urgency":"not yet assigned"},"bullseye":{"status":"resolved","repositories":{"bullseye":"120.0.6099.224-1~deb11u1","bullseye-security":"120.0.6099.224-1~deb11u1"},"fixed_version":"71.0.3578.80-1","urgency":"not yet assigned"},"forky":{"status":"resolved","repositories":{"forky":"145.0.7632.159-1"},"fixed_version":"71.0.3578.80-1","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"146.0.7680.71-1"},"fixed_version":"71.0.3578.80-1","urgency":"not yet assigned"},"trixie":{"status":"resolved","repositories":{"trixie":"143.0.7499.169-1~deb13u1","trixie-security":"145.0.7632.159-1~deb13u1"},"fixed_version":"71.0.3578.80-1","urgency":"not yet assigned"}}},"CVE-2018-18337":{"description":"Incorrect handling of stylesheets leading to a use after free in Blink in Google Chrome prior to 71.0.3578.80 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page.","scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"143.0.7499.169-1~deb12u1","bookworm-security":"145.0.7632.159-1~deb12u1"},"fixed_version":"71.0.3578.80-1","urgency":"not yet assigned"},"bullseye":{"status":"resolved","repositories":{"bullseye":"120.0.6099.224-1~deb11u1","bullseye-security":"120.0.6099.224-1~deb11u1"},"fixed_version":"71.0.3578.80-1","urgency":"not yet assigned"},"forky":{"status":"resolved","repositories":{"forky":"145.0.7632.159-1"},"fixed_version":"71.0.3578.80-1","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"146.0.7680.71-1"},"fixed_version":"71.0.3578.80-1","urgency":"not yet assigned"},"trixie":{"status":"resolved","repositories":{"trixie":"143.0.7499.169-1~deb13u1","trixie-security":"145.0.7632.159-1~deb13u1"},"fixed_version":"71.0.3578.80-1","urgency":"not yet assigned"}}},"CVE-2018-18338":{"description":"Incorrect, thread-unsafe use of SkImage in Canvas in Google Chrome prior to 71.0.3578.80 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page.","scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"143.0.7499.169-1~deb12u1","bookworm-security":"145.0.7632.159-1~deb12u1"},"fixed_version":"71.0.3578.80-1","urgency":"not yet assigned"},"bullseye":{"status":"resolved","repositories":{"bullseye":"120.0.6099.224-1~deb11u1","bullseye-security":"120.0.6099.224-1~deb11u1"},"fixed_version":"71.0.3578.80-1","urgency":"not yet assigned"},"forky":{"status":"resolved","repositories":{"forky":"145.0.7632.159-1"},"fixed_version":"71.0.3578.80-1","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"146.0.7680.71-1"},"fixed_version":"71.0.3578.80-1","urgency":"not yet assigned"},"trixie":{"status":"resolved","repositories":{"trixie":"143.0.7499.169-1~deb13u1","trixie-security":"145.0.7632.159-1~deb13u1"},"fixed_version":"71.0.3578.80-1","urgency":"not yet assigned"}}},"CVE-2018-18339":{"description":"Incorrect object lifecycle in WebAudio in Google Chrome prior to 71.0.3578.80 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page.","scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"143.0.7499.169-1~deb12u1","bookworm-security":"145.0.7632.159-1~deb12u1"},"fixed_version":"71.0.3578.80-1","urgency":"not yet assigned"},"bullseye":{"status":"resolved","repositories":{"bullseye":"120.0.6099.224-1~deb11u1","bullseye-security":"120.0.6099.224-1~deb11u1"},"fixed_version":"71.0.3578.80-1","urgency":"not yet assigned"},"forky":{"status":"resolved","repositories":{"forky":"145.0.7632.159-1"},"fixed_version":"71.0.3578.80-1","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"146.0.7680.71-1"},"fixed_version":"71.0.3578.80-1","urgency":"not yet assigned"},"trixie":{"status":"resolved","repositories":{"trixie":"143.0.7499.169-1~deb13u1","trixie-security":"145.0.7632.159-1~deb13u1"},"fixed_version":"71.0.3578.80-1","urgency":"not yet assigned"}}},"CVE-2018-18340":{"description":"Incorrect object lifecycle in MediaRecorder in Google Chrome prior to 71.0.3578.80 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page.","scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"143.0.7499.169-1~deb12u1","bookworm-security":"145.0.7632.159-1~deb12u1"},"fixed_version":"71.0.3578.80-1","urgency":"not yet assigned"},"bullseye":{"status":"resolved","repositories":{"bullseye":"120.0.6099.224-1~deb11u1","bullseye-security":"120.0.6099.224-1~deb11u1"},"fixed_version":"71.0.3578.80-1","urgency":"not yet assigned"},"forky":{"status":"resolved","repositories":{"forky":"145.0.7632.159-1"},"fixed_version":"71.0.3578.80-1","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"146.0.7680.71-1"},"fixed_version":"71.0.3578.80-1","urgency":"not yet assigned"},"trixie":{"status":"resolved","repositories":{"trixie":"143.0.7499.169-1~deb13u1","trixie-security":"145.0.7632.159-1~deb13u1"},"fixed_version":"71.0.3578.80-1","urgency":"not yet assigned"}}},"CVE-2018-18341":{"description":"An integer overflow leading to a heap buffer overflow in Blink in Google Chrome prior to 71.0.3578.80 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page.","scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"143.0.7499.169-1~deb12u1","bookworm-security":"145.0.7632.159-1~deb12u1"},"fixed_version":"71.0.3578.80-1","urgency":"not yet assigned"},"bullseye":{"status":"resolved","repositories":{"bullseye":"120.0.6099.224-1~deb11u1","bullseye-security":"120.0.6099.224-1~deb11u1"},"fixed_version":"71.0.3578.80-1","urgency":"not yet assigned"},"forky":{"status":"resolved","repositories":{"forky":"145.0.7632.159-1"},"fixed_version":"71.0.3578.80-1","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"146.0.7680.71-1"},"fixed_version":"71.0.3578.80-1","urgency":"not yet assigned"},"trixie":{"status":"resolved","repositories":{"trixie":"143.0.7499.169-1~deb13u1","trixie-security":"145.0.7632.159-1~deb13u1"},"fixed_version":"71.0.3578.80-1","urgency":"not yet assigned"}}},"CVE-2018-18342":{"description":"Execution of user supplied Javascript during object deserialization can update object length leading to an out of bounds write in V8 in Google Chrome prior to 71.0.3578.80 allowed a remote attacker to execute arbitrary code inside a sandbox via a crafted HTML page.","scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"143.0.7499.169-1~deb12u1","bookworm-security":"145.0.7632.159-1~deb12u1"},"fixed_version":"71.0.3578.80-1","urgency":"not yet assigned"},"bullseye":{"status":"resolved","repositories":{"bullseye":"120.0.6099.224-1~deb11u1","bullseye-security":"120.0.6099.224-1~deb11u1"},"fixed_version":"71.0.3578.80-1","urgency":"not yet assigned"},"forky":{"status":"resolved","repositories":{"forky":"145.0.7632.159-1"},"fixed_version":"71.0.3578.80-1","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"146.0.7680.71-1"},"fixed_version":"71.0.3578.80-1","urgency":"not yet assigned"},"trixie":{"status":"resolved","repositories":{"trixie":"143.0.7499.169-1~deb13u1","trixie-security":"145.0.7632.159-1~deb13u1"},"fixed_version":"71.0.3578.80-1","urgency":"not yet assigned"}}},"CVE-2018-18343":{"description":"Incorrect handing of paths leading to a use after free in Skia in Google Chrome prior to 71.0.3578.80 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page.","scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"143.0.7499.169-1~deb12u1","bookworm-security":"145.0.7632.159-1~deb12u1"},"fixed_version":"71.0.3578.80-1","urgency":"not yet assigned"},"bullseye":{"status":"resolved","repositories":{"bullseye":"120.0.6099.224-1~deb11u1","bullseye-security":"120.0.6099.224-1~deb11u1"},"fixed_version":"71.0.3578.80-1","urgency":"not yet assigned"},"forky":{"status":"resolved","repositories":{"forky":"145.0.7632.159-1"},"fixed_version":"71.0.3578.80-1","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"146.0.7680.71-1"},"fixed_version":"71.0.3578.80-1","urgency":"not yet assigned"},"trixie":{"status":"resolved","repositories":{"trixie":"143.0.7499.169-1~deb13u1","trixie-security":"145.0.7632.159-1~deb13u1"},"fixed_version":"71.0.3578.80-1","urgency":"not yet assigned"}}},"CVE-2018-18344":{"description":"Inappropriate allowance of the setDownloadBehavior devtools protocol feature in Extensions in Google Chrome prior to 71.0.3578.80 allowed a remote attacker with control of an installed extension to access files on the local file system via a crafted Chrome Extension.","scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"143.0.7499.169-1~deb12u1","bookworm-security":"145.0.7632.159-1~deb12u1"},"fixed_version":"71.0.3578.80-1","urgency":"not yet assigned"},"bullseye":{"status":"resolved","repositories":{"bullseye":"120.0.6099.224-1~deb11u1","bullseye-security":"120.0.6099.224-1~deb11u1"},"fixed_version":"71.0.3578.80-1","urgency":"not yet assigned"},"forky":{"status":"resolved","repositories":{"forky":"145.0.7632.159-1"},"fixed_version":"71.0.3578.80-1","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"146.0.7680.71-1"},"fixed_version":"71.0.3578.80-1","urgency":"not yet assigned"},"trixie":{"status":"resolved","repositories":{"trixie":"143.0.7499.169-1~deb13u1","trixie-security":"145.0.7632.159-1~deb13u1"},"fixed_version":"71.0.3578.80-1","urgency":"not yet assigned"}}},"CVE-2018-18345":{"description":"Incorrect handling of blob URLS in Site Isolation in Google Chrome prior to 71.0.3578.80 allowed a remote attacker who had compromised the renderer process to bypass site isolation protections via a crafted HTML page.","scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"143.0.7499.169-1~deb12u1","bookworm-security":"145.0.7632.159-1~deb12u1"},"fixed_version":"71.0.3578.80-1","urgency":"not yet assigned"},"bullseye":{"status":"resolved","repositories":{"bullseye":"120.0.6099.224-1~deb11u1","bullseye-security":"120.0.6099.224-1~deb11u1"},"fixed_version":"71.0.3578.80-1","urgency":"not yet assigned"},"forky":{"status":"resolved","repositories":{"forky":"145.0.7632.159-1"},"fixed_version":"71.0.3578.80-1","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"146.0.7680.71-1"},"fixed_version":"71.0.3578.80-1","urgency":"not yet assigned"},"trixie":{"status":"resolved","repositories":{"trixie":"143.0.7499.169-1~deb13u1","trixie-security":"145.0.7632.159-1~deb13u1"},"fixed_version":"71.0.3578.80-1","urgency":"not yet assigned"}}},"CVE-2018-18346":{"description":"Incorrect handling of alert box display in Blink in Google Chrome prior to 71.0.3578.80 allowed a remote attacker to present confusing browser UI via a crafted HTML page.","scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"143.0.7499.169-1~deb12u1","bookworm-security":"145.0.7632.159-1~deb12u1"},"fixed_version":"71.0.3578.80-1","urgency":"not yet assigned"},"bullseye":{"status":"resolved","repositories":{"bullseye":"120.0.6099.224-1~deb11u1","bullseye-security":"120.0.6099.224-1~deb11u1"},"fixed_version":"71.0.3578.80-1","urgency":"not yet assigned"},"forky":{"status":"resolved","repositories":{"forky":"145.0.7632.159-1"},"fixed_version":"71.0.3578.80-1","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"146.0.7680.71-1"},"fixed_version":"71.0.3578.80-1","urgency":"not yet assigned"},"trixie":{"status":"resolved","repositories":{"trixie":"143.0.7499.169-1~deb13u1","trixie-security":"145.0.7632.159-1~deb13u1"},"fixed_version":"71.0.3578.80-1","urgency":"not yet assigned"}}},"CVE-2018-18347":{"description":"Incorrect handling of failed navigations with invalid URLs in Navigation in Google Chrome prior to 71.0.3578.80 allowed a remote attacker to trick a user into executing javascript in an arbitrary origin via a crafted HTML page.","scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"143.0.7499.169-1~deb12u1","bookworm-security":"145.0.7632.159-1~deb12u1"},"fixed_version":"71.0.3578.80-1","urgency":"not yet assigned"},"bullseye":{"status":"resolved","repositories":{"bullseye":"120.0.6099.224-1~deb11u1","bullseye-security":"120.0.6099.224-1~deb11u1"},"fixed_version":"71.0.3578.80-1","urgency":"not yet assigned"},"forky":{"status":"resolved","repositories":{"forky":"145.0.7632.159-1"},"fixed_version":"71.0.3578.80-1","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"146.0.7680.71-1"},"fixed_version":"71.0.3578.80-1","urgency":"not yet assigned"},"trixie":{"status":"resolved","repositories":{"trixie":"143.0.7499.169-1~deb13u1","trixie-security":"145.0.7632.159-1~deb13u1"},"fixed_version":"71.0.3578.80-1","urgency":"not yet assigned"}}},"CVE-2018-18348":{"description":"Incorrect handling of bidirectional domain names with RTL characters in Omnibox in Google Chrome prior to 71.0.3578.80 allowed a remote attacker to spoof the contents of the Omnibox (URL bar) via a crafted domain name.","scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"143.0.7499.169-1~deb12u1","bookworm-security":"145.0.7632.159-1~deb12u1"},"fixed_version":"71.0.3578.80-1","urgency":"not yet assigned"},"bullseye":{"status":"resolved","repositories":{"bullseye":"120.0.6099.224-1~deb11u1","bullseye-security":"120.0.6099.224-1~deb11u1"},"fixed_version":"71.0.3578.80-1","urgency":"not yet assigned"},"forky":{"status":"resolved","repositories":{"forky":"145.0.7632.159-1"},"fixed_version":"71.0.3578.80-1","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"146.0.7680.71-1"},"fixed_version":"71.0.3578.80-1","urgency":"not yet assigned"},"trixie":{"status":"resolved","repositories":{"trixie":"143.0.7499.169-1~deb13u1","trixie-security":"145.0.7632.159-1~deb13u1"},"fixed_version":"71.0.3578.80-1","urgency":"not yet assigned"}}},"CVE-2018-18349":{"description":"Remote frame navigations was incorrectly permitted to local resources in Blink in Google Chrome prior to 71.0.3578.80 allowed an attacker who convinced a user to install a malicious extension to access files on the local file system via a crafted Chrome Extension.","scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"143.0.7499.169-1~deb12u1","bookworm-security":"145.0.7632.159-1~deb12u1"},"fixed_version":"71.0.3578.80-1","urgency":"not yet assigned"},"bullseye":{"status":"resolved","repositories":{"bullseye":"120.0.6099.224-1~deb11u1","bullseye-security":"120.0.6099.224-1~deb11u1"},"fixed_version":"71.0.3578.80-1","urgency":"not yet assigned"},"forky":{"status":"resolved","repositories":{"forky":"145.0.7632.159-1"},"fixed_version":"71.0.3578.80-1","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"146.0.7680.71-1"},"fixed_version":"71.0.3578.80-1","urgency":"not yet assigned"},"trixie":{"status":"resolved","repositories":{"trixie":"143.0.7499.169-1~deb13u1","trixie-security":"145.0.7632.159-1~deb13u1"},"fixed_version":"71.0.3578.80-1","urgency":"not yet assigned"}}},"CVE-2018-18350":{"description":"Incorrect handling of CSP enforcement during navigations in Blink in Google Chrome prior to 71.0.3578.80 allowed a remote attacker to bypass content security policy via a crafted HTML page.","scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"143.0.7499.169-1~deb12u1","bookworm-security":"145.0.7632.159-1~deb12u1"},"fixed_version":"71.0.3578.80-1","urgency":"not yet assigned"},"bullseye":{"status":"resolved","repositories":{"bullseye":"120.0.6099.224-1~deb11u1","bullseye-security":"120.0.6099.224-1~deb11u1"},"fixed_version":"71.0.3578.80-1","urgency":"not yet assigned"},"forky":{"status":"resolved","repositories":{"forky":"145.0.7632.159-1"},"fixed_version":"71.0.3578.80-1","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"146.0.7680.71-1"},"fixed_version":"71.0.3578.80-1","urgency":"not yet assigned"},"trixie":{"status":"resolved","repositories":{"trixie":"143.0.7499.169-1~deb13u1","trixie-security":"145.0.7632.159-1~deb13u1"},"fixed_version":"71.0.3578.80-1","urgency":"not yet assigned"}}},"CVE-2018-18351":{"description":"Lack of proper validation of ancestor frames site when sending lax cookies in Navigation in Google Chrome prior to 71.0.3578.80 allowed a remote attacker to bypass SameSite cookie policy via a crafted HTML page.","scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"143.0.7499.169-1~deb12u1","bookworm-security":"145.0.7632.159-1~deb12u1"},"fixed_version":"71.0.3578.80-1","urgency":"not yet assigned"},"bullseye":{"status":"resolved","repositories":{"bullseye":"120.0.6099.224-1~deb11u1","bullseye-security":"120.0.6099.224-1~deb11u1"},"fixed_version":"71.0.3578.80-1","urgency":"not yet assigned"},"forky":{"status":"resolved","repositories":{"forky":"145.0.7632.159-1"},"fixed_version":"71.0.3578.80-1","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"146.0.7680.71-1"},"fixed_version":"71.0.3578.80-1","urgency":"not yet assigned"},"trixie":{"status":"resolved","repositories":{"trixie":"143.0.7499.169-1~deb13u1","trixie-security":"145.0.7632.159-1~deb13u1"},"fixed_version":"71.0.3578.80-1","urgency":"not yet assigned"}}},"CVE-2018-18352":{"description":"Service works could inappropriately gain access to cross origin audio in Media in Google Chrome prior to 71.0.3578.80 allowed a remote attacker to bypass same origin policy for audio content via a crafted HTML page.","scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"143.0.7499.169-1~deb12u1","bookworm-security":"145.0.7632.159-1~deb12u1"},"fixed_version":"71.0.3578.80-1","urgency":"not yet assigned"},"bullseye":{"status":"resolved","repositories":{"bullseye":"120.0.6099.224-1~deb11u1","bullseye-security":"120.0.6099.224-1~deb11u1"},"fixed_version":"71.0.3578.80-1","urgency":"not yet assigned"},"forky":{"status":"resolved","repositories":{"forky":"145.0.7632.159-1"},"fixed_version":"71.0.3578.80-1","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"146.0.7680.71-1"},"fixed_version":"71.0.3578.80-1","urgency":"not yet assigned"},"trixie":{"status":"resolved","repositories":{"trixie":"143.0.7499.169-1~deb13u1","trixie-security":"145.0.7632.159-1~deb13u1"},"fixed_version":"71.0.3578.80-1","urgency":"not yet assigned"}}},"CVE-2018-18353":{"description":"Failure to dismiss http auth dialogs on navigation in Network Authentication in Google Chrome on Android prior to 71.0.3578.80 allowed a remote attacker to confuse the user about the origin of an auto dialog via a crafted HTML page.","scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"143.0.7499.169-1~deb12u1","bookworm-security":"145.0.7632.159-1~deb12u1"},"fixed_version":"71.0.3578.80-1","urgency":"not yet assigned"},"bullseye":{"status":"resolved","repositories":{"bullseye":"120.0.6099.224-1~deb11u1","bullseye-security":"120.0.6099.224-1~deb11u1"},"fixed_version":"71.0.3578.80-1","urgency":"not yet assigned"},"forky":{"status":"resolved","repositories":{"forky":"145.0.7632.159-1"},"fixed_version":"71.0.3578.80-1","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"146.0.7680.71-1"},"fixed_version":"71.0.3578.80-1","urgency":"not yet assigned"},"trixie":{"status":"resolved","repositories":{"trixie":"143.0.7499.169-1~deb13u1","trixie-security":"145.0.7632.159-1~deb13u1"},"fixed_version":"71.0.3578.80-1","urgency":"not yet assigned"}}},"CVE-2018-18354":{"description":"Insufficient validate of external protocols in Shell Integration in Google Chrome on Windows prior to 71.0.3578.80 allowed a remote attacker to launch external programs via a crafted HTML page.","scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"143.0.7499.169-1~deb12u1","bookworm-security":"145.0.7632.159-1~deb12u1"},"fixed_version":"71.0.3578.80-1","urgency":"not yet assigned"},"bullseye":{"status":"resolved","repositories":{"bullseye":"120.0.6099.224-1~deb11u1","bullseye-security":"120.0.6099.224-1~deb11u1"},"fixed_version":"71.0.3578.80-1","urgency":"not yet assigned"},"forky":{"status":"resolved","repositories":{"forky":"145.0.7632.159-1"},"fixed_version":"71.0.3578.80-1","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"146.0.7680.71-1"},"fixed_version":"71.0.3578.80-1","urgency":"not yet assigned"},"trixie":{"status":"resolved","repositories":{"trixie":"143.0.7499.169-1~deb13u1","trixie-security":"145.0.7632.159-1~deb13u1"},"fixed_version":"71.0.3578.80-1","urgency":"not yet assigned"}}},"CVE-2018-18355":{"description":"Incorrect handling of confusable characters in URL Formatter in Google Chrome prior to 71.0.3578.80 allowed a remote attacker to spoof the contents of the Omnibox (URL bar) via a crafted domain name.","scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"143.0.7499.169-1~deb12u1","bookworm-security":"145.0.7632.159-1~deb12u1"},"fixed_version":"71.0.3578.80-1","urgency":"not yet assigned"},"bullseye":{"status":"resolved","repositories":{"bullseye":"120.0.6099.224-1~deb11u1","bullseye-security":"120.0.6099.224-1~deb11u1"},"fixed_version":"71.0.3578.80-1","urgency":"not yet assigned"},"forky":{"status":"resolved","repositories":{"forky":"145.0.7632.159-1"},"fixed_version":"71.0.3578.80-1","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"146.0.7680.71-1"},"fixed_version":"71.0.3578.80-1","urgency":"not yet assigned"},"trixie":{"status":"resolved","repositories":{"trixie":"143.0.7499.169-1~deb13u1","trixie-security":"145.0.7632.159-1~deb13u1"},"fixed_version":"71.0.3578.80-1","urgency":"not yet assigned"}}},"CVE-2018-18356":{"description":"An integer overflow in path handling lead to a use after free in Skia in Google Chrome prior to 71.0.3578.80 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page.","scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"143.0.7499.169-1~deb12u1","bookworm-security":"145.0.7632.159-1~deb12u1"},"fixed_version":"71.0.3578.80-1","urgency":"not yet assigned"},"bullseye":{"status":"resolved","repositories":{"bullseye":"120.0.6099.224-1~deb11u1","bullseye-security":"120.0.6099.224-1~deb11u1"},"fixed_version":"71.0.3578.80-1","urgency":"not yet assigned"},"forky":{"status":"resolved","repositories":{"forky":"145.0.7632.159-1"},"fixed_version":"71.0.3578.80-1","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"146.0.7680.71-1"},"fixed_version":"71.0.3578.80-1","urgency":"not yet assigned"},"trixie":{"status":"resolved","repositories":{"trixie":"143.0.7499.169-1~deb13u1","trixie-security":"145.0.7632.159-1~deb13u1"},"fixed_version":"71.0.3578.80-1","urgency":"not yet assigned"}}},"CVE-2018-18357":{"description":"Incorrect handling of confusable characters in URL Formatter in Google Chrome prior to 71.0.3578.80 allowed a remote attacker to spoof the contents of the Omnibox (URL bar) via a crafted domain name.","scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"143.0.7499.169-1~deb12u1","bookworm-security":"145.0.7632.159-1~deb12u1"},"fixed_version":"71.0.3578.80-1","urgency":"not yet assigned"},"bullseye":{"status":"resolved","repositories":{"bullseye":"120.0.6099.224-1~deb11u1","bullseye-security":"120.0.6099.224-1~deb11u1"},"fixed_version":"71.0.3578.80-1","urgency":"not yet assigned"},"forky":{"status":"resolved","repositories":{"forky":"145.0.7632.159-1"},"fixed_version":"71.0.3578.80-1","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"146.0.7680.71-1"},"fixed_version":"71.0.3578.80-1","urgency":"not yet assigned"},"trixie":{"status":"resolved","repositories":{"trixie":"143.0.7499.169-1~deb13u1","trixie-security":"145.0.7632.159-1~deb13u1"},"fixed_version":"71.0.3578.80-1","urgency":"not yet assigned"}}},"CVE-2018-18358":{"description":"Lack of special casing of localhost in WPAD files in Google Chrome prior to 71.0.3578.80 allowed an attacker on the local network segment to proxy resources on localhost via a crafted WPAD file.","scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"143.0.7499.169-1~deb12u1","bookworm-security":"145.0.7632.159-1~deb12u1"},"fixed_version":"71.0.3578.80-1","urgency":"not yet assigned"},"bullseye":{"status":"resolved","repositories":{"bullseye":"120.0.6099.224-1~deb11u1","bullseye-security":"120.0.6099.224-1~deb11u1"},"fixed_version":"71.0.3578.80-1","urgency":"not yet assigned"},"forky":{"status":"resolved","repositories":{"forky":"145.0.7632.159-1"},"fixed_version":"71.0.3578.80-1","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"146.0.7680.71-1"},"fixed_version":"71.0.3578.80-1","urgency":"not yet assigned"},"trixie":{"status":"resolved","repositories":{"trixie":"143.0.7499.169-1~deb13u1","trixie-security":"145.0.7632.159-1~deb13u1"},"fixed_version":"71.0.3578.80-1","urgency":"not yet assigned"}}},"CVE-2018-18359":{"description":"Incorrect handling of Reflect.construct in V8 in Google Chrome prior to 71.0.3578.80 allowed a remote attacker to perform an out of bounds memory read via a crafted HTML page.","scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"143.0.7499.169-1~deb12u1","bookworm-security":"145.0.7632.159-1~deb12u1"},"fixed_version":"71.0.3578.80-1","urgency":"not yet assigned"},"bullseye":{"status":"resolved","repositories":{"bullseye":"120.0.6099.224-1~deb11u1","bullseye-security":"120.0.6099.224-1~deb11u1"},"fixed_version":"71.0.3578.80-1","urgency":"not yet assigned"},"forky":{"status":"resolved","repositories":{"forky":"145.0.7632.159-1"},"fixed_version":"71.0.3578.80-1","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"146.0.7680.71-1"},"fixed_version":"71.0.3578.80-1","urgency":"not yet assigned"},"trixie":{"status":"resolved","repositories":{"trixie":"143.0.7499.169-1~deb13u1","trixie-security":"145.0.7632.159-1~deb13u1"},"fixed_version":"71.0.3578.80-1","urgency":"not yet assigned"}}},"CVE-2018-20065":{"description":"Handling of URI action in PDFium in Google Chrome prior to 71.0.3578.80 allowed a remote attacker to initiate potentially unsafe navigations without a user gesture via a crafted PDF file.","scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"143.0.7499.169-1~deb12u1","bookworm-security":"145.0.7632.159-1~deb12u1"},"fixed_version":"71.0.3578.80-1","urgency":"not yet assigned"},"bullseye":{"status":"resolved","repositories":{"bullseye":"120.0.6099.224-1~deb11u1","bullseye-security":"120.0.6099.224-1~deb11u1"},"fixed_version":"71.0.3578.80-1","urgency":"not yet assigned"},"forky":{"status":"resolved","repositories":{"forky":"145.0.7632.159-1"},"fixed_version":"71.0.3578.80-1","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"146.0.7680.71-1"},"fixed_version":"71.0.3578.80-1","urgency":"not yet assigned"},"trixie":{"status":"resolved","repositories":{"trixie":"143.0.7499.169-1~deb13u1","trixie-security":"145.0.7632.159-1~deb13u1"},"fixed_version":"71.0.3578.80-1","urgency":"not yet assigned"}}},"CVE-2018-20066":{"description":"Incorrect object lifecycle in Extensions in Google Chrome prior to 71.0.3578.80 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page.","scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"143.0.7499.169-1~deb12u1","bookworm-security":"145.0.7632.159-1~deb12u1"},"fixed_version":"71.0.3578.80-1","urgency":"not yet assigned"},"bullseye":{"status":"resolved","repositories":{"bullseye":"120.0.6099.224-1~deb11u1","bullseye-security":"120.0.6099.224-1~deb11u1"},"fixed_version":"71.0.3578.80-1","urgency":"not yet assigned"},"forky":{"status":"resolved","repositories":{"forky":"145.0.7632.159-1"},"fixed_version":"71.0.3578.80-1","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"146.0.7680.71-1"},"fixed_version":"71.0.3578.80-1","urgency":"not yet assigned"},"trixie":{"status":"resolved","repositories":{"trixie":"143.0.7499.169-1~deb13u1","trixie-security":"145.0.7632.159-1~deb13u1"},"fixed_version":"71.0.3578.80-1","urgency":"not yet assigned"}}},"CVE-2018-20067":{"description":"A renderer initiated back navigation was incorrectly allowed to cancel a browser initiated one in Navigation in Google Chrome prior to 71.0.3578.80 allowed a remote attacker to confuse the user about the origin of the current page via a crafted HTML page.","scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"143.0.7499.169-1~deb12u1","bookworm-security":"145.0.7632.159-1~deb12u1"},"fixed_version":"71.0.3578.80-1","urgency":"not yet assigned"},"bullseye":{"status":"resolved","repositories":{"bullseye":"120.0.6099.224-1~deb11u1","bullseye-security":"120.0.6099.224-1~deb11u1"},"fixed_version":"71.0.3578.80-1","urgency":"not yet assigned"},"forky":{"status":"resolved","repositories":{"forky":"145.0.7632.159-1"},"fixed_version":"71.0.3578.80-1","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"146.0.7680.71-1"},"fixed_version":"71.0.3578.80-1","urgency":"not yet assigned"},"trixie":{"status":"resolved","repositories":{"trixie":"143.0.7499.169-1~deb13u1","trixie-security":"145.0.7632.159-1~deb13u1"},"fixed_version":"71.0.3578.80-1","urgency":"not yet assigned"}}},"CVE-2018-20068":{"description":"Incorrect handling of 304 status codes in Navigation in Google Chrome prior to 71.0.3578.80 allowed a remote attacker to confuse the user about the origin of the current page via a crafted HTML page.","scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"143.0.7499.169-1~deb12u1","bookworm-security":"145.0.7632.159-1~deb12u1"},"fixed_version":"71.0.3578.80-1","urgency":"not yet assigned"},"bullseye":{"status":"resolved","repositories":{"bullseye":"120.0.6099.224-1~deb11u1","bullseye-security":"120.0.6099.224-1~deb11u1"},"fixed_version":"71.0.3578.80-1","urgency":"not yet assigned"},"forky":{"status":"resolved","repositories":{"forky":"145.0.7632.159-1"},"fixed_version":"71.0.3578.80-1","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"146.0.7680.71-1"},"fixed_version":"71.0.3578.80-1","urgency":"not yet assigned"},"trixie":{"status":"resolved","repositories":{"trixie":"143.0.7499.169-1~deb13u1","trixie-security":"145.0.7632.159-1~deb13u1"},"fixed_version":"71.0.3578.80-1","urgency":"not yet assigned"}}},"CVE-2018-20069":{"description":"Failure to prevent navigation to top frame to data URLs in Navigation in Google Chrome on iOS prior to 71.0.3578.80 allowed a remote attacker to confuse the user about the origin of the current page via a crafted HTML page.","scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"143.0.7499.169-1~deb12u1","bookworm-security":"145.0.7632.159-1~deb12u1"},"fixed_version":"0","urgency":"unimportant"},"bullseye":{"status":"resolved","repositories":{"bullseye":"120.0.6099.224-1~deb11u1","bullseye-security":"120.0.6099.224-1~deb11u1"},"fixed_version":"0","urgency":"unimportant"},"forky":{"status":"resolved","repositories":{"forky":"145.0.7632.159-1"},"fixed_version":"0","urgency":"unimportant"},"sid":{"status":"resolved","repositories":{"sid":"146.0.7680.71-1"},"fixed_version":"0","urgency":"unimportant"},"trixie":{"status":"resolved","repositories":{"trixie":"143.0.7499.169-1~deb13u1","trixie-security":"145.0.7632.159-1~deb13u1"},"fixed_version":"0","urgency":"unimportant"}}},"CVE-2018-20070":{"description":"Incorrect handling of confusable characters in URL Formatter in Google Chrome prior to 71.0.3578.80 allowed a remote attacker to spoof the contents of the Omnibox (URL bar) via a crafted domain name.","scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"143.0.7499.169-1~deb12u1","bookworm-security":"145.0.7632.159-1~deb12u1"},"fixed_version":"71.0.3578.80-1","urgency":"not yet assigned"},"bullseye":{"status":"resolved","repositories":{"bullseye":"120.0.6099.224-1~deb11u1","bullseye-security":"120.0.6099.224-1~deb11u1"},"fixed_version":"71.0.3578.80-1","urgency":"not yet assigned"},"forky":{"status":"resolved","repositories":{"forky":"145.0.7632.159-1"},"fixed_version":"71.0.3578.80-1","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"146.0.7680.71-1"},"fixed_version":"71.0.3578.80-1","urgency":"not yet assigned"},"trixie":{"status":"resolved","repositories":{"trixie":"143.0.7499.169-1~deb13u1","trixie-security":"145.0.7632.159-1~deb13u1"},"fixed_version":"71.0.3578.80-1","urgency":"not yet assigned"}}},"CVE-2018-20072":{"description":"Insufficient data validation in PDF in Google Chrome prior to 73.0.3683.75 allowed a remote attacker to perform out of bounds memory access via a crafted PDF file. (Chromium security severity: Low)","scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"143.0.7499.169-1~deb12u1","bookworm-security":"145.0.7632.159-1~deb12u1"},"fixed_version":"73.0.3683.75-1","urgency":"not yet assigned"},"bullseye":{"status":"resolved","repositories":{"bullseye":"120.0.6099.224-1~deb11u1","bullseye-security":"120.0.6099.224-1~deb11u1"},"fixed_version":"73.0.3683.75-1","urgency":"not yet assigned"},"forky":{"status":"resolved","repositories":{"forky":"145.0.7632.159-1"},"fixed_version":"73.0.3683.75-1","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"146.0.7680.71-1"},"fixed_version":"73.0.3683.75-1","urgency":"not yet assigned"},"trixie":{"status":"resolved","repositories":{"trixie":"143.0.7499.169-1~deb13u1","trixie-security":"145.0.7632.159-1~deb13u1"},"fixed_version":"73.0.3683.75-1","urgency":"not yet assigned"}}},"CVE-2018-20073":{"description":"Use of extended attributes in downloads in Google Chrome prior to 72.0.3626.81 allowed a local attacker to read download URLs via the filesystem.","scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"143.0.7499.169-1~deb12u1","bookworm-security":"145.0.7632.159-1~deb12u1"},"fixed_version":"72.0.3626.81-1","urgency":"low"},"bullseye":{"status":"resolved","repositories":{"bullseye":"120.0.6099.224-1~deb11u1","bullseye-security":"120.0.6099.224-1~deb11u1"},"fixed_version":"72.0.3626.81-1","urgency":"low"},"forky":{"status":"resolved","repositories":{"forky":"145.0.7632.159-1"},"fixed_version":"72.0.3626.81-1","urgency":"low"},"sid":{"status":"resolved","repositories":{"sid":"146.0.7680.71-1"},"fixed_version":"72.0.3626.81-1","urgency":"low"},"trixie":{"status":"resolved","repositories":{"trixie":"143.0.7499.169-1~deb13u1","trixie-security":"145.0.7632.159-1~deb13u1"},"fixed_version":"72.0.3626.81-1","urgency":"low"}}},"CVE-2018-20346":{"description":"SQLite before 3.25.3, when the FTS3 extension is enabled, encounters an integer overflow (and resultant buffer overflow) for FTS3 queries that occur after crafted changes to FTS3 shadow tables, allowing remote attackers to execute arbitrary code by leveraging the ability to run arbitrary SQL statements (such as in certain WebSQL use cases), aka Magellan.","scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"143.0.7499.169-1~deb12u1","bookworm-security":"145.0.7632.159-1~deb12u1"},"fixed_version":"71.0.3578.80-1","urgency":"not yet assigned"},"bullseye":{"status":"resolved","repositories":{"bullseye":"120.0.6099.224-1~deb11u1","bullseye-security":"120.0.6099.224-1~deb11u1"},"fixed_version":"71.0.3578.80-1","urgency":"not yet assigned"},"forky":{"status":"resolved","repositories":{"forky":"145.0.7632.159-1"},"fixed_version":"71.0.3578.80-1","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"146.0.7680.71-1"},"fixed_version":"71.0.3578.80-1","urgency":"not yet assigned"},"trixie":{"status":"resolved","repositories":{"trixie":"143.0.7499.169-1~deb13u1","trixie-security":"145.0.7632.159-1~deb13u1"},"fixed_version":"71.0.3578.80-1","urgency":"not yet assigned"}}},"CVE-2019-13659":{"description":"IDN spoofing in Omnibox in Google Chrome prior to 77.0.3865.75 allowed a remote attacker to perform domain spoofing via IDN homographs via a crafted domain name.","scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"143.0.7499.169-1~deb12u1","bookworm-security":"145.0.7632.159-1~deb12u1"},"fixed_version":"78.0.3904.87-1","urgency":"not yet assigned"},"bullseye":{"status":"resolved","repositories":{"bullseye":"120.0.6099.224-1~deb11u1","bullseye-security":"120.0.6099.224-1~deb11u1"},"fixed_version":"78.0.3904.87-1","urgency":"not yet assigned"},"forky":{"status":"resolved","repositories":{"forky":"145.0.7632.159-1"},"fixed_version":"78.0.3904.87-1","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"146.0.7680.71-1"},"fixed_version":"78.0.3904.87-1","urgency":"not yet assigned"},"trixie":{"status":"resolved","repositories":{"trixie":"143.0.7499.169-1~deb13u1","trixie-security":"145.0.7632.159-1~deb13u1"},"fixed_version":"78.0.3904.87-1","urgency":"not yet assigned"}}},"CVE-2019-13660":{"description":"UI spoofing in Chromium in Google Chrome prior to 77.0.3865.75 allowed a remote attacker to spoof notifications via a crafted HTML page.","scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"143.0.7499.169-1~deb12u1","bookworm-security":"145.0.7632.159-1~deb12u1"},"fixed_version":"78.0.3904.87-1","urgency":"not yet assigned"},"bullseye":{"status":"resolved","repositories":{"bullseye":"120.0.6099.224-1~deb11u1","bullseye-security":"120.0.6099.224-1~deb11u1"},"fixed_version":"78.0.3904.87-1","urgency":"not yet assigned"},"forky":{"status":"resolved","repositories":{"forky":"145.0.7632.159-1"},"fixed_version":"78.0.3904.87-1","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"146.0.7680.71-1"},"fixed_version":"78.0.3904.87-1","urgency":"not yet assigned"},"trixie":{"status":"resolved","repositories":{"trixie":"143.0.7499.169-1~deb13u1","trixie-security":"145.0.7632.159-1~deb13u1"},"fixed_version":"78.0.3904.87-1","urgency":"not yet assigned"}}},"CVE-2019-13661":{"description":"UI spoofing in Chromium in Google Chrome prior to 77.0.3865.75 allowed a remote attacker to spoof notifications via a crafted HTML page.","scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"143.0.7499.169-1~deb12u1","bookworm-security":"145.0.7632.159-1~deb12u1"},"fixed_version":"78.0.3904.87-1","urgency":"not yet assigned"},"bullseye":{"status":"resolved","repositories":{"bullseye":"120.0.6099.224-1~deb11u1","bullseye-security":"120.0.6099.224-1~deb11u1"},"fixed_version":"78.0.3904.87-1","urgency":"not yet assigned"},"forky":{"status":"resolved","repositories":{"forky":"145.0.7632.159-1"},"fixed_version":"78.0.3904.87-1","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"146.0.7680.71-1"},"fixed_version":"78.0.3904.87-1","urgency":"not yet assigned"},"trixie":{"status":"resolved","repositories":{"trixie":"143.0.7499.169-1~deb13u1","trixie-security":"145.0.7632.159-1~deb13u1"},"fixed_version":"78.0.3904.87-1","urgency":"not yet assigned"}}},"CVE-2019-13662":{"description":"Insufficient policy enforcement in navigations in Google Chrome prior to 77.0.3865.75 allowed a remote attacker to bypass content security policy via a crafted HTML page.","scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"143.0.7499.169-1~deb12u1","bookworm-security":"145.0.7632.159-1~deb12u1"},"fixed_version":"78.0.3904.87-1","urgency":"not yet assigned"},"bullseye":{"status":"resolved","repositories":{"bullseye":"120.0.6099.224-1~deb11u1","bullseye-security":"120.0.6099.224-1~deb11u1"},"fixed_version":"78.0.3904.87-1","urgency":"not yet assigned"},"forky":{"status":"resolved","repositories":{"forky":"145.0.7632.159-1"},"fixed_version":"78.0.3904.87-1","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"146.0.7680.71-1"},"fixed_version":"78.0.3904.87-1","urgency":"not yet assigned"},"trixie":{"status":"resolved","repositories":{"trixie":"143.0.7499.169-1~deb13u1","trixie-security":"145.0.7632.159-1~deb13u1"},"fixed_version":"78.0.3904.87-1","urgency":"not yet assigned"}}},"CVE-2019-13663":{"description":"IDN spoofing in Omnibox in Google Chrome prior to 77.0.3865.75 allowed a remote attacker to perform domain spoofing via IDN homographs via a crafted domain name.","scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"143.0.7499.169-1~deb12u1","bookworm-security":"145.0.7632.159-1~deb12u1"},"fixed_version":"78.0.3904.87-1","urgency":"not yet assigned"},"bullseye":{"status":"resolved","repositories":{"bullseye":"120.0.6099.224-1~deb11u1","bullseye-security":"120.0.6099.224-1~deb11u1"},"fixed_version":"78.0.3904.87-1","urgency":"not yet assigned"},"forky":{"status":"resolved","repositories":{"forky":"145.0.7632.159-1"},"fixed_version":"78.0.3904.87-1","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"146.0.7680.71-1"},"fixed_version":"78.0.3904.87-1","urgency":"not yet assigned"},"trixie":{"status":"resolved","repositories":{"trixie":"143.0.7499.169-1~deb13u1","trixie-security":"145.0.7632.159-1~deb13u1"},"fixed_version":"78.0.3904.87-1","urgency":"not yet assigned"}}},"CVE-2019-13664":{"description":"Insufficient policy enforcement in Blink in Google Chrome prior to 77.0.3865.75 allowed a remote attacker to bypass content security policy via a crafted HTML page.","scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"143.0.7499.169-1~deb12u1","bookworm-security":"145.0.7632.159-1~deb12u1"},"fixed_version":"78.0.3904.87-1","urgency":"not yet assigned"},"bullseye":{"status":"resolved","repositories":{"bullseye":"120.0.6099.224-1~deb11u1","bullseye-security":"120.0.6099.224-1~deb11u1"},"fixed_version":"78.0.3904.87-1","urgency":"not yet assigned"},"forky":{"status":"resolved","repositories":{"forky":"145.0.7632.159-1"},"fixed_version":"78.0.3904.87-1","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"146.0.7680.71-1"},"fixed_version":"78.0.3904.87-1","urgency":"not yet assigned"},"trixie":{"status":"resolved","repositories":{"trixie":"143.0.7499.169-1~deb13u1","trixie-security":"145.0.7632.159-1~deb13u1"},"fixed_version":"78.0.3904.87-1","urgency":"not yet assigned"}}},"CVE-2019-13665":{"description":"Insufficient filtering in Blink in Google Chrome prior to 77.0.3865.75 allowed a remote attacker to bypass multiple file download protection via a crafted HTML page.","scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"143.0.7499.169-1~deb12u1","bookworm-security":"145.0.7632.159-1~deb12u1"},"fixed_version":"78.0.3904.87-1","urgency":"not yet assigned"},"bullseye":{"status":"resolved","repositories":{"bullseye":"120.0.6099.224-1~deb11u1","bullseye-security":"120.0.6099.224-1~deb11u1"},"fixed_version":"78.0.3904.87-1","urgency":"not yet assigned"},"forky":{"status":"resolved","repositories":{"forky":"145.0.7632.159-1"},"fixed_version":"78.0.3904.87-1","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"146.0.7680.71-1"},"fixed_version":"78.0.3904.87-1","urgency":"not yet assigned"},"trixie":{"status":"resolved","repositories":{"trixie":"143.0.7499.169-1~deb13u1","trixie-security":"145.0.7632.159-1~deb13u1"},"fixed_version":"78.0.3904.87-1","urgency":"not yet assigned"}}},"CVE-2019-13666":{"description":"Information leak in storage in Google Chrome prior to 77.0.3865.75 allowed a remote attacker to leak cross-origin data via a crafted HTML page.","scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"143.0.7499.169-1~deb12u1","bookworm-security":"145.0.7632.159-1~deb12u1"},"fixed_version":"78.0.3904.87-1","urgency":"not yet assigned"},"bullseye":{"status":"resolved","repositories":{"bullseye":"120.0.6099.224-1~deb11u1","bullseye-security":"120.0.6099.224-1~deb11u1"},"fixed_version":"78.0.3904.87-1","urgency":"not yet assigned"},"forky":{"status":"resolved","repositories":{"forky":"145.0.7632.159-1"},"fixed_version":"78.0.3904.87-1","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"146.0.7680.71-1"},"fixed_version":"78.0.3904.87-1","urgency":"not yet assigned"},"trixie":{"status":"resolved","repositories":{"trixie":"143.0.7499.169-1~deb13u1","trixie-security":"145.0.7632.159-1~deb13u1"},"fixed_version":"78.0.3904.87-1","urgency":"not yet assigned"}}},"CVE-2019-13667":{"description":"Inappropriate implementation in Omnibox in Google Chrome on iOS prior to 77.0.3865.75 allowed a remote attacker to spoof the contents of the Omnibox (URL bar) via a crafted HTML page.","scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"143.0.7499.169-1~deb12u1","bookworm-security":"145.0.7632.159-1~deb12u1"},"fixed_version":"78.0.3904.87-1","urgency":"not yet assigned"},"bullseye":{"status":"resolved","repositories":{"bullseye":"120.0.6099.224-1~deb11u1","bullseye-security":"120.0.6099.224-1~deb11u1"},"fixed_version":"78.0.3904.87-1","urgency":"not yet assigned"},"forky":{"status":"resolved","repositories":{"forky":"145.0.7632.159-1"},"fixed_version":"78.0.3904.87-1","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"146.0.7680.71-1"},"fixed_version":"78.0.3904.87-1","urgency":"not yet assigned"},"trixie":{"status":"resolved","repositories":{"trixie":"143.0.7499.169-1~deb13u1","trixie-security":"145.0.7632.159-1~deb13u1"},"fixed_version":"78.0.3904.87-1","urgency":"not yet assigned"}}},"CVE-2019-13668":{"description":"Insufficient policy enforcement in developer tools in Google Chrome prior to 77.0.3865.75 allowed a remote attacker to leak cross-origin data via a crafted HTML page.","scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"143.0.7499.169-1~deb12u1","bookworm-security":"145.0.7632.159-1~deb12u1"},"fixed_version":"78.0.3904.87-1","urgency":"not yet assigned"},"bullseye":{"status":"resolved","repositories":{"bullseye":"120.0.6099.224-1~deb11u1","bullseye-security":"120.0.6099.224-1~deb11u1"},"fixed_version":"78.0.3904.87-1","urgency":"not yet assigned"},"forky":{"status":"resolved","repositories":{"forky":"145.0.7632.159-1"},"fixed_version":"78.0.3904.87-1","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"146.0.7680.71-1"},"fixed_version":"78.0.3904.87-1","urgency":"not yet assigned"},"trixie":{"status":"resolved","repositories":{"trixie":"143.0.7499.169-1~deb13u1","trixie-security":"145.0.7632.159-1~deb13u1"},"fixed_version":"78.0.3904.87-1","urgency":"not yet assigned"}}},"CVE-2019-13669":{"description":"Incorrect data validation in navigation in Google Chrome prior to 77.0.3865.75 allowed a remote attacker to spoof the contents of the Omnibox (URL bar) via a crafted HTML page.","scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"143.0.7499.169-1~deb12u1","bookworm-security":"145.0.7632.159-1~deb12u1"},"fixed_version":"78.0.3904.87-1","urgency":"not yet assigned"},"bullseye":{"status":"resolved","repositories":{"bullseye":"120.0.6099.224-1~deb11u1","bullseye-security":"120.0.6099.224-1~deb11u1"},"fixed_version":"78.0.3904.87-1","urgency":"not yet assigned"},"forky":{"status":"resolved","repositories":{"forky":"145.0.7632.159-1"},"fixed_version":"78.0.3904.87-1","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"146.0.7680.71-1"},"fixed_version":"78.0.3904.87-1","urgency":"not yet assigned"},"trixie":{"status":"resolved","repositories":{"trixie":"143.0.7499.169-1~deb13u1","trixie-security":"145.0.7632.159-1~deb13u1"},"fixed_version":"78.0.3904.87-1","urgency":"not yet assigned"}}},"CVE-2019-13670":{"description":"Insufficient data validation in JavaScript in Google Chrome prior to 77.0.3865.75 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page.","scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"143.0.7499.169-1~deb12u1","bookworm-security":"145.0.7632.159-1~deb12u1"},"fixed_version":"78.0.3904.87-1","urgency":"not yet assigned"},"bullseye":{"status":"resolved","repositories":{"bullseye":"120.0.6099.224-1~deb11u1","bullseye-security":"120.0.6099.224-1~deb11u1"},"fixed_version":"78.0.3904.87-1","urgency":"not yet assigned"},"forky":{"status":"resolved","repositories":{"forky":"145.0.7632.159-1"},"fixed_version":"78.0.3904.87-1","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"146.0.7680.71-1"},"fixed_version":"78.0.3904.87-1","urgency":"not yet assigned"},"trixie":{"status":"resolved","repositories":{"trixie":"143.0.7499.169-1~deb13u1","trixie-security":"145.0.7632.159-1~deb13u1"},"fixed_version":"78.0.3904.87-1","urgency":"not yet assigned"}}},"CVE-2019-13671":{"description":"UI spoofing in Blink in Google Chrome prior to 77.0.3865.75 allowed a remote attacker to spoof security UI via a crafted HTML page.","scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"143.0.7499.169-1~deb12u1","bookworm-security":"145.0.7632.159-1~deb12u1"},"fixed_version":"78.0.3904.87-1","urgency":"not yet assigned"},"bullseye":{"status":"resolved","repositories":{"bullseye":"120.0.6099.224-1~deb11u1","bullseye-security":"120.0.6099.224-1~deb11u1"},"fixed_version":"78.0.3904.87-1","urgency":"not yet assigned"},"forky":{"status":"resolved","repositories":{"forky":"145.0.7632.159-1"},"fixed_version":"78.0.3904.87-1","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"146.0.7680.71-1"},"fixed_version":"78.0.3904.87-1","urgency":"not yet assigned"},"trixie":{"status":"resolved","repositories":{"trixie":"143.0.7499.169-1~deb13u1","trixie-security":"145.0.7632.159-1~deb13u1"},"fixed_version":"78.0.3904.87-1","urgency":"not yet assigned"}}},"CVE-2019-13672":{"description":"Incorrect security UI in Omnibox in Google Chrome prior to 77.0.3865.75 allowed a remote attacker to potentially spoof the contents of the Omnibox (URL bar) via a crafted HTML page on iOS.","scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"143.0.7499.169-1~deb12u1","bookworm-security":"145.0.7632.159-1~deb12u1"},"fixed_version":"78.0.3904.87-1","urgency":"not yet assigned"},"bullseye":{"status":"resolved","repositories":{"bullseye":"120.0.6099.224-1~deb11u1","bullseye-security":"120.0.6099.224-1~deb11u1"},"fixed_version":"78.0.3904.87-1","urgency":"not yet assigned"},"forky":{"status":"resolved","repositories":{"forky":"145.0.7632.159-1"},"fixed_version":"78.0.3904.87-1","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"146.0.7680.71-1"},"fixed_version":"78.0.3904.87-1","urgency":"not yet assigned"},"trixie":{"status":"resolved","repositories":{"trixie":"143.0.7499.169-1~deb13u1","trixie-security":"145.0.7632.159-1~deb13u1"},"fixed_version":"78.0.3904.87-1","urgency":"not yet assigned"}}},"CVE-2019-13673":{"description":"Insufficient data validation in developer tools in Google Chrome prior to 77.0.3865.75 allowed a remote attacker to leak cross-origin data via a crafted HTML page.","scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"143.0.7499.169-1~deb12u1","bookworm-security":"145.0.7632.159-1~deb12u1"},"fixed_version":"78.0.3904.87-1","urgency":"not yet assigned"},"bullseye":{"status":"resolved","repositories":{"bullseye":"120.0.6099.224-1~deb11u1","bullseye-security":"120.0.6099.224-1~deb11u1"},"fixed_version":"78.0.3904.87-1","urgency":"not yet assigned"},"forky":{"status":"resolved","repositories":{"forky":"145.0.7632.159-1"},"fixed_version":"78.0.3904.87-1","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"146.0.7680.71-1"},"fixed_version":"78.0.3904.87-1","urgency":"not yet assigned"},"trixie":{"status":"resolved","repositories":{"trixie":"143.0.7499.169-1~deb13u1","trixie-security":"145.0.7632.159-1~deb13u1"},"fixed_version":"78.0.3904.87-1","urgency":"not yet assigned"}}},"CVE-2019-13674":{"description":"IDN spoofing in Omnibox in Google Chrome prior to 77.0.3865.75 allowed a remote attacker to perform domain spoofing via IDN homographs via a crafted domain name.","scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"143.0.7499.169-1~deb12u1","bookworm-security":"145.0.7632.159-1~deb12u1"},"fixed_version":"78.0.3904.87-1","urgency":"not yet assigned"},"bullseye":{"status":"resolved","repositories":{"bullseye":"120.0.6099.224-1~deb11u1","bullseye-security":"120.0.6099.224-1~deb11u1"},"fixed_version":"78.0.3904.87-1","urgency":"not yet assigned"},"forky":{"status":"resolved","repositories":{"forky":"145.0.7632.159-1"},"fixed_version":"78.0.3904.87-1","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"146.0.7680.71-1"},"fixed_version":"78.0.3904.87-1","urgency":"not yet assigned"},"trixie":{"status":"resolved","repositories":{"trixie":"143.0.7499.169-1~deb13u1","trixie-security":"145.0.7632.159-1~deb13u1"},"fixed_version":"78.0.3904.87-1","urgency":"not yet assigned"}}},"CVE-2019-13675":{"description":"Insufficient data validation in extensions in Google Chrome prior to 77.0.3865.75 allowed a remote attacker to disable extensions via a crafted HTML page.","scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"143.0.7499.169-1~deb12u1","bookworm-security":"145.0.7632.159-1~deb12u1"},"fixed_version":"78.0.3904.87-1","urgency":"not yet assigned"},"bullseye":{"status":"resolved","repositories":{"bullseye":"120.0.6099.224-1~deb11u1","bullseye-security":"120.0.6099.224-1~deb11u1"},"fixed_version":"78.0.3904.87-1","urgency":"not yet assigned"},"forky":{"status":"resolved","repositories":{"forky":"145.0.7632.159-1"},"fixed_version":"78.0.3904.87-1","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"146.0.7680.71-1"},"fixed_version":"78.0.3904.87-1","urgency":"not yet assigned"},"trixie":{"status":"resolved","repositories":{"trixie":"143.0.7499.169-1~deb13u1","trixie-security":"145.0.7632.159-1~deb13u1"},"fixed_version":"78.0.3904.87-1","urgency":"not yet assigned"}}},"CVE-2019-13676":{"description":"Insufficient policy enforcement in Chromium in Google Chrome prior to 77.0.3865.75 allowed a remote attacker to perform domain spoofing via a crafted HTML page.","scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"143.0.7499.169-1~deb12u1","bookworm-security":"145.0.7632.159-1~deb12u1"},"fixed_version":"78.0.3904.87-1","urgency":"not yet assigned"},"bullseye":{"status":"resolved","repositories":{"bullseye":"120.0.6099.224-1~deb11u1","bullseye-security":"120.0.6099.224-1~deb11u1"},"fixed_version":"78.0.3904.87-1","urgency":"not yet assigned"},"forky":{"status":"resolved","repositories":{"forky":"145.0.7632.159-1"},"fixed_version":"78.0.3904.87-1","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"146.0.7680.71-1"},"fixed_version":"78.0.3904.87-1","urgency":"not yet assigned"},"trixie":{"status":"resolved","repositories":{"trixie":"143.0.7499.169-1~deb13u1","trixie-security":"145.0.7632.159-1~deb13u1"},"fixed_version":"78.0.3904.87-1","urgency":"not yet assigned"}}},"CVE-2019-13677":{"description":"Insufficient policy enforcement in site isolation in Google Chrome prior to 77.0.3865.75 allowed a remote attacker to bypass site isolation via a crafted HTML page.","scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"143.0.7499.169-1~deb12u1","bookworm-security":"145.0.7632.159-1~deb12u1"},"fixed_version":"78.0.3904.87-1","urgency":"not yet assigned"},"bullseye":{"status":"resolved","repositories":{"bullseye":"120.0.6099.224-1~deb11u1","bullseye-security":"120.0.6099.224-1~deb11u1"},"fixed_version":"78.0.3904.87-1","urgency":"not yet assigned"},"forky":{"status":"resolved","repositories":{"forky":"145.0.7632.159-1"},"fixed_version":"78.0.3904.87-1","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"146.0.7680.71-1"},"fixed_version":"78.0.3904.87-1","urgency":"not yet assigned"},"trixie":{"status":"resolved","repositories":{"trixie":"143.0.7499.169-1~deb13u1","trixie-security":"145.0.7632.159-1~deb13u1"},"fixed_version":"78.0.3904.87-1","urgency":"not yet assigned"}}},"CVE-2019-13678":{"description":"Incorrect data validation in downloads in Google Chrome prior to 77.0.3865.75 allowed a remote attacker to perform domain spoofing via a crafted HTML page.","scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"143.0.7499.169-1~deb12u1","bookworm-security":"145.0.7632.159-1~deb12u1"},"fixed_version":"78.0.3904.87-1","urgency":"not yet assigned"},"bullseye":{"status":"resolved","repositories":{"bullseye":"120.0.6099.224-1~deb11u1","bullseye-security":"120.0.6099.224-1~deb11u1"},"fixed_version":"78.0.3904.87-1","urgency":"not yet assigned"},"forky":{"status":"resolved","repositories":{"forky":"145.0.7632.159-1"},"fixed_version":"78.0.3904.87-1","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"146.0.7680.71-1"},"fixed_version":"78.0.3904.87-1","urgency":"not yet assigned"},"trixie":{"status":"resolved","repositories":{"trixie":"143.0.7499.169-1~deb13u1","trixie-security":"145.0.7632.159-1~deb13u1"},"fixed_version":"78.0.3904.87-1","urgency":"not yet assigned"}}},"CVE-2019-13679":{"description":"Insufficient policy enforcement in PDFium in Google Chrome prior to 77.0.3865.75 allowed a remote attacker to show print dialogs via a crafted PDF file.","scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"143.0.7499.169-1~deb12u1","bookworm-security":"145.0.7632.159-1~deb12u1"},"fixed_version":"78.0.3904.87-1","urgency":"not yet assigned"},"bullseye":{"status":"resolved","repositories":{"bullseye":"120.0.6099.224-1~deb11u1","bullseye-security":"120.0.6099.224-1~deb11u1"},"fixed_version":"78.0.3904.87-1","urgency":"not yet assigned"},"forky":{"status":"resolved","repositories":{"forky":"145.0.7632.159-1"},"fixed_version":"78.0.3904.87-1","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"146.0.7680.71-1"},"fixed_version":"78.0.3904.87-1","urgency":"not yet assigned"},"trixie":{"status":"resolved","repositories":{"trixie":"143.0.7499.169-1~deb13u1","trixie-security":"145.0.7632.159-1~deb13u1"},"fixed_version":"78.0.3904.87-1","urgency":"not yet assigned"}}},"CVE-2019-13680":{"description":"Inappropriate implementation in TLS in Google Chrome prior to 77.0.3865.75 allowed a remote attacker to spoof client IP address to websites via crafted TLS connections.","scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"143.0.7499.169-1~deb12u1","bookworm-security":"145.0.7632.159-1~deb12u1"},"fixed_version":"78.0.3904.87-1","urgency":"not yet assigned"},"bullseye":{"status":"resolved","repositories":{"bullseye":"120.0.6099.224-1~deb11u1","bullseye-security":"120.0.6099.224-1~deb11u1"},"fixed_version":"78.0.3904.87-1","urgency":"not yet assigned"},"forky":{"status":"resolved","repositories":{"forky":"145.0.7632.159-1"},"fixed_version":"78.0.3904.87-1","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"146.0.7680.71-1"},"fixed_version":"78.0.3904.87-1","urgency":"not yet assigned"},"trixie":{"status":"resolved","repositories":{"trixie":"143.0.7499.169-1~deb13u1","trixie-security":"145.0.7632.159-1~deb13u1"},"fixed_version":"78.0.3904.87-1","urgency":"not yet assigned"}}},"CVE-2019-13681":{"description":"Insufficient data validation in downloads in Google Chrome prior to 77.0.3865.75 allowed a remote attacker to bypass download restrictions via a crafted HTML page.","scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"143.0.7499.169-1~deb12u1","bookworm-security":"145.0.7632.159-1~deb12u1"},"fixed_version":"78.0.3904.87-1","urgency":"not yet assigned"},"bullseye":{"status":"resolved","repositories":{"bullseye":"120.0.6099.224-1~deb11u1","bullseye-security":"120.0.6099.224-1~deb11u1"},"fixed_version":"78.0.3904.87-1","urgency":"not yet assigned"},"forky":{"status":"resolved","repositories":{"forky":"145.0.7632.159-1"},"fixed_version":"78.0.3904.87-1","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"146.0.7680.71-1"},"fixed_version":"78.0.3904.87-1","urgency":"not yet assigned"},"trixie":{"status":"resolved","repositories":{"trixie":"143.0.7499.169-1~deb13u1","trixie-security":"145.0.7632.159-1~deb13u1"},"fixed_version":"78.0.3904.87-1","urgency":"not yet assigned"}}},"CVE-2019-13682":{"description":"Insufficient policy enforcement in external protocol handling in Google Chrome prior to 77.0.3865.75 allowed a remote attacker to bypass same origin policy via a crafted HTML page.","scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"143.0.7499.169-1~deb12u1","bookworm-security":"145.0.7632.159-1~deb12u1"},"fixed_version":"78.0.3904.87-1","urgency":"not yet assigned"},"bullseye":{"status":"resolved","repositories":{"bullseye":"120.0.6099.224-1~deb11u1","bullseye-security":"120.0.6099.224-1~deb11u1"},"fixed_version":"78.0.3904.87-1","urgency":"not yet assigned"},"forky":{"status":"resolved","repositories":{"forky":"145.0.7632.159-1"},"fixed_version":"78.0.3904.87-1","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"146.0.7680.71-1"},"fixed_version":"78.0.3904.87-1","urgency":"not yet assigned"},"trixie":{"status":"resolved","repositories":{"trixie":"143.0.7499.169-1~deb13u1","trixie-security":"145.0.7632.159-1~deb13u1"},"fixed_version":"78.0.3904.87-1","urgency":"not yet assigned"}}},"CVE-2019-13683":{"description":"Insufficient policy enforcement in developer tools in Google Chrome prior to 77.0.3865.75 allowed a remote attacker to leak cross-origin data via a crafted HTML page.","scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"143.0.7499.169-1~deb12u1","bookworm-security":"145.0.7632.159-1~deb12u1"},"fixed_version":"78.0.3904.87-1","urgency":"not yet assigned"},"bullseye":{"status":"resolved","repositories":{"bullseye":"120.0.6099.224-1~deb11u1","bullseye-security":"120.0.6099.224-1~deb11u1"},"fixed_version":"78.0.3904.87-1","urgency":"not yet assigned"},"forky":{"status":"resolved","repositories":{"forky":"145.0.7632.159-1"},"fixed_version":"78.0.3904.87-1","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"146.0.7680.71-1"},"fixed_version":"78.0.3904.87-1","urgency":"not yet assigned"},"trixie":{"status":"resolved","repositories":{"trixie":"143.0.7499.169-1~deb13u1","trixie-security":"145.0.7632.159-1~deb13u1"},"fixed_version":"78.0.3904.87-1","urgency":"not yet assigned"}}},"CVE-2019-13684":{"description":"Inappropriate implementation in JavaScript in Google Chrome prior to 72.0.3626.81 allowed a remote attacker to leak cross-origin data via a crafted HTML page.","scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"143.0.7499.169-1~deb12u1","bookworm-security":"145.0.7632.159-1~deb12u1"},"fixed_version":"72.0.3626.81-1","urgency":"not yet assigned"},"bullseye":{"status":"resolved","repositories":{"bullseye":"120.0.6099.224-1~deb11u1","bullseye-security":"120.0.6099.224-1~deb11u1"},"fixed_version":"72.0.3626.81-1","urgency":"not yet assigned"},"forky":{"status":"resolved","repositories":{"forky":"145.0.7632.159-1"},"fixed_version":"72.0.3626.81-1","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"146.0.7680.71-1"},"fixed_version":"72.0.3626.81-1","urgency":"not yet assigned"},"trixie":{"status":"resolved","repositories":{"trixie":"143.0.7499.169-1~deb13u1","trixie-security":"145.0.7632.159-1~deb13u1"},"fixed_version":"72.0.3626.81-1","urgency":"not yet assigned"}}},"CVE-2019-13685":{"description":"Use after free in sharing view in Google Chrome prior to 77.0.3865.90 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page.","scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"143.0.7499.169-1~deb12u1","bookworm-security":"145.0.7632.159-1~deb12u1"},"fixed_version":"78.0.3904.87-1","urgency":"not yet assigned"},"bullseye":{"status":"resolved","repositories":{"bullseye":"120.0.6099.224-1~deb11u1","bullseye-security":"120.0.6099.224-1~deb11u1"},"fixed_version":"78.0.3904.87-1","urgency":"not yet assigned"},"forky":{"status":"resolved","repositories":{"forky":"145.0.7632.159-1"},"fixed_version":"78.0.3904.87-1","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"146.0.7680.71-1"},"fixed_version":"78.0.3904.87-1","urgency":"not yet assigned"},"trixie":{"status":"resolved","repositories":{"trixie":"143.0.7499.169-1~deb13u1","trixie-security":"145.0.7632.159-1~deb13u1"},"fixed_version":"78.0.3904.87-1","urgency":"not yet assigned"}}},"CVE-2019-13686":{"description":"Use after free in offline mode in Google Chrome prior to 77.0.3865.90 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page.","scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"143.0.7499.169-1~deb12u1","bookworm-security":"145.0.7632.159-1~deb12u1"},"fixed_version":"78.0.3904.87-1","urgency":"not yet assigned"},"bullseye":{"status":"resolved","repositories":{"bullseye":"120.0.6099.224-1~deb11u1","bullseye-security":"120.0.6099.224-1~deb11u1"},"fixed_version":"78.0.3904.87-1","urgency":"not yet assigned"},"forky":{"status":"resolved","repositories":{"forky":"145.0.7632.159-1"},"fixed_version":"78.0.3904.87-1","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"146.0.7680.71-1"},"fixed_version":"78.0.3904.87-1","urgency":"not yet assigned"},"trixie":{"status":"resolved","repositories":{"trixie":"143.0.7499.169-1~deb13u1","trixie-security":"145.0.7632.159-1~deb13u1"},"fixed_version":"78.0.3904.87-1","urgency":"not yet assigned"}}},"CVE-2019-13687":{"description":"Use after free in Blink in Google Chrome prior to 77.0.3865.90 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page.","scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"143.0.7499.169-1~deb12u1","bookworm-security":"145.0.7632.159-1~deb12u1"},"fixed_version":"78.0.3904.87-1","urgency":"not yet assigned"},"bullseye":{"status":"resolved","repositories":{"bullseye":"120.0.6099.224-1~deb11u1","bullseye-security":"120.0.6099.224-1~deb11u1"},"fixed_version":"78.0.3904.87-1","urgency":"not yet assigned"},"forky":{"status":"resolved","repositories":{"forky":"145.0.7632.159-1"},"fixed_version":"78.0.3904.87-1","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"146.0.7680.71-1"},"fixed_version":"78.0.3904.87-1","urgency":"not yet assigned"},"trixie":{"status":"resolved","repositories":{"trixie":"143.0.7499.169-1~deb13u1","trixie-security":"145.0.7632.159-1~deb13u1"},"fixed_version":"78.0.3904.87-1","urgency":"not yet assigned"}}},"CVE-2019-13688":{"description":"Use after free in Blink in Google Chrome prior to 77.0.3865.90 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page.","scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"143.0.7499.169-1~deb12u1","bookworm-security":"145.0.7632.159-1~deb12u1"},"fixed_version":"78.0.3904.87-1","urgency":"not yet assigned"},"bullseye":{"status":"resolved","repositories":{"bullseye":"120.0.6099.224-1~deb11u1","bullseye-security":"120.0.6099.224-1~deb11u1"},"fixed_version":"78.0.3904.87-1","urgency":"not yet assigned"},"forky":{"status":"resolved","repositories":{"forky":"145.0.7632.159-1"},"fixed_version":"78.0.3904.87-1","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"146.0.7680.71-1"},"fixed_version":"78.0.3904.87-1","urgency":"not yet assigned"},"trixie":{"status":"resolved","repositories":{"trixie":"143.0.7499.169-1~deb13u1","trixie-security":"145.0.7632.159-1~deb13u1"},"fixed_version":"78.0.3904.87-1","urgency":"not yet assigned"}}},"CVE-2019-13691":{"description":"Insufficient validation of untrusted input in navigation in Google Chrome prior to 77.0.3865.75 allowed a remote attacker to spoof the contents of the Omnibox (URL bar) via a crafted HTML page.","scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"143.0.7499.169-1~deb12u1","bookworm-security":"145.0.7632.159-1~deb12u1"},"fixed_version":"78.0.3904.87-1","urgency":"not yet assigned"},"bullseye":{"status":"resolved","repositories":{"bullseye":"120.0.6099.224-1~deb11u1","bullseye-security":"120.0.6099.224-1~deb11u1"},"fixed_version":"78.0.3904.87-1","urgency":"not yet assigned"},"forky":{"status":"resolved","repositories":{"forky":"145.0.7632.159-1"},"fixed_version":"78.0.3904.87-1","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"146.0.7680.71-1"},"fixed_version":"78.0.3904.87-1","urgency":"not yet assigned"},"trixie":{"status":"resolved","repositories":{"trixie":"143.0.7499.169-1~deb13u1","trixie-security":"145.0.7632.159-1~deb13u1"},"fixed_version":"78.0.3904.87-1","urgency":"not yet assigned"}}},"CVE-2019-13692":{"description":"Insufficient policy enforcement in reader mode in Google Chrome prior to 77.0.3865.75 allowed a remote attacker to bypass site isolation via a crafted HTML page.","scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"143.0.7499.169-1~deb12u1","bookworm-security":"145.0.7632.159-1~deb12u1"},"fixed_version":"78.0.3904.87-1","urgency":"not yet assigned"},"bullseye":{"status":"resolved","repositories":{"bullseye":"120.0.6099.224-1~deb11u1","bullseye-security":"120.0.6099.224-1~deb11u1"},"fixed_version":"78.0.3904.87-1","urgency":"not yet assigned"},"forky":{"status":"resolved","repositories":{"forky":"145.0.7632.159-1"},"fixed_version":"78.0.3904.87-1","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"146.0.7680.71-1"},"fixed_version":"78.0.3904.87-1","urgency":"not yet assigned"},"trixie":{"status":"resolved","repositories":{"trixie":"143.0.7499.169-1~deb13u1","trixie-security":"145.0.7632.159-1~deb13u1"},"fixed_version":"78.0.3904.87-1","urgency":"not yet assigned"}}},"CVE-2019-13693":{"description":"Use after free in IndexedDB in Google Chrome prior to 77.0.3865.120 allowed a remote attacker who had compromised the renderer process to execute arbitrary code via a crafted HTML page.","scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"143.0.7499.169-1~deb12u1","bookworm-security":"145.0.7632.159-1~deb12u1"},"fixed_version":"78.0.3904.87-1","urgency":"not yet assigned"},"bullseye":{"status":"resolved","repositories":{"bullseye":"120.0.6099.224-1~deb11u1","bullseye-security":"120.0.6099.224-1~deb11u1"},"fixed_version":"78.0.3904.87-1","urgency":"not yet assigned"},"forky":{"status":"resolved","repositories":{"forky":"145.0.7632.159-1"},"fixed_version":"78.0.3904.87-1","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"146.0.7680.71-1"},"fixed_version":"78.0.3904.87-1","urgency":"not yet assigned"},"trixie":{"status":"resolved","repositories":{"trixie":"143.0.7499.169-1~deb13u1","trixie-security":"145.0.7632.159-1~deb13u1"},"fixed_version":"78.0.3904.87-1","urgency":"not yet assigned"}}},"CVE-2019-13694":{"description":"Use after free in WebRTC in Google Chrome prior to 77.0.3865.120 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page.","scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"143.0.7499.169-1~deb12u1","bookworm-security":"145.0.7632.159-1~deb12u1"},"fixed_version":"78.0.3904.87-1","urgency":"not yet assigned"},"bullseye":{"status":"resolved","repositories":{"bullseye":"120.0.6099.224-1~deb11u1","bullseye-security":"120.0.6099.224-1~deb11u1"},"fixed_version":"78.0.3904.87-1","urgency":"not yet assigned"},"forky":{"status":"resolved","repositories":{"forky":"145.0.7632.159-1"},"fixed_version":"78.0.3904.87-1","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"146.0.7680.71-1"},"fixed_version":"78.0.3904.87-1","urgency":"not yet assigned"},"trixie":{"status":"resolved","repositories":{"trixie":"143.0.7499.169-1~deb13u1","trixie-security":"145.0.7632.159-1~deb13u1"},"fixed_version":"78.0.3904.87-1","urgency":"not yet assigned"}}},"CVE-2019-13695":{"description":"Use after free in audio in Google Chrome on Android prior to 77.0.3865.120 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page.","scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"143.0.7499.169-1~deb12u1","bookworm-security":"145.0.7632.159-1~deb12u1"},"fixed_version":"78.0.3904.87-1","urgency":"not yet assigned"},"bullseye":{"status":"resolved","repositories":{"bullseye":"120.0.6099.224-1~deb11u1","bullseye-security":"120.0.6099.224-1~deb11u1"},"fixed_version":"78.0.3904.87-1","urgency":"not yet assigned"},"forky":{"status":"resolved","repositories":{"forky":"145.0.7632.159-1"},"fixed_version":"78.0.3904.87-1","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"146.0.7680.71-1"},"fixed_version":"78.0.3904.87-1","urgency":"not yet assigned"},"trixie":{"status":"resolved","repositories":{"trixie":"143.0.7499.169-1~deb13u1","trixie-security":"145.0.7632.159-1~deb13u1"},"fixed_version":"78.0.3904.87-1","urgency":"not yet assigned"}}},"CVE-2019-13696":{"description":"Use after free in JavaScript in Google Chrome prior to 77.0.3865.120 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page.","scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"143.0.7499.169-1~deb12u1","bookworm-security":"145.0.7632.159-1~deb12u1"},"fixed_version":"78.0.3904.87-1","urgency":"not yet assigned"},"bullseye":{"status":"resolved","repositories":{"bullseye":"120.0.6099.224-1~deb11u1","bullseye-security":"120.0.6099.224-1~deb11u1"},"fixed_version":"78.0.3904.87-1","urgency":"not yet assigned"},"forky":{"status":"resolved","repositories":{"forky":"145.0.7632.159-1"},"fixed_version":"78.0.3904.87-1","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"146.0.7680.71-1"},"fixed_version":"78.0.3904.87-1","urgency":"not yet assigned"},"trixie":{"status":"resolved","repositories":{"trixie":"143.0.7499.169-1~deb13u1","trixie-security":"145.0.7632.159-1~deb13u1"},"fixed_version":"78.0.3904.87-1","urgency":"not yet assigned"}}},"CVE-2019-13697":{"description":"Insufficient policy enforcement in performance APIs in Google Chrome prior to 77.0.3865.120 allowed a remote attacker to leak cross-origin data via a crafted HTML page.","scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"143.0.7499.169-1~deb12u1","bookworm-security":"145.0.7632.159-1~deb12u1"},"fixed_version":"78.0.3904.87-1","urgency":"not yet assigned"},"bullseye":{"status":"resolved","repositories":{"bullseye":"120.0.6099.224-1~deb11u1","bullseye-security":"120.0.6099.224-1~deb11u1"},"fixed_version":"78.0.3904.87-1","urgency":"not yet assigned"},"forky":{"status":"resolved","repositories":{"forky":"145.0.7632.159-1"},"fixed_version":"78.0.3904.87-1","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"146.0.7680.71-1"},"fixed_version":"78.0.3904.87-1","urgency":"not yet assigned"},"trixie":{"status":"resolved","repositories":{"trixie":"143.0.7499.169-1~deb13u1","trixie-security":"145.0.7632.159-1~deb13u1"},"fixed_version":"78.0.3904.87-1","urgency":"not yet assigned"}}},"CVE-2019-13698":{"description":"Out of bounds memory access in JavaScript in Google Chrome prior to 73.0.3683.103 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page.","scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"143.0.7499.169-1~deb12u1","bookworm-security":"145.0.7632.159-1~deb12u1"},"fixed_version":"74.0.3729.108-1","urgency":"not yet assigned"},"bullseye":{"status":"resolved","repositories":{"bullseye":"120.0.6099.224-1~deb11u1","bullseye-security":"120.0.6099.224-1~deb11u1"},"fixed_version":"74.0.3729.108-1","urgency":"not yet assigned"},"forky":{"status":"resolved","repositories":{"forky":"145.0.7632.159-1"},"fixed_version":"74.0.3729.108-1","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"146.0.7680.71-1"},"fixed_version":"74.0.3729.108-1","urgency":"not yet assigned"},"trixie":{"status":"resolved","repositories":{"trixie":"143.0.7499.169-1~deb13u1","trixie-security":"145.0.7632.159-1~deb13u1"},"fixed_version":"74.0.3729.108-1","urgency":"not yet assigned"}}},"CVE-2019-13699":{"description":"Use after free in media in Google Chrome prior to 78.0.3904.70 allowed a remote attacker who had compromised the renderer process to potentially exploit heap corruption via a crafted HTML page.","scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"143.0.7499.169-1~deb12u1","bookworm-security":"145.0.7632.159-1~deb12u1"},"fixed_version":"78.0.3904.87-1","urgency":"not yet assigned"},"bullseye":{"status":"resolved","repositories":{"bullseye":"120.0.6099.224-1~deb11u1","bullseye-security":"120.0.6099.224-1~deb11u1"},"fixed_version":"78.0.3904.87-1","urgency":"not yet assigned"},"forky":{"status":"resolved","repositories":{"forky":"145.0.7632.159-1"},"fixed_version":"78.0.3904.87-1","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"146.0.7680.71-1"},"fixed_version":"78.0.3904.87-1","urgency":"not yet assigned"},"trixie":{"status":"resolved","repositories":{"trixie":"143.0.7499.169-1~deb13u1","trixie-security":"145.0.7632.159-1~deb13u1"},"fixed_version":"78.0.3904.87-1","urgency":"not yet assigned"}}},"CVE-2019-13700":{"description":"Out of bounds memory access in the gamepad API in Google Chrome prior to 78.0.3904.70 allowed a remote attacker who had compromised the renderer process to potentially exploit heap corruption via a crafted HTML page.","scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"143.0.7499.169-1~deb12u1","bookworm-security":"145.0.7632.159-1~deb12u1"},"fixed_version":"78.0.3904.87-1","urgency":"not yet assigned"},"bullseye":{"status":"resolved","repositories":{"bullseye":"120.0.6099.224-1~deb11u1","bullseye-security":"120.0.6099.224-1~deb11u1"},"fixed_version":"78.0.3904.87-1","urgency":"not yet assigned"},"forky":{"status":"resolved","repositories":{"forky":"145.0.7632.159-1"},"fixed_version":"78.0.3904.87-1","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"146.0.7680.71-1"},"fixed_version":"78.0.3904.87-1","urgency":"not yet assigned"},"trixie":{"status":"resolved","repositories":{"trixie":"143.0.7499.169-1~deb13u1","trixie-security":"145.0.7632.159-1~deb13u1"},"fixed_version":"78.0.3904.87-1","urgency":"not yet assigned"}}},"CVE-2019-13701":{"description":"Incorrect implementation in navigation in Google Chrome prior to 78.0.3904.70 allowed a remote attacker to spoof the contents of the Omnibox (URL bar) via a crafted HTML page.","scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"143.0.7499.169-1~deb12u1","bookworm-security":"145.0.7632.159-1~deb12u1"},"fixed_version":"78.0.3904.87-1","urgency":"not yet assigned"},"bullseye":{"status":"resolved","repositories":{"bullseye":"120.0.6099.224-1~deb11u1","bullseye-security":"120.0.6099.224-1~deb11u1"},"fixed_version":"78.0.3904.87-1","urgency":"not yet assigned"},"forky":{"status":"resolved","repositories":{"forky":"145.0.7632.159-1"},"fixed_version":"78.0.3904.87-1","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"146.0.7680.71-1"},"fixed_version":"78.0.3904.87-1","urgency":"not yet assigned"},"trixie":{"status":"resolved","repositories":{"trixie":"143.0.7499.169-1~deb13u1","trixie-security":"145.0.7632.159-1~deb13u1"},"fixed_version":"78.0.3904.87-1","urgency":"not yet assigned"}}},"CVE-2019-13702":{"description":"Inappropriate implementation in installer in Google Chrome on Windows prior to 78.0.3904.70 allowed a local attacker to perform privilege escalation via a crafted executable.","scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"143.0.7499.169-1~deb12u1","bookworm-security":"145.0.7632.159-1~deb12u1"},"fixed_version":"0","urgency":"unimportant"},"bullseye":{"status":"resolved","repositories":{"bullseye":"120.0.6099.224-1~deb11u1","bullseye-security":"120.0.6099.224-1~deb11u1"},"fixed_version":"0","urgency":"unimportant"},"forky":{"status":"resolved","repositories":{"forky":"145.0.7632.159-1"},"fixed_version":"0","urgency":"unimportant"},"sid":{"status":"resolved","repositories":{"sid":"146.0.7680.71-1"},"fixed_version":"0","urgency":"unimportant"},"trixie":{"status":"resolved","repositories":{"trixie":"143.0.7499.169-1~deb13u1","trixie-security":"145.0.7632.159-1~deb13u1"},"fixed_version":"0","urgency":"unimportant"}}},"CVE-2019-13703":{"description":"Insufficient policy enforcement in the Omnibox in Google Chrome on Android prior to 78.0.3904.70 allowed a remote attacker to spoof the contents of the Omnibox (URL bar) via a crafted HTML page.","scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"143.0.7499.169-1~deb12u1","bookworm-security":"145.0.7632.159-1~deb12u1"},"fixed_version":"78.0.3904.87-1","urgency":"not yet assigned"},"bullseye":{"status":"resolved","repositories":{"bullseye":"120.0.6099.224-1~deb11u1","bullseye-security":"120.0.6099.224-1~deb11u1"},"fixed_version":"78.0.3904.87-1","urgency":"not yet assigned"},"forky":{"status":"resolved","repositories":{"forky":"145.0.7632.159-1"},"fixed_version":"78.0.3904.87-1","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"146.0.7680.71-1"},"fixed_version":"78.0.3904.87-1","urgency":"not yet assigned"},"trixie":{"status":"resolved","repositories":{"trixie":"143.0.7499.169-1~deb13u1","trixie-security":"145.0.7632.159-1~deb13u1"},"fixed_version":"78.0.3904.87-1","urgency":"not yet assigned"}}},"CVE-2019-13704":{"description":"Insufficient policy enforcement in navigation in Google Chrome prior to 78.0.3904.70 allowed a remote attacker to bypass content security policy via a crafted HTML page.","scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"143.0.7499.169-1~deb12u1","bookworm-security":"145.0.7632.159-1~deb12u1"},"fixed_version":"78.0.3904.87-1","urgency":"not yet assigned"},"bullseye":{"status":"resolved","repositories":{"bullseye":"120.0.6099.224-1~deb11u1","bullseye-security":"120.0.6099.224-1~deb11u1"},"fixed_version":"78.0.3904.87-1","urgency":"not yet assigned"},"forky":{"status":"resolved","repositories":{"forky":"145.0.7632.159-1"},"fixed_version":"78.0.3904.87-1","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"146.0.7680.71-1"},"fixed_version":"78.0.3904.87-1","urgency":"not yet assigned"},"trixie":{"status":"resolved","repositories":{"trixie":"143.0.7499.169-1~deb13u1","trixie-security":"145.0.7632.159-1~deb13u1"},"fixed_version":"78.0.3904.87-1","urgency":"not yet assigned"}}},"CVE-2019-13705":{"description":"Insufficient policy enforcement in extensions in Google Chrome prior to 78.0.3904.70 allowed an attacker who convinced a user to install a malicious extension to leak cross-origin data via a crafted Chrome Extension.","scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"143.0.7499.169-1~deb12u1","bookworm-security":"145.0.7632.159-1~deb12u1"},"fixed_version":"78.0.3904.87-1","urgency":"not yet assigned"},"bullseye":{"status":"resolved","repositories":{"bullseye":"120.0.6099.224-1~deb11u1","bullseye-security":"120.0.6099.224-1~deb11u1"},"fixed_version":"78.0.3904.87-1","urgency":"not yet assigned"},"forky":{"status":"resolved","repositories":{"forky":"145.0.7632.159-1"},"fixed_version":"78.0.3904.87-1","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"146.0.7680.71-1"},"fixed_version":"78.0.3904.87-1","urgency":"not yet assigned"},"trixie":{"status":"resolved","repositories":{"trixie":"143.0.7499.169-1~deb13u1","trixie-security":"145.0.7632.159-1~deb13u1"},"fixed_version":"78.0.3904.87-1","urgency":"not yet assigned"}}},"CVE-2019-13706":{"description":"Out of bounds memory access in PDFium in Google Chrome prior to 78.0.3904.70 allowed a remote attacker to potentially exploit heap corruption via a crafted PDF file.","scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"143.0.7499.169-1~deb12u1","bookworm-security":"145.0.7632.159-1~deb12u1"},"fixed_version":"78.0.3904.87-1","urgency":"not yet assigned"},"bullseye":{"status":"resolved","repositories":{"bullseye":"120.0.6099.224-1~deb11u1","bullseye-security":"120.0.6099.224-1~deb11u1"},"fixed_version":"78.0.3904.87-1","urgency":"not yet assigned"},"forky":{"status":"resolved","repositories":{"forky":"145.0.7632.159-1"},"fixed_version":"78.0.3904.87-1","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"146.0.7680.71-1"},"fixed_version":"78.0.3904.87-1","urgency":"not yet assigned"},"trixie":{"status":"resolved","repositories":{"trixie":"143.0.7499.169-1~deb13u1","trixie-security":"145.0.7632.159-1~deb13u1"},"fixed_version":"78.0.3904.87-1","urgency":"not yet assigned"}}},"CVE-2019-13707":{"description":"Insufficient validation of untrusted input in intents in Google Chrome on Android prior to 78.0.3904.70 allowed a local attacker to leak files via a crafted application.","scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"143.0.7499.169-1~deb12u1","bookworm-security":"145.0.7632.159-1~deb12u1"},"fixed_version":"78.0.3904.87-1","urgency":"not yet assigned"},"bullseye":{"status":"resolved","repositories":{"bullseye":"120.0.6099.224-1~deb11u1","bullseye-security":"120.0.6099.224-1~deb11u1"},"fixed_version":"78.0.3904.87-1","urgency":"not yet assigned"},"forky":{"status":"resolved","repositories":{"forky":"145.0.7632.159-1"},"fixed_version":"78.0.3904.87-1","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"146.0.7680.71-1"},"fixed_version":"78.0.3904.87-1","urgency":"not yet assigned"},"trixie":{"status":"resolved","repositories":{"trixie":"143.0.7499.169-1~deb13u1","trixie-security":"145.0.7632.159-1~deb13u1"},"fixed_version":"78.0.3904.87-1","urgency":"not yet assigned"}}},"CVE-2019-13708":{"description":"Inappropriate implementation in navigation in Google Chrome on iOS prior to 78.0.3904.70 allowed a remote attacker to spoof the contents of the Omnibox (URL bar) via a crafted HTML page.","scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"143.0.7499.169-1~deb12u1","bookworm-security":"145.0.7632.159-1~deb12u1"},"fixed_version":"78.0.3904.87-1","urgency":"not yet assigned"},"bullseye":{"status":"resolved","repositories":{"bullseye":"120.0.6099.224-1~deb11u1","bullseye-security":"120.0.6099.224-1~deb11u1"},"fixed_version":"78.0.3904.87-1","urgency":"not yet assigned"},"forky":{"status":"resolved","repositories":{"forky":"145.0.7632.159-1"},"fixed_version":"78.0.3904.87-1","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"146.0.7680.71-1"},"fixed_version":"78.0.3904.87-1","urgency":"not yet assigned"},"trixie":{"status":"resolved","repositories":{"trixie":"143.0.7499.169-1~deb13u1","trixie-security":"145.0.7632.159-1~deb13u1"},"fixed_version":"78.0.3904.87-1","urgency":"not yet assigned"}}},"CVE-2019-13709":{"description":"Insufficient policy enforcement in downloads in Google Chrome prior to 78.0.3904.70 allowed a remote attacker to bypass download restrictions via a crafted HTML page.","scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"143.0.7499.169-1~deb12u1","bookworm-security":"145.0.7632.159-1~deb12u1"},"fixed_version":"78.0.3904.87-1","urgency":"not yet assigned"},"bullseye":{"status":"resolved","repositories":{"bullseye":"120.0.6099.224-1~deb11u1","bullseye-security":"120.0.6099.224-1~deb11u1"},"fixed_version":"78.0.3904.87-1","urgency":"not yet assigned"},"forky":{"status":"resolved","repositories":{"forky":"145.0.7632.159-1"},"fixed_version":"78.0.3904.87-1","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"146.0.7680.71-1"},"fixed_version":"78.0.3904.87-1","urgency":"not yet assigned"},"trixie":{"status":"resolved","repositories":{"trixie":"143.0.7499.169-1~deb13u1","trixie-security":"145.0.7632.159-1~deb13u1"},"fixed_version":"78.0.3904.87-1","urgency":"not yet assigned"}}},"CVE-2019-13710":{"description":"Insufficient validation of untrusted input in downloads in Google Chrome prior to 78.0.3904.70 allowed a remote attacker to bypass download restrictions via a crafted HTML page.","scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"143.0.7499.169-1~deb12u1","bookworm-security":"145.0.7632.159-1~deb12u1"},"fixed_version":"78.0.3904.87-1","urgency":"not yet assigned"},"bullseye":{"status":"resolved","repositories":{"bullseye":"120.0.6099.224-1~deb11u1","bullseye-security":"120.0.6099.224-1~deb11u1"},"fixed_version":"78.0.3904.87-1","urgency":"not yet assigned"},"forky":{"status":"resolved","repositories":{"forky":"145.0.7632.159-1"},"fixed_version":"78.0.3904.87-1","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"146.0.7680.71-1"},"fixed_version":"78.0.3904.87-1","urgency":"not yet assigned"},"trixie":{"status":"resolved","repositories":{"trixie":"143.0.7499.169-1~deb13u1","trixie-security":"145.0.7632.159-1~deb13u1"},"fixed_version":"78.0.3904.87-1","urgency":"not yet assigned"}}},"CVE-2019-13711":{"description":"Insufficient policy enforcement in JavaScript in Google Chrome prior to 78.0.3904.70 allowed a remote attacker to leak cross-origin data via a crafted HTML page.","scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"143.0.7499.169-1~deb12u1","bookworm-security":"145.0.7632.159-1~deb12u1"},"fixed_version":"78.0.3904.87-1","urgency":"not yet assigned"},"bullseye":{"status":"resolved","repositories":{"bullseye":"120.0.6099.224-1~deb11u1","bullseye-security":"120.0.6099.224-1~deb11u1"},"fixed_version":"78.0.3904.87-1","urgency":"not yet assigned"},"forky":{"status":"resolved","repositories":{"forky":"145.0.7632.159-1"},"fixed_version":"78.0.3904.87-1","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"146.0.7680.71-1"},"fixed_version":"78.0.3904.87-1","urgency":"not yet assigned"},"trixie":{"status":"resolved","repositories":{"trixie":"143.0.7499.169-1~deb13u1","trixie-security":"145.0.7632.159-1~deb13u1"},"fixed_version":"78.0.3904.87-1","urgency":"not yet assigned"}}},"CVE-2019-13713":{"description":"Insufficient policy enforcement in JavaScript in Google Chrome prior to 78.0.3904.70 allowed a remote attacker to leak cross-origin data via a crafted HTML page.","scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"143.0.7499.169-1~deb12u1","bookworm-security":"145.0.7632.159-1~deb12u1"},"fixed_version":"78.0.3904.87-1","urgency":"not yet assigned"},"bullseye":{"status":"resolved","repositories":{"bullseye":"120.0.6099.224-1~deb11u1","bullseye-security":"120.0.6099.224-1~deb11u1"},"fixed_version":"78.0.3904.87-1","urgency":"not yet assigned"},"forky":{"status":"resolved","repositories":{"forky":"145.0.7632.159-1"},"fixed_version":"78.0.3904.87-1","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"146.0.7680.71-1"},"fixed_version":"78.0.3904.87-1","urgency":"not yet assigned"},"trixie":{"status":"resolved","repositories":{"trixie":"143.0.7499.169-1~deb13u1","trixie-security":"145.0.7632.159-1~deb13u1"},"fixed_version":"78.0.3904.87-1","urgency":"not yet assigned"}}},"CVE-2019-13714":{"description":"Insufficient validation of untrusted input in Color Enhancer extension in Google Chrome prior to 78.0.3904.70 allowed a remote attacker to inject CSS into an HTML page via a crafted URL.","scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"143.0.7499.169-1~deb12u1","bookworm-security":"145.0.7632.159-1~deb12u1"},"fixed_version":"78.0.3904.87-1","urgency":"not yet assigned"},"bullseye":{"status":"resolved","repositories":{"bullseye":"120.0.6099.224-1~deb11u1","bullseye-security":"120.0.6099.224-1~deb11u1"},"fixed_version":"78.0.3904.87-1","urgency":"not yet assigned"},"forky":{"status":"resolved","repositories":{"forky":"145.0.7632.159-1"},"fixed_version":"78.0.3904.87-1","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"146.0.7680.71-1"},"fixed_version":"78.0.3904.87-1","urgency":"not yet assigned"},"trixie":{"status":"resolved","repositories":{"trixie":"143.0.7499.169-1~deb13u1","trixie-security":"145.0.7632.159-1~deb13u1"},"fixed_version":"78.0.3904.87-1","urgency":"not yet assigned"}}},"CVE-2019-13715":{"description":"Insufficient validation of untrusted input in Omnibox in Google Chrome prior to 78.0.3904.70 allowed a remote attacker to perform domain spoofing via IDN homographs via a crafted domain name.","scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"143.0.7499.169-1~deb12u1","bookworm-security":"145.0.7632.159-1~deb12u1"},"fixed_version":"78.0.3904.87-1","urgency":"not yet assigned"},"bullseye":{"status":"resolved","repositories":{"bullseye":"120.0.6099.224-1~deb11u1","bullseye-security":"120.0.6099.224-1~deb11u1"},"fixed_version":"78.0.3904.87-1","urgency":"not yet assigned"},"forky":{"status":"resolved","repositories":{"forky":"145.0.7632.159-1"},"fixed_version":"78.0.3904.87-1","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"146.0.7680.71-1"},"fixed_version":"78.0.3904.87-1","urgency":"not yet assigned"},"trixie":{"status":"resolved","repositories":{"trixie":"143.0.7499.169-1~deb13u1","trixie-security":"145.0.7632.159-1~deb13u1"},"fixed_version":"78.0.3904.87-1","urgency":"not yet assigned"}}},"CVE-2019-13716":{"description":"Insufficient policy enforcement in service workers in Google Chrome prior to 78.0.3904.70 allowed a remote attacker to bypass navigation restrictions via a crafted HTML page.","scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"143.0.7499.169-1~deb12u1","bookworm-security":"145.0.7632.159-1~deb12u1"},"fixed_version":"78.0.3904.87-1","urgency":"not yet assigned"},"bullseye":{"status":"resolved","repositories":{"bullseye":"120.0.6099.224-1~deb11u1","bullseye-security":"120.0.6099.224-1~deb11u1"},"fixed_version":"78.0.3904.87-1","urgency":"not yet assigned"},"forky":{"status":"resolved","repositories":{"forky":"145.0.7632.159-1"},"fixed_version":"78.0.3904.87-1","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"146.0.7680.71-1"},"fixed_version":"78.0.3904.87-1","urgency":"not yet assigned"},"trixie":{"status":"resolved","repositories":{"trixie":"143.0.7499.169-1~deb13u1","trixie-security":"145.0.7632.159-1~deb13u1"},"fixed_version":"78.0.3904.87-1","urgency":"not yet assigned"}}},"CVE-2019-13717":{"description":"Incorrect security UI in full screen mode in Google Chrome prior to 78.0.3904.70 allowed a remote attacker to hide security UI via a crafted HTML page.","scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"143.0.7499.169-1~deb12u1","bookworm-security":"145.0.7632.159-1~deb12u1"},"fixed_version":"78.0.3904.87-1","urgency":"not yet assigned"},"bullseye":{"status":"resolved","repositories":{"bullseye":"120.0.6099.224-1~deb11u1","bullseye-security":"120.0.6099.224-1~deb11u1"},"fixed_version":"78.0.3904.87-1","urgency":"not yet assigned"},"forky":{"status":"resolved","repositories":{"forky":"145.0.7632.159-1"},"fixed_version":"78.0.3904.87-1","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"146.0.7680.71-1"},"fixed_version":"78.0.3904.87-1","urgency":"not yet assigned"},"trixie":{"status":"resolved","repositories":{"trixie":"143.0.7499.169-1~deb13u1","trixie-security":"145.0.7632.159-1~deb13u1"},"fixed_version":"78.0.3904.87-1","urgency":"not yet assigned"}}},"CVE-2019-13718":{"description":"Insufficient data validation in Omnibox in Google Chrome prior to 78.0.3904.70 allowed a remote attacker to perform domain spoofing via IDN homographs via a crafted domain name.","scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"143.0.7499.169-1~deb12u1","bookworm-security":"145.0.7632.159-1~deb12u1"},"fixed_version":"78.0.3904.87-1","urgency":"not yet assigned"},"bullseye":{"status":"resolved","repositories":{"bullseye":"120.0.6099.224-1~deb11u1","bullseye-security":"120.0.6099.224-1~deb11u1"},"fixed_version":"78.0.3904.87-1","urgency":"not yet assigned"},"forky":{"status":"resolved","repositories":{"forky":"145.0.7632.159-1"},"fixed_version":"78.0.3904.87-1","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"146.0.7680.71-1"},"fixed_version":"78.0.3904.87-1","urgency":"not yet assigned"},"trixie":{"status":"resolved","repositories":{"trixie":"143.0.7499.169-1~deb13u1","trixie-security":"145.0.7632.159-1~deb13u1"},"fixed_version":"78.0.3904.87-1","urgency":"not yet assigned"}}},"CVE-2019-13719":{"description":"Incorrect security UI in full screen mode in Google Chrome prior to 78.0.3904.70 allowed a remote attacker to hide security UI via a crafted HTML page.","scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"143.0.7499.169-1~deb12u1","bookworm-security":"145.0.7632.159-1~deb12u1"},"fixed_version":"78.0.3904.87-1","urgency":"not yet assigned"},"bullseye":{"status":"resolved","repositories":{"bullseye":"120.0.6099.224-1~deb11u1","bullseye-security":"120.0.6099.224-1~deb11u1"},"fixed_version":"78.0.3904.87-1","urgency":"not yet assigned"},"forky":{"status":"resolved","repositories":{"forky":"145.0.7632.159-1"},"fixed_version":"78.0.3904.87-1","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"146.0.7680.71-1"},"fixed_version":"78.0.3904.87-1","urgency":"not yet assigned"},"trixie":{"status":"resolved","repositories":{"trixie":"143.0.7499.169-1~deb13u1","trixie-security":"145.0.7632.159-1~deb13u1"},"fixed_version":"78.0.3904.87-1","urgency":"not yet assigned"}}},"CVE-2019-13720":{"description":"Use after free in WebAudio in Google Chrome prior to 78.0.3904.87 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page.","scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"143.0.7499.169-1~deb12u1","bookworm-security":"145.0.7632.159-1~deb12u1"},"fixed_version":"78.0.3904.87-1","urgency":"not yet assigned"},"bullseye":{"status":"resolved","repositories":{"bullseye":"120.0.6099.224-1~deb11u1","bullseye-security":"120.0.6099.224-1~deb11u1"},"fixed_version":"78.0.3904.87-1","urgency":"not yet assigned"},"forky":{"status":"resolved","repositories":{"forky":"145.0.7632.159-1"},"fixed_version":"78.0.3904.87-1","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"146.0.7680.71-1"},"fixed_version":"78.0.3904.87-1","urgency":"not yet assigned"},"trixie":{"status":"resolved","repositories":{"trixie":"143.0.7499.169-1~deb13u1","trixie-security":"145.0.7632.159-1~deb13u1"},"fixed_version":"78.0.3904.87-1","urgency":"not yet assigned"}}},"CVE-2019-13721":{"description":"Use after free in PDFium in Google Chrome prior to 78.0.3904.87 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page.","scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"143.0.7499.169-1~deb12u1","bookworm-security":"145.0.7632.159-1~deb12u1"},"fixed_version":"78.0.3904.87-1","urgency":"not yet assigned"},"bullseye":{"status":"resolved","repositories":{"bullseye":"120.0.6099.224-1~deb11u1","bullseye-security":"120.0.6099.224-1~deb11u1"},"fixed_version":"78.0.3904.87-1","urgency":"not yet assigned"},"forky":{"status":"resolved","repositories":{"forky":"145.0.7632.159-1"},"fixed_version":"78.0.3904.87-1","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"146.0.7680.71-1"},"fixed_version":"78.0.3904.87-1","urgency":"not yet assigned"},"trixie":{"status":"resolved","repositories":{"trixie":"143.0.7499.169-1~deb13u1","trixie-security":"145.0.7632.159-1~deb13u1"},"fixed_version":"78.0.3904.87-1","urgency":"not yet assigned"}}},"CVE-2019-13723":{"description":"Use after free in WebBluetooth in Google Chrome prior to 78.0.3904.108 allowed a remote attacker who had compromised the renderer process to potentially exploit heap corruption via a crafted HTML page.","scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"143.0.7499.169-1~deb12u1","bookworm-security":"145.0.7632.159-1~deb12u1"},"fixed_version":"78.0.3904.108-1","urgency":"not yet assigned"},"bullseye":{"status":"resolved","repositories":{"bullseye":"120.0.6099.224-1~deb11u1","bullseye-security":"120.0.6099.224-1~deb11u1"},"fixed_version":"78.0.3904.108-1","urgency":"not yet assigned"},"forky":{"status":"resolved","repositories":{"forky":"145.0.7632.159-1"},"fixed_version":"78.0.3904.108-1","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"146.0.7680.71-1"},"fixed_version":"78.0.3904.108-1","urgency":"not yet assigned"},"trixie":{"status":"resolved","repositories":{"trixie":"143.0.7499.169-1~deb13u1","trixie-security":"145.0.7632.159-1~deb13u1"},"fixed_version":"78.0.3904.108-1","urgency":"not yet assigned"}}},"CVE-2019-13724":{"description":"Out of bounds memory access in WebBluetooth in Google Chrome prior to 78.0.3904.108 allowed a remote attacker who had compromised the renderer process to potentially exploit heap corruption via a crafted HTML page.","scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"143.0.7499.169-1~deb12u1","bookworm-security":"145.0.7632.159-1~deb12u1"},"fixed_version":"78.0.3904.108-1","urgency":"not yet assigned"},"bullseye":{"status":"resolved","repositories":{"bullseye":"120.0.6099.224-1~deb11u1","bullseye-security":"120.0.6099.224-1~deb11u1"},"fixed_version":"78.0.3904.108-1","urgency":"not yet assigned"},"forky":{"status":"resolved","repositories":{"forky":"145.0.7632.159-1"},"fixed_version":"78.0.3904.108-1","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"146.0.7680.71-1"},"fixed_version":"78.0.3904.108-1","urgency":"not yet assigned"},"trixie":{"status":"resolved","repositories":{"trixie":"143.0.7499.169-1~deb13u1","trixie-security":"145.0.7632.159-1~deb13u1"},"fixed_version":"78.0.3904.108-1","urgency":"not yet assigned"}}},"CVE-2019-13725":{"description":"Use-after-free in Bluetooth in Google Chrome prior to 79.0.3945.79 allowed a remote attacker to execute arbitrary code via a crafted HTML page.","scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"143.0.7499.169-1~deb12u1","bookworm-security":"145.0.7632.159-1~deb12u1"},"fixed_version":"79.0.3945.79-1","urgency":"not yet assigned"},"bullseye":{"status":"resolved","repositories":{"bullseye":"120.0.6099.224-1~deb11u1","bullseye-security":"120.0.6099.224-1~deb11u1"},"fixed_version":"79.0.3945.79-1","urgency":"not yet assigned"},"forky":{"status":"resolved","repositories":{"forky":"145.0.7632.159-1"},"fixed_version":"79.0.3945.79-1","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"146.0.7680.71-1"},"fixed_version":"79.0.3945.79-1","urgency":"not yet assigned"},"trixie":{"status":"resolved","repositories":{"trixie":"143.0.7499.169-1~deb13u1","trixie-security":"145.0.7632.159-1~deb13u1"},"fixed_version":"79.0.3945.79-1","urgency":"not yet assigned"}}},"CVE-2019-13726":{"description":"Buffer overflow in password manager in Google Chrome prior to 79.0.3945.79 allowed a remote attacker to execute arbitrary code via a crafted HTML page.","scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"143.0.7499.169-1~deb12u1","bookworm-security":"145.0.7632.159-1~deb12u1"},"fixed_version":"79.0.3945.79-1","urgency":"not yet assigned"},"bullseye":{"status":"resolved","repositories":{"bullseye":"120.0.6099.224-1~deb11u1","bullseye-security":"120.0.6099.224-1~deb11u1"},"fixed_version":"79.0.3945.79-1","urgency":"not yet assigned"},"forky":{"status":"resolved","repositories":{"forky":"145.0.7632.159-1"},"fixed_version":"79.0.3945.79-1","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"146.0.7680.71-1"},"fixed_version":"79.0.3945.79-1","urgency":"not yet assigned"},"trixie":{"status":"resolved","repositories":{"trixie":"143.0.7499.169-1~deb13u1","trixie-security":"145.0.7632.159-1~deb13u1"},"fixed_version":"79.0.3945.79-1","urgency":"not yet assigned"}}},"CVE-2019-13727":{"description":"Insufficient policy enforcement in WebSockets in Google Chrome prior to 79.0.3945.79 allowed a remote attacker to bypass same origin policy via a crafted HTML page.","scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"143.0.7499.169-1~deb12u1","bookworm-security":"145.0.7632.159-1~deb12u1"},"fixed_version":"79.0.3945.79-1","urgency":"not yet assigned"},"bullseye":{"status":"resolved","repositories":{"bullseye":"120.0.6099.224-1~deb11u1","bullseye-security":"120.0.6099.224-1~deb11u1"},"fixed_version":"79.0.3945.79-1","urgency":"not yet assigned"},"forky":{"status":"resolved","repositories":{"forky":"145.0.7632.159-1"},"fixed_version":"79.0.3945.79-1","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"146.0.7680.71-1"},"fixed_version":"79.0.3945.79-1","urgency":"not yet assigned"},"trixie":{"status":"resolved","repositories":{"trixie":"143.0.7499.169-1~deb13u1","trixie-security":"145.0.7632.159-1~deb13u1"},"fixed_version":"79.0.3945.79-1","urgency":"not yet assigned"}}},"CVE-2019-13728":{"description":"Out of bounds write in JavaScript in Google Chrome prior to 79.0.3945.79 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page.","scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"143.0.7499.169-1~deb12u1","bookworm-security":"145.0.7632.159-1~deb12u1"},"fixed_version":"79.0.3945.79-1","urgency":"not yet assigned"},"bullseye":{"status":"resolved","repositories":{"bullseye":"120.0.6099.224-1~deb11u1","bullseye-security":"120.0.6099.224-1~deb11u1"},"fixed_version":"79.0.3945.79-1","urgency":"not yet assigned"},"forky":{"status":"resolved","repositories":{"forky":"145.0.7632.159-1"},"fixed_version":"79.0.3945.79-1","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"146.0.7680.71-1"},"fixed_version":"79.0.3945.79-1","urgency":"not yet assigned"},"trixie":{"status":"resolved","repositories":{"trixie":"143.0.7499.169-1~deb13u1","trixie-security":"145.0.7632.159-1~deb13u1"},"fixed_version":"79.0.3945.79-1","urgency":"not yet assigned"}}},"CVE-2019-13729":{"description":"Use-after-free in WebSockets in Google Chrome prior to 79.0.3945.79 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page.","scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"143.0.7499.169-1~deb12u1","bookworm-security":"145.0.7632.159-1~deb12u1"},"fixed_version":"79.0.3945.79-1","urgency":"not yet assigned"},"bullseye":{"status":"resolved","repositories":{"bullseye":"120.0.6099.224-1~deb11u1","bullseye-security":"120.0.6099.224-1~deb11u1"},"fixed_version":"79.0.3945.79-1","urgency":"not yet assigned"},"forky":{"status":"resolved","repositories":{"forky":"145.0.7632.159-1"},"fixed_version":"79.0.3945.79-1","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"146.0.7680.71-1"},"fixed_version":"79.0.3945.79-1","urgency":"not yet assigned"},"trixie":{"status":"resolved","repositories":{"trixie":"143.0.7499.169-1~deb13u1","trixie-security":"145.0.7632.159-1~deb13u1"},"fixed_version":"79.0.3945.79-1","urgency":"not yet assigned"}}},"CVE-2019-13730":{"description":"Type confusion in JavaScript in Google Chrome prior to 79.0.3945.79 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page.","scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"143.0.7499.169-1~deb12u1","bookworm-security":"145.0.7632.159-1~deb12u1"},"fixed_version":"79.0.3945.79-1","urgency":"not yet assigned"},"bullseye":{"status":"resolved","repositories":{"bullseye":"120.0.6099.224-1~deb11u1","bullseye-security":"120.0.6099.224-1~deb11u1"},"fixed_version":"79.0.3945.79-1","urgency":"not yet assigned"},"forky":{"status":"resolved","repositories":{"forky":"145.0.7632.159-1"},"fixed_version":"79.0.3945.79-1","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"146.0.7680.71-1"},"fixed_version":"79.0.3945.79-1","urgency":"not yet assigned"},"trixie":{"status":"resolved","repositories":{"trixie":"143.0.7499.169-1~deb13u1","trixie-security":"145.0.7632.159-1~deb13u1"},"fixed_version":"79.0.3945.79-1","urgency":"not yet assigned"}}},"CVE-2019-13732":{"description":"Use-after-free in WebAudio in Google Chrome prior to 79.0.3945.79 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page.","scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"143.0.7499.169-1~deb12u1","bookworm-security":"145.0.7632.159-1~deb12u1"},"fixed_version":"79.0.3945.79-1","urgency":"not yet assigned"},"bullseye":{"status":"resolved","repositories":{"bullseye":"120.0.6099.224-1~deb11u1","bullseye-security":"120.0.6099.224-1~deb11u1"},"fixed_version":"79.0.3945.79-1","urgency":"not yet assigned"},"forky":{"status":"resolved","repositories":{"forky":"145.0.7632.159-1"},"fixed_version":"79.0.3945.79-1","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"146.0.7680.71-1"},"fixed_version":"79.0.3945.79-1","urgency":"not yet assigned"},"trixie":{"status":"resolved","repositories":{"trixie":"143.0.7499.169-1~deb13u1","trixie-security":"145.0.7632.159-1~deb13u1"},"fixed_version":"79.0.3945.79-1","urgency":"not yet assigned"}}},"CVE-2019-13734":{"description":"Out of bounds write in SQLite in Google Chrome prior to 79.0.3945.79 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page.","scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"143.0.7499.169-1~deb12u1","bookworm-security":"145.0.7632.159-1~deb12u1"},"fixed_version":"79.0.3945.79-1","urgency":"not yet assigned"},"bullseye":{"status":"resolved","repositories":{"bullseye":"120.0.6099.224-1~deb11u1","bullseye-security":"120.0.6099.224-1~deb11u1"},"fixed_version":"79.0.3945.79-1","urgency":"not yet assigned"},"forky":{"status":"resolved","repositories":{"forky":"145.0.7632.159-1"},"fixed_version":"79.0.3945.79-1","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"146.0.7680.71-1"},"fixed_version":"79.0.3945.79-1","urgency":"not yet assigned"},"trixie":{"status":"resolved","repositories":{"trixie":"143.0.7499.169-1~deb13u1","trixie-security":"145.0.7632.159-1~deb13u1"},"fixed_version":"79.0.3945.79-1","urgency":"not yet assigned"}}},"CVE-2019-13735":{"description":"Out of bounds write in JavaScript in Google Chrome prior to 79.0.3945.79 allowed a remote attacker to execute arbitrary code inside a sandbox via a crafted HTML page.","scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"143.0.7499.169-1~deb12u1","bookworm-security":"145.0.7632.159-1~deb12u1"},"fixed_version":"79.0.3945.79-1","urgency":"not yet assigned"},"bullseye":{"status":"resolved","repositories":{"bullseye":"120.0.6099.224-1~deb11u1","bullseye-security":"120.0.6099.224-1~deb11u1"},"fixed_version":"79.0.3945.79-1","urgency":"not yet assigned"},"forky":{"status":"resolved","repositories":{"forky":"145.0.7632.159-1"},"fixed_version":"79.0.3945.79-1","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"146.0.7680.71-1"},"fixed_version":"79.0.3945.79-1","urgency":"not yet assigned"},"trixie":{"status":"resolved","repositories":{"trixie":"143.0.7499.169-1~deb13u1","trixie-security":"145.0.7632.159-1~deb13u1"},"fixed_version":"79.0.3945.79-1","urgency":"not yet assigned"}}},"CVE-2019-13736":{"description":"Integer overflow in PDFium in Google Chrome prior to 79.0.3945.79 allowed a remote attacker to potentially exploit heap corruption via a crafted PDF file.","scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"143.0.7499.169-1~deb12u1","bookworm-security":"145.0.7632.159-1~deb12u1"},"fixed_version":"79.0.3945.79-1","urgency":"not yet assigned"},"bullseye":{"status":"resolved","repositories":{"bullseye":"120.0.6099.224-1~deb11u1","bullseye-security":"120.0.6099.224-1~deb11u1"},"fixed_version":"79.0.3945.79-1","urgency":"not yet assigned"},"forky":{"status":"resolved","repositories":{"forky":"145.0.7632.159-1"},"fixed_version":"79.0.3945.79-1","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"146.0.7680.71-1"},"fixed_version":"79.0.3945.79-1","urgency":"not yet assigned"},"trixie":{"status":"resolved","repositories":{"trixie":"143.0.7499.169-1~deb13u1","trixie-security":"145.0.7632.159-1~deb13u1"},"fixed_version":"79.0.3945.79-1","urgency":"not yet assigned"}}},"CVE-2019-13737":{"description":"Insufficient policy enforcement in autocomplete in Google Chrome prior to 79.0.3945.79 allowed a remote attacker to obtain potentially sensitive information from process memory via a crafted HTML page.","scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"143.0.7499.169-1~deb12u1","bookworm-security":"145.0.7632.159-1~deb12u1"},"fixed_version":"79.0.3945.79-1","urgency":"not yet assigned"},"bullseye":{"status":"resolved","repositories":{"bullseye":"120.0.6099.224-1~deb11u1","bullseye-security":"120.0.6099.224-1~deb11u1"},"fixed_version":"79.0.3945.79-1","urgency":"not yet assigned"},"forky":{"status":"resolved","repositories":{"forky":"145.0.7632.159-1"},"fixed_version":"79.0.3945.79-1","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"146.0.7680.71-1"},"fixed_version":"79.0.3945.79-1","urgency":"not yet assigned"},"trixie":{"status":"resolved","repositories":{"trixie":"143.0.7499.169-1~deb13u1","trixie-security":"145.0.7632.159-1~deb13u1"},"fixed_version":"79.0.3945.79-1","urgency":"not yet assigned"}}},"CVE-2019-13738":{"description":"Insufficient policy enforcement in navigation in Google Chrome prior to 79.0.3945.79 allowed a remote attacker to bypass site isolation via a crafted HTML page.","scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"143.0.7499.169-1~deb12u1","bookworm-security":"145.0.7632.159-1~deb12u1"},"fixed_version":"79.0.3945.79-1","urgency":"not yet assigned"},"bullseye":{"status":"resolved","repositories":{"bullseye":"120.0.6099.224-1~deb11u1","bullseye-security":"120.0.6099.224-1~deb11u1"},"fixed_version":"79.0.3945.79-1","urgency":"not yet assigned"},"forky":{"status":"resolved","repositories":{"forky":"145.0.7632.159-1"},"fixed_version":"79.0.3945.79-1","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"146.0.7680.71-1"},"fixed_version":"79.0.3945.79-1","urgency":"not yet assigned"},"trixie":{"status":"resolved","repositories":{"trixie":"143.0.7499.169-1~deb13u1","trixie-security":"145.0.7632.159-1~deb13u1"},"fixed_version":"79.0.3945.79-1","urgency":"not yet assigned"}}},"CVE-2019-13739":{"description":"Insufficient policy enforcement in Omnibox in Google Chrome prior to 79.0.3945.79 allowed a remote attacker to perform domain spoofing via IDN homographs via a crafted domain name.","scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"143.0.7499.169-1~deb12u1","bookworm-security":"145.0.7632.159-1~deb12u1"},"fixed_version":"79.0.3945.79-1","urgency":"not yet assigned"},"bullseye":{"status":"resolved","repositories":{"bullseye":"120.0.6099.224-1~deb11u1","bullseye-security":"120.0.6099.224-1~deb11u1"},"fixed_version":"79.0.3945.79-1","urgency":"not yet assigned"},"forky":{"status":"resolved","repositories":{"forky":"145.0.7632.159-1"},"fixed_version":"79.0.3945.79-1","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"146.0.7680.71-1"},"fixed_version":"79.0.3945.79-1","urgency":"not yet assigned"},"trixie":{"status":"resolved","repositories":{"trixie":"143.0.7499.169-1~deb13u1","trixie-security":"145.0.7632.159-1~deb13u1"},"fixed_version":"79.0.3945.79-1","urgency":"not yet assigned"}}},"CVE-2019-13740":{"description":"Incorrect security UI in sharing in Google Chrome prior to 79.0.3945.79 allowed a remote attacker to perform domain spoofing via a crafted HTML page.","scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"143.0.7499.169-1~deb12u1","bookworm-security":"145.0.7632.159-1~deb12u1"},"fixed_version":"79.0.3945.79-1","urgency":"not yet assigned"},"bullseye":{"status":"resolved","repositories":{"bullseye":"120.0.6099.224-1~deb11u1","bullseye-security":"120.0.6099.224-1~deb11u1"},"fixed_version":"79.0.3945.79-1","urgency":"not yet assigned"},"forky":{"status":"resolved","repositories":{"forky":"145.0.7632.159-1"},"fixed_version":"79.0.3945.79-1","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"146.0.7680.71-1"},"fixed_version":"79.0.3945.79-1","urgency":"not yet assigned"},"trixie":{"status":"resolved","repositories":{"trixie":"143.0.7499.169-1~deb13u1","trixie-security":"145.0.7632.159-1~deb13u1"},"fixed_version":"79.0.3945.79-1","urgency":"not yet assigned"}}},"CVE-2019-13741":{"description":"Insufficient validation of untrusted input in Blink in Google Chrome prior to 79.0.3945.79 allowed a local attacker to bypass same origin policy via crafted clipboard content.","scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"143.0.7499.169-1~deb12u1","bookworm-security":"145.0.7632.159-1~deb12u1"},"fixed_version":"79.0.3945.79-1","urgency":"not yet assigned"},"bullseye":{"status":"resolved","repositories":{"bullseye":"120.0.6099.224-1~deb11u1","bullseye-security":"120.0.6099.224-1~deb11u1"},"fixed_version":"79.0.3945.79-1","urgency":"not yet assigned"},"forky":{"status":"resolved","repositories":{"forky":"145.0.7632.159-1"},"fixed_version":"79.0.3945.79-1","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"146.0.7680.71-1"},"fixed_version":"79.0.3945.79-1","urgency":"not yet assigned"},"trixie":{"status":"resolved","repositories":{"trixie":"143.0.7499.169-1~deb13u1","trixie-security":"145.0.7632.159-1~deb13u1"},"fixed_version":"79.0.3945.79-1","urgency":"not yet assigned"}}},"CVE-2019-13742":{"description":"Incorrect security UI in Omnibox in Google Chrome on iOS prior to 79.0.3945.79 allowed a remote attacker to spoof the contents of the Omnibox (URL bar) via a crafted domain name.","scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"143.0.7499.169-1~deb12u1","bookworm-security":"145.0.7632.159-1~deb12u1"},"fixed_version":"79.0.3945.79-1","urgency":"not yet assigned"},"bullseye":{"status":"resolved","repositories":{"bullseye":"120.0.6099.224-1~deb11u1","bullseye-security":"120.0.6099.224-1~deb11u1"},"fixed_version":"79.0.3945.79-1","urgency":"not yet assigned"},"forky":{"status":"resolved","repositories":{"forky":"145.0.7632.159-1"},"fixed_version":"79.0.3945.79-1","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"146.0.7680.71-1"},"fixed_version":"79.0.3945.79-1","urgency":"not yet assigned"},"trixie":{"status":"resolved","repositories":{"trixie":"143.0.7499.169-1~deb13u1","trixie-security":"145.0.7632.159-1~deb13u1"},"fixed_version":"79.0.3945.79-1","urgency":"not yet assigned"}}},"CVE-2019-13743":{"description":"Incorrect security UI in external protocol handling in Google Chrome prior to 79.0.3945.79 allowed a remote attacker to spoof security UI via a crafted HTML page.","scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"143.0.7499.169-1~deb12u1","bookworm-security":"145.0.7632.159-1~deb12u1"},"fixed_version":"79.0.3945.79-1","urgency":"not yet assigned"},"bullseye":{"status":"resolved","repositories":{"bullseye":"120.0.6099.224-1~deb11u1","bullseye-security":"120.0.6099.224-1~deb11u1"},"fixed_version":"79.0.3945.79-1","urgency":"not yet assigned"},"forky":{"status":"resolved","repositories":{"forky":"145.0.7632.159-1"},"fixed_version":"79.0.3945.79-1","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"146.0.7680.71-1"},"fixed_version":"79.0.3945.79-1","urgency":"not yet assigned"},"trixie":{"status":"resolved","repositories":{"trixie":"143.0.7499.169-1~deb13u1","trixie-security":"145.0.7632.159-1~deb13u1"},"fixed_version":"79.0.3945.79-1","urgency":"not yet assigned"}}},"CVE-2019-13744":{"description":"Insufficient policy enforcement in cookies in Google Chrome prior to 79.0.3945.79 allowed a remote attacker to leak cross-origin data via a crafted HTML page.","scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"143.0.7499.169-1~deb12u1","bookworm-security":"145.0.7632.159-1~deb12u1"},"fixed_version":"79.0.3945.79-1","urgency":"not yet assigned"},"bullseye":{"status":"resolved","repositories":{"bullseye":"120.0.6099.224-1~deb11u1","bullseye-security":"120.0.6099.224-1~deb11u1"},"fixed_version":"79.0.3945.79-1","urgency":"not yet assigned"},"forky":{"status":"resolved","repositories":{"forky":"145.0.7632.159-1"},"fixed_version":"79.0.3945.79-1","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"146.0.7680.71-1"},"fixed_version":"79.0.3945.79-1","urgency":"not yet assigned"},"trixie":{"status":"resolved","repositories":{"trixie":"143.0.7499.169-1~deb13u1","trixie-security":"145.0.7632.159-1~deb13u1"},"fixed_version":"79.0.3945.79-1","urgency":"not yet assigned"}}},"CVE-2019-13745":{"description":"Insufficient policy enforcement in audio in Google Chrome prior to 79.0.3945.79 allowed a remote attacker to leak cross-origin data via a crafted HTML page.","scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"143.0.7499.169-1~deb12u1","bookworm-security":"145.0.7632.159-1~deb12u1"},"fixed_version":"79.0.3945.79-1","urgency":"not yet assigned"},"bullseye":{"status":"resolved","repositories":{"bullseye":"120.0.6099.224-1~deb11u1","bullseye-security":"120.0.6099.224-1~deb11u1"},"fixed_version":"79.0.3945.79-1","urgency":"not yet assigned"},"forky":{"status":"resolved","repositories":{"forky":"145.0.7632.159-1"},"fixed_version":"79.0.3945.79-1","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"146.0.7680.71-1"},"fixed_version":"79.0.3945.79-1","urgency":"not yet assigned"},"trixie":{"status":"resolved","repositories":{"trixie":"143.0.7499.169-1~deb13u1","trixie-security":"145.0.7632.159-1~deb13u1"},"fixed_version":"79.0.3945.79-1","urgency":"not yet assigned"}}},"CVE-2019-13746":{"description":"Insufficient policy enforcement in Omnibox in Google Chrome prior to 79.0.3945.79 allowed a remote attacker to spoof the contents of the Omnibox (URL bar) via a crafted HTML page.","scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"143.0.7499.169-1~deb12u1","bookworm-security":"145.0.7632.159-1~deb12u1"},"fixed_version":"79.0.3945.79-1","urgency":"not yet assigned"},"bullseye":{"status":"resolved","repositories":{"bullseye":"120.0.6099.224-1~deb11u1","bullseye-security":"120.0.6099.224-1~deb11u1"},"fixed_version":"79.0.3945.79-1","urgency":"not yet assigned"},"forky":{"status":"resolved","repositories":{"forky":"145.0.7632.159-1"},"fixed_version":"79.0.3945.79-1","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"146.0.7680.71-1"},"fixed_version":"79.0.3945.79-1","urgency":"not yet assigned"},"trixie":{"status":"resolved","repositories":{"trixie":"143.0.7499.169-1~deb13u1","trixie-security":"145.0.7632.159-1~deb13u1"},"fixed_version":"79.0.3945.79-1","urgency":"not yet assigned"}}},"CVE-2019-13747":{"description":"Uninitialized data in rendering in Google Chrome on Android prior to 79.0.3945.79 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page.","scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"143.0.7499.169-1~deb12u1","bookworm-security":"145.0.7632.159-1~deb12u1"},"fixed_version":"79.0.3945.79-1","urgency":"not yet assigned"},"bullseye":{"status":"resolved","repositories":{"bullseye":"120.0.6099.224-1~deb11u1","bullseye-security":"120.0.6099.224-1~deb11u1"},"fixed_version":"79.0.3945.79-1","urgency":"not yet assigned"},"forky":{"status":"resolved","repositories":{"forky":"145.0.7632.159-1"},"fixed_version":"79.0.3945.79-1","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"146.0.7680.71-1"},"fixed_version":"79.0.3945.79-1","urgency":"not yet assigned"},"trixie":{"status":"resolved","repositories":{"trixie":"143.0.7499.169-1~deb13u1","trixie-security":"145.0.7632.159-1~deb13u1"},"fixed_version":"79.0.3945.79-1","urgency":"not yet assigned"}}},"CVE-2019-13748":{"description":"Insufficient policy enforcement in developer tools in Google Chrome prior to 79.0.3945.79 allowed a local attacker to obtain potentially sensitive information from process memory via a crafted HTML page.","scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"143.0.7499.169-1~deb12u1","bookworm-security":"145.0.7632.159-1~deb12u1"},"fixed_version":"79.0.3945.79-1","urgency":"not yet assigned"},"bullseye":{"status":"resolved","repositories":{"bullseye":"120.0.6099.224-1~deb11u1","bullseye-security":"120.0.6099.224-1~deb11u1"},"fixed_version":"79.0.3945.79-1","urgency":"not yet assigned"},"forky":{"status":"resolved","repositories":{"forky":"145.0.7632.159-1"},"fixed_version":"79.0.3945.79-1","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"146.0.7680.71-1"},"fixed_version":"79.0.3945.79-1","urgency":"not yet assigned"},"trixie":{"status":"resolved","repositories":{"trixie":"143.0.7499.169-1~deb13u1","trixie-security":"145.0.7632.159-1~deb13u1"},"fixed_version":"79.0.3945.79-1","urgency":"not yet assigned"}}},"CVE-2019-13749":{"description":"Incorrect security UI in Omnibox in Google Chrome on iOS prior to 79.0.3945.79 allowed a remote attacker to spoof the contents of the Omnibox (URL bar) via a crafted HTML page.","scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"143.0.7499.169-1~deb12u1","bookworm-security":"145.0.7632.159-1~deb12u1"},"fixed_version":"79.0.3945.79-1","urgency":"not yet assigned"},"bullseye":{"status":"resolved","repositories":{"bullseye":"120.0.6099.224-1~deb11u1","bullseye-security":"120.0.6099.224-1~deb11u1"},"fixed_version":"79.0.3945.79-1","urgency":"not yet assigned"},"forky":{"status":"resolved","repositories":{"forky":"145.0.7632.159-1"},"fixed_version":"79.0.3945.79-1","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"146.0.7680.71-1"},"fixed_version":"79.0.3945.79-1","urgency":"not yet assigned"},"trixie":{"status":"resolved","repositories":{"trixie":"143.0.7499.169-1~deb13u1","trixie-security":"145.0.7632.159-1~deb13u1"},"fixed_version":"79.0.3945.79-1","urgency":"not yet assigned"}}},"CVE-2019-13750":{"description":"Insufficient data validation in SQLite in Google Chrome prior to 79.0.3945.79 allowed a remote attacker to bypass defense-in-depth measures via a crafted HTML page.","scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"143.0.7499.169-1~deb12u1","bookworm-security":"145.0.7632.159-1~deb12u1"},"fixed_version":"79.0.3945.79-1","urgency":"not yet assigned"},"bullseye":{"status":"resolved","repositories":{"bullseye":"120.0.6099.224-1~deb11u1","bullseye-security":"120.0.6099.224-1~deb11u1"},"fixed_version":"79.0.3945.79-1","urgency":"not yet assigned"},"forky":{"status":"resolved","repositories":{"forky":"145.0.7632.159-1"},"fixed_version":"79.0.3945.79-1","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"146.0.7680.71-1"},"fixed_version":"79.0.3945.79-1","urgency":"not yet assigned"},"trixie":{"status":"resolved","repositories":{"trixie":"143.0.7499.169-1~deb13u1","trixie-security":"145.0.7632.159-1~deb13u1"},"fixed_version":"79.0.3945.79-1","urgency":"not yet assigned"}}},"CVE-2019-13751":{"description":"Uninitialized data in SQLite in Google Chrome prior to 79.0.3945.79 allowed a remote attacker to obtain potentially sensitive information from process memory via a crafted HTML page.","scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"143.0.7499.169-1~deb12u1","bookworm-security":"145.0.7632.159-1~deb12u1"},"fixed_version":"79.0.3945.79-1","urgency":"not yet assigned"},"bullseye":{"status":"resolved","repositories":{"bullseye":"120.0.6099.224-1~deb11u1","bullseye-security":"120.0.6099.224-1~deb11u1"},"fixed_version":"79.0.3945.79-1","urgency":"not yet assigned"},"forky":{"status":"resolved","repositories":{"forky":"145.0.7632.159-1"},"fixed_version":"79.0.3945.79-1","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"146.0.7680.71-1"},"fixed_version":"79.0.3945.79-1","urgency":"not yet assigned"},"trixie":{"status":"resolved","repositories":{"trixie":"143.0.7499.169-1~deb13u1","trixie-security":"145.0.7632.159-1~deb13u1"},"fixed_version":"79.0.3945.79-1","urgency":"not yet assigned"}}},"CVE-2019-13752":{"description":"Out of bounds read in SQLite in Google Chrome prior to 79.0.3945.79 allowed a remote attacker to obtain potentially sensitive information from process memory via a crafted HTML page.","scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"143.0.7499.169-1~deb12u1","bookworm-security":"145.0.7632.159-1~deb12u1"},"fixed_version":"79.0.3945.79-1","urgency":"not yet assigned"},"bullseye":{"status":"resolved","repositories":{"bullseye":"120.0.6099.224-1~deb11u1","bullseye-security":"120.0.6099.224-1~deb11u1"},"fixed_version":"79.0.3945.79-1","urgency":"not yet assigned"},"forky":{"status":"resolved","repositories":{"forky":"145.0.7632.159-1"},"fixed_version":"79.0.3945.79-1","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"146.0.7680.71-1"},"fixed_version":"79.0.3945.79-1","urgency":"not yet assigned"},"trixie":{"status":"resolved","repositories":{"trixie":"143.0.7499.169-1~deb13u1","trixie-security":"145.0.7632.159-1~deb13u1"},"fixed_version":"79.0.3945.79-1","urgency":"not yet assigned"}}},"CVE-2019-13753":{"description":"Out of bounds read in SQLite in Google Chrome prior to 79.0.3945.79 allowed a remote attacker to obtain potentially sensitive information from process memory via a crafted HTML page.","scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"143.0.7499.169-1~deb12u1","bookworm-security":"145.0.7632.159-1~deb12u1"},"fixed_version":"79.0.3945.79-1","urgency":"not yet assigned"},"bullseye":{"status":"resolved","repositories":{"bullseye":"120.0.6099.224-1~deb11u1","bullseye-security":"120.0.6099.224-1~deb11u1"},"fixed_version":"79.0.3945.79-1","urgency":"not yet assigned"},"forky":{"status":"resolved","repositories":{"forky":"145.0.7632.159-1"},"fixed_version":"79.0.3945.79-1","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"146.0.7680.71-1"},"fixed_version":"79.0.3945.79-1","urgency":"not yet assigned"},"trixie":{"status":"resolved","repositories":{"trixie":"143.0.7499.169-1~deb13u1","trixie-security":"145.0.7632.159-1~deb13u1"},"fixed_version":"79.0.3945.79-1","urgency":"not yet assigned"}}},"CVE-2019-13754":{"description":"Insufficient policy enforcement in extensions in Google Chrome prior to 79.0.3945.79 allowed a remote attacker to bypass navigation restrictions via a crafted HTML page.","scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"143.0.7499.169-1~deb12u1","bookworm-security":"145.0.7632.159-1~deb12u1"},"fixed_version":"79.0.3945.79-1","urgency":"not yet assigned"},"bullseye":{"status":"resolved","repositories":{"bullseye":"120.0.6099.224-1~deb11u1","bullseye-security":"120.0.6099.224-1~deb11u1"},"fixed_version":"79.0.3945.79-1","urgency":"not yet assigned"},"forky":{"status":"resolved","repositories":{"forky":"145.0.7632.159-1"},"fixed_version":"79.0.3945.79-1","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"146.0.7680.71-1"},"fixed_version":"79.0.3945.79-1","urgency":"not yet assigned"},"trixie":{"status":"resolved","repositories":{"trixie":"143.0.7499.169-1~deb13u1","trixie-security":"145.0.7632.159-1~deb13u1"},"fixed_version":"79.0.3945.79-1","urgency":"not yet assigned"}}},"CVE-2019-13755":{"description":"Insufficient policy enforcement in extensions in Google Chrome prior to 79.0.3945.79 allowed a remote attacker to disable extensions via a crafted HTML page.","scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"143.0.7499.169-1~deb12u1","bookworm-security":"145.0.7632.159-1~deb12u1"},"fixed_version":"79.0.3945.79-1","urgency":"not yet assigned"},"bullseye":{"status":"resolved","repositories":{"bullseye":"120.0.6099.224-1~deb11u1","bullseye-security":"120.0.6099.224-1~deb11u1"},"fixed_version":"79.0.3945.79-1","urgency":"not yet assigned"},"forky":{"status":"resolved","repositories":{"forky":"145.0.7632.159-1"},"fixed_version":"79.0.3945.79-1","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"146.0.7680.71-1"},"fixed_version":"79.0.3945.79-1","urgency":"not yet assigned"},"trixie":{"status":"resolved","repositories":{"trixie":"143.0.7499.169-1~deb13u1","trixie-security":"145.0.7632.159-1~deb13u1"},"fixed_version":"79.0.3945.79-1","urgency":"not yet assigned"}}},"CVE-2019-13756":{"description":"Incorrect security UI in printing in Google Chrome prior to 79.0.3945.79 allowed a remote attacker to perform domain spoofing via a crafted HTML page.","scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"143.0.7499.169-1~deb12u1","bookworm-security":"145.0.7632.159-1~deb12u1"},"fixed_version":"79.0.3945.79-1","urgency":"not yet assigned"},"bullseye":{"status":"resolved","repositories":{"bullseye":"120.0.6099.224-1~deb11u1","bullseye-security":"120.0.6099.224-1~deb11u1"},"fixed_version":"79.0.3945.79-1","urgency":"not yet assigned"},"forky":{"status":"resolved","repositories":{"forky":"145.0.7632.159-1"},"fixed_version":"79.0.3945.79-1","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"146.0.7680.71-1"},"fixed_version":"79.0.3945.79-1","urgency":"not yet assigned"},"trixie":{"status":"resolved","repositories":{"trixie":"143.0.7499.169-1~deb13u1","trixie-security":"145.0.7632.159-1~deb13u1"},"fixed_version":"79.0.3945.79-1","urgency":"not yet assigned"}}},"CVE-2019-13757":{"description":"Incorrect security UI in Omnibox in Google Chrome prior to 79.0.3945.79 allowed a remote attacker to perform domain spoofing via IDN homographs via a crafted domain name.","scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"143.0.7499.169-1~deb12u1","bookworm-security":"145.0.7632.159-1~deb12u1"},"fixed_version":"79.0.3945.79-1","urgency":"not yet assigned"},"bullseye":{"status":"resolved","repositories":{"bullseye":"120.0.6099.224-1~deb11u1","bullseye-security":"120.0.6099.224-1~deb11u1"},"fixed_version":"79.0.3945.79-1","urgency":"not yet assigned"},"forky":{"status":"resolved","repositories":{"forky":"145.0.7632.159-1"},"fixed_version":"79.0.3945.79-1","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"146.0.7680.71-1"},"fixed_version":"79.0.3945.79-1","urgency":"not yet assigned"},"trixie":{"status":"resolved","repositories":{"trixie":"143.0.7499.169-1~deb13u1","trixie-security":"145.0.7632.159-1~deb13u1"},"fixed_version":"79.0.3945.79-1","urgency":"not yet assigned"}}},"CVE-2019-13758":{"description":"Insufficient policy enforcement in navigation in Google Chrome on Android prior to 79.0.3945.79 allowed a remote attacker to bypass navigation restrictions via a crafted HTML page.","scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"143.0.7499.169-1~deb12u1","bookworm-security":"145.0.7632.159-1~deb12u1"},"fixed_version":"79.0.3945.79-1","urgency":"not yet assigned"},"bullseye":{"status":"resolved","repositories":{"bullseye":"120.0.6099.224-1~deb11u1","bullseye-security":"120.0.6099.224-1~deb11u1"},"fixed_version":"79.0.3945.79-1","urgency":"not yet assigned"},"forky":{"status":"resolved","repositories":{"forky":"145.0.7632.159-1"},"fixed_version":"79.0.3945.79-1","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"146.0.7680.71-1"},"fixed_version":"79.0.3945.79-1","urgency":"not yet assigned"},"trixie":{"status":"resolved","repositories":{"trixie":"143.0.7499.169-1~deb13u1","trixie-security":"145.0.7632.159-1~deb13u1"},"fixed_version":"79.0.3945.79-1","urgency":"not yet assigned"}}},"CVE-2019-13759":{"description":"Incorrect security UI in interstitials in Google Chrome prior to 79.0.3945.79 allowed a remote attacker to perform domain spoofing via a crafted HTML page.","scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"143.0.7499.169-1~deb12u1","bookworm-security":"145.0.7632.159-1~deb12u1"},"fixed_version":"79.0.3945.79-1","urgency":"not yet assigned"},"bullseye":{"status":"resolved","repositories":{"bullseye":"120.0.6099.224-1~deb11u1","bullseye-security":"120.0.6099.224-1~deb11u1"},"fixed_version":"79.0.3945.79-1","urgency":"not yet assigned"},"forky":{"status":"resolved","repositories":{"forky":"145.0.7632.159-1"},"fixed_version":"79.0.3945.79-1","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"146.0.7680.71-1"},"fixed_version":"79.0.3945.79-1","urgency":"not yet assigned"},"trixie":{"status":"resolved","repositories":{"trixie":"143.0.7499.169-1~deb13u1","trixie-security":"145.0.7632.159-1~deb13u1"},"fixed_version":"79.0.3945.79-1","urgency":"not yet assigned"}}},"CVE-2019-13761":{"description":"Incorrect security UI in Omnibox in Google Chrome prior to 79.0.3945.79 allowed a remote attacker to perform domain spoofing via IDN homographs via a crafted domain name.","scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"143.0.7499.169-1~deb12u1","bookworm-security":"145.0.7632.159-1~deb12u1"},"fixed_version":"79.0.3945.79-1","urgency":"not yet assigned"},"bullseye":{"status":"resolved","repositories":{"bullseye":"120.0.6099.224-1~deb11u1","bullseye-security":"120.0.6099.224-1~deb11u1"},"fixed_version":"79.0.3945.79-1","urgency":"not yet assigned"},"forky":{"status":"resolved","repositories":{"forky":"145.0.7632.159-1"},"fixed_version":"79.0.3945.79-1","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"146.0.7680.71-1"},"fixed_version":"79.0.3945.79-1","urgency":"not yet assigned"},"trixie":{"status":"resolved","repositories":{"trixie":"143.0.7499.169-1~deb13u1","trixie-security":"145.0.7632.159-1~deb13u1"},"fixed_version":"79.0.3945.79-1","urgency":"not yet assigned"}}},"CVE-2019-13762":{"description":"Insufficient policy enforcement in downloads in Google Chrome on Windows prior to 79.0.3945.79 allowed a local attacker to spoof downloaded files via local code.","scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"143.0.7499.169-1~deb12u1","bookworm-security":"145.0.7632.159-1~deb12u1"},"fixed_version":"79.0.3945.79-1","urgency":"not yet assigned"},"bullseye":{"status":"resolved","repositories":{"bullseye":"120.0.6099.224-1~deb11u1","bullseye-security":"120.0.6099.224-1~deb11u1"},"fixed_version":"79.0.3945.79-1","urgency":"not yet assigned"},"forky":{"status":"resolved","repositories":{"forky":"145.0.7632.159-1"},"fixed_version":"79.0.3945.79-1","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"146.0.7680.71-1"},"fixed_version":"79.0.3945.79-1","urgency":"not yet assigned"},"trixie":{"status":"resolved","repositories":{"trixie":"143.0.7499.169-1~deb13u1","trixie-security":"145.0.7632.159-1~deb13u1"},"fixed_version":"79.0.3945.79-1","urgency":"not yet assigned"}}},"CVE-2019-13763":{"description":"Insufficient policy enforcement in payments in Google Chrome prior to 79.0.3945.79 allowed a remote attacker who had compromised the renderer process to leak cross-origin data via a crafted HTML page.","scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"143.0.7499.169-1~deb12u1","bookworm-security":"145.0.7632.159-1~deb12u1"},"fixed_version":"79.0.3945.79-1","urgency":"not yet assigned"},"bullseye":{"status":"resolved","repositories":{"bullseye":"120.0.6099.224-1~deb11u1","bullseye-security":"120.0.6099.224-1~deb11u1"},"fixed_version":"79.0.3945.79-1","urgency":"not yet assigned"},"forky":{"status":"resolved","repositories":{"forky":"145.0.7632.159-1"},"fixed_version":"79.0.3945.79-1","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"146.0.7680.71-1"},"fixed_version":"79.0.3945.79-1","urgency":"not yet assigned"},"trixie":{"status":"resolved","repositories":{"trixie":"143.0.7499.169-1~deb13u1","trixie-security":"145.0.7632.159-1~deb13u1"},"fixed_version":"79.0.3945.79-1","urgency":"not yet assigned"}}},"CVE-2019-13764":{"description":"Type confusion in JavaScript in Google Chrome prior to 79.0.3945.79 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page.","scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"143.0.7499.169-1~deb12u1","bookworm-security":"145.0.7632.159-1~deb12u1"},"fixed_version":"79.0.3945.79-1","urgency":"not yet assigned"},"bullseye":{"status":"resolved","repositories":{"bullseye":"120.0.6099.224-1~deb11u1","bullseye-security":"120.0.6099.224-1~deb11u1"},"fixed_version":"79.0.3945.79-1","urgency":"not yet assigned"},"forky":{"status":"resolved","repositories":{"forky":"145.0.7632.159-1"},"fixed_version":"79.0.3945.79-1","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"146.0.7680.71-1"},"fixed_version":"79.0.3945.79-1","urgency":"not yet assigned"},"trixie":{"status":"resolved","repositories":{"trixie":"143.0.7499.169-1~deb13u1","trixie-security":"145.0.7632.159-1~deb13u1"},"fixed_version":"79.0.3945.79-1","urgency":"not yet assigned"}}},"CVE-2019-13765":{"description":"Use-after-free in content delivery manager in Google Chrome prior to 78.0.3904.70 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page.","scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"143.0.7499.169-1~deb12u1","bookworm-security":"145.0.7632.159-1~deb12u1"},"fixed_version":"78.0.3904.87-1","urgency":"not yet assigned"},"bullseye":{"status":"resolved","repositories":{"bullseye":"120.0.6099.224-1~deb11u1","bullseye-security":"120.0.6099.224-1~deb11u1"},"fixed_version":"78.0.3904.87-1","urgency":"not yet assigned"},"forky":{"status":"resolved","repositories":{"forky":"145.0.7632.159-1"},"fixed_version":"78.0.3904.87-1","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"146.0.7680.71-1"},"fixed_version":"78.0.3904.87-1","urgency":"not yet assigned"},"trixie":{"status":"resolved","repositories":{"trixie":"143.0.7499.169-1~deb13u1","trixie-security":"145.0.7632.159-1~deb13u1"},"fixed_version":"78.0.3904.87-1","urgency":"not yet assigned"}}},"CVE-2019-13766":{"description":"Use-after-free in accessibility in Google Chrome prior to 77.0.3865.75 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page.","scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"143.0.7499.169-1~deb12u1","bookworm-security":"145.0.7632.159-1~deb12u1"},"fixed_version":"78.0.3904.87-1","urgency":"not yet assigned"},"bullseye":{"status":"resolved","repositories":{"bullseye":"120.0.6099.224-1~deb11u1","bullseye-security":"120.0.6099.224-1~deb11u1"},"fixed_version":"78.0.3904.87-1","urgency":"not yet assigned"},"forky":{"status":"resolved","repositories":{"forky":"145.0.7632.159-1"},"fixed_version":"78.0.3904.87-1","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"146.0.7680.71-1"},"fixed_version":"78.0.3904.87-1","urgency":"not yet assigned"},"trixie":{"status":"resolved","repositories":{"trixie":"143.0.7499.169-1~deb13u1","trixie-security":"145.0.7632.159-1~deb13u1"},"fixed_version":"78.0.3904.87-1","urgency":"not yet assigned"}}},"CVE-2019-13767":{"description":"Use after free in media picker in Google Chrome prior to 79.0.3945.88 allowed a remote attacker who had compromised the renderer process to potentially exploit heap corruption via a crafted HTML page.","scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"143.0.7499.169-1~deb12u1","bookworm-security":"145.0.7632.159-1~deb12u1"},"fixed_version":"79.0.3945.130-1","urgency":"not yet assigned"},"bullseye":{"status":"resolved","repositories":{"bullseye":"120.0.6099.224-1~deb11u1","bullseye-security":"120.0.6099.224-1~deb11u1"},"fixed_version":"79.0.3945.130-1","urgency":"not yet assigned"},"forky":{"status":"resolved","repositories":{"forky":"145.0.7632.159-1"},"fixed_version":"79.0.3945.130-1","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"146.0.7680.71-1"},"fixed_version":"79.0.3945.130-1","urgency":"not yet assigned"},"trixie":{"status":"resolved","repositories":{"trixie":"143.0.7499.169-1~deb13u1","trixie-security":"145.0.7632.159-1~deb13u1"},"fixed_version":"79.0.3945.130-1","urgency":"not yet assigned"}}},"CVE-2019-13768":{"description":"Use after free in FileAPI in Google Chrome prior to 72.0.3626.81 allowed a remote attacker to potentially perform a sandbox escape via a crafted HTML page. (Chrome security severity: High)","scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"143.0.7499.169-1~deb12u1","bookworm-security":"145.0.7632.159-1~deb12u1"},"fixed_version":"72.0.3626.81-1","urgency":"not yet assigned"},"bullseye":{"status":"resolved","repositories":{"bullseye":"120.0.6099.224-1~deb11u1","bullseye-security":"120.0.6099.224-1~deb11u1"},"fixed_version":"72.0.3626.81-1","urgency":"not yet assigned"},"forky":{"status":"resolved","repositories":{"forky":"145.0.7632.159-1"},"fixed_version":"72.0.3626.81-1","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"146.0.7680.71-1"},"fixed_version":"72.0.3626.81-1","urgency":"not yet assigned"},"trixie":{"status":"resolved","repositories":{"trixie":"143.0.7499.169-1~deb13u1","trixie-security":"145.0.7632.159-1~deb13u1"},"fixed_version":"72.0.3626.81-1","urgency":"not yet assigned"}}},"CVE-2019-15903":{"description":"In libexpat before 2.2.8, crafted XML input could fool the parser into changing from DTD parsing to document parsing too early; a consecutive call to XML_GetCurrentLineNumber (or XML_GetCurrentColumnNumber) then resulted in a heap-based buffer over-read.","scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"143.0.7499.169-1~deb12u1","bookworm-security":"145.0.7632.159-1~deb12u1"},"fixed_version":"0","urgency":"unimportant"},"bullseye":{"status":"resolved","repositories":{"bullseye":"120.0.6099.224-1~deb11u1","bullseye-security":"120.0.6099.224-1~deb11u1"},"fixed_version":"0","urgency":"unimportant"},"forky":{"status":"resolved","repositories":{"forky":"145.0.7632.159-1"},"fixed_version":"0","urgency":"unimportant"},"sid":{"status":"resolved","repositories":{"sid":"146.0.7680.71-1"},"fixed_version":"0","urgency":"unimportant"},"trixie":{"status":"resolved","repositories":{"trixie":"143.0.7499.169-1~deb13u1","trixie-security":"145.0.7632.159-1~deb13u1"},"fixed_version":"0","urgency":"unimportant"}}},"CVE-2019-19880":{"description":"exprListAppendList in window.c in SQLite 3.30.1 allows attackers to trigger an invalid pointer dereference because constant integer values in ORDER BY clauses of window definitions are mishandled.","scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"143.0.7499.169-1~deb12u1","bookworm-security":"145.0.7632.159-1~deb12u1"},"fixed_version":"80.0.3987.106-1","urgency":"not yet assigned"},"bullseye":{"status":"resolved","repositories":{"bullseye":"120.0.6099.224-1~deb11u1","bullseye-security":"120.0.6099.224-1~deb11u1"},"fixed_version":"80.0.3987.106-1","urgency":"not yet assigned"},"forky":{"status":"resolved","repositories":{"forky":"145.0.7632.159-1"},"fixed_version":"80.0.3987.106-1","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"146.0.7680.71-1"},"fixed_version":"80.0.3987.106-1","urgency":"not yet assigned"},"trixie":{"status":"resolved","repositories":{"trixie":"143.0.7499.169-1~deb13u1","trixie-security":"145.0.7632.159-1~deb13u1"},"fixed_version":"80.0.3987.106-1","urgency":"not yet assigned"}}},"CVE-2019-19923":{"description":"flattenSubquery in select.c in SQLite 3.30.1 mishandles certain uses of SELECT DISTINCT involving a LEFT JOIN in which the right-hand side is a view. This can cause a NULL pointer dereference (or incorrect results).","scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"143.0.7499.169-1~deb12u1","bookworm-security":"145.0.7632.159-1~deb12u1"},"fixed_version":"80.0.3987.106-1","urgency":"not yet assigned"},"bullseye":{"status":"resolved","repositories":{"bullseye":"120.0.6099.224-1~deb11u1","bullseye-security":"120.0.6099.224-1~deb11u1"},"fixed_version":"80.0.3987.106-1","urgency":"not yet assigned"},"forky":{"status":"resolved","repositories":{"forky":"145.0.7632.159-1"},"fixed_version":"80.0.3987.106-1","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"146.0.7680.71-1"},"fixed_version":"80.0.3987.106-1","urgency":"not yet assigned"},"trixie":{"status":"resolved","repositories":{"trixie":"143.0.7499.169-1~deb13u1","trixie-security":"145.0.7632.159-1~deb13u1"},"fixed_version":"80.0.3987.106-1","urgency":"not yet assigned"}}},"CVE-2019-19925":{"description":"zipfileUpdate in ext/misc/zipfile.c in SQLite 3.30.1 mishandles a NULL pathname during an update of a ZIP archive.","scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"143.0.7499.169-1~deb12u1","bookworm-security":"145.0.7632.159-1~deb12u1"},"fixed_version":"80.0.3987.106-1","urgency":"not yet assigned"},"bullseye":{"status":"resolved","repositories":{"bullseye":"120.0.6099.224-1~deb11u1","bullseye-security":"120.0.6099.224-1~deb11u1"},"fixed_version":"80.0.3987.106-1","urgency":"not yet assigned"},"forky":{"status":"resolved","repositories":{"forky":"145.0.7632.159-1"},"fixed_version":"80.0.3987.106-1","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"146.0.7680.71-1"},"fixed_version":"80.0.3987.106-1","urgency":"not yet assigned"},"trixie":{"status":"resolved","repositories":{"trixie":"143.0.7499.169-1~deb13u1","trixie-security":"145.0.7632.159-1~deb13u1"},"fixed_version":"80.0.3987.106-1","urgency":"not yet assigned"}}},"CVE-2019-19926":{"description":"multiSelect in select.c in SQLite 3.30.1 mishandles certain errors during parsing, as demonstrated by errors from sqlite3WindowRewrite() calls. NOTE: this vulnerability exists because of an incomplete fix for CVE-2019-19880.","scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"143.0.7499.169-1~deb12u1","bookworm-security":"145.0.7632.159-1~deb12u1"},"fixed_version":"80.0.3987.106-1","urgency":"not yet assigned"},"bullseye":{"status":"resolved","repositories":{"bullseye":"120.0.6099.224-1~deb11u1","bullseye-security":"120.0.6099.224-1~deb11u1"},"fixed_version":"80.0.3987.106-1","urgency":"not yet assigned"},"forky":{"status":"resolved","repositories":{"forky":"145.0.7632.159-1"},"fixed_version":"80.0.3987.106-1","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"146.0.7680.71-1"},"fixed_version":"80.0.3987.106-1","urgency":"not yet assigned"},"trixie":{"status":"resolved","repositories":{"trixie":"143.0.7499.169-1~deb13u1","trixie-security":"145.0.7632.159-1~deb13u1"},"fixed_version":"80.0.3987.106-1","urgency":"not yet assigned"}}},"CVE-2019-20503":{"description":"usrsctp before 2019-12-20 has out-of-bounds reads in sctp_load_addresses_from_init.","scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"143.0.7499.169-1~deb12u1","bookworm-security":"145.0.7632.159-1~deb12u1"},"fixed_version":"80.0.3987.149-1","urgency":"not yet assigned"},"bullseye":{"status":"resolved","repositories":{"bullseye":"120.0.6099.224-1~deb11u1","bullseye-security":"120.0.6099.224-1~deb11u1"},"fixed_version":"80.0.3987.149-1","urgency":"not yet assigned"},"forky":{"status":"resolved","repositories":{"forky":"145.0.7632.159-1"},"fixed_version":"80.0.3987.149-1","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"146.0.7680.71-1"},"fixed_version":"80.0.3987.149-1","urgency":"not yet assigned"},"trixie":{"status":"resolved","repositories":{"trixie":"143.0.7499.169-1~deb13u1","trixie-security":"145.0.7632.159-1~deb13u1"},"fixed_version":"80.0.3987.149-1","urgency":"not yet assigned"}}},"CVE-2019-25154":{"description":"Inappropriate implementation in iframe in Google Chrome prior to 77.0.3865.75 allowed a remote attacker to potentially perform a sandbox escape via a crafted HTML page. (Chromium security severity: Medium)","scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"143.0.7499.169-1~deb12u1","bookworm-security":"145.0.7632.159-1~deb12u1"},"fixed_version":"78.0.3904.87-1","urgency":"not yet assigned"},"bullseye":{"status":"resolved","repositories":{"bullseye":"120.0.6099.224-1~deb11u1","bullseye-security":"120.0.6099.224-1~deb11u1"},"fixed_version":"78.0.3904.87-1","urgency":"not yet assigned"},"forky":{"status":"resolved","repositories":{"forky":"145.0.7632.159-1"},"fixed_version":"78.0.3904.87-1","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"146.0.7680.71-1"},"fixed_version":"78.0.3904.87-1","urgency":"not yet assigned"},"trixie":{"status":"resolved","repositories":{"trixie":"143.0.7499.169-1~deb13u1","trixie-security":"145.0.7632.159-1~deb13u1"},"fixed_version":"78.0.3904.87-1","urgency":"not yet assigned"}}},"CVE-2019-5754":{"description":"Implementation error in QUIC Networking in Google Chrome prior to 72.0.3626.81 allowed an attacker running or able to cause use of a proxy server to obtain cleartext of transport encryption via malicious network proxy.","scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"143.0.7499.169-1~deb12u1","bookworm-security":"145.0.7632.159-1~deb12u1"},"fixed_version":"72.0.3626.81-1","urgency":"not yet assigned"},"bullseye":{"status":"resolved","repositories":{"bullseye":"120.0.6099.224-1~deb11u1","bullseye-security":"120.0.6099.224-1~deb11u1"},"fixed_version":"72.0.3626.81-1","urgency":"not yet assigned"},"forky":{"status":"resolved","repositories":{"forky":"145.0.7632.159-1"},"fixed_version":"72.0.3626.81-1","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"146.0.7680.71-1"},"fixed_version":"72.0.3626.81-1","urgency":"not yet assigned"},"trixie":{"status":"resolved","repositories":{"trixie":"143.0.7499.169-1~deb13u1","trixie-security":"145.0.7632.159-1~deb13u1"},"fixed_version":"72.0.3626.81-1","urgency":"not yet assigned"}}},"CVE-2019-5755":{"description":"Incorrect handling of negative zero in V8 in Google Chrome prior to 72.0.3626.81 allowed a remote attacker to perform arbitrary read/write via a crafted HTML page.","scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"143.0.7499.169-1~deb12u1","bookworm-security":"145.0.7632.159-1~deb12u1"},"fixed_version":"72.0.3626.81-1","urgency":"not yet assigned"},"bullseye":{"status":"resolved","repositories":{"bullseye":"120.0.6099.224-1~deb11u1","bullseye-security":"120.0.6099.224-1~deb11u1"},"fixed_version":"72.0.3626.81-1","urgency":"not yet assigned"},"forky":{"status":"resolved","repositories":{"forky":"145.0.7632.159-1"},"fixed_version":"72.0.3626.81-1","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"146.0.7680.71-1"},"fixed_version":"72.0.3626.81-1","urgency":"not yet assigned"},"trixie":{"status":"resolved","repositories":{"trixie":"143.0.7499.169-1~deb13u1","trixie-security":"145.0.7632.159-1~deb13u1"},"fixed_version":"72.0.3626.81-1","urgency":"not yet assigned"}}},"CVE-2019-5756":{"description":"Inappropriate memory management when caching in PDFium in Google Chrome prior to 72.0.3626.81 allowed a remote attacker to execute arbitrary code inside a sandbox via a crafted PDF file.","scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"143.0.7499.169-1~deb12u1","bookworm-security":"145.0.7632.159-1~deb12u1"},"fixed_version":"72.0.3626.81-1","urgency":"not yet assigned"},"bullseye":{"status":"resolved","repositories":{"bullseye":"120.0.6099.224-1~deb11u1","bullseye-security":"120.0.6099.224-1~deb11u1"},"fixed_version":"72.0.3626.81-1","urgency":"not yet assigned"},"forky":{"status":"resolved","repositories":{"forky":"145.0.7632.159-1"},"fixed_version":"72.0.3626.81-1","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"146.0.7680.71-1"},"fixed_version":"72.0.3626.81-1","urgency":"not yet assigned"},"trixie":{"status":"resolved","repositories":{"trixie":"143.0.7499.169-1~deb13u1","trixie-security":"145.0.7632.159-1~deb13u1"},"fixed_version":"72.0.3626.81-1","urgency":"not yet assigned"}}},"CVE-2019-5757":{"description":"An incorrect object type assumption in SVG in Google Chrome prior to 72.0.3626.81 allowed a remote attacker to potentially exploit object corruption via a crafted HTML page.","scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"143.0.7499.169-1~deb12u1","bookworm-security":"145.0.7632.159-1~deb12u1"},"fixed_version":"72.0.3626.81-1","urgency":"not yet assigned"},"bullseye":{"status":"resolved","repositories":{"bullseye":"120.0.6099.224-1~deb11u1","bullseye-security":"120.0.6099.224-1~deb11u1"},"fixed_version":"72.0.3626.81-1","urgency":"not yet assigned"},"forky":{"status":"resolved","repositories":{"forky":"145.0.7632.159-1"},"fixed_version":"72.0.3626.81-1","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"146.0.7680.71-1"},"fixed_version":"72.0.3626.81-1","urgency":"not yet assigned"},"trixie":{"status":"resolved","repositories":{"trixie":"143.0.7499.169-1~deb13u1","trixie-security":"145.0.7632.159-1~deb13u1"},"fixed_version":"72.0.3626.81-1","urgency":"not yet assigned"}}},"CVE-2019-5758":{"description":"Incorrect object lifecycle management in Blink in Google Chrome prior to 72.0.3626.81 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page.","scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"143.0.7499.169-1~deb12u1","bookworm-security":"145.0.7632.159-1~deb12u1"},"fixed_version":"72.0.3626.81-1","urgency":"not yet assigned"},"bullseye":{"status":"resolved","repositories":{"bullseye":"120.0.6099.224-1~deb11u1","bullseye-security":"120.0.6099.224-1~deb11u1"},"fixed_version":"72.0.3626.81-1","urgency":"not yet assigned"},"forky":{"status":"resolved","repositories":{"forky":"145.0.7632.159-1"},"fixed_version":"72.0.3626.81-1","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"146.0.7680.71-1"},"fixed_version":"72.0.3626.81-1","urgency":"not yet assigned"},"trixie":{"status":"resolved","repositories":{"trixie":"143.0.7499.169-1~deb13u1","trixie-security":"145.0.7632.159-1~deb13u1"},"fixed_version":"72.0.3626.81-1","urgency":"not yet assigned"}}},"CVE-2019-5759":{"description":"Incorrect lifetime handling in HTML select elements in Google Chrome on Android and Mac prior to 72.0.3626.81 allowed a remote attacker to potentially perform a sandbox escape via a crafted HTML page.","scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"143.0.7499.169-1~deb12u1","bookworm-security":"145.0.7632.159-1~deb12u1"},"fixed_version":"72.0.3626.81-1","urgency":"not yet assigned"},"bullseye":{"status":"resolved","repositories":{"bullseye":"120.0.6099.224-1~deb11u1","bullseye-security":"120.0.6099.224-1~deb11u1"},"fixed_version":"72.0.3626.81-1","urgency":"not yet assigned"},"forky":{"status":"resolved","repositories":{"forky":"145.0.7632.159-1"},"fixed_version":"72.0.3626.81-1","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"146.0.7680.71-1"},"fixed_version":"72.0.3626.81-1","urgency":"not yet assigned"},"trixie":{"status":"resolved","repositories":{"trixie":"143.0.7499.169-1~deb13u1","trixie-security":"145.0.7632.159-1~deb13u1"},"fixed_version":"72.0.3626.81-1","urgency":"not yet assigned"}}},"CVE-2019-5760":{"description":"Insufficient checks of pointer validity in WebRTC in Google Chrome prior to 72.0.3626.81 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page.","scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"143.0.7499.169-1~deb12u1","bookworm-security":"145.0.7632.159-1~deb12u1"},"fixed_version":"72.0.3626.81-1","urgency":"not yet assigned"},"bullseye":{"status":"resolved","repositories":{"bullseye":"120.0.6099.224-1~deb11u1","bullseye-security":"120.0.6099.224-1~deb11u1"},"fixed_version":"72.0.3626.81-1","urgency":"not yet assigned"},"forky":{"status":"resolved","repositories":{"forky":"145.0.7632.159-1"},"fixed_version":"72.0.3626.81-1","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"146.0.7680.71-1"},"fixed_version":"72.0.3626.81-1","urgency":"not yet assigned"},"trixie":{"status":"resolved","repositories":{"trixie":"143.0.7499.169-1~deb13u1","trixie-security":"145.0.7632.159-1~deb13u1"},"fixed_version":"72.0.3626.81-1","urgency":"not yet assigned"}}},"CVE-2019-5761":{"description":"Incorrect object lifecycle management in SwiftShader in Google Chrome prior to 72.0.3626.81 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page.","scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"143.0.7499.169-1~deb12u1","bookworm-security":"145.0.7632.159-1~deb12u1"},"fixed_version":"0","urgency":"unimportant"},"bullseye":{"status":"resolved","repositories":{"bullseye":"120.0.6099.224-1~deb11u1","bullseye-security":"120.0.6099.224-1~deb11u1"},"fixed_version":"0","urgency":"unimportant"},"forky":{"status":"resolved","repositories":{"forky":"145.0.7632.159-1"},"fixed_version":"0","urgency":"unimportant"},"sid":{"status":"resolved","repositories":{"sid":"146.0.7680.71-1"},"fixed_version":"0","urgency":"unimportant"},"trixie":{"status":"resolved","repositories":{"trixie":"143.0.7499.169-1~deb13u1","trixie-security":"145.0.7632.159-1~deb13u1"},"fixed_version":"0","urgency":"unimportant"}}},"CVE-2019-5762":{"description":"Inappropriate memory management when caching in PDFium in Google Chrome prior to 72.0.3626.81 allowed a remote attacker to execute arbitrary code inside a sandbox via a crafted PDF file.","scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"143.0.7499.169-1~deb12u1","bookworm-security":"145.0.7632.159-1~deb12u1"},"fixed_version":"72.0.3626.81-1","urgency":"not yet assigned"},"bullseye":{"status":"resolved","repositories":{"bullseye":"120.0.6099.224-1~deb11u1","bullseye-security":"120.0.6099.224-1~deb11u1"},"fixed_version":"72.0.3626.81-1","urgency":"not yet assigned"},"forky":{"status":"resolved","repositories":{"forky":"145.0.7632.159-1"},"fixed_version":"72.0.3626.81-1","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"146.0.7680.71-1"},"fixed_version":"72.0.3626.81-1","urgency":"not yet assigned"},"trixie":{"status":"resolved","repositories":{"trixie":"143.0.7499.169-1~deb13u1","trixie-security":"145.0.7632.159-1~deb13u1"},"fixed_version":"72.0.3626.81-1","urgency":"not yet assigned"}}},"CVE-2019-5763":{"description":"Failure to check error conditions in V8 in Google Chrome prior to 72.0.3626.81 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page.","scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"143.0.7499.169-1~deb12u1","bookworm-security":"145.0.7632.159-1~deb12u1"},"fixed_version":"72.0.3626.81-1","urgency":"not yet assigned"},"bullseye":{"status":"resolved","repositories":{"bullseye":"120.0.6099.224-1~deb11u1","bullseye-security":"120.0.6099.224-1~deb11u1"},"fixed_version":"72.0.3626.81-1","urgency":"not yet assigned"},"forky":{"status":"resolved","repositories":{"forky":"145.0.7632.159-1"},"fixed_version":"72.0.3626.81-1","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"146.0.7680.71-1"},"fixed_version":"72.0.3626.81-1","urgency":"not yet assigned"},"trixie":{"status":"resolved","repositories":{"trixie":"143.0.7499.169-1~deb13u1","trixie-security":"145.0.7632.159-1~deb13u1"},"fixed_version":"72.0.3626.81-1","urgency":"not yet assigned"}}},"CVE-2019-5764":{"description":"Incorrect pointer management in WebRTC in Google Chrome prior to 72.0.3626.81 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page.","scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"143.0.7499.169-1~deb12u1","bookworm-security":"145.0.7632.159-1~deb12u1"},"fixed_version":"72.0.3626.81-1","urgency":"not yet assigned"},"bullseye":{"status":"resolved","repositories":{"bullseye":"120.0.6099.224-1~deb11u1","bullseye-security":"120.0.6099.224-1~deb11u1"},"fixed_version":"72.0.3626.81-1","urgency":"not yet assigned"},"forky":{"status":"resolved","repositories":{"forky":"145.0.7632.159-1"},"fixed_version":"72.0.3626.81-1","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"146.0.7680.71-1"},"fixed_version":"72.0.3626.81-1","urgency":"not yet assigned"},"trixie":{"status":"resolved","repositories":{"trixie":"143.0.7499.169-1~deb13u1","trixie-security":"145.0.7632.159-1~deb13u1"},"fixed_version":"72.0.3626.81-1","urgency":"not yet assigned"}}},"CVE-2019-5765":{"description":"An exposed debugging endpoint in the browser in Google Chrome on Android prior to 72.0.3626.81 allowed a local attacker to obtain potentially sensitive information from process memory via a crafted Intent.","scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"143.0.7499.169-1~deb12u1","bookworm-security":"145.0.7632.159-1~deb12u1"},"fixed_version":"72.0.3626.81-1","urgency":"not yet assigned"},"bullseye":{"status":"resolved","repositories":{"bullseye":"120.0.6099.224-1~deb11u1","bullseye-security":"120.0.6099.224-1~deb11u1"},"fixed_version":"72.0.3626.81-1","urgency":"not yet assigned"},"forky":{"status":"resolved","repositories":{"forky":"145.0.7632.159-1"},"fixed_version":"72.0.3626.81-1","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"146.0.7680.71-1"},"fixed_version":"72.0.3626.81-1","urgency":"not yet assigned"},"trixie":{"status":"resolved","repositories":{"trixie":"143.0.7499.169-1~deb13u1","trixie-security":"145.0.7632.159-1~deb13u1"},"fixed_version":"72.0.3626.81-1","urgency":"not yet assigned"}}},"CVE-2019-5766":{"description":"Incorrect handling of origin taint checking in Canvas in Google Chrome prior to 72.0.3626.81 allowed a remote attacker to leak cross-origin data via a crafted HTML page.","scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"143.0.7499.169-1~deb12u1","bookworm-security":"145.0.7632.159-1~deb12u1"},"fixed_version":"72.0.3626.81-1","urgency":"not yet assigned"},"bullseye":{"status":"resolved","repositories":{"bullseye":"120.0.6099.224-1~deb11u1","bullseye-security":"120.0.6099.224-1~deb11u1"},"fixed_version":"72.0.3626.81-1","urgency":"not yet assigned"},"forky":{"status":"resolved","repositories":{"forky":"145.0.7632.159-1"},"fixed_version":"72.0.3626.81-1","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"146.0.7680.71-1"},"fixed_version":"72.0.3626.81-1","urgency":"not yet assigned"},"trixie":{"status":"resolved","repositories":{"trixie":"143.0.7499.169-1~deb13u1","trixie-security":"145.0.7632.159-1~deb13u1"},"fixed_version":"72.0.3626.81-1","urgency":"not yet assigned"}}},"CVE-2019-5767":{"description":"Insufficient protection of permission UI in WebAPKs in Google Chrome on Android prior to 72.0.3626.81 allowed an attacker who convinced the user to install a malicious application to access privacy/security sensitive web APIs via a crafted APK.","scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"143.0.7499.169-1~deb12u1","bookworm-security":"145.0.7632.159-1~deb12u1"},"fixed_version":"72.0.3626.81-1","urgency":"not yet assigned"},"bullseye":{"status":"resolved","repositories":{"bullseye":"120.0.6099.224-1~deb11u1","bullseye-security":"120.0.6099.224-1~deb11u1"},"fixed_version":"72.0.3626.81-1","urgency":"not yet assigned"},"forky":{"status":"resolved","repositories":{"forky":"145.0.7632.159-1"},"fixed_version":"72.0.3626.81-1","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"146.0.7680.71-1"},"fixed_version":"72.0.3626.81-1","urgency":"not yet assigned"},"trixie":{"status":"resolved","repositories":{"trixie":"143.0.7499.169-1~deb13u1","trixie-security":"145.0.7632.159-1~deb13u1"},"fixed_version":"72.0.3626.81-1","urgency":"not yet assigned"}}},"CVE-2019-5768":{"description":"DevTools API not correctly gating on extension capability in DevTools in Google Chrome prior to 72.0.3626.81 allowed an attacker who convinced a user to install a malicious extension to read local files via a crafted Chrome Extension.","scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"143.0.7499.169-1~deb12u1","bookworm-security":"145.0.7632.159-1~deb12u1"},"fixed_version":"72.0.3626.81-1","urgency":"not yet assigned"},"bullseye":{"status":"resolved","repositories":{"bullseye":"120.0.6099.224-1~deb11u1","bullseye-security":"120.0.6099.224-1~deb11u1"},"fixed_version":"72.0.3626.81-1","urgency":"not yet assigned"},"forky":{"status":"resolved","repositories":{"forky":"145.0.7632.159-1"},"fixed_version":"72.0.3626.81-1","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"146.0.7680.71-1"},"fixed_version":"72.0.3626.81-1","urgency":"not yet assigned"},"trixie":{"status":"resolved","repositories":{"trixie":"143.0.7499.169-1~deb13u1","trixie-security":"145.0.7632.159-1~deb13u1"},"fixed_version":"72.0.3626.81-1","urgency":"not yet assigned"}}},"CVE-2019-5769":{"description":"Incorrect handling of invalid end character position when front rendering in Blink in Google Chrome prior to 72.0.3626.81 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page.","scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"143.0.7499.169-1~deb12u1","bookworm-security":"145.0.7632.159-1~deb12u1"},"fixed_version":"72.0.3626.81-1","urgency":"not yet assigned"},"bullseye":{"status":"resolved","repositories":{"bullseye":"120.0.6099.224-1~deb11u1","bullseye-security":"120.0.6099.224-1~deb11u1"},"fixed_version":"72.0.3626.81-1","urgency":"not yet assigned"},"forky":{"status":"resolved","repositories":{"forky":"145.0.7632.159-1"},"fixed_version":"72.0.3626.81-1","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"146.0.7680.71-1"},"fixed_version":"72.0.3626.81-1","urgency":"not yet assigned"},"trixie":{"status":"resolved","repositories":{"trixie":"143.0.7499.169-1~deb13u1","trixie-security":"145.0.7632.159-1~deb13u1"},"fixed_version":"72.0.3626.81-1","urgency":"not yet assigned"}}},"CVE-2019-5770":{"description":"Insufficient input validation in WebGL in Google Chrome prior to 72.0.3626.81 allowed a remote attacker to perform an out of bounds memory read via a crafted HTML page.","scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"143.0.7499.169-1~deb12u1","bookworm-security":"145.0.7632.159-1~deb12u1"},"fixed_version":"72.0.3626.81-1","urgency":"not yet assigned"},"bullseye":{"status":"resolved","repositories":{"bullseye":"120.0.6099.224-1~deb11u1","bullseye-security":"120.0.6099.224-1~deb11u1"},"fixed_version":"72.0.3626.81-1","urgency":"not yet assigned"},"forky":{"status":"resolved","repositories":{"forky":"145.0.7632.159-1"},"fixed_version":"72.0.3626.81-1","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"146.0.7680.71-1"},"fixed_version":"72.0.3626.81-1","urgency":"not yet assigned"},"trixie":{"status":"resolved","repositories":{"trixie":"143.0.7499.169-1~deb13u1","trixie-security":"145.0.7632.159-1~deb13u1"},"fixed_version":"72.0.3626.81-1","urgency":"not yet assigned"}}},"CVE-2019-5771":{"description":"An incorrect JIT of GLSL shaders in SwiftShader in Google Chrome prior to 72.0.3626.81 allowed a remote attacker to execute arbitrary code via a crafted HTML page.","scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"143.0.7499.169-1~deb12u1","bookworm-security":"145.0.7632.159-1~deb12u1"},"fixed_version":"0","urgency":"unimportant"},"bullseye":{"status":"resolved","repositories":{"bullseye":"120.0.6099.224-1~deb11u1","bullseye-security":"120.0.6099.224-1~deb11u1"},"fixed_version":"0","urgency":"unimportant"},"forky":{"status":"resolved","repositories":{"forky":"145.0.7632.159-1"},"fixed_version":"0","urgency":"unimportant"},"sid":{"status":"resolved","repositories":{"sid":"146.0.7680.71-1"},"fixed_version":"0","urgency":"unimportant"},"trixie":{"status":"resolved","repositories":{"trixie":"143.0.7499.169-1~deb13u1","trixie-security":"145.0.7632.159-1~deb13u1"},"fixed_version":"0","urgency":"unimportant"}}},"CVE-2019-5772":{"description":"Sharing of objects over calls into JavaScript runtime in PDFium in Google Chrome prior to 72.0.3626.81 allowed a remote attacker to potentially exploit heap corruption via a crafted PDF file.","scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"143.0.7499.169-1~deb12u1","bookworm-security":"145.0.7632.159-1~deb12u1"},"fixed_version":"72.0.3626.81-1","urgency":"not yet assigned"},"bullseye":{"status":"resolved","repositories":{"bullseye":"120.0.6099.224-1~deb11u1","bullseye-security":"120.0.6099.224-1~deb11u1"},"fixed_version":"72.0.3626.81-1","urgency":"not yet assigned"},"forky":{"status":"resolved","repositories":{"forky":"145.0.7632.159-1"},"fixed_version":"72.0.3626.81-1","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"146.0.7680.71-1"},"fixed_version":"72.0.3626.81-1","urgency":"not yet assigned"},"trixie":{"status":"resolved","repositories":{"trixie":"143.0.7499.169-1~deb13u1","trixie-security":"145.0.7632.159-1~deb13u1"},"fixed_version":"72.0.3626.81-1","urgency":"not yet assigned"}}},"CVE-2019-5773":{"description":"Insufficient origin validation in IndexedDB in Google Chrome prior to 72.0.3626.81 allowed a remote attacker who had compromised the renderer process to bypass same origin policy via a crafted HTML page.","scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"143.0.7499.169-1~deb12u1","bookworm-security":"145.0.7632.159-1~deb12u1"},"fixed_version":"72.0.3626.81-1","urgency":"not yet assigned"},"bullseye":{"status":"resolved","repositories":{"bullseye":"120.0.6099.224-1~deb11u1","bullseye-security":"120.0.6099.224-1~deb11u1"},"fixed_version":"72.0.3626.81-1","urgency":"not yet assigned"},"forky":{"status":"resolved","repositories":{"forky":"145.0.7632.159-1"},"fixed_version":"72.0.3626.81-1","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"146.0.7680.71-1"},"fixed_version":"72.0.3626.81-1","urgency":"not yet assigned"},"trixie":{"status":"resolved","repositories":{"trixie":"143.0.7499.169-1~deb13u1","trixie-security":"145.0.7632.159-1~deb13u1"},"fixed_version":"72.0.3626.81-1","urgency":"not yet assigned"}}},"CVE-2019-5774":{"description":"Omission of the .desktop filetype from the Safe Browsing checklist in SafeBrowsing in Google Chrome on Linux prior to 72.0.3626.81 allowed an attacker who convinced a user to download a .desktop file to execute arbitrary code via a downloaded .desktop file.","scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"143.0.7499.169-1~deb12u1","bookworm-security":"145.0.7632.159-1~deb12u1"},"fixed_version":"72.0.3626.81-1","urgency":"not yet assigned"},"bullseye":{"status":"resolved","repositories":{"bullseye":"120.0.6099.224-1~deb11u1","bullseye-security":"120.0.6099.224-1~deb11u1"},"fixed_version":"72.0.3626.81-1","urgency":"not yet assigned"},"forky":{"status":"resolved","repositories":{"forky":"145.0.7632.159-1"},"fixed_version":"72.0.3626.81-1","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"146.0.7680.71-1"},"fixed_version":"72.0.3626.81-1","urgency":"not yet assigned"},"trixie":{"status":"resolved","repositories":{"trixie":"143.0.7499.169-1~deb13u1","trixie-security":"145.0.7632.159-1~deb13u1"},"fixed_version":"72.0.3626.81-1","urgency":"not yet assigned"}}},"CVE-2019-5775":{"description":"Incorrect handling of a confusable character in Omnibox in Google Chrome prior to 72.0.3626.81 allowed a remote attacker to spoof the contents of the Omnibox (URL bar) via a crafted domain name.","scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"143.0.7499.169-1~deb12u1","bookworm-security":"145.0.7632.159-1~deb12u1"},"fixed_version":"72.0.3626.81-1","urgency":"not yet assigned"},"bullseye":{"status":"resolved","repositories":{"bullseye":"120.0.6099.224-1~deb11u1","bullseye-security":"120.0.6099.224-1~deb11u1"},"fixed_version":"72.0.3626.81-1","urgency":"not yet assigned"},"forky":{"status":"resolved","repositories":{"forky":"145.0.7632.159-1"},"fixed_version":"72.0.3626.81-1","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"146.0.7680.71-1"},"fixed_version":"72.0.3626.81-1","urgency":"not yet assigned"},"trixie":{"status":"resolved","repositories":{"trixie":"143.0.7499.169-1~deb13u1","trixie-security":"145.0.7632.159-1~deb13u1"},"fixed_version":"72.0.3626.81-1","urgency":"not yet assigned"}}},"CVE-2019-5776":{"description":"Incorrect handling of a confusable character in Omnibox in Google Chrome prior to 72.0.3626.81 allowed a remote attacker to spoof the contents of the Omnibox (URL bar) via a crafted domain name.","scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"143.0.7499.169-1~deb12u1","bookworm-security":"145.0.7632.159-1~deb12u1"},"fixed_version":"72.0.3626.81-1","urgency":"not yet assigned"},"bullseye":{"status":"resolved","repositories":{"bullseye":"120.0.6099.224-1~deb11u1","bullseye-security":"120.0.6099.224-1~deb11u1"},"fixed_version":"72.0.3626.81-1","urgency":"not yet assigned"},"forky":{"status":"resolved","repositories":{"forky":"145.0.7632.159-1"},"fixed_version":"72.0.3626.81-1","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"146.0.7680.71-1"},"fixed_version":"72.0.3626.81-1","urgency":"not yet assigned"},"trixie":{"status":"resolved","repositories":{"trixie":"143.0.7499.169-1~deb13u1","trixie-security":"145.0.7632.159-1~deb13u1"},"fixed_version":"72.0.3626.81-1","urgency":"not yet assigned"}}},"CVE-2019-5777":{"description":"Incorrect handling of a confusable character in Omnibox in Google Chrome prior to 72.0.3626.81 allowed a remote attacker to spoof the contents of the Omnibox (URL bar) via a crafted domain name.","scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"143.0.7499.169-1~deb12u1","bookworm-security":"145.0.7632.159-1~deb12u1"},"fixed_version":"72.0.3626.81-1","urgency":"not yet assigned"},"bullseye":{"status":"resolved","repositories":{"bullseye":"120.0.6099.224-1~deb11u1","bullseye-security":"120.0.6099.224-1~deb11u1"},"fixed_version":"72.0.3626.81-1","urgency":"not yet assigned"},"forky":{"status":"resolved","repositories":{"forky":"145.0.7632.159-1"},"fixed_version":"72.0.3626.81-1","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"146.0.7680.71-1"},"fixed_version":"72.0.3626.81-1","urgency":"not yet assigned"},"trixie":{"status":"resolved","repositories":{"trixie":"143.0.7499.169-1~deb13u1","trixie-security":"145.0.7632.159-1~deb13u1"},"fixed_version":"72.0.3626.81-1","urgency":"not yet assigned"}}},"CVE-2019-5778":{"description":"A missing case for handling special schemes in permission request checks in Extensions in Google Chrome prior to 72.0.3626.81 allowed an attacker who convinced a user to install a malicious extension to bypass extension permission checks for privileged pages via a crafted Chrome Extension.","scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"143.0.7499.169-1~deb12u1","bookworm-security":"145.0.7632.159-1~deb12u1"},"fixed_version":"72.0.3626.81-1","urgency":"not yet assigned"},"bullseye":{"status":"resolved","repositories":{"bullseye":"120.0.6099.224-1~deb11u1","bullseye-security":"120.0.6099.224-1~deb11u1"},"fixed_version":"72.0.3626.81-1","urgency":"not yet assigned"},"forky":{"status":"resolved","repositories":{"forky":"145.0.7632.159-1"},"fixed_version":"72.0.3626.81-1","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"146.0.7680.71-1"},"fixed_version":"72.0.3626.81-1","urgency":"not yet assigned"},"trixie":{"status":"resolved","repositories":{"trixie":"143.0.7499.169-1~deb13u1","trixie-security":"145.0.7632.159-1~deb13u1"},"fixed_version":"72.0.3626.81-1","urgency":"not yet assigned"}}},"CVE-2019-5779":{"description":"Insufficient policy validation in ServiceWorker in Google Chrome prior to 72.0.3626.81 allowed a remote attacker to bypass navigation restrictions via a crafted HTML page.","scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"143.0.7499.169-1~deb12u1","bookworm-security":"145.0.7632.159-1~deb12u1"},"fixed_version":"72.0.3626.81-1","urgency":"not yet assigned"},"bullseye":{"status":"resolved","repositories":{"bullseye":"120.0.6099.224-1~deb11u1","bullseye-security":"120.0.6099.224-1~deb11u1"},"fixed_version":"72.0.3626.81-1","urgency":"not yet assigned"},"forky":{"status":"resolved","repositories":{"forky":"145.0.7632.159-1"},"fixed_version":"72.0.3626.81-1","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"146.0.7680.71-1"},"fixed_version":"72.0.3626.81-1","urgency":"not yet assigned"},"trixie":{"status":"resolved","repositories":{"trixie":"143.0.7499.169-1~deb13u1","trixie-security":"145.0.7632.159-1~deb13u1"},"fixed_version":"72.0.3626.81-1","urgency":"not yet assigned"}}},"CVE-2019-5780":{"description":"Insufficient restrictions on what can be done with Apple Events in Google Chrome on macOS prior to 72.0.3626.81 allowed a local attacker to execute JavaScript via Apple Events.","scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"143.0.7499.169-1~deb12u1","bookworm-security":"145.0.7632.159-1~deb12u1"},"fixed_version":"72.0.3626.81-1","urgency":"not yet assigned"},"bullseye":{"status":"resolved","repositories":{"bullseye":"120.0.6099.224-1~deb11u1","bullseye-security":"120.0.6099.224-1~deb11u1"},"fixed_version":"72.0.3626.81-1","urgency":"not yet assigned"},"forky":{"status":"resolved","repositories":{"forky":"145.0.7632.159-1"},"fixed_version":"72.0.3626.81-1","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"146.0.7680.71-1"},"fixed_version":"72.0.3626.81-1","urgency":"not yet assigned"},"trixie":{"status":"resolved","repositories":{"trixie":"143.0.7499.169-1~deb13u1","trixie-security":"145.0.7632.159-1~deb13u1"},"fixed_version":"72.0.3626.81-1","urgency":"not yet assigned"}}},"CVE-2019-5781":{"description":"Incorrect handling of a confusable character in Omnibox in Google Chrome prior to 72.0.3626.81 allowed a remote attacker to spoof the contents of the Omnibox (URL bar) via a crafted domain name.","scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"143.0.7499.169-1~deb12u1","bookworm-security":"145.0.7632.159-1~deb12u1"},"fixed_version":"72.0.3626.81-1","urgency":"not yet assigned"},"bullseye":{"status":"resolved","repositories":{"bullseye":"120.0.6099.224-1~deb11u1","bullseye-security":"120.0.6099.224-1~deb11u1"},"fixed_version":"72.0.3626.81-1","urgency":"not yet assigned"},"forky":{"status":"resolved","repositories":{"forky":"145.0.7632.159-1"},"fixed_version":"72.0.3626.81-1","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"146.0.7680.71-1"},"fixed_version":"72.0.3626.81-1","urgency":"not yet assigned"},"trixie":{"status":"resolved","repositories":{"trixie":"143.0.7499.169-1~deb13u1","trixie-security":"145.0.7632.159-1~deb13u1"},"fixed_version":"72.0.3626.81-1","urgency":"not yet assigned"}}},"CVE-2019-5782":{"description":"Incorrect optimization assumptions in V8 in Google Chrome prior to 72.0.3626.81 allowed a remote attacker to execute arbitrary code inside a sandbox via a crafted HTML page.","scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"143.0.7499.169-1~deb12u1","bookworm-security":"145.0.7632.159-1~deb12u1"},"fixed_version":"72.0.3626.81-1","urgency":"not yet assigned"},"bullseye":{"status":"resolved","repositories":{"bullseye":"120.0.6099.224-1~deb11u1","bullseye-security":"120.0.6099.224-1~deb11u1"},"fixed_version":"72.0.3626.81-1","urgency":"not yet assigned"},"forky":{"status":"resolved","repositories":{"forky":"145.0.7632.159-1"},"fixed_version":"72.0.3626.81-1","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"146.0.7680.71-1"},"fixed_version":"72.0.3626.81-1","urgency":"not yet assigned"},"trixie":{"status":"resolved","repositories":{"trixie":"143.0.7499.169-1~deb13u1","trixie-security":"145.0.7632.159-1~deb13u1"},"fixed_version":"72.0.3626.81-1","urgency":"not yet assigned"}}},"CVE-2019-5783":{"description":"Missing URI encoding of untrusted input in DevTools in Google Chrome prior to 72.0.3626.81 allowed a remote attacker to perform a Dangling Markup Injection attack via a crafted HTML page.","scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"143.0.7499.169-1~deb12u1","bookworm-security":"145.0.7632.159-1~deb12u1"},"fixed_version":"72.0.3626.81-1","urgency":"not yet assigned"},"bullseye":{"status":"resolved","repositories":{"bullseye":"120.0.6099.224-1~deb11u1","bullseye-security":"120.0.6099.224-1~deb11u1"},"fixed_version":"72.0.3626.81-1","urgency":"not yet assigned"},"forky":{"status":"resolved","repositories":{"forky":"145.0.7632.159-1"},"fixed_version":"72.0.3626.81-1","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"146.0.7680.71-1"},"fixed_version":"72.0.3626.81-1","urgency":"not yet assigned"},"trixie":{"status":"resolved","repositories":{"trixie":"143.0.7499.169-1~deb13u1","trixie-security":"145.0.7632.159-1~deb13u1"},"fixed_version":"72.0.3626.81-1","urgency":"not yet assigned"}}},"CVE-2019-5784":{"description":"Incorrect handling of deferred code in V8 in Google Chrome prior to 72.0.3626.96 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page.","scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"143.0.7499.169-1~deb12u1","bookworm-security":"145.0.7632.159-1~deb12u1"},"fixed_version":"72.0.3626.109-1","urgency":"not yet assigned"},"bullseye":{"status":"resolved","repositories":{"bullseye":"120.0.6099.224-1~deb11u1","bullseye-security":"120.0.6099.224-1~deb11u1"},"fixed_version":"72.0.3626.109-1","urgency":"not yet assigned"},"forky":{"status":"resolved","repositories":{"forky":"145.0.7632.159-1"},"fixed_version":"72.0.3626.109-1","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"146.0.7680.71-1"},"fixed_version":"72.0.3626.109-1","urgency":"not yet assigned"},"trixie":{"status":"resolved","repositories":{"trixie":"143.0.7499.169-1~deb13u1","trixie-security":"145.0.7632.159-1~deb13u1"},"fixed_version":"72.0.3626.109-1","urgency":"not yet assigned"}}},"CVE-2019-5786":{"description":"Object lifetime issue in Blink in Google Chrome prior to 72.0.3626.121 allowed a remote attacker to potentially perform out of bounds memory access via a crafted HTML page.","scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"143.0.7499.169-1~deb12u1","bookworm-security":"145.0.7632.159-1~deb12u1"},"fixed_version":"72.0.3626.121-1","urgency":"not yet assigned"},"bullseye":{"status":"resolved","repositories":{"bullseye":"120.0.6099.224-1~deb11u1","bullseye-security":"120.0.6099.224-1~deb11u1"},"fixed_version":"72.0.3626.121-1","urgency":"not yet assigned"},"forky":{"status":"resolved","repositories":{"forky":"145.0.7632.159-1"},"fixed_version":"72.0.3626.121-1","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"146.0.7680.71-1"},"fixed_version":"72.0.3626.121-1","urgency":"not yet assigned"},"trixie":{"status":"resolved","repositories":{"trixie":"143.0.7499.169-1~deb13u1","trixie-security":"145.0.7632.159-1~deb13u1"},"fixed_version":"72.0.3626.121-1","urgency":"not yet assigned"}}},"CVE-2019-5787":{"description":"Use-after-garbage-collection in Blink in Google Chrome prior to 73.0.3683.75 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page.","scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"143.0.7499.169-1~deb12u1","bookworm-security":"145.0.7632.159-1~deb12u1"},"fixed_version":"73.0.3683.75-1","urgency":"not yet assigned"},"bullseye":{"status":"resolved","repositories":{"bullseye":"120.0.6099.224-1~deb11u1","bullseye-security":"120.0.6099.224-1~deb11u1"},"fixed_version":"73.0.3683.75-1","urgency":"not yet assigned"},"forky":{"status":"resolved","repositories":{"forky":"145.0.7632.159-1"},"fixed_version":"73.0.3683.75-1","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"146.0.7680.71-1"},"fixed_version":"73.0.3683.75-1","urgency":"not yet assigned"},"trixie":{"status":"resolved","repositories":{"trixie":"143.0.7499.169-1~deb13u1","trixie-security":"145.0.7632.159-1~deb13u1"},"fixed_version":"73.0.3683.75-1","urgency":"not yet assigned"}}},"CVE-2019-5788":{"description":"An integer overflow that leads to a use-after-free in Blink Storage in Google Chrome on Linux prior to 73.0.3683.75 allowed a remote attacker who had compromised the renderer process to execute arbitrary code via a crafted HTML page.","scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"143.0.7499.169-1~deb12u1","bookworm-security":"145.0.7632.159-1~deb12u1"},"fixed_version":"73.0.3683.75-1","urgency":"not yet assigned"},"bullseye":{"status":"resolved","repositories":{"bullseye":"120.0.6099.224-1~deb11u1","bullseye-security":"120.0.6099.224-1~deb11u1"},"fixed_version":"73.0.3683.75-1","urgency":"not yet assigned"},"forky":{"status":"resolved","repositories":{"forky":"145.0.7632.159-1"},"fixed_version":"73.0.3683.75-1","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"146.0.7680.71-1"},"fixed_version":"73.0.3683.75-1","urgency":"not yet assigned"},"trixie":{"status":"resolved","repositories":{"trixie":"143.0.7499.169-1~deb13u1","trixie-security":"145.0.7632.159-1~deb13u1"},"fixed_version":"73.0.3683.75-1","urgency":"not yet assigned"}}},"CVE-2019-5789":{"description":"An integer overflow that leads to a use-after-free in WebMIDI in Google Chrome on Windows prior to 73.0.3683.75 allowed a remote attacker who had compromised the renderer process to execute arbitrary code via a crafted HTML page.","scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"143.0.7499.169-1~deb12u1","bookworm-security":"145.0.7632.159-1~deb12u1"},"fixed_version":"73.0.3683.75-1","urgency":"not yet assigned"},"bullseye":{"status":"resolved","repositories":{"bullseye":"120.0.6099.224-1~deb11u1","bullseye-security":"120.0.6099.224-1~deb11u1"},"fixed_version":"73.0.3683.75-1","urgency":"not yet assigned"},"forky":{"status":"resolved","repositories":{"forky":"145.0.7632.159-1"},"fixed_version":"73.0.3683.75-1","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"146.0.7680.71-1"},"fixed_version":"73.0.3683.75-1","urgency":"not yet assigned"},"trixie":{"status":"resolved","repositories":{"trixie":"143.0.7499.169-1~deb13u1","trixie-security":"145.0.7632.159-1~deb13u1"},"fixed_version":"73.0.3683.75-1","urgency":"not yet assigned"}}},"CVE-2019-5790":{"description":"An integer overflow leading to an incorrect capacity of a buffer in JavaScript in Google Chrome prior to 73.0.3683.75 allowed a remote attacker to execute arbitrary code inside a sandbox via a crafted HTML page.","scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"143.0.7499.169-1~deb12u1","bookworm-security":"145.0.7632.159-1~deb12u1"},"fixed_version":"73.0.3683.75-1","urgency":"not yet assigned"},"bullseye":{"status":"resolved","repositories":{"bullseye":"120.0.6099.224-1~deb11u1","bullseye-security":"120.0.6099.224-1~deb11u1"},"fixed_version":"73.0.3683.75-1","urgency":"not yet assigned"},"forky":{"status":"resolved","repositories":{"forky":"145.0.7632.159-1"},"fixed_version":"73.0.3683.75-1","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"146.0.7680.71-1"},"fixed_version":"73.0.3683.75-1","urgency":"not yet assigned"},"trixie":{"status":"resolved","repositories":{"trixie":"143.0.7499.169-1~deb13u1","trixie-security":"145.0.7632.159-1~deb13u1"},"fixed_version":"73.0.3683.75-1","urgency":"not yet assigned"}}},"CVE-2019-5791":{"description":"Inappropriate optimization in V8 in Google Chrome prior to 73.0.3683.75 allowed a remote attacker to perform an out of bounds memory read via a crafted HTML page.","scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"143.0.7499.169-1~deb12u1","bookworm-security":"145.0.7632.159-1~deb12u1"},"fixed_version":"73.0.3683.75-1","urgency":"not yet assigned"},"bullseye":{"status":"resolved","repositories":{"bullseye":"120.0.6099.224-1~deb11u1","bullseye-security":"120.0.6099.224-1~deb11u1"},"fixed_version":"73.0.3683.75-1","urgency":"not yet assigned"},"forky":{"status":"resolved","repositories":{"forky":"145.0.7632.159-1"},"fixed_version":"73.0.3683.75-1","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"146.0.7680.71-1"},"fixed_version":"73.0.3683.75-1","urgency":"not yet assigned"},"trixie":{"status":"resolved","repositories":{"trixie":"143.0.7499.169-1~deb13u1","trixie-security":"145.0.7632.159-1~deb13u1"},"fixed_version":"73.0.3683.75-1","urgency":"not yet assigned"}}},"CVE-2019-5792":{"description":"Integer overflow in PDFium in Google Chrome prior to 73.0.3683.75 allowed a remote attacker to potentially perform out of bounds memory access via a crafted PDF file.","scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"143.0.7499.169-1~deb12u1","bookworm-security":"145.0.7632.159-1~deb12u1"},"fixed_version":"73.0.3683.75-1","urgency":"not yet assigned"},"bullseye":{"status":"resolved","repositories":{"bullseye":"120.0.6099.224-1~deb11u1","bullseye-security":"120.0.6099.224-1~deb11u1"},"fixed_version":"73.0.3683.75-1","urgency":"not yet assigned"},"forky":{"status":"resolved","repositories":{"forky":"145.0.7632.159-1"},"fixed_version":"73.0.3683.75-1","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"146.0.7680.71-1"},"fixed_version":"73.0.3683.75-1","urgency":"not yet assigned"},"trixie":{"status":"resolved","repositories":{"trixie":"143.0.7499.169-1~deb13u1","trixie-security":"145.0.7632.159-1~deb13u1"},"fixed_version":"73.0.3683.75-1","urgency":"not yet assigned"}}},"CVE-2019-5793":{"description":"Insufficient policy enforcement in extensions in Google Chrome prior to 73.0.3683.75 allowed a remote attacker to initiate the extensions installation user interface via a crafted HTML page.","scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"143.0.7499.169-1~deb12u1","bookworm-security":"145.0.7632.159-1~deb12u1"},"fixed_version":"73.0.3683.75-1","urgency":"not yet assigned"},"bullseye":{"status":"resolved","repositories":{"bullseye":"120.0.6099.224-1~deb11u1","bullseye-security":"120.0.6099.224-1~deb11u1"},"fixed_version":"73.0.3683.75-1","urgency":"not yet assigned"},"forky":{"status":"resolved","repositories":{"forky":"145.0.7632.159-1"},"fixed_version":"73.0.3683.75-1","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"146.0.7680.71-1"},"fixed_version":"73.0.3683.75-1","urgency":"not yet assigned"},"trixie":{"status":"resolved","repositories":{"trixie":"143.0.7499.169-1~deb13u1","trixie-security":"145.0.7632.159-1~deb13u1"},"fixed_version":"73.0.3683.75-1","urgency":"not yet assigned"}}},"CVE-2019-5794":{"description":"Incorrect handling of cancelled requests in Navigation in Google Chrome prior to 73.0.3683.75 allowed a remote attacker to perform domain spoofing via a crafted HTML page.","scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"143.0.7499.169-1~deb12u1","bookworm-security":"145.0.7632.159-1~deb12u1"},"fixed_version":"73.0.3683.75-1","urgency":"not yet assigned"},"bullseye":{"status":"resolved","repositories":{"bullseye":"120.0.6099.224-1~deb11u1","bullseye-security":"120.0.6099.224-1~deb11u1"},"fixed_version":"73.0.3683.75-1","urgency":"not yet assigned"},"forky":{"status":"resolved","repositories":{"forky":"145.0.7632.159-1"},"fixed_version":"73.0.3683.75-1","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"146.0.7680.71-1"},"fixed_version":"73.0.3683.75-1","urgency":"not yet assigned"},"trixie":{"status":"resolved","repositories":{"trixie":"143.0.7499.169-1~deb13u1","trixie-security":"145.0.7632.159-1~deb13u1"},"fixed_version":"73.0.3683.75-1","urgency":"not yet assigned"}}},"CVE-2019-5795":{"description":"Integer overflow in PDFium in Google Chrome prior to 73.0.3683.75 allowed a remote attacker to potentially perform out of bounds memory access via a crafted PDF file.","scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"143.0.7499.169-1~deb12u1","bookworm-security":"145.0.7632.159-1~deb12u1"},"fixed_version":"73.0.3683.75-1","urgency":"not yet assigned"},"bullseye":{"status":"resolved","repositories":{"bullseye":"120.0.6099.224-1~deb11u1","bullseye-security":"120.0.6099.224-1~deb11u1"},"fixed_version":"73.0.3683.75-1","urgency":"not yet assigned"},"forky":{"status":"resolved","repositories":{"forky":"145.0.7632.159-1"},"fixed_version":"73.0.3683.75-1","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"146.0.7680.71-1"},"fixed_version":"73.0.3683.75-1","urgency":"not yet assigned"},"trixie":{"status":"resolved","repositories":{"trixie":"143.0.7499.169-1~deb13u1","trixie-security":"145.0.7632.159-1~deb13u1"},"fixed_version":"73.0.3683.75-1","urgency":"not yet assigned"}}},"CVE-2019-5796":{"description":"Data race in extensions guest view in Google Chrome prior to 73.0.3683.75 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page.","scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"143.0.7499.169-1~deb12u1","bookworm-security":"145.0.7632.159-1~deb12u1"},"fixed_version":"73.0.3683.75-1","urgency":"not yet assigned"},"bullseye":{"status":"resolved","repositories":{"bullseye":"120.0.6099.224-1~deb11u1","bullseye-security":"120.0.6099.224-1~deb11u1"},"fixed_version":"73.0.3683.75-1","urgency":"not yet assigned"},"forky":{"status":"resolved","repositories":{"forky":"145.0.7632.159-1"},"fixed_version":"73.0.3683.75-1","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"146.0.7680.71-1"},"fixed_version":"73.0.3683.75-1","urgency":"not yet assigned"},"trixie":{"status":"resolved","repositories":{"trixie":"143.0.7499.169-1~deb13u1","trixie-security":"145.0.7632.159-1~deb13u1"},"fixed_version":"73.0.3683.75-1","urgency":"not yet assigned"}}},"CVE-2019-5797":{"description":"Double free in DOMStorage in Google Chrome prior to 73.0.3683.75 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page.","scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"143.0.7499.169-1~deb12u1","bookworm-security":"145.0.7632.159-1~deb12u1"},"fixed_version":"73.0.3683.75-1","urgency":"not yet assigned"},"bullseye":{"status":"resolved","repositories":{"bullseye":"120.0.6099.224-1~deb11u1","bullseye-security":"120.0.6099.224-1~deb11u1"},"fixed_version":"73.0.3683.75-1","urgency":"not yet assigned"},"forky":{"status":"resolved","repositories":{"forky":"145.0.7632.159-1"},"fixed_version":"73.0.3683.75-1","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"146.0.7680.71-1"},"fixed_version":"73.0.3683.75-1","urgency":"not yet assigned"},"trixie":{"status":"resolved","repositories":{"trixie":"143.0.7499.169-1~deb13u1","trixie-security":"145.0.7632.159-1~deb13u1"},"fixed_version":"73.0.3683.75-1","urgency":"not yet assigned"}}},"CVE-2019-5798":{"description":"Lack of correct bounds checking in Skia in Google Chrome prior to 73.0.3683.75 allowed a remote attacker to perform an out of bounds memory read via a crafted HTML page.","scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"143.0.7499.169-1~deb12u1","bookworm-security":"145.0.7632.159-1~deb12u1"},"fixed_version":"73.0.3683.75-1","urgency":"not yet assigned"},"bullseye":{"status":"resolved","repositories":{"bullseye":"120.0.6099.224-1~deb11u1","bullseye-security":"120.0.6099.224-1~deb11u1"},"fixed_version":"73.0.3683.75-1","urgency":"not yet assigned"},"forky":{"status":"resolved","repositories":{"forky":"145.0.7632.159-1"},"fixed_version":"73.0.3683.75-1","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"146.0.7680.71-1"},"fixed_version":"73.0.3683.75-1","urgency":"not yet assigned"},"trixie":{"status":"resolved","repositories":{"trixie":"143.0.7499.169-1~deb13u1","trixie-security":"145.0.7632.159-1~deb13u1"},"fixed_version":"73.0.3683.75-1","urgency":"not yet assigned"}}},"CVE-2019-5799":{"description":"Incorrect inheritance of a new document's policy in Content Security Policy in Google Chrome prior to 73.0.3683.75 allowed a remote attacker to bypass content security policy via a crafted HTML page.","scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"143.0.7499.169-1~deb12u1","bookworm-security":"145.0.7632.159-1~deb12u1"},"fixed_version":"73.0.3683.75-1","urgency":"not yet assigned"},"bullseye":{"status":"resolved","repositories":{"bullseye":"120.0.6099.224-1~deb11u1","bullseye-security":"120.0.6099.224-1~deb11u1"},"fixed_version":"73.0.3683.75-1","urgency":"not yet assigned"},"forky":{"status":"resolved","repositories":{"forky":"145.0.7632.159-1"},"fixed_version":"73.0.3683.75-1","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"146.0.7680.71-1"},"fixed_version":"73.0.3683.75-1","urgency":"not yet assigned"},"trixie":{"status":"resolved","repositories":{"trixie":"143.0.7499.169-1~deb13u1","trixie-security":"145.0.7632.159-1~deb13u1"},"fixed_version":"73.0.3683.75-1","urgency":"not yet assigned"}}},"CVE-2019-5800":{"description":"Insufficient policy enforcement in Blink in Google Chrome prior to 73.0.3683.75 allowed a remote attacker to bypass content security policy via a crafted HTML page.","scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"143.0.7499.169-1~deb12u1","bookworm-security":"145.0.7632.159-1~deb12u1"},"fixed_version":"73.0.3683.75-1","urgency":"not yet assigned"},"bullseye":{"status":"resolved","repositories":{"bullseye":"120.0.6099.224-1~deb11u1","bullseye-security":"120.0.6099.224-1~deb11u1"},"fixed_version":"73.0.3683.75-1","urgency":"not yet assigned"},"forky":{"status":"resolved","repositories":{"forky":"145.0.7632.159-1"},"fixed_version":"73.0.3683.75-1","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"146.0.7680.71-1"},"fixed_version":"73.0.3683.75-1","urgency":"not yet assigned"},"trixie":{"status":"resolved","repositories":{"trixie":"143.0.7499.169-1~deb13u1","trixie-security":"145.0.7632.159-1~deb13u1"},"fixed_version":"73.0.3683.75-1","urgency":"not yet assigned"}}},"CVE-2019-5801":{"description":"Incorrect eliding of URLs in Omnibox in Google Chrome on iOS prior to 73.0.3683.75 allowed a remote attacker to perform domain spoofing via a crafted HTML page.","scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"143.0.7499.169-1~deb12u1","bookworm-security":"145.0.7632.159-1~deb12u1"},"fixed_version":"0","urgency":"unimportant"},"bullseye":{"status":"resolved","repositories":{"bullseye":"120.0.6099.224-1~deb11u1","bullseye-security":"120.0.6099.224-1~deb11u1"},"fixed_version":"0","urgency":"unimportant"},"forky":{"status":"resolved","repositories":{"forky":"145.0.7632.159-1"},"fixed_version":"0","urgency":"unimportant"},"sid":{"status":"resolved","repositories":{"sid":"146.0.7680.71-1"},"fixed_version":"0","urgency":"unimportant"},"trixie":{"status":"resolved","repositories":{"trixie":"143.0.7499.169-1~deb13u1","trixie-security":"145.0.7632.159-1~deb13u1"},"fixed_version":"0","urgency":"unimportant"}}},"CVE-2019-5802":{"description":"Incorrect handling of download origins in Navigation in Google Chrome prior to 73.0.3683.75 allowed a remote attacker to perform domain spoofing via a crafted HTML page.","scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"143.0.7499.169-1~deb12u1","bookworm-security":"145.0.7632.159-1~deb12u1"},"fixed_version":"73.0.3683.75-1","urgency":"not yet assigned"},"bullseye":{"status":"resolved","repositories":{"bullseye":"120.0.6099.224-1~deb11u1","bullseye-security":"120.0.6099.224-1~deb11u1"},"fixed_version":"73.0.3683.75-1","urgency":"not yet assigned"},"forky":{"status":"resolved","repositories":{"forky":"145.0.7632.159-1"},"fixed_version":"73.0.3683.75-1","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"146.0.7680.71-1"},"fixed_version":"73.0.3683.75-1","urgency":"not yet assigned"},"trixie":{"status":"resolved","repositories":{"trixie":"143.0.7499.169-1~deb13u1","trixie-security":"145.0.7632.159-1~deb13u1"},"fixed_version":"73.0.3683.75-1","urgency":"not yet assigned"}}},"CVE-2019-5803":{"description":"Insufficient policy enforcement in Content Security Policy in Google Chrome prior to 73.0.3683.75 allowed a remote attacker to bypass content security policy via a crafted HTML page.","scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"143.0.7499.169-1~deb12u1","bookworm-security":"145.0.7632.159-1~deb12u1"},"fixed_version":"73.0.3683.75-1","urgency":"not yet assigned"},"bullseye":{"status":"resolved","repositories":{"bullseye":"120.0.6099.224-1~deb11u1","bullseye-security":"120.0.6099.224-1~deb11u1"},"fixed_version":"73.0.3683.75-1","urgency":"not yet assigned"},"forky":{"status":"resolved","repositories":{"forky":"145.0.7632.159-1"},"fixed_version":"73.0.3683.75-1","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"146.0.7680.71-1"},"fixed_version":"73.0.3683.75-1","urgency":"not yet assigned"},"trixie":{"status":"resolved","repositories":{"trixie":"143.0.7499.169-1~deb13u1","trixie-security":"145.0.7632.159-1~deb13u1"},"fixed_version":"73.0.3683.75-1","urgency":"not yet assigned"}}},"CVE-2019-5804":{"description":"Incorrect command line processing in Chrome in Google Chrome prior to 73.0.3683.75 allowed a local attacker to perform domain spoofing via a crafted domain name.","scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"143.0.7499.169-1~deb12u1","bookworm-security":"145.0.7632.159-1~deb12u1"},"fixed_version":"0","urgency":"unimportant"},"bullseye":{"status":"resolved","repositories":{"bullseye":"120.0.6099.224-1~deb11u1","bullseye-security":"120.0.6099.224-1~deb11u1"},"fixed_version":"0","urgency":"unimportant"},"forky":{"status":"resolved","repositories":{"forky":"145.0.7632.159-1"},"fixed_version":"0","urgency":"unimportant"},"sid":{"status":"resolved","repositories":{"sid":"146.0.7680.71-1"},"fixed_version":"0","urgency":"unimportant"},"trixie":{"status":"resolved","repositories":{"trixie":"143.0.7499.169-1~deb13u1","trixie-security":"145.0.7632.159-1~deb13u1"},"fixed_version":"0","urgency":"unimportant"}}},"CVE-2019-5805":{"description":"Use-after-free in PDFium in Google Chrome prior to 74.0.3729.108 allowed a remote attacker to potentially exploit heap corruption via a crafted PDF file.","scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"143.0.7499.169-1~deb12u1","bookworm-security":"145.0.7632.159-1~deb12u1"},"fixed_version":"74.0.3729.108-1","urgency":"not yet assigned"},"bullseye":{"status":"resolved","repositories":{"bullseye":"120.0.6099.224-1~deb11u1","bullseye-security":"120.0.6099.224-1~deb11u1"},"fixed_version":"74.0.3729.108-1","urgency":"not yet assigned"},"forky":{"status":"resolved","repositories":{"forky":"145.0.7632.159-1"},"fixed_version":"74.0.3729.108-1","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"146.0.7680.71-1"},"fixed_version":"74.0.3729.108-1","urgency":"not yet assigned"},"trixie":{"status":"resolved","repositories":{"trixie":"143.0.7499.169-1~deb13u1","trixie-security":"145.0.7632.159-1~deb13u1"},"fixed_version":"74.0.3729.108-1","urgency":"not yet assigned"}}},"CVE-2019-5806":{"description":"Integer overflow in ANGLE in Google Chrome on Windows prior to 74.0.3729.108 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page.","scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"143.0.7499.169-1~deb12u1","bookworm-security":"145.0.7632.159-1~deb12u1"},"fixed_version":"74.0.3729.108-1","urgency":"not yet assigned"},"bullseye":{"status":"resolved","repositories":{"bullseye":"120.0.6099.224-1~deb11u1","bullseye-security":"120.0.6099.224-1~deb11u1"},"fixed_version":"74.0.3729.108-1","urgency":"not yet assigned"},"forky":{"status":"resolved","repositories":{"forky":"145.0.7632.159-1"},"fixed_version":"74.0.3729.108-1","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"146.0.7680.71-1"},"fixed_version":"74.0.3729.108-1","urgency":"not yet assigned"},"trixie":{"status":"resolved","repositories":{"trixie":"143.0.7499.169-1~deb13u1","trixie-security":"145.0.7632.159-1~deb13u1"},"fixed_version":"74.0.3729.108-1","urgency":"not yet assigned"}}},"CVE-2019-5807":{"description":"Object lifetime issue in V8 in Google Chrome prior to 74.0.3729.108 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page.","scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"143.0.7499.169-1~deb12u1","bookworm-security":"145.0.7632.159-1~deb12u1"},"fixed_version":"74.0.3729.108-1","urgency":"not yet assigned"},"bullseye":{"status":"resolved","repositories":{"bullseye":"120.0.6099.224-1~deb11u1","bullseye-security":"120.0.6099.224-1~deb11u1"},"fixed_version":"74.0.3729.108-1","urgency":"not yet assigned"},"forky":{"status":"resolved","repositories":{"forky":"145.0.7632.159-1"},"fixed_version":"74.0.3729.108-1","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"146.0.7680.71-1"},"fixed_version":"74.0.3729.108-1","urgency":"not yet assigned"},"trixie":{"status":"resolved","repositories":{"trixie":"143.0.7499.169-1~deb13u1","trixie-security":"145.0.7632.159-1~deb13u1"},"fixed_version":"74.0.3729.108-1","urgency":"not yet assigned"}}},"CVE-2019-5808":{"description":"Use after free in Blink in Google Chrome prior to 74.0.3729.108 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page.","scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"143.0.7499.169-1~deb12u1","bookworm-security":"145.0.7632.159-1~deb12u1"},"fixed_version":"74.0.3729.108-1","urgency":"not yet assigned"},"bullseye":{"status":"resolved","repositories":{"bullseye":"120.0.6099.224-1~deb11u1","bullseye-security":"120.0.6099.224-1~deb11u1"},"fixed_version":"74.0.3729.108-1","urgency":"not yet assigned"},"forky":{"status":"resolved","repositories":{"forky":"145.0.7632.159-1"},"fixed_version":"74.0.3729.108-1","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"146.0.7680.71-1"},"fixed_version":"74.0.3729.108-1","urgency":"not yet assigned"},"trixie":{"status":"resolved","repositories":{"trixie":"143.0.7499.169-1~deb13u1","trixie-security":"145.0.7632.159-1~deb13u1"},"fixed_version":"74.0.3729.108-1","urgency":"not yet assigned"}}},"CVE-2019-5809":{"description":"Use after free in file chooser in Google Chrome prior to 74.0.3729.108 allowed a remote attacker who had compromised the renderer process to perform privilege escalation via a crafted HTML page.","scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"143.0.7499.169-1~deb12u1","bookworm-security":"145.0.7632.159-1~deb12u1"},"fixed_version":"74.0.3729.108-1","urgency":"not yet assigned"},"bullseye":{"status":"resolved","repositories":{"bullseye":"120.0.6099.224-1~deb11u1","bullseye-security":"120.0.6099.224-1~deb11u1"},"fixed_version":"74.0.3729.108-1","urgency":"not yet assigned"},"forky":{"status":"resolved","repositories":{"forky":"145.0.7632.159-1"},"fixed_version":"74.0.3729.108-1","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"146.0.7680.71-1"},"fixed_version":"74.0.3729.108-1","urgency":"not yet assigned"},"trixie":{"status":"resolved","repositories":{"trixie":"143.0.7499.169-1~deb13u1","trixie-security":"145.0.7632.159-1~deb13u1"},"fixed_version":"74.0.3729.108-1","urgency":"not yet assigned"}}},"CVE-2019-5810":{"description":"Information leak in autofill in Google Chrome prior to 74.0.3729.108 allowed a remote attacker to obtain potentially sensitive information from process memory via a crafted HTML page.","scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"143.0.7499.169-1~deb12u1","bookworm-security":"145.0.7632.159-1~deb12u1"},"fixed_version":"74.0.3729.108-1","urgency":"not yet assigned"},"bullseye":{"status":"resolved","repositories":{"bullseye":"120.0.6099.224-1~deb11u1","bullseye-security":"120.0.6099.224-1~deb11u1"},"fixed_version":"74.0.3729.108-1","urgency":"not yet assigned"},"forky":{"status":"resolved","repositories":{"forky":"145.0.7632.159-1"},"fixed_version":"74.0.3729.108-1","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"146.0.7680.71-1"},"fixed_version":"74.0.3729.108-1","urgency":"not yet assigned"},"trixie":{"status":"resolved","repositories":{"trixie":"143.0.7499.169-1~deb13u1","trixie-security":"145.0.7632.159-1~deb13u1"},"fixed_version":"74.0.3729.108-1","urgency":"not yet assigned"}}},"CVE-2019-5811":{"description":"Incorrect handling of CORS in ServiceWorker in Google Chrome prior to 74.0.3729.108 allowed a remote attacker to bypass same origin policy via a crafted HTML page.","scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"143.0.7499.169-1~deb12u1","bookworm-security":"145.0.7632.159-1~deb12u1"},"fixed_version":"74.0.3729.108-1","urgency":"not yet assigned"},"bullseye":{"status":"resolved","repositories":{"bullseye":"120.0.6099.224-1~deb11u1","bullseye-security":"120.0.6099.224-1~deb11u1"},"fixed_version":"74.0.3729.108-1","urgency":"not yet assigned"},"forky":{"status":"resolved","repositories":{"forky":"145.0.7632.159-1"},"fixed_version":"74.0.3729.108-1","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"146.0.7680.71-1"},"fixed_version":"74.0.3729.108-1","urgency":"not yet assigned"},"trixie":{"status":"resolved","repositories":{"trixie":"143.0.7499.169-1~deb13u1","trixie-security":"145.0.7632.159-1~deb13u1"},"fixed_version":"74.0.3729.108-1","urgency":"not yet assigned"}}},"CVE-2019-5812":{"description":"Inadequate security UI in iOS UI in Google Chrome prior to 74.0.3729.108 allowed a remote attacker to perform domain spoofing via a crafted HTML page.","scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"143.0.7499.169-1~deb12u1","bookworm-security":"145.0.7632.159-1~deb12u1"},"fixed_version":"0","urgency":"unimportant"},"bullseye":{"status":"resolved","repositories":{"bullseye":"120.0.6099.224-1~deb11u1","bullseye-security":"120.0.6099.224-1~deb11u1"},"fixed_version":"0","urgency":"unimportant"},"forky":{"status":"resolved","repositories":{"forky":"145.0.7632.159-1"},"fixed_version":"0","urgency":"unimportant"},"sid":{"status":"resolved","repositories":{"sid":"146.0.7680.71-1"},"fixed_version":"0","urgency":"unimportant"},"trixie":{"status":"resolved","repositories":{"trixie":"143.0.7499.169-1~deb13u1","trixie-security":"145.0.7632.159-1~deb13u1"},"fixed_version":"0","urgency":"unimportant"}}},"CVE-2019-5813":{"description":"Use after free in V8 in Google Chrome prior to 74.0.3729.108 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page.","scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"143.0.7499.169-1~deb12u1","bookworm-security":"145.0.7632.159-1~deb12u1"},"fixed_version":"74.0.3729.108-1","urgency":"not yet assigned"},"bullseye":{"status":"resolved","repositories":{"bullseye":"120.0.6099.224-1~deb11u1","bullseye-security":"120.0.6099.224-1~deb11u1"},"fixed_version":"74.0.3729.108-1","urgency":"not yet assigned"},"forky":{"status":"resolved","repositories":{"forky":"145.0.7632.159-1"},"fixed_version":"74.0.3729.108-1","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"146.0.7680.71-1"},"fixed_version":"74.0.3729.108-1","urgency":"not yet assigned"},"trixie":{"status":"resolved","repositories":{"trixie":"143.0.7499.169-1~deb13u1","trixie-security":"145.0.7632.159-1~deb13u1"},"fixed_version":"74.0.3729.108-1","urgency":"not yet assigned"}}},"CVE-2019-5814":{"description":"Insufficient policy enforcement in Blink in Google Chrome prior to 74.0.3729.108 allowed a remote attacker to leak cross-origin data via a crafted HTML page.","scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"143.0.7499.169-1~deb12u1","bookworm-security":"145.0.7632.159-1~deb12u1"},"fixed_version":"74.0.3729.108-1","urgency":"not yet assigned"},"bullseye":{"status":"resolved","repositories":{"bullseye":"120.0.6099.224-1~deb11u1","bullseye-security":"120.0.6099.224-1~deb11u1"},"fixed_version":"74.0.3729.108-1","urgency":"not yet assigned"},"forky":{"status":"resolved","repositories":{"forky":"145.0.7632.159-1"},"fixed_version":"74.0.3729.108-1","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"146.0.7680.71-1"},"fixed_version":"74.0.3729.108-1","urgency":"not yet assigned"},"trixie":{"status":"resolved","repositories":{"trixie":"143.0.7499.169-1~deb13u1","trixie-security":"145.0.7632.159-1~deb13u1"},"fixed_version":"74.0.3729.108-1","urgency":"not yet assigned"}}},"CVE-2019-5815":{"description":"Type confusion in xsltNumberFormatGetMultipleLevel prior to libxslt 1.1.33 could allow attackers to potentially exploit heap corruption via crafted XML data.","scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"143.0.7499.169-1~deb12u1","bookworm-security":"145.0.7632.159-1~deb12u1"},"fixed_version":"74.0.3729.108-1","urgency":"not yet assigned"},"bullseye":{"status":"resolved","repositories":{"bullseye":"120.0.6099.224-1~deb11u1","bullseye-security":"120.0.6099.224-1~deb11u1"},"fixed_version":"74.0.3729.108-1","urgency":"not yet assigned"},"forky":{"status":"resolved","repositories":{"forky":"145.0.7632.159-1"},"fixed_version":"74.0.3729.108-1","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"146.0.7680.71-1"},"fixed_version":"74.0.3729.108-1","urgency":"not yet assigned"},"trixie":{"status":"resolved","repositories":{"trixie":"143.0.7499.169-1~deb13u1","trixie-security":"145.0.7632.159-1~deb13u1"},"fixed_version":"74.0.3729.108-1","urgency":"not yet assigned"}}},"CVE-2019-5816":{"description":"Process lifetime issue in Chrome in Google Chrome on Android prior to 74.0.3729.108 allowed a remote attacker to potentially persist an exploited process via a crafted HTML page.","scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"143.0.7499.169-1~deb12u1","bookworm-security":"145.0.7632.159-1~deb12u1"},"fixed_version":"0","urgency":"unimportant"},"bullseye":{"status":"resolved","repositories":{"bullseye":"120.0.6099.224-1~deb11u1","bullseye-security":"120.0.6099.224-1~deb11u1"},"fixed_version":"0","urgency":"unimportant"},"forky":{"status":"resolved","repositories":{"forky":"145.0.7632.159-1"},"fixed_version":"0","urgency":"unimportant"},"sid":{"status":"resolved","repositories":{"sid":"146.0.7680.71-1"},"fixed_version":"0","urgency":"unimportant"},"trixie":{"status":"resolved","repositories":{"trixie":"143.0.7499.169-1~deb13u1","trixie-security":"145.0.7632.159-1~deb13u1"},"fixed_version":"0","urgency":"unimportant"}}},"CVE-2019-5817":{"description":"Heap buffer overflow in ANGLE in Google Chrome on Windows prior to 74.0.3729.108 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page.","scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"143.0.7499.169-1~deb12u1","bookworm-security":"145.0.7632.159-1~deb12u1"},"fixed_version":"0","urgency":"unimportant"},"bullseye":{"status":"resolved","repositories":{"bullseye":"120.0.6099.224-1~deb11u1","bullseye-security":"120.0.6099.224-1~deb11u1"},"fixed_version":"0","urgency":"unimportant"},"forky":{"status":"resolved","repositories":{"forky":"145.0.7632.159-1"},"fixed_version":"0","urgency":"unimportant"},"sid":{"status":"resolved","repositories":{"sid":"146.0.7680.71-1"},"fixed_version":"0","urgency":"unimportant"},"trixie":{"status":"resolved","repositories":{"trixie":"143.0.7499.169-1~deb13u1","trixie-security":"145.0.7632.159-1~deb13u1"},"fixed_version":"0","urgency":"unimportant"}}},"CVE-2019-5818":{"description":"Uninitialized data in media in Google Chrome prior to 74.0.3729.108 allowed a remote attacker to obtain potentially sensitive information from process memory via a crafted video file.","scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"143.0.7499.169-1~deb12u1","bookworm-security":"145.0.7632.159-1~deb12u1"},"fixed_version":"74.0.3729.108-1","urgency":"not yet assigned"},"bullseye":{"status":"resolved","repositories":{"bullseye":"120.0.6099.224-1~deb11u1","bullseye-security":"120.0.6099.224-1~deb11u1"},"fixed_version":"74.0.3729.108-1","urgency":"not yet assigned"},"forky":{"status":"resolved","repositories":{"forky":"145.0.7632.159-1"},"fixed_version":"74.0.3729.108-1","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"146.0.7680.71-1"},"fixed_version":"74.0.3729.108-1","urgency":"not yet assigned"},"trixie":{"status":"resolved","repositories":{"trixie":"143.0.7499.169-1~deb13u1","trixie-security":"145.0.7632.159-1~deb13u1"},"fixed_version":"74.0.3729.108-1","urgency":"not yet assigned"}}},"CVE-2019-5819":{"description":"Insufficient data validation in developer tools in Google Chrome on OS X prior to 74.0.3729.108 allowed a local attacker to execute arbitrary code via a crafted string copied to clipboard.","scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"143.0.7499.169-1~deb12u1","bookworm-security":"145.0.7632.159-1~deb12u1"},"fixed_version":"74.0.3729.108-1","urgency":"not yet assigned"},"bullseye":{"status":"resolved","repositories":{"bullseye":"120.0.6099.224-1~deb11u1","bullseye-security":"120.0.6099.224-1~deb11u1"},"fixed_version":"74.0.3729.108-1","urgency":"not yet assigned"},"forky":{"status":"resolved","repositories":{"forky":"145.0.7632.159-1"},"fixed_version":"74.0.3729.108-1","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"146.0.7680.71-1"},"fixed_version":"74.0.3729.108-1","urgency":"not yet assigned"},"trixie":{"status":"resolved","repositories":{"trixie":"143.0.7499.169-1~deb13u1","trixie-security":"145.0.7632.159-1~deb13u1"},"fixed_version":"74.0.3729.108-1","urgency":"not yet assigned"}}},"CVE-2019-5820":{"description":"Integer overflow in PDFium in Google Chrome prior to 74.0.3729.108 allowed a remote attacker to potentially exploit heap corruption via a crafted PDF file.","scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"143.0.7499.169-1~deb12u1","bookworm-security":"145.0.7632.159-1~deb12u1"},"fixed_version":"74.0.3729.108-1","urgency":"not yet assigned"},"bullseye":{"status":"resolved","repositories":{"bullseye":"120.0.6099.224-1~deb11u1","bullseye-security":"120.0.6099.224-1~deb11u1"},"fixed_version":"74.0.3729.108-1","urgency":"not yet assigned"},"forky":{"status":"resolved","repositories":{"forky":"145.0.7632.159-1"},"fixed_version":"74.0.3729.108-1","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"146.0.7680.71-1"},"fixed_version":"74.0.3729.108-1","urgency":"not yet assigned"},"trixie":{"status":"resolved","repositories":{"trixie":"143.0.7499.169-1~deb13u1","trixie-security":"145.0.7632.159-1~deb13u1"},"fixed_version":"74.0.3729.108-1","urgency":"not yet assigned"}}},"CVE-2019-5821":{"description":"Integer overflow in PDFium in Google Chrome prior to 74.0.3729.108 allowed a remote attacker to potentially exploit heap corruption via a crafted PDF file.","scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"143.0.7499.169-1~deb12u1","bookworm-security":"145.0.7632.159-1~deb12u1"},"fixed_version":"74.0.3729.108-1","urgency":"not yet assigned"},"bullseye":{"status":"resolved","repositories":{"bullseye":"120.0.6099.224-1~deb11u1","bullseye-security":"120.0.6099.224-1~deb11u1"},"fixed_version":"74.0.3729.108-1","urgency":"not yet assigned"},"forky":{"status":"resolved","repositories":{"forky":"145.0.7632.159-1"},"fixed_version":"74.0.3729.108-1","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"146.0.7680.71-1"},"fixed_version":"74.0.3729.108-1","urgency":"not yet assigned"},"trixie":{"status":"resolved","repositories":{"trixie":"143.0.7499.169-1~deb13u1","trixie-security":"145.0.7632.159-1~deb13u1"},"fixed_version":"74.0.3729.108-1","urgency":"not yet assigned"}}},"CVE-2019-5822":{"description":"Inappropriate implementation in Blink in Google Chrome prior to 74.0.3729.108 allowed a remote attacker to bypass same origin policy via a crafted HTML page.","scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"143.0.7499.169-1~deb12u1","bookworm-security":"145.0.7632.159-1~deb12u1"},"fixed_version":"74.0.3729.108-1","urgency":"not yet assigned"},"bullseye":{"status":"resolved","repositories":{"bullseye":"120.0.6099.224-1~deb11u1","bullseye-security":"120.0.6099.224-1~deb11u1"},"fixed_version":"74.0.3729.108-1","urgency":"not yet assigned"},"forky":{"status":"resolved","repositories":{"forky":"145.0.7632.159-1"},"fixed_version":"74.0.3729.108-1","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"146.0.7680.71-1"},"fixed_version":"74.0.3729.108-1","urgency":"not yet assigned"},"trixie":{"status":"resolved","repositories":{"trixie":"143.0.7499.169-1~deb13u1","trixie-security":"145.0.7632.159-1~deb13u1"},"fixed_version":"74.0.3729.108-1","urgency":"not yet assigned"}}},"CVE-2019-5823":{"description":"Insufficient policy enforcement in service workers in Google Chrome prior to 74.0.3729.108 allowed a remote attacker to bypass navigation restrictions via a crafted HTML page.","scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"143.0.7499.169-1~deb12u1","bookworm-security":"145.0.7632.159-1~deb12u1"},"fixed_version":"74.0.3729.108-1","urgency":"not yet assigned"},"bullseye":{"status":"resolved","repositories":{"bullseye":"120.0.6099.224-1~deb11u1","bullseye-security":"120.0.6099.224-1~deb11u1"},"fixed_version":"74.0.3729.108-1","urgency":"not yet assigned"},"forky":{"status":"resolved","repositories":{"forky":"145.0.7632.159-1"},"fixed_version":"74.0.3729.108-1","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"146.0.7680.71-1"},"fixed_version":"74.0.3729.108-1","urgency":"not yet assigned"},"trixie":{"status":"resolved","repositories":{"trixie":"143.0.7499.169-1~deb13u1","trixie-security":"145.0.7632.159-1~deb13u1"},"fixed_version":"74.0.3729.108-1","urgency":"not yet assigned"}}},"CVE-2019-5824":{"description":"Parameter passing error in media in Google Chrome prior to 74.0.3729.131 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page.","scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"143.0.7499.169-1~deb12u1","bookworm-security":"145.0.7632.159-1~deb12u1"},"fixed_version":"75.0.3770.80-1","urgency":"not yet assigned"},"bullseye":{"status":"resolved","repositories":{"bullseye":"120.0.6099.224-1~deb11u1","bullseye-security":"120.0.6099.224-1~deb11u1"},"fixed_version":"75.0.3770.80-1","urgency":"not yet assigned"},"forky":{"status":"resolved","repositories":{"forky":"145.0.7632.159-1"},"fixed_version":"75.0.3770.80-1","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"146.0.7680.71-1"},"fixed_version":"75.0.3770.80-1","urgency":"not yet assigned"},"trixie":{"status":"resolved","repositories":{"trixie":"143.0.7499.169-1~deb13u1","trixie-security":"145.0.7632.159-1~deb13u1"},"fixed_version":"75.0.3770.80-1","urgency":"not yet assigned"}}},"CVE-2019-5825":{"description":"Out of bounds write in JavaScript in Google Chrome prior to 73.0.3683.86 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page.","scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"143.0.7499.169-1~deb12u1","bookworm-security":"145.0.7632.159-1~deb12u1"},"fixed_version":"75.0.3770.80-1","urgency":"not yet assigned"},"bullseye":{"status":"resolved","repositories":{"bullseye":"120.0.6099.224-1~deb11u1","bullseye-security":"120.0.6099.224-1~deb11u1"},"fixed_version":"75.0.3770.80-1","urgency":"not yet assigned"},"forky":{"status":"resolved","repositories":{"forky":"145.0.7632.159-1"},"fixed_version":"75.0.3770.80-1","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"146.0.7680.71-1"},"fixed_version":"75.0.3770.80-1","urgency":"not yet assigned"},"trixie":{"status":"resolved","repositories":{"trixie":"143.0.7499.169-1~deb13u1","trixie-security":"145.0.7632.159-1~deb13u1"},"fixed_version":"75.0.3770.80-1","urgency":"not yet assigned"}}},"CVE-2019-5826":{"description":"Use after free in IndexedDB in Google Chrome prior to 73.0.3683.86 allowed a remote attacker who had compromised the renderer process to potentially exploit heap corruption via a crafted HTML page.","scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"143.0.7499.169-1~deb12u1","bookworm-security":"145.0.7632.159-1~deb12u1"},"fixed_version":"75.0.3770.80-1","urgency":"not yet assigned"},"bullseye":{"status":"resolved","repositories":{"bullseye":"120.0.6099.224-1~deb11u1","bullseye-security":"120.0.6099.224-1~deb11u1"},"fixed_version":"75.0.3770.80-1","urgency":"not yet assigned"},"forky":{"status":"resolved","repositories":{"forky":"145.0.7632.159-1"},"fixed_version":"75.0.3770.80-1","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"146.0.7680.71-1"},"fixed_version":"75.0.3770.80-1","urgency":"not yet assigned"},"trixie":{"status":"resolved","repositories":{"trixie":"143.0.7499.169-1~deb13u1","trixie-security":"145.0.7632.159-1~deb13u1"},"fixed_version":"75.0.3770.80-1","urgency":"not yet assigned"}}},"CVE-2019-5827":{"description":"Integer overflow in SQLite via WebSQL in Google Chrome prior to 74.0.3729.131 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page.","scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"143.0.7499.169-1~deb12u1","bookworm-security":"145.0.7632.159-1~deb12u1"},"fixed_version":"75.0.3770.80-1","urgency":"not yet assigned"},"bullseye":{"status":"resolved","repositories":{"bullseye":"120.0.6099.224-1~deb11u1","bullseye-security":"120.0.6099.224-1~deb11u1"},"fixed_version":"75.0.3770.80-1","urgency":"not yet assigned"},"forky":{"status":"resolved","repositories":{"forky":"145.0.7632.159-1"},"fixed_version":"75.0.3770.80-1","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"146.0.7680.71-1"},"fixed_version":"75.0.3770.80-1","urgency":"not yet assigned"},"trixie":{"status":"resolved","repositories":{"trixie":"143.0.7499.169-1~deb13u1","trixie-security":"145.0.7632.159-1~deb13u1"},"fixed_version":"75.0.3770.80-1","urgency":"not yet assigned"}}},"CVE-2019-5828":{"description":"Object lifecycle issue in ServiceWorker in Google Chrome prior to 75.0.3770.80 allowed a remote attacker to potentially perform out of bounds memory access via a crafted HTML page.","scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"143.0.7499.169-1~deb12u1","bookworm-security":"145.0.7632.159-1~deb12u1"},"fixed_version":"75.0.3770.80-1","urgency":"not yet assigned"},"bullseye":{"status":"resolved","repositories":{"bullseye":"120.0.6099.224-1~deb11u1","bullseye-security":"120.0.6099.224-1~deb11u1"},"fixed_version":"75.0.3770.80-1","urgency":"not yet assigned"},"forky":{"status":"resolved","repositories":{"forky":"145.0.7632.159-1"},"fixed_version":"75.0.3770.80-1","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"146.0.7680.71-1"},"fixed_version":"75.0.3770.80-1","urgency":"not yet assigned"},"trixie":{"status":"resolved","repositories":{"trixie":"143.0.7499.169-1~deb13u1","trixie-security":"145.0.7632.159-1~deb13u1"},"fixed_version":"75.0.3770.80-1","urgency":"not yet assigned"}}},"CVE-2019-5829":{"description":"Integer overflow in download manager in Google Chrome prior to 75.0.3770.80 allowed a remote attacker to potentially perform out of bounds memory access via a crafted HTML page.","scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"143.0.7499.169-1~deb12u1","bookworm-security":"145.0.7632.159-1~deb12u1"},"fixed_version":"75.0.3770.80-1","urgency":"not yet assigned"},"bullseye":{"status":"resolved","repositories":{"bullseye":"120.0.6099.224-1~deb11u1","bullseye-security":"120.0.6099.224-1~deb11u1"},"fixed_version":"75.0.3770.80-1","urgency":"not yet assigned"},"forky":{"status":"resolved","repositories":{"forky":"145.0.7632.159-1"},"fixed_version":"75.0.3770.80-1","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"146.0.7680.71-1"},"fixed_version":"75.0.3770.80-1","urgency":"not yet assigned"},"trixie":{"status":"resolved","repositories":{"trixie":"143.0.7499.169-1~deb13u1","trixie-security":"145.0.7632.159-1~deb13u1"},"fixed_version":"75.0.3770.80-1","urgency":"not yet assigned"}}},"CVE-2019-5830":{"description":"Insufficient policy enforcement in CORS in Google Chrome prior to 75.0.3770.80 allowed a remote attacker to leak cross-origin data via a crafted HTML page.","scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"143.0.7499.169-1~deb12u1","bookworm-security":"145.0.7632.159-1~deb12u1"},"fixed_version":"75.0.3770.80-1","urgency":"not yet assigned"},"bullseye":{"status":"resolved","repositories":{"bullseye":"120.0.6099.224-1~deb11u1","bullseye-security":"120.0.6099.224-1~deb11u1"},"fixed_version":"75.0.3770.80-1","urgency":"not yet assigned"},"forky":{"status":"resolved","repositories":{"forky":"145.0.7632.159-1"},"fixed_version":"75.0.3770.80-1","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"146.0.7680.71-1"},"fixed_version":"75.0.3770.80-1","urgency":"not yet assigned"},"trixie":{"status":"resolved","repositories":{"trixie":"143.0.7499.169-1~deb13u1","trixie-security":"145.0.7632.159-1~deb13u1"},"fixed_version":"75.0.3770.80-1","urgency":"not yet assigned"}}},"CVE-2019-5831":{"description":"Object lifecycle issue in V8 in Google Chrome prior to 75.0.3770.80 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page.","scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"143.0.7499.169-1~deb12u1","bookworm-security":"145.0.7632.159-1~deb12u1"},"fixed_version":"75.0.3770.80-1","urgency":"not yet assigned"},"bullseye":{"status":"resolved","repositories":{"bullseye":"120.0.6099.224-1~deb11u1","bullseye-security":"120.0.6099.224-1~deb11u1"},"fixed_version":"75.0.3770.80-1","urgency":"not yet assigned"},"forky":{"status":"resolved","repositories":{"forky":"145.0.7632.159-1"},"fixed_version":"75.0.3770.80-1","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"146.0.7680.71-1"},"fixed_version":"75.0.3770.80-1","urgency":"not yet assigned"},"trixie":{"status":"resolved","repositories":{"trixie":"143.0.7499.169-1~deb13u1","trixie-security":"145.0.7632.159-1~deb13u1"},"fixed_version":"75.0.3770.80-1","urgency":"not yet assigned"}}},"CVE-2019-5832":{"description":"Insufficient policy enforcement in XMLHttpRequest in Google Chrome prior to 75.0.3770.80 allowed a remote attacker to leak cross-origin data via a crafted HTML page.","scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"143.0.7499.169-1~deb12u1","bookworm-security":"145.0.7632.159-1~deb12u1"},"fixed_version":"75.0.3770.80-1","urgency":"not yet assigned"},"bullseye":{"status":"resolved","repositories":{"bullseye":"120.0.6099.224-1~deb11u1","bullseye-security":"120.0.6099.224-1~deb11u1"},"fixed_version":"75.0.3770.80-1","urgency":"not yet assigned"},"forky":{"status":"resolved","repositories":{"forky":"145.0.7632.159-1"},"fixed_version":"75.0.3770.80-1","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"146.0.7680.71-1"},"fixed_version":"75.0.3770.80-1","urgency":"not yet assigned"},"trixie":{"status":"resolved","repositories":{"trixie":"143.0.7499.169-1~deb13u1","trixie-security":"145.0.7632.159-1~deb13u1"},"fixed_version":"75.0.3770.80-1","urgency":"not yet assigned"}}},"CVE-2019-5833":{"description":"Incorrect dialog box scoping in browser in Google Chrome on Android prior to 75.0.3770.80 allowed a remote attacker to display misleading security UI via a crafted HTML page.","scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"143.0.7499.169-1~deb12u1","bookworm-security":"145.0.7632.159-1~deb12u1"},"fixed_version":"75.0.3770.80-1","urgency":"not yet assigned"},"bullseye":{"status":"resolved","repositories":{"bullseye":"120.0.6099.224-1~deb11u1","bullseye-security":"120.0.6099.224-1~deb11u1"},"fixed_version":"75.0.3770.80-1","urgency":"not yet assigned"},"forky":{"status":"resolved","repositories":{"forky":"145.0.7632.159-1"},"fixed_version":"75.0.3770.80-1","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"146.0.7680.71-1"},"fixed_version":"75.0.3770.80-1","urgency":"not yet assigned"},"trixie":{"status":"resolved","repositories":{"trixie":"143.0.7499.169-1~deb13u1","trixie-security":"145.0.7632.159-1~deb13u1"},"fixed_version":"75.0.3770.80-1","urgency":"not yet assigned"}}},"CVE-2019-5834":{"description":"Insufficient data validation in Blink in Google Chrome prior to 75.0.3770.80 allowed a remote attacker to perform domain spoofing via a crafted HTML page.","scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"143.0.7499.169-1~deb12u1","bookworm-security":"145.0.7632.159-1~deb12u1"},"fixed_version":"0","urgency":"unimportant"},"bullseye":{"status":"resolved","repositories":{"bullseye":"120.0.6099.224-1~deb11u1","bullseye-security":"120.0.6099.224-1~deb11u1"},"fixed_version":"0","urgency":"unimportant"},"forky":{"status":"resolved","repositories":{"forky":"145.0.7632.159-1"},"fixed_version":"0","urgency":"unimportant"},"sid":{"status":"resolved","repositories":{"sid":"146.0.7680.71-1"},"fixed_version":"0","urgency":"unimportant"},"trixie":{"status":"resolved","repositories":{"trixie":"143.0.7499.169-1~deb13u1","trixie-security":"145.0.7632.159-1~deb13u1"},"fixed_version":"0","urgency":"unimportant"}}},"CVE-2019-5835":{"description":"Object lifecycle issue in SwiftShader in Google Chrome prior to 75.0.3770.80 allowed a remote attacker to potentially perform out of bounds memory access via a crafted HTML page.","scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"143.0.7499.169-1~deb12u1","bookworm-security":"145.0.7632.159-1~deb12u1"},"fixed_version":"75.0.3770.80-1","urgency":"not yet assigned"},"bullseye":{"status":"resolved","repositories":{"bullseye":"120.0.6099.224-1~deb11u1","bullseye-security":"120.0.6099.224-1~deb11u1"},"fixed_version":"75.0.3770.80-1","urgency":"not yet assigned"},"forky":{"status":"resolved","repositories":{"forky":"145.0.7632.159-1"},"fixed_version":"75.0.3770.80-1","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"146.0.7680.71-1"},"fixed_version":"75.0.3770.80-1","urgency":"not yet assigned"},"trixie":{"status":"resolved","repositories":{"trixie":"143.0.7499.169-1~deb13u1","trixie-security":"145.0.7632.159-1~deb13u1"},"fixed_version":"75.0.3770.80-1","urgency":"not yet assigned"}}},"CVE-2019-5836":{"description":"Heap buffer overflow in ANGLE in Google Chrome prior to 75.0.3770.80 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page.","scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"143.0.7499.169-1~deb12u1","bookworm-security":"145.0.7632.159-1~deb12u1"},"fixed_version":"75.0.3770.80-1","urgency":"not yet assigned"},"bullseye":{"status":"resolved","repositories":{"bullseye":"120.0.6099.224-1~deb11u1","bullseye-security":"120.0.6099.224-1~deb11u1"},"fixed_version":"75.0.3770.80-1","urgency":"not yet assigned"},"forky":{"status":"resolved","repositories":{"forky":"145.0.7632.159-1"},"fixed_version":"75.0.3770.80-1","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"146.0.7680.71-1"},"fixed_version":"75.0.3770.80-1","urgency":"not yet assigned"},"trixie":{"status":"resolved","repositories":{"trixie":"143.0.7499.169-1~deb13u1","trixie-security":"145.0.7632.159-1~deb13u1"},"fixed_version":"75.0.3770.80-1","urgency":"not yet assigned"}}},"CVE-2019-5837":{"description":"Resource size information leakage in Blink in Google Chrome prior to 75.0.3770.80 allowed a remote attacker to leak cross-origin data via a crafted HTML page.","scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"143.0.7499.169-1~deb12u1","bookworm-security":"145.0.7632.159-1~deb12u1"},"fixed_version":"75.0.3770.80-1","urgency":"not yet assigned"},"bullseye":{"status":"resolved","repositories":{"bullseye":"120.0.6099.224-1~deb11u1","bullseye-security":"120.0.6099.224-1~deb11u1"},"fixed_version":"75.0.3770.80-1","urgency":"not yet assigned"},"forky":{"status":"resolved","repositories":{"forky":"145.0.7632.159-1"},"fixed_version":"75.0.3770.80-1","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"146.0.7680.71-1"},"fixed_version":"75.0.3770.80-1","urgency":"not yet assigned"},"trixie":{"status":"resolved","repositories":{"trixie":"143.0.7499.169-1~deb13u1","trixie-security":"145.0.7632.159-1~deb13u1"},"fixed_version":"75.0.3770.80-1","urgency":"not yet assigned"}}},"CVE-2019-5838":{"description":"Insufficient policy enforcement in extensions API in Google Chrome prior to 75.0.3770.80 allowed an attacker who convinced a user to install a malicious extension to bypass restrictions on file URIs via a crafted Chrome Extension.","scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"143.0.7499.169-1~deb12u1","bookworm-security":"145.0.7632.159-1~deb12u1"},"fixed_version":"75.0.3770.80-1","urgency":"not yet assigned"},"bullseye":{"status":"resolved","repositories":{"bullseye":"120.0.6099.224-1~deb11u1","bullseye-security":"120.0.6099.224-1~deb11u1"},"fixed_version":"75.0.3770.80-1","urgency":"not yet assigned"},"forky":{"status":"resolved","repositories":{"forky":"145.0.7632.159-1"},"fixed_version":"75.0.3770.80-1","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"146.0.7680.71-1"},"fixed_version":"75.0.3770.80-1","urgency":"not yet assigned"},"trixie":{"status":"resolved","repositories":{"trixie":"143.0.7499.169-1~deb13u1","trixie-security":"145.0.7632.159-1~deb13u1"},"fixed_version":"75.0.3770.80-1","urgency":"not yet assigned"}}},"CVE-2019-5839":{"description":"Excessive data validation in URL parser in Google Chrome prior to 75.0.3770.80 allowed a remote attacker who convinced a user to input a URL to bypass website URL validation via a crafted URL.","scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"143.0.7499.169-1~deb12u1","bookworm-security":"145.0.7632.159-1~deb12u1"},"fixed_version":"75.0.3770.80-1","urgency":"not yet assigned"},"bullseye":{"status":"resolved","repositories":{"bullseye":"120.0.6099.224-1~deb11u1","bullseye-security":"120.0.6099.224-1~deb11u1"},"fixed_version":"75.0.3770.80-1","urgency":"not yet assigned"},"forky":{"status":"resolved","repositories":{"forky":"145.0.7632.159-1"},"fixed_version":"75.0.3770.80-1","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"146.0.7680.71-1"},"fixed_version":"75.0.3770.80-1","urgency":"not yet assigned"},"trixie":{"status":"resolved","repositories":{"trixie":"143.0.7499.169-1~deb13u1","trixie-security":"145.0.7632.159-1~deb13u1"},"fixed_version":"75.0.3770.80-1","urgency":"not yet assigned"}}},"CVE-2019-5840":{"description":"Incorrect security UI in popup blocker in Google Chrome on iOS prior to 75.0.3770.80 allowed a remote attacker to bypass navigation restrictions via a crafted HTML page.","scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"143.0.7499.169-1~deb12u1","bookworm-security":"145.0.7632.159-1~deb12u1"},"fixed_version":"75.0.3770.80-1","urgency":"not yet assigned"},"bullseye":{"status":"resolved","repositories":{"bullseye":"120.0.6099.224-1~deb11u1","bullseye-security":"120.0.6099.224-1~deb11u1"},"fixed_version":"75.0.3770.80-1","urgency":"not yet assigned"},"forky":{"status":"resolved","repositories":{"forky":"145.0.7632.159-1"},"fixed_version":"75.0.3770.80-1","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"146.0.7680.71-1"},"fixed_version":"75.0.3770.80-1","urgency":"not yet assigned"},"trixie":{"status":"resolved","repositories":{"trixie":"143.0.7499.169-1~deb13u1","trixie-security":"145.0.7632.159-1~deb13u1"},"fixed_version":"75.0.3770.80-1","urgency":"not yet assigned"}}},"CVE-2019-5841":{"description":"Out of bounds memory access in JavaScript in Google Chrome prior to 75.0.3770.80 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page.","scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"143.0.7499.169-1~deb12u1","bookworm-security":"145.0.7632.159-1~deb12u1"},"fixed_version":"75.0.3770.80-1","urgency":"not yet assigned"},"bullseye":{"status":"resolved","repositories":{"bullseye":"120.0.6099.224-1~deb11u1","bullseye-security":"120.0.6099.224-1~deb11u1"},"fixed_version":"75.0.3770.80-1","urgency":"not yet assigned"},"forky":{"status":"resolved","repositories":{"forky":"145.0.7632.159-1"},"fixed_version":"75.0.3770.80-1","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"146.0.7680.71-1"},"fixed_version":"75.0.3770.80-1","urgency":"not yet assigned"},"trixie":{"status":"resolved","repositories":{"trixie":"143.0.7499.169-1~deb13u1","trixie-security":"145.0.7632.159-1~deb13u1"},"fixed_version":"75.0.3770.80-1","urgency":"not yet assigned"}}},"CVE-2019-5842":{"description":"Use after free in Blink in Google Chrome prior to 75.0.3770.90 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page.","scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"143.0.7499.169-1~deb12u1","bookworm-security":"145.0.7632.159-1~deb12u1"},"fixed_version":"75.0.3770.90-1","urgency":"not yet assigned"},"bullseye":{"status":"resolved","repositories":{"bullseye":"120.0.6099.224-1~deb11u1","bullseye-security":"120.0.6099.224-1~deb11u1"},"fixed_version":"75.0.3770.90-1","urgency":"not yet assigned"},"forky":{"status":"resolved","repositories":{"forky":"145.0.7632.159-1"},"fixed_version":"75.0.3770.90-1","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"146.0.7680.71-1"},"fixed_version":"75.0.3770.90-1","urgency":"not yet assigned"},"trixie":{"status":"resolved","repositories":{"trixie":"143.0.7499.169-1~deb13u1","trixie-security":"145.0.7632.159-1~deb13u1"},"fixed_version":"75.0.3770.90-1","urgency":"not yet assigned"}}},"CVE-2019-5843":{"description":"Out of bounds memory access in JavaScript in Google Chrome prior to 74.0.3729.108 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page.","scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"143.0.7499.169-1~deb12u1","bookworm-security":"145.0.7632.159-1~deb12u1"},"fixed_version":"74.0.3729.108-1","urgency":"not yet assigned"},"bullseye":{"status":"resolved","repositories":{"bullseye":"120.0.6099.224-1~deb11u1","bullseye-security":"120.0.6099.224-1~deb11u1"},"fixed_version":"74.0.3729.108-1","urgency":"not yet assigned"},"forky":{"status":"resolved","repositories":{"forky":"145.0.7632.159-1"},"fixed_version":"74.0.3729.108-1","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"146.0.7680.71-1"},"fixed_version":"74.0.3729.108-1","urgency":"not yet assigned"},"trixie":{"status":"resolved","repositories":{"trixie":"143.0.7499.169-1~deb13u1","trixie-security":"145.0.7632.159-1~deb13u1"},"fixed_version":"74.0.3729.108-1","urgency":"not yet assigned"}}},"CVE-2019-5844":{"description":"Out of bounds access in SwiftShader in Google Chrome prior to 73.0.3683.75 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page.","scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"143.0.7499.169-1~deb12u1","bookworm-security":"145.0.7632.159-1~deb12u1"},"fixed_version":"73.0.3683.75-1","urgency":"not yet assigned"},"bullseye":{"status":"resolved","repositories":{"bullseye":"120.0.6099.224-1~deb11u1","bullseye-security":"120.0.6099.224-1~deb11u1"},"fixed_version":"73.0.3683.75-1","urgency":"not yet assigned"},"forky":{"status":"resolved","repositories":{"forky":"145.0.7632.159-1"},"fixed_version":"73.0.3683.75-1","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"146.0.7680.71-1"},"fixed_version":"73.0.3683.75-1","urgency":"not yet assigned"},"trixie":{"status":"resolved","repositories":{"trixie":"143.0.7499.169-1~deb13u1","trixie-security":"145.0.7632.159-1~deb13u1"},"fixed_version":"73.0.3683.75-1","urgency":"not yet assigned"}}},"CVE-2019-5845":{"description":"Out of bounds access in SwiftShader in Google Chrome prior to 73.0.3683.75 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page.","scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"143.0.7499.169-1~deb12u1","bookworm-security":"145.0.7632.159-1~deb12u1"},"fixed_version":"73.0.3683.75-1","urgency":"not yet assigned"},"bullseye":{"status":"resolved","repositories":{"bullseye":"120.0.6099.224-1~deb11u1","bullseye-security":"120.0.6099.224-1~deb11u1"},"fixed_version":"73.0.3683.75-1","urgency":"not yet assigned"},"forky":{"status":"resolved","repositories":{"forky":"145.0.7632.159-1"},"fixed_version":"73.0.3683.75-1","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"146.0.7680.71-1"},"fixed_version":"73.0.3683.75-1","urgency":"not yet assigned"},"trixie":{"status":"resolved","repositories":{"trixie":"143.0.7499.169-1~deb13u1","trixie-security":"145.0.7632.159-1~deb13u1"},"fixed_version":"73.0.3683.75-1","urgency":"not yet assigned"}}},"CVE-2019-5846":{"description":"Out of bounds access in SwiftShader in Google Chrome prior to 73.0.3683.75 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page.","scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"143.0.7499.169-1~deb12u1","bookworm-security":"145.0.7632.159-1~deb12u1"},"fixed_version":"73.0.3683.75-1","urgency":"not yet assigned"},"bullseye":{"status":"resolved","repositories":{"bullseye":"120.0.6099.224-1~deb11u1","bullseye-security":"120.0.6099.224-1~deb11u1"},"fixed_version":"73.0.3683.75-1","urgency":"not yet assigned"},"forky":{"status":"resolved","repositories":{"forky":"145.0.7632.159-1"},"fixed_version":"73.0.3683.75-1","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"146.0.7680.71-1"},"fixed_version":"73.0.3683.75-1","urgency":"not yet assigned"},"trixie":{"status":"resolved","repositories":{"trixie":"143.0.7499.169-1~deb13u1","trixie-security":"145.0.7632.159-1~deb13u1"},"fixed_version":"73.0.3683.75-1","urgency":"not yet assigned"}}},"CVE-2019-5847":{"description":"Inappropriate implementation in JavaScript in Google Chrome prior to 75.0.3770.142 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page.","scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"143.0.7499.169-1~deb12u1","bookworm-security":"145.0.7632.159-1~deb12u1"},"fixed_version":"76.0.3809.87-1","urgency":"not yet assigned"},"bullseye":{"status":"resolved","repositories":{"bullseye":"120.0.6099.224-1~deb11u1","bullseye-security":"120.0.6099.224-1~deb11u1"},"fixed_version":"76.0.3809.87-1","urgency":"not yet assigned"},"forky":{"status":"resolved","repositories":{"forky":"145.0.7632.159-1"},"fixed_version":"76.0.3809.87-1","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"146.0.7680.71-1"},"fixed_version":"76.0.3809.87-1","urgency":"not yet assigned"},"trixie":{"status":"resolved","repositories":{"trixie":"143.0.7499.169-1~deb13u1","trixie-security":"145.0.7632.159-1~deb13u1"},"fixed_version":"76.0.3809.87-1","urgency":"not yet assigned"}}},"CVE-2019-5848":{"description":"Incorrect font handling in autofill in Google Chrome prior to 75.0.3770.142 allowed a remote attacker to obtain potentially sensitive information from process memory via a crafted HTML page.","scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"143.0.7499.169-1~deb12u1","bookworm-security":"145.0.7632.159-1~deb12u1"},"fixed_version":"76.0.3809.87-1","urgency":"not yet assigned"},"bullseye":{"status":"resolved","repositories":{"bullseye":"120.0.6099.224-1~deb11u1","bullseye-security":"120.0.6099.224-1~deb11u1"},"fixed_version":"76.0.3809.87-1","urgency":"not yet assigned"},"forky":{"status":"resolved","repositories":{"forky":"145.0.7632.159-1"},"fixed_version":"76.0.3809.87-1","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"146.0.7680.71-1"},"fixed_version":"76.0.3809.87-1","urgency":"not yet assigned"},"trixie":{"status":"resolved","repositories":{"trixie":"143.0.7499.169-1~deb13u1","trixie-security":"145.0.7632.159-1~deb13u1"},"fixed_version":"76.0.3809.87-1","urgency":"not yet assigned"}}},"CVE-2019-5849":{"description":"Out of bounds read in Skia in Google Chrome prior to 75.0.3770.80 allowed a remote attacker to obtain potentially sensitive information from process memory via a crafted HTML page.","scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"143.0.7499.169-1~deb12u1","bookworm-security":"145.0.7632.159-1~deb12u1"},"fixed_version":"76.0.3809.87-1","urgency":"not yet assigned"},"bullseye":{"status":"resolved","repositories":{"bullseye":"120.0.6099.224-1~deb11u1","bullseye-security":"120.0.6099.224-1~deb11u1"},"fixed_version":"76.0.3809.87-1","urgency":"not yet assigned"},"forky":{"status":"resolved","repositories":{"forky":"145.0.7632.159-1"},"fixed_version":"76.0.3809.87-1","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"146.0.7680.71-1"},"fixed_version":"76.0.3809.87-1","urgency":"not yet assigned"},"trixie":{"status":"resolved","repositories":{"trixie":"143.0.7499.169-1~deb13u1","trixie-security":"145.0.7632.159-1~deb13u1"},"fixed_version":"76.0.3809.87-1","urgency":"not yet assigned"}}},"CVE-2019-5850":{"description":"Use after free in offline mode in Google Chrome prior to 76.0.3809.87 allowed a remote attacker who had compromised the renderer process to potentially perform a sandbox escape via a crafted HTML page.","scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"143.0.7499.169-1~deb12u1","bookworm-security":"145.0.7632.159-1~deb12u1"},"fixed_version":"76.0.3809.87-1","urgency":"not yet assigned"},"bullseye":{"status":"resolved","repositories":{"bullseye":"120.0.6099.224-1~deb11u1","bullseye-security":"120.0.6099.224-1~deb11u1"},"fixed_version":"76.0.3809.87-1","urgency":"not yet assigned"},"forky":{"status":"resolved","repositories":{"forky":"145.0.7632.159-1"},"fixed_version":"76.0.3809.87-1","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"146.0.7680.71-1"},"fixed_version":"76.0.3809.87-1","urgency":"not yet assigned"},"trixie":{"status":"resolved","repositories":{"trixie":"143.0.7499.169-1~deb13u1","trixie-security":"145.0.7632.159-1~deb13u1"},"fixed_version":"76.0.3809.87-1","urgency":"not yet assigned"}}},"CVE-2019-5851":{"description":"Use after free in WebAudio in Google Chrome prior to 76.0.3809.87 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page.","scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"143.0.7499.169-1~deb12u1","bookworm-security":"145.0.7632.159-1~deb12u1"},"fixed_version":"76.0.3809.87-1","urgency":"not yet assigned"},"bullseye":{"status":"resolved","repositories":{"bullseye":"120.0.6099.224-1~deb11u1","bullseye-security":"120.0.6099.224-1~deb11u1"},"fixed_version":"76.0.3809.87-1","urgency":"not yet assigned"},"forky":{"status":"resolved","repositories":{"forky":"145.0.7632.159-1"},"fixed_version":"76.0.3809.87-1","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"146.0.7680.71-1"},"fixed_version":"76.0.3809.87-1","urgency":"not yet assigned"},"trixie":{"status":"resolved","repositories":{"trixie":"143.0.7499.169-1~deb13u1","trixie-security":"145.0.7632.159-1~deb13u1"},"fixed_version":"76.0.3809.87-1","urgency":"not yet assigned"}}},"CVE-2019-5852":{"description":"Inappropriate implementation in JavaScript in Google Chrome prior to 76.0.3809.87 allowed a remote attacker to obtain potentially sensitive information from process memory via a crafted HTML page.","scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"143.0.7499.169-1~deb12u1","bookworm-security":"145.0.7632.159-1~deb12u1"},"fixed_version":"76.0.3809.87-1","urgency":"not yet assigned"},"bullseye":{"status":"resolved","repositories":{"bullseye":"120.0.6099.224-1~deb11u1","bullseye-security":"120.0.6099.224-1~deb11u1"},"fixed_version":"76.0.3809.87-1","urgency":"not yet assigned"},"forky":{"status":"resolved","repositories":{"forky":"145.0.7632.159-1"},"fixed_version":"76.0.3809.87-1","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"146.0.7680.71-1"},"fixed_version":"76.0.3809.87-1","urgency":"not yet assigned"},"trixie":{"status":"resolved","repositories":{"trixie":"143.0.7499.169-1~deb13u1","trixie-security":"145.0.7632.159-1~deb13u1"},"fixed_version":"76.0.3809.87-1","urgency":"not yet assigned"}}},"CVE-2019-5853":{"description":"Inappropriate implementation in JavaScript in Google Chrome prior to 76.0.3809.87 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page.","scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"143.0.7499.169-1~deb12u1","bookworm-security":"145.0.7632.159-1~deb12u1"},"fixed_version":"76.0.3809.87-1","urgency":"not yet assigned"},"bullseye":{"status":"resolved","repositories":{"bullseye":"120.0.6099.224-1~deb11u1","bullseye-security":"120.0.6099.224-1~deb11u1"},"fixed_version":"76.0.3809.87-1","urgency":"not yet assigned"},"forky":{"status":"resolved","repositories":{"forky":"145.0.7632.159-1"},"fixed_version":"76.0.3809.87-1","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"146.0.7680.71-1"},"fixed_version":"76.0.3809.87-1","urgency":"not yet assigned"},"trixie":{"status":"resolved","repositories":{"trixie":"143.0.7499.169-1~deb13u1","trixie-security":"145.0.7632.159-1~deb13u1"},"fixed_version":"76.0.3809.87-1","urgency":"not yet assigned"}}},"CVE-2019-5854":{"description":"Integer overflow in PDFium in Google Chrome prior to 76.0.3809.87 allowed a remote attacker to potentially exploit heap corruption via a crafted PDF file.","scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"143.0.7499.169-1~deb12u1","bookworm-security":"145.0.7632.159-1~deb12u1"},"fixed_version":"76.0.3809.87-1","urgency":"not yet assigned"},"bullseye":{"status":"resolved","repositories":{"bullseye":"120.0.6099.224-1~deb11u1","bullseye-security":"120.0.6099.224-1~deb11u1"},"fixed_version":"76.0.3809.87-1","urgency":"not yet assigned"},"forky":{"status":"resolved","repositories":{"forky":"145.0.7632.159-1"},"fixed_version":"76.0.3809.87-1","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"146.0.7680.71-1"},"fixed_version":"76.0.3809.87-1","urgency":"not yet assigned"},"trixie":{"status":"resolved","repositories":{"trixie":"143.0.7499.169-1~deb13u1","trixie-security":"145.0.7632.159-1~deb13u1"},"fixed_version":"76.0.3809.87-1","urgency":"not yet assigned"}}},"CVE-2019-5855":{"description":"Integer overflow in PDFium in Google Chrome prior to 76.0.3809.87 allowed a remote attacker to potentially exploit heap corruption via a crafted PDF file.","scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"143.0.7499.169-1~deb12u1","bookworm-security":"145.0.7632.159-1~deb12u1"},"fixed_version":"76.0.3809.87-1","urgency":"not yet assigned"},"bullseye":{"status":"resolved","repositories":{"bullseye":"120.0.6099.224-1~deb11u1","bullseye-security":"120.0.6099.224-1~deb11u1"},"fixed_version":"76.0.3809.87-1","urgency":"not yet assigned"},"forky":{"status":"resolved","repositories":{"forky":"145.0.7632.159-1"},"fixed_version":"76.0.3809.87-1","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"146.0.7680.71-1"},"fixed_version":"76.0.3809.87-1","urgency":"not yet assigned"},"trixie":{"status":"resolved","repositories":{"trixie":"143.0.7499.169-1~deb13u1","trixie-security":"145.0.7632.159-1~deb13u1"},"fixed_version":"76.0.3809.87-1","urgency":"not yet assigned"}}},"CVE-2019-5856":{"description":"Insufficient policy enforcement in storage in Google Chrome prior to 76.0.3809.87 allowed a remote attacker who had compromised the renderer process to bypass site isolation via a crafted HTML page.","scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"143.0.7499.169-1~deb12u1","bookworm-security":"145.0.7632.159-1~deb12u1"},"fixed_version":"76.0.3809.87-1","urgency":"not yet assigned"},"bullseye":{"status":"resolved","repositories":{"bullseye":"120.0.6099.224-1~deb11u1","bullseye-security":"120.0.6099.224-1~deb11u1"},"fixed_version":"76.0.3809.87-1","urgency":"not yet assigned"},"forky":{"status":"resolved","repositories":{"forky":"145.0.7632.159-1"},"fixed_version":"76.0.3809.87-1","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"146.0.7680.71-1"},"fixed_version":"76.0.3809.87-1","urgency":"not yet assigned"},"trixie":{"status":"resolved","repositories":{"trixie":"143.0.7499.169-1~deb13u1","trixie-security":"145.0.7632.159-1~deb13u1"},"fixed_version":"76.0.3809.87-1","urgency":"not yet assigned"}}},"CVE-2019-5857":{"description":"Inappropriate implementation in JavaScript in Google Chrome prior to 76.0.3809.87 allowed a remote attacker to potentially exploit object corruption via a crafted HTML page.","scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"143.0.7499.169-1~deb12u1","bookworm-security":"145.0.7632.159-1~deb12u1"},"fixed_version":"76.0.3809.87-1","urgency":"not yet assigned"},"bullseye":{"status":"resolved","repositories":{"bullseye":"120.0.6099.224-1~deb11u1","bullseye-security":"120.0.6099.224-1~deb11u1"},"fixed_version":"76.0.3809.87-1","urgency":"not yet assigned"},"forky":{"status":"resolved","repositories":{"forky":"145.0.7632.159-1"},"fixed_version":"76.0.3809.87-1","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"146.0.7680.71-1"},"fixed_version":"76.0.3809.87-1","urgency":"not yet assigned"},"trixie":{"status":"resolved","repositories":{"trixie":"143.0.7499.169-1~deb13u1","trixie-security":"145.0.7632.159-1~deb13u1"},"fixed_version":"76.0.3809.87-1","urgency":"not yet assigned"}}},"CVE-2019-5858":{"description":"Incorrect security UI in MacOS services integration in Google Chrome on OS X prior to 76.0.3809.87 allowed a local attacker to execute arbitrary code via a crafted HTML page.","scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"143.0.7499.169-1~deb12u1","bookworm-security":"145.0.7632.159-1~deb12u1"},"fixed_version":"76.0.3809.87-1","urgency":"not yet assigned"},"bullseye":{"status":"resolved","repositories":{"bullseye":"120.0.6099.224-1~deb11u1","bullseye-security":"120.0.6099.224-1~deb11u1"},"fixed_version":"76.0.3809.87-1","urgency":"not yet assigned"},"forky":{"status":"resolved","repositories":{"forky":"145.0.7632.159-1"},"fixed_version":"76.0.3809.87-1","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"146.0.7680.71-1"},"fixed_version":"76.0.3809.87-1","urgency":"not yet assigned"},"trixie":{"status":"resolved","repositories":{"trixie":"143.0.7499.169-1~deb13u1","trixie-security":"145.0.7632.159-1~deb13u1"},"fixed_version":"76.0.3809.87-1","urgency":"not yet assigned"}}},"CVE-2019-5859":{"description":"Insufficient filtering in URI schemes in Google Chrome on Windows prior to 76.0.3809.87 allowed a remote attacker to bypass navigation restrictions via a crafted HTML page.","scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"143.0.7499.169-1~deb12u1","bookworm-security":"145.0.7632.159-1~deb12u1"},"fixed_version":"76.0.3809.87-1","urgency":"not yet assigned"},"bullseye":{"status":"resolved","repositories":{"bullseye":"120.0.6099.224-1~deb11u1","bullseye-security":"120.0.6099.224-1~deb11u1"},"fixed_version":"76.0.3809.87-1","urgency":"not yet assigned"},"forky":{"status":"resolved","repositories":{"forky":"145.0.7632.159-1"},"fixed_version":"76.0.3809.87-1","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"146.0.7680.71-1"},"fixed_version":"76.0.3809.87-1","urgency":"not yet assigned"},"trixie":{"status":"resolved","repositories":{"trixie":"143.0.7499.169-1~deb13u1","trixie-security":"145.0.7632.159-1~deb13u1"},"fixed_version":"76.0.3809.87-1","urgency":"not yet assigned"}}},"CVE-2019-5860":{"description":"Use after free in PDFium in Google Chrome prior to 76.0.3809.87 allowed a remote attacker to potentially exploit heap corruption via a crafted PDF file.","scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"143.0.7499.169-1~deb12u1","bookworm-security":"145.0.7632.159-1~deb12u1"},"fixed_version":"76.0.3809.87-1","urgency":"not yet assigned"},"bullseye":{"status":"resolved","repositories":{"bullseye":"120.0.6099.224-1~deb11u1","bullseye-security":"120.0.6099.224-1~deb11u1"},"fixed_version":"76.0.3809.87-1","urgency":"not yet assigned"},"forky":{"status":"resolved","repositories":{"forky":"145.0.7632.159-1"},"fixed_version":"76.0.3809.87-1","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"146.0.7680.71-1"},"fixed_version":"76.0.3809.87-1","urgency":"not yet assigned"},"trixie":{"status":"resolved","repositories":{"trixie":"143.0.7499.169-1~deb13u1","trixie-security":"145.0.7632.159-1~deb13u1"},"fixed_version":"76.0.3809.87-1","urgency":"not yet assigned"}}},"CVE-2019-5861":{"description":"Insufficient data validation in Blink in Google Chrome prior to 76.0.3809.87 allowed a remote attacker to bypass anti-clickjacking policy via a crafted HTML page.","scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"143.0.7499.169-1~deb12u1","bookworm-security":"145.0.7632.159-1~deb12u1"},"fixed_version":"76.0.3809.87-1","urgency":"not yet assigned"},"bullseye":{"status":"resolved","repositories":{"bullseye":"120.0.6099.224-1~deb11u1","bullseye-security":"120.0.6099.224-1~deb11u1"},"fixed_version":"76.0.3809.87-1","urgency":"not yet assigned"},"forky":{"status":"resolved","repositories":{"forky":"145.0.7632.159-1"},"fixed_version":"76.0.3809.87-1","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"146.0.7680.71-1"},"fixed_version":"76.0.3809.87-1","urgency":"not yet assigned"},"trixie":{"status":"resolved","repositories":{"trixie":"143.0.7499.169-1~deb13u1","trixie-security":"145.0.7632.159-1~deb13u1"},"fixed_version":"76.0.3809.87-1","urgency":"not yet assigned"}}},"CVE-2019-5862":{"description":"Insufficient data validation in AppCache in Google Chrome prior to 76.0.3809.87 allowed a remote attacker who had compromised the renderer process to bypass site isolation via a crafted HTML page.","scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"143.0.7499.169-1~deb12u1","bookworm-security":"145.0.7632.159-1~deb12u1"},"fixed_version":"76.0.3809.87-1","urgency":"not yet assigned"},"bullseye":{"status":"resolved","repositories":{"bullseye":"120.0.6099.224-1~deb11u1","bullseye-security":"120.0.6099.224-1~deb11u1"},"fixed_version":"76.0.3809.87-1","urgency":"not yet assigned"},"forky":{"status":"resolved","repositories":{"forky":"145.0.7632.159-1"},"fixed_version":"76.0.3809.87-1","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"146.0.7680.71-1"},"fixed_version":"76.0.3809.87-1","urgency":"not yet assigned"},"trixie":{"status":"resolved","repositories":{"trixie":"143.0.7499.169-1~deb13u1","trixie-security":"145.0.7632.159-1~deb13u1"},"fixed_version":"76.0.3809.87-1","urgency":"not yet assigned"}}},"CVE-2019-5864":{"description":"Insufficient data validation in CORS in Google Chrome prior to 76.0.3809.87 allowed an attacker who convinced a user to install a malicious extension to bypass content security policy via a crafted Chrome Extension.","scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"143.0.7499.169-1~deb12u1","bookworm-security":"145.0.7632.159-1~deb12u1"},"fixed_version":"76.0.3809.87-1","urgency":"not yet assigned"},"bullseye":{"status":"resolved","repositories":{"bullseye":"120.0.6099.224-1~deb11u1","bullseye-security":"120.0.6099.224-1~deb11u1"},"fixed_version":"76.0.3809.87-1","urgency":"not yet assigned"},"forky":{"status":"resolved","repositories":{"forky":"145.0.7632.159-1"},"fixed_version":"76.0.3809.87-1","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"146.0.7680.71-1"},"fixed_version":"76.0.3809.87-1","urgency":"not yet assigned"},"trixie":{"status":"resolved","repositories":{"trixie":"143.0.7499.169-1~deb13u1","trixie-security":"145.0.7632.159-1~deb13u1"},"fixed_version":"76.0.3809.87-1","urgency":"not yet assigned"}}},"CVE-2019-5865":{"description":"Insufficient policy enforcement in navigations in Google Chrome prior to 76.0.3809.87 allowed a remote attacker who had compromised the renderer process to bypass site isolation via a crafted HTML page.","scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"143.0.7499.169-1~deb12u1","bookworm-security":"145.0.7632.159-1~deb12u1"},"fixed_version":"76.0.3809.87-1","urgency":"not yet assigned"},"bullseye":{"status":"resolved","repositories":{"bullseye":"120.0.6099.224-1~deb11u1","bullseye-security":"120.0.6099.224-1~deb11u1"},"fixed_version":"76.0.3809.87-1","urgency":"not yet assigned"},"forky":{"status":"resolved","repositories":{"forky":"145.0.7632.159-1"},"fixed_version":"76.0.3809.87-1","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"146.0.7680.71-1"},"fixed_version":"76.0.3809.87-1","urgency":"not yet assigned"},"trixie":{"status":"resolved","repositories":{"trixie":"143.0.7499.169-1~deb13u1","trixie-security":"145.0.7632.159-1~deb13u1"},"fixed_version":"76.0.3809.87-1","urgency":"not yet assigned"}}},"CVE-2019-5866":{"description":"Out of bounds memory access in JavaScript in Google Chrome prior to 75.0.3770.142 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page.","scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"143.0.7499.169-1~deb12u1","bookworm-security":"145.0.7632.159-1~deb12u1"},"fixed_version":"76.0.3809.71-1","urgency":"not yet assigned"},"bullseye":{"status":"resolved","repositories":{"bullseye":"120.0.6099.224-1~deb11u1","bullseye-security":"120.0.6099.224-1~deb11u1"},"fixed_version":"76.0.3809.71-1","urgency":"not yet assigned"},"forky":{"status":"resolved","repositories":{"forky":"145.0.7632.159-1"},"fixed_version":"76.0.3809.71-1","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"146.0.7680.71-1"},"fixed_version":"76.0.3809.71-1","urgency":"not yet assigned"},"trixie":{"status":"resolved","repositories":{"trixie":"143.0.7499.169-1~deb13u1","trixie-security":"145.0.7632.159-1~deb13u1"},"fixed_version":"76.0.3809.71-1","urgency":"not yet assigned"}}},"CVE-2019-5867":{"description":"Out of bounds read in JavaScript in Google Chrome prior to 76.0.3809.100 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page.","scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"143.0.7499.169-1~deb12u1","bookworm-security":"145.0.7632.159-1~deb12u1"},"fixed_version":"76.0.3809.100-1","urgency":"not yet assigned"},"bullseye":{"status":"resolved","repositories":{"bullseye":"120.0.6099.224-1~deb11u1","bullseye-security":"120.0.6099.224-1~deb11u1"},"fixed_version":"76.0.3809.100-1","urgency":"not yet assigned"},"forky":{"status":"resolved","repositories":{"forky":"145.0.7632.159-1"},"fixed_version":"76.0.3809.100-1","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"146.0.7680.71-1"},"fixed_version":"76.0.3809.100-1","urgency":"not yet assigned"},"trixie":{"status":"resolved","repositories":{"trixie":"143.0.7499.169-1~deb13u1","trixie-security":"145.0.7632.159-1~deb13u1"},"fixed_version":"76.0.3809.100-1","urgency":"not yet assigned"}}},"CVE-2019-5868":{"description":"Use after free in PDFium in Google Chrome prior to 76.0.3809.100 allowed a remote attacker to potentially exploit heap corruption via a crafted PDF file.","scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"143.0.7499.169-1~deb12u1","bookworm-security":"145.0.7632.159-1~deb12u1"},"fixed_version":"76.0.3809.100-1","urgency":"not yet assigned"},"bullseye":{"status":"resolved","repositories":{"bullseye":"120.0.6099.224-1~deb11u1","bullseye-security":"120.0.6099.224-1~deb11u1"},"fixed_version":"76.0.3809.100-1","urgency":"not yet assigned"},"forky":{"status":"resolved","repositories":{"forky":"145.0.7632.159-1"},"fixed_version":"76.0.3809.100-1","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"146.0.7680.71-1"},"fixed_version":"76.0.3809.100-1","urgency":"not yet assigned"},"trixie":{"status":"resolved","repositories":{"trixie":"143.0.7499.169-1~deb13u1","trixie-security":"145.0.7632.159-1~deb13u1"},"fixed_version":"76.0.3809.100-1","urgency":"not yet assigned"}}},"CVE-2019-5869":{"description":"Use after free in Blink in Google Chrome prior to 76.0.3809.132 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page.","scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"143.0.7499.169-1~deb12u1","bookworm-security":"145.0.7632.159-1~deb12u1"},"fixed_version":"78.0.3904.87-1","urgency":"not yet assigned"},"bullseye":{"status":"resolved","repositories":{"bullseye":"120.0.6099.224-1~deb11u1","bullseye-security":"120.0.6099.224-1~deb11u1"},"fixed_version":"78.0.3904.87-1","urgency":"not yet assigned"},"forky":{"status":"resolved","repositories":{"forky":"145.0.7632.159-1"},"fixed_version":"78.0.3904.87-1","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"146.0.7680.71-1"},"fixed_version":"78.0.3904.87-1","urgency":"not yet assigned"},"trixie":{"status":"resolved","repositories":{"trixie":"143.0.7499.169-1~deb13u1","trixie-security":"145.0.7632.159-1~deb13u1"},"fixed_version":"78.0.3904.87-1","urgency":"not yet assigned"}}},"CVE-2019-5870":{"description":"Use after free in media in Google Chrome prior to 77.0.3865.75 allowed a remote attacker to potentially perform a sandbox escape via a crafted HTML page.","scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"143.0.7499.169-1~deb12u1","bookworm-security":"145.0.7632.159-1~deb12u1"},"fixed_version":"78.0.3904.87-1","urgency":"not yet assigned"},"bullseye":{"status":"resolved","repositories":{"bullseye":"120.0.6099.224-1~deb11u1","bullseye-security":"120.0.6099.224-1~deb11u1"},"fixed_version":"78.0.3904.87-1","urgency":"not yet assigned"},"forky":{"status":"resolved","repositories":{"forky":"145.0.7632.159-1"},"fixed_version":"78.0.3904.87-1","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"146.0.7680.71-1"},"fixed_version":"78.0.3904.87-1","urgency":"not yet assigned"},"trixie":{"status":"resolved","repositories":{"trixie":"143.0.7499.169-1~deb13u1","trixie-security":"145.0.7632.159-1~deb13u1"},"fixed_version":"78.0.3904.87-1","urgency":"not yet assigned"}}},"CVE-2019-5871":{"description":"Heap buffer overflow in Skia in Google Chrome prior to 77.0.3865.75 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page.","scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"143.0.7499.169-1~deb12u1","bookworm-security":"145.0.7632.159-1~deb12u1"},"fixed_version":"78.0.3904.87-1","urgency":"not yet assigned"},"bullseye":{"status":"resolved","repositories":{"bullseye":"120.0.6099.224-1~deb11u1","bullseye-security":"120.0.6099.224-1~deb11u1"},"fixed_version":"78.0.3904.87-1","urgency":"not yet assigned"},"forky":{"status":"resolved","repositories":{"forky":"145.0.7632.159-1"},"fixed_version":"78.0.3904.87-1","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"146.0.7680.71-1"},"fixed_version":"78.0.3904.87-1","urgency":"not yet assigned"},"trixie":{"status":"resolved","repositories":{"trixie":"143.0.7499.169-1~deb13u1","trixie-security":"145.0.7632.159-1~deb13u1"},"fixed_version":"78.0.3904.87-1","urgency":"not yet assigned"}}},"CVE-2019-5872":{"description":"Use after free in Mojo in Google Chrome prior to 77.0.3865.75 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page.","scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"143.0.7499.169-1~deb12u1","bookworm-security":"145.0.7632.159-1~deb12u1"},"fixed_version":"78.0.3904.87-1","urgency":"not yet assigned"},"bullseye":{"status":"resolved","repositories":{"bullseye":"120.0.6099.224-1~deb11u1","bullseye-security":"120.0.6099.224-1~deb11u1"},"fixed_version":"78.0.3904.87-1","urgency":"not yet assigned"},"forky":{"status":"resolved","repositories":{"forky":"145.0.7632.159-1"},"fixed_version":"78.0.3904.87-1","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"146.0.7680.71-1"},"fixed_version":"78.0.3904.87-1","urgency":"not yet assigned"},"trixie":{"status":"resolved","repositories":{"trixie":"143.0.7499.169-1~deb13u1","trixie-security":"145.0.7632.159-1~deb13u1"},"fixed_version":"78.0.3904.87-1","urgency":"not yet assigned"}}},"CVE-2019-5873":{"description":"Insufficient policy validation in navigation in Google Chrome on iOS prior to 77.0.3865.75 allowed a remote attacker to spoof the contents of the Omnibox (URL bar) via a crafted HTML page.","scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"143.0.7499.169-1~deb12u1","bookworm-security":"145.0.7632.159-1~deb12u1"},"fixed_version":"0","urgency":"unimportant"},"bullseye":{"status":"resolved","repositories":{"bullseye":"120.0.6099.224-1~deb11u1","bullseye-security":"120.0.6099.224-1~deb11u1"},"fixed_version":"0","urgency":"unimportant"},"forky":{"status":"resolved","repositories":{"forky":"145.0.7632.159-1"},"fixed_version":"0","urgency":"unimportant"},"sid":{"status":"resolved","repositories":{"sid":"146.0.7680.71-1"},"fixed_version":"0","urgency":"unimportant"},"trixie":{"status":"resolved","repositories":{"trixie":"143.0.7499.169-1~deb13u1","trixie-security":"145.0.7632.159-1~deb13u1"},"fixed_version":"0","urgency":"unimportant"}}},"CVE-2019-5874":{"description":"Insufficient filtering in URI schemes in Google Chrome on Windows prior to 77.0.3865.75 allowed a remote attacker to bypass navigation restrictions via a crafted HTML page.","scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"143.0.7499.169-1~deb12u1","bookworm-security":"145.0.7632.159-1~deb12u1"},"fixed_version":"78.0.3904.87-1","urgency":"not yet assigned"},"bullseye":{"status":"resolved","repositories":{"bullseye":"120.0.6099.224-1~deb11u1","bullseye-security":"120.0.6099.224-1~deb11u1"},"fixed_version":"78.0.3904.87-1","urgency":"not yet assigned"},"forky":{"status":"resolved","repositories":{"forky":"145.0.7632.159-1"},"fixed_version":"78.0.3904.87-1","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"146.0.7680.71-1"},"fixed_version":"78.0.3904.87-1","urgency":"not yet assigned"},"trixie":{"status":"resolved","repositories":{"trixie":"143.0.7499.169-1~deb13u1","trixie-security":"145.0.7632.159-1~deb13u1"},"fixed_version":"78.0.3904.87-1","urgency":"not yet assigned"}}},"CVE-2019-5875":{"description":"Insufficient data validation in downloads in Google Chrome prior to 77.0.3865.75 allowed a remote attacker to spoof the contents of the Omnibox (URL bar) via a crafted HTML page.","scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"143.0.7499.169-1~deb12u1","bookworm-security":"145.0.7632.159-1~deb12u1"},"fixed_version":"78.0.3904.87-1","urgency":"not yet assigned"},"bullseye":{"status":"resolved","repositories":{"bullseye":"120.0.6099.224-1~deb11u1","bullseye-security":"120.0.6099.224-1~deb11u1"},"fixed_version":"78.0.3904.87-1","urgency":"not yet assigned"},"forky":{"status":"resolved","repositories":{"forky":"145.0.7632.159-1"},"fixed_version":"78.0.3904.87-1","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"146.0.7680.71-1"},"fixed_version":"78.0.3904.87-1","urgency":"not yet assigned"},"trixie":{"status":"resolved","repositories":{"trixie":"143.0.7499.169-1~deb13u1","trixie-security":"145.0.7632.159-1~deb13u1"},"fixed_version":"78.0.3904.87-1","urgency":"not yet assigned"}}},"CVE-2019-5876":{"description":"Use after free in media in Google Chrome on Android prior to 77.0.3865.75 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page.","scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"143.0.7499.169-1~deb12u1","bookworm-security":"145.0.7632.159-1~deb12u1"},"fixed_version":"78.0.3904.87-1","urgency":"not yet assigned"},"bullseye":{"status":"resolved","repositories":{"bullseye":"120.0.6099.224-1~deb11u1","bullseye-security":"120.0.6099.224-1~deb11u1"},"fixed_version":"78.0.3904.87-1","urgency":"not yet assigned"},"forky":{"status":"resolved","repositories":{"forky":"145.0.7632.159-1"},"fixed_version":"78.0.3904.87-1","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"146.0.7680.71-1"},"fixed_version":"78.0.3904.87-1","urgency":"not yet assigned"},"trixie":{"status":"resolved","repositories":{"trixie":"143.0.7499.169-1~deb13u1","trixie-security":"145.0.7632.159-1~deb13u1"},"fixed_version":"78.0.3904.87-1","urgency":"not yet assigned"}}},"CVE-2019-5877":{"description":"Out of bounds memory access in JavaScript in Google Chrome prior to 77.0.3865.75 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page.","scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"143.0.7499.169-1~deb12u1","bookworm-security":"145.0.7632.159-1~deb12u1"},"fixed_version":"78.0.3904.87-1","urgency":"not yet assigned"},"bullseye":{"status":"resolved","repositories":{"bullseye":"120.0.6099.224-1~deb11u1","bullseye-security":"120.0.6099.224-1~deb11u1"},"fixed_version":"78.0.3904.87-1","urgency":"not yet assigned"},"forky":{"status":"resolved","repositories":{"forky":"145.0.7632.159-1"},"fixed_version":"78.0.3904.87-1","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"146.0.7680.71-1"},"fixed_version":"78.0.3904.87-1","urgency":"not yet assigned"},"trixie":{"status":"resolved","repositories":{"trixie":"143.0.7499.169-1~deb13u1","trixie-security":"145.0.7632.159-1~deb13u1"},"fixed_version":"78.0.3904.87-1","urgency":"not yet assigned"}}},"CVE-2019-5878":{"description":"Use after free in V8 in Google Chrome prior to 77.0.3865.75 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page.","scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"143.0.7499.169-1~deb12u1","bookworm-security":"145.0.7632.159-1~deb12u1"},"fixed_version":"78.0.3904.87-1","urgency":"not yet assigned"},"bullseye":{"status":"resolved","repositories":{"bullseye":"120.0.6099.224-1~deb11u1","bullseye-security":"120.0.6099.224-1~deb11u1"},"fixed_version":"78.0.3904.87-1","urgency":"not yet assigned"},"forky":{"status":"resolved","repositories":{"forky":"145.0.7632.159-1"},"fixed_version":"78.0.3904.87-1","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"146.0.7680.71-1"},"fixed_version":"78.0.3904.87-1","urgency":"not yet assigned"},"trixie":{"status":"resolved","repositories":{"trixie":"143.0.7499.169-1~deb13u1","trixie-security":"145.0.7632.159-1~deb13u1"},"fixed_version":"78.0.3904.87-1","urgency":"not yet assigned"}}},"CVE-2019-5879":{"description":"Insufficient policy enforcement in extensions in Google Chrome prior to 77.0.3865.75 allowed an attacker who convinced a user to install a malicious extension to read local files via a crafted Chrome Extension.","scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"143.0.7499.169-1~deb12u1","bookworm-security":"145.0.7632.159-1~deb12u1"},"fixed_version":"78.0.3904.87-1","urgency":"not yet assigned"},"bullseye":{"status":"resolved","repositories":{"bullseye":"120.0.6099.224-1~deb11u1","bullseye-security":"120.0.6099.224-1~deb11u1"},"fixed_version":"78.0.3904.87-1","urgency":"not yet assigned"},"forky":{"status":"resolved","repositories":{"forky":"145.0.7632.159-1"},"fixed_version":"78.0.3904.87-1","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"146.0.7680.71-1"},"fixed_version":"78.0.3904.87-1","urgency":"not yet assigned"},"trixie":{"status":"resolved","repositories":{"trixie":"143.0.7499.169-1~deb13u1","trixie-security":"145.0.7632.159-1~deb13u1"},"fixed_version":"78.0.3904.87-1","urgency":"not yet assigned"}}},"CVE-2019-5880":{"description":"Insufficient policy enforcement in Blink in Google Chrome prior to 77.0.3865.75 allowed a remote attacker to leak cross-origin data via a crafted HTML page.","scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"143.0.7499.169-1~deb12u1","bookworm-security":"145.0.7632.159-1~deb12u1"},"fixed_version":"78.0.3904.87-1","urgency":"not yet assigned"},"bullseye":{"status":"resolved","repositories":{"bullseye":"120.0.6099.224-1~deb11u1","bullseye-security":"120.0.6099.224-1~deb11u1"},"fixed_version":"78.0.3904.87-1","urgency":"not yet assigned"},"forky":{"status":"resolved","repositories":{"forky":"145.0.7632.159-1"},"fixed_version":"78.0.3904.87-1","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"146.0.7680.71-1"},"fixed_version":"78.0.3904.87-1","urgency":"not yet assigned"},"trixie":{"status":"resolved","repositories":{"trixie":"143.0.7499.169-1~deb13u1","trixie-security":"145.0.7632.159-1~deb13u1"},"fixed_version":"78.0.3904.87-1","urgency":"not yet assigned"}}},"CVE-2019-5881":{"description":"Out of bounds read in SwiftShader in Google Chrome prior to 77.0.3865.75 allowed a remote attacker to obtain potentially sensitive information from process memory via a crafted HTML page.","scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"143.0.7499.169-1~deb12u1","bookworm-security":"145.0.7632.159-1~deb12u1"},"fixed_version":"78.0.3904.87-1","urgency":"not yet assigned"},"bullseye":{"status":"resolved","repositories":{"bullseye":"120.0.6099.224-1~deb11u1","bullseye-security":"120.0.6099.224-1~deb11u1"},"fixed_version":"78.0.3904.87-1","urgency":"not yet assigned"},"forky":{"status":"resolved","repositories":{"forky":"145.0.7632.159-1"},"fixed_version":"78.0.3904.87-1","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"146.0.7680.71-1"},"fixed_version":"78.0.3904.87-1","urgency":"not yet assigned"},"trixie":{"status":"resolved","repositories":{"trixie":"143.0.7499.169-1~deb13u1","trixie-security":"145.0.7632.159-1~deb13u1"},"fixed_version":"78.0.3904.87-1","urgency":"not yet assigned"}}},"CVE-2020-15959":{"description":"Insufficient policy enforcement in networking in Google Chrome prior to 85.0.4183.102 allowed an attacker who convinced the user to enable logging to obtain potentially sensitive information from process memory via social engineering.","scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"143.0.7499.169-1~deb12u1","bookworm-security":"145.0.7632.159-1~deb12u1"},"fixed_version":"87.0.4280.88-0.1","urgency":"not yet assigned"},"bullseye":{"status":"resolved","repositories":{"bullseye":"120.0.6099.224-1~deb11u1","bullseye-security":"120.0.6099.224-1~deb11u1"},"fixed_version":"87.0.4280.88-0.1","urgency":"not yet assigned"},"forky":{"status":"resolved","repositories":{"forky":"145.0.7632.159-1"},"fixed_version":"87.0.4280.88-0.1","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"146.0.7680.71-1"},"fixed_version":"87.0.4280.88-0.1","urgency":"not yet assigned"},"trixie":{"status":"resolved","repositories":{"trixie":"143.0.7499.169-1~deb13u1","trixie-security":"145.0.7632.159-1~deb13u1"},"fixed_version":"87.0.4280.88-0.1","urgency":"not yet assigned"}}},"CVE-2020-15960":{"description":"Heap buffer overflow in storage in Google Chrome prior to 85.0.4183.121 allowed a remote attacker to potentially perform out of bounds memory access via a crafted HTML page.","scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"143.0.7499.169-1~deb12u1","bookworm-security":"145.0.7632.159-1~deb12u1"},"fixed_version":"87.0.4280.88-0.1","urgency":"not yet assigned"},"bullseye":{"status":"resolved","repositories":{"bullseye":"120.0.6099.224-1~deb11u1","bullseye-security":"120.0.6099.224-1~deb11u1"},"fixed_version":"87.0.4280.88-0.1","urgency":"not yet assigned"},"forky":{"status":"resolved","repositories":{"forky":"145.0.7632.159-1"},"fixed_version":"87.0.4280.88-0.1","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"146.0.7680.71-1"},"fixed_version":"87.0.4280.88-0.1","urgency":"not yet assigned"},"trixie":{"status":"resolved","repositories":{"trixie":"143.0.7499.169-1~deb13u1","trixie-security":"145.0.7632.159-1~deb13u1"},"fixed_version":"87.0.4280.88-0.1","urgency":"not yet assigned"}}},"CVE-2020-15961":{"description":"Insufficient policy validation in extensions in Google Chrome prior to 85.0.4183.121 allowed an attacker who convinced a user to install a malicious extension to potentially perform a sandbox escape via a crafted Chrome Extension.","scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"143.0.7499.169-1~deb12u1","bookworm-security":"145.0.7632.159-1~deb12u1"},"fixed_version":"87.0.4280.88-0.1","urgency":"not yet assigned"},"bullseye":{"status":"resolved","repositories":{"bullseye":"120.0.6099.224-1~deb11u1","bullseye-security":"120.0.6099.224-1~deb11u1"},"fixed_version":"87.0.4280.88-0.1","urgency":"not yet assigned"},"forky":{"status":"resolved","repositories":{"forky":"145.0.7632.159-1"},"fixed_version":"87.0.4280.88-0.1","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"146.0.7680.71-1"},"fixed_version":"87.0.4280.88-0.1","urgency":"not yet assigned"},"trixie":{"status":"resolved","repositories":{"trixie":"143.0.7499.169-1~deb13u1","trixie-security":"145.0.7632.159-1~deb13u1"},"fixed_version":"87.0.4280.88-0.1","urgency":"not yet assigned"}}},"CVE-2020-15962":{"description":"Insufficient policy validation in serial in Google Chrome prior to 85.0.4183.121 allowed a remote attacker to potentially perform out of bounds memory access via a crafted HTML page.","scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"143.0.7499.169-1~deb12u1","bookworm-security":"145.0.7632.159-1~deb12u1"},"fixed_version":"87.0.4280.88-0.1","urgency":"not yet assigned"},"bullseye":{"status":"resolved","repositories":{"bullseye":"120.0.6099.224-1~deb11u1","bullseye-security":"120.0.6099.224-1~deb11u1"},"fixed_version":"87.0.4280.88-0.1","urgency":"not yet assigned"},"forky":{"status":"resolved","repositories":{"forky":"145.0.7632.159-1"},"fixed_version":"87.0.4280.88-0.1","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"146.0.7680.71-1"},"fixed_version":"87.0.4280.88-0.1","urgency":"not yet assigned"},"trixie":{"status":"resolved","repositories":{"trixie":"143.0.7499.169-1~deb13u1","trixie-security":"145.0.7632.159-1~deb13u1"},"fixed_version":"87.0.4280.88-0.1","urgency":"not yet assigned"}}},"CVE-2020-15963":{"description":"Insufficient policy enforcement in extensions in Google Chrome prior to 85.0.4183.121 allowed an attacker who convinced a user to install a malicious extension to potentially perform a sandbox escape via a crafted Chrome Extension.","scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"143.0.7499.169-1~deb12u1","bookworm-security":"145.0.7632.159-1~deb12u1"},"fixed_version":"87.0.4280.88-0.1","urgency":"not yet assigned"},"bullseye":{"status":"resolved","repositories":{"bullseye":"120.0.6099.224-1~deb11u1","bullseye-security":"120.0.6099.224-1~deb11u1"},"fixed_version":"87.0.4280.88-0.1","urgency":"not yet assigned"},"forky":{"status":"resolved","repositories":{"forky":"145.0.7632.159-1"},"fixed_version":"87.0.4280.88-0.1","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"146.0.7680.71-1"},"fixed_version":"87.0.4280.88-0.1","urgency":"not yet assigned"},"trixie":{"status":"resolved","repositories":{"trixie":"143.0.7499.169-1~deb13u1","trixie-security":"145.0.7632.159-1~deb13u1"},"fixed_version":"87.0.4280.88-0.1","urgency":"not yet assigned"}}},"CVE-2020-15964":{"description":"Insufficient data validation in media in Google Chrome prior to 85.0.4183.121 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page.","scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"143.0.7499.169-1~deb12u1","bookworm-security":"145.0.7632.159-1~deb12u1"},"fixed_version":"87.0.4280.88-0.1","urgency":"not yet assigned"},"bullseye":{"status":"resolved","repositories":{"bullseye":"120.0.6099.224-1~deb11u1","bullseye-security":"120.0.6099.224-1~deb11u1"},"fixed_version":"87.0.4280.88-0.1","urgency":"not yet assigned"},"forky":{"status":"resolved","repositories":{"forky":"145.0.7632.159-1"},"fixed_version":"87.0.4280.88-0.1","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"146.0.7680.71-1"},"fixed_version":"87.0.4280.88-0.1","urgency":"not yet assigned"},"trixie":{"status":"resolved","repositories":{"trixie":"143.0.7499.169-1~deb13u1","trixie-security":"145.0.7632.159-1~deb13u1"},"fixed_version":"87.0.4280.88-0.1","urgency":"not yet assigned"}}},"CVE-2020-15965":{"description":"Type confusion in V8 in Google Chrome prior to 85.0.4183.121 allowed a remote attacker to potentially perform out of bounds memory access via a crafted HTML page.","scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"143.0.7499.169-1~deb12u1","bookworm-security":"145.0.7632.159-1~deb12u1"},"fixed_version":"87.0.4280.88-0.1","urgency":"not yet assigned"},"bullseye":{"status":"resolved","repositories":{"bullseye":"120.0.6099.224-1~deb11u1","bullseye-security":"120.0.6099.224-1~deb11u1"},"fixed_version":"87.0.4280.88-0.1","urgency":"not yet assigned"},"forky":{"status":"resolved","repositories":{"forky":"145.0.7632.159-1"},"fixed_version":"87.0.4280.88-0.1","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"146.0.7680.71-1"},"fixed_version":"87.0.4280.88-0.1","urgency":"not yet assigned"},"trixie":{"status":"resolved","repositories":{"trixie":"143.0.7499.169-1~deb13u1","trixie-security":"145.0.7632.159-1~deb13u1"},"fixed_version":"87.0.4280.88-0.1","urgency":"not yet assigned"}}},"CVE-2020-15966":{"description":"Insufficient policy enforcement in extensions in Google Chrome prior to 85.0.4183.121 allowed an attacker who convinced a user to install a malicious extension to obtain potentially sensitive information via a crafted Chrome Extension.","scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"143.0.7499.169-1~deb12u1","bookworm-security":"145.0.7632.159-1~deb12u1"},"fixed_version":"87.0.4280.88-0.1","urgency":"not yet assigned"},"bullseye":{"status":"resolved","repositories":{"bullseye":"120.0.6099.224-1~deb11u1","bullseye-security":"120.0.6099.224-1~deb11u1"},"fixed_version":"87.0.4280.88-0.1","urgency":"not yet assigned"},"forky":{"status":"resolved","repositories":{"forky":"145.0.7632.159-1"},"fixed_version":"87.0.4280.88-0.1","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"146.0.7680.71-1"},"fixed_version":"87.0.4280.88-0.1","urgency":"not yet assigned"},"trixie":{"status":"resolved","repositories":{"trixie":"143.0.7499.169-1~deb13u1","trixie-security":"145.0.7632.159-1~deb13u1"},"fixed_version":"87.0.4280.88-0.1","urgency":"not yet assigned"}}},"CVE-2020-15967":{"description":"Use after free in payments in Google Chrome prior to 86.0.4240.75 allowed a remote attacker to potentially perform a sandbox escape via a crafted HTML page.","scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"143.0.7499.169-1~deb12u1","bookworm-security":"145.0.7632.159-1~deb12u1"},"fixed_version":"87.0.4280.88-0.1","urgency":"not yet assigned"},"bullseye":{"status":"resolved","repositories":{"bullseye":"120.0.6099.224-1~deb11u1","bullseye-security":"120.0.6099.224-1~deb11u1"},"fixed_version":"87.0.4280.88-0.1","urgency":"not yet assigned"},"forky":{"status":"resolved","repositories":{"forky":"145.0.7632.159-1"},"fixed_version":"87.0.4280.88-0.1","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"146.0.7680.71-1"},"fixed_version":"87.0.4280.88-0.1","urgency":"not yet assigned"},"trixie":{"status":"resolved","repositories":{"trixie":"143.0.7499.169-1~deb13u1","trixie-security":"145.0.7632.159-1~deb13u1"},"fixed_version":"87.0.4280.88-0.1","urgency":"not yet assigned"}}},"CVE-2020-15968":{"description":"Use after free in Blink in Google Chrome prior to 86.0.4240.75 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page.","scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"143.0.7499.169-1~deb12u1","bookworm-security":"145.0.7632.159-1~deb12u1"},"fixed_version":"87.0.4280.88-0.1","urgency":"not yet assigned"},"bullseye":{"status":"resolved","repositories":{"bullseye":"120.0.6099.224-1~deb11u1","bullseye-security":"120.0.6099.224-1~deb11u1"},"fixed_version":"87.0.4280.88-0.1","urgency":"not yet assigned"},"forky":{"status":"resolved","repositories":{"forky":"145.0.7632.159-1"},"fixed_version":"87.0.4280.88-0.1","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"146.0.7680.71-1"},"fixed_version":"87.0.4280.88-0.1","urgency":"not yet assigned"},"trixie":{"status":"resolved","repositories":{"trixie":"143.0.7499.169-1~deb13u1","trixie-security":"145.0.7632.159-1~deb13u1"},"fixed_version":"87.0.4280.88-0.1","urgency":"not yet assigned"}}},"CVE-2020-15969":{"description":"Use after free in WebRTC in Google Chrome prior to 86.0.4240.75 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page.","scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"143.0.7499.169-1~deb12u1","bookworm-security":"145.0.7632.159-1~deb12u1"},"fixed_version":"87.0.4280.88-0.1","urgency":"not yet assigned"},"bullseye":{"status":"resolved","repositories":{"bullseye":"120.0.6099.224-1~deb11u1","bullseye-security":"120.0.6099.224-1~deb11u1"},"fixed_version":"87.0.4280.88-0.1","urgency":"not yet assigned"},"forky":{"status":"resolved","repositories":{"forky":"145.0.7632.159-1"},"fixed_version":"87.0.4280.88-0.1","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"146.0.7680.71-1"},"fixed_version":"87.0.4280.88-0.1","urgency":"not yet assigned"},"trixie":{"status":"resolved","repositories":{"trixie":"143.0.7499.169-1~deb13u1","trixie-security":"145.0.7632.159-1~deb13u1"},"fixed_version":"87.0.4280.88-0.1","urgency":"not yet assigned"}}},"CVE-2020-15970":{"description":"Use after free in NFC in Google Chrome prior to 86.0.4240.75 allowed a remote attacker who had compromised the renderer process to potentially perform a sandbox escape via a crafted HTML page.","scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"143.0.7499.169-1~deb12u1","bookworm-security":"145.0.7632.159-1~deb12u1"},"fixed_version":"87.0.4280.88-0.1","urgency":"not yet assigned"},"bullseye":{"status":"resolved","repositories":{"bullseye":"120.0.6099.224-1~deb11u1","bullseye-security":"120.0.6099.224-1~deb11u1"},"fixed_version":"87.0.4280.88-0.1","urgency":"not yet assigned"},"forky":{"status":"resolved","repositories":{"forky":"145.0.7632.159-1"},"fixed_version":"87.0.4280.88-0.1","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"146.0.7680.71-1"},"fixed_version":"87.0.4280.88-0.1","urgency":"not yet assigned"},"trixie":{"status":"resolved","repositories":{"trixie":"143.0.7499.169-1~deb13u1","trixie-security":"145.0.7632.159-1~deb13u1"},"fixed_version":"87.0.4280.88-0.1","urgency":"not yet assigned"}}},"CVE-2020-15971":{"description":"Use after free in printing in Google Chrome prior to 86.0.4240.75 allowed a remote attacker who had compromised the renderer process to potentially perform a sandbox escape via a crafted HTML page.","scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"143.0.7499.169-1~deb12u1","bookworm-security":"145.0.7632.159-1~deb12u1"},"fixed_version":"87.0.4280.88-0.1","urgency":"not yet assigned"},"bullseye":{"status":"resolved","repositories":{"bullseye":"120.0.6099.224-1~deb11u1","bullseye-security":"120.0.6099.224-1~deb11u1"},"fixed_version":"87.0.4280.88-0.1","urgency":"not yet assigned"},"forky":{"status":"resolved","repositories":{"forky":"145.0.7632.159-1"},"fixed_version":"87.0.4280.88-0.1","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"146.0.7680.71-1"},"fixed_version":"87.0.4280.88-0.1","urgency":"not yet assigned"},"trixie":{"status":"resolved","repositories":{"trixie":"143.0.7499.169-1~deb13u1","trixie-security":"145.0.7632.159-1~deb13u1"},"fixed_version":"87.0.4280.88-0.1","urgency":"not yet assigned"}}},"CVE-2020-15972":{"description":"Use after free in audio in Google Chrome prior to 86.0.4240.75 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page.","scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"143.0.7499.169-1~deb12u1","bookworm-security":"145.0.7632.159-1~deb12u1"},"fixed_version":"87.0.4280.88-0.1","urgency":"not yet assigned"},"bullseye":{"status":"resolved","repositories":{"bullseye":"120.0.6099.224-1~deb11u1","bullseye-security":"120.0.6099.224-1~deb11u1"},"fixed_version":"87.0.4280.88-0.1","urgency":"not yet assigned"},"forky":{"status":"resolved","repositories":{"forky":"145.0.7632.159-1"},"fixed_version":"87.0.4280.88-0.1","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"146.0.7680.71-1"},"fixed_version":"87.0.4280.88-0.1","urgency":"not yet assigned"},"trixie":{"status":"resolved","repositories":{"trixie":"143.0.7499.169-1~deb13u1","trixie-security":"145.0.7632.159-1~deb13u1"},"fixed_version":"87.0.4280.88-0.1","urgency":"not yet assigned"}}},"CVE-2020-15973":{"description":"Insufficient policy enforcement in extensions in Google Chrome prior to 86.0.4240.75 allowed an attacker who convinced a user to install a malicious extension to bypass same origin policy via a crafted Chrome Extension.","scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"143.0.7499.169-1~deb12u1","bookworm-security":"145.0.7632.159-1~deb12u1"},"fixed_version":"87.0.4280.88-0.1","urgency":"not yet assigned"},"bullseye":{"status":"resolved","repositories":{"bullseye":"120.0.6099.224-1~deb11u1","bullseye-security":"120.0.6099.224-1~deb11u1"},"fixed_version":"87.0.4280.88-0.1","urgency":"not yet assigned"},"forky":{"status":"resolved","repositories":{"forky":"145.0.7632.159-1"},"fixed_version":"87.0.4280.88-0.1","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"146.0.7680.71-1"},"fixed_version":"87.0.4280.88-0.1","urgency":"not yet assigned"},"trixie":{"status":"resolved","repositories":{"trixie":"143.0.7499.169-1~deb13u1","trixie-security":"145.0.7632.159-1~deb13u1"},"fixed_version":"87.0.4280.88-0.1","urgency":"not yet assigned"}}},"CVE-2020-15974":{"description":"Integer overflow in Blink in Google Chrome prior to 86.0.4240.75 allowed a remote attacker to bypass site isolation via a crafted HTML page.","scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"143.0.7499.169-1~deb12u1","bookworm-security":"145.0.7632.159-1~deb12u1"},"fixed_version":"87.0.4280.88-0.1","urgency":"not yet assigned"},"bullseye":{"status":"resolved","repositories":{"bullseye":"120.0.6099.224-1~deb11u1","bullseye-security":"120.0.6099.224-1~deb11u1"},"fixed_version":"87.0.4280.88-0.1","urgency":"not yet assigned"},"forky":{"status":"resolved","repositories":{"forky":"145.0.7632.159-1"},"fixed_version":"87.0.4280.88-0.1","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"146.0.7680.71-1"},"fixed_version":"87.0.4280.88-0.1","urgency":"not yet assigned"},"trixie":{"status":"resolved","repositories":{"trixie":"143.0.7499.169-1~deb13u1","trixie-security":"145.0.7632.159-1~deb13u1"},"fixed_version":"87.0.4280.88-0.1","urgency":"not yet assigned"}}},"CVE-2020-15975":{"description":"Integer overflow in SwiftShader in Google Chrome prior to 86.0.4240.75 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page.","scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"143.0.7499.169-1~deb12u1","bookworm-security":"145.0.7632.159-1~deb12u1"},"fixed_version":"87.0.4280.88-0.1","urgency":"not yet assigned"},"bullseye":{"status":"resolved","repositories":{"bullseye":"120.0.6099.224-1~deb11u1","bullseye-security":"120.0.6099.224-1~deb11u1"},"fixed_version":"87.0.4280.88-0.1","urgency":"not yet assigned"},"forky":{"status":"resolved","repositories":{"forky":"145.0.7632.159-1"},"fixed_version":"87.0.4280.88-0.1","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"146.0.7680.71-1"},"fixed_version":"87.0.4280.88-0.1","urgency":"not yet assigned"},"trixie":{"status":"resolved","repositories":{"trixie":"143.0.7499.169-1~deb13u1","trixie-security":"145.0.7632.159-1~deb13u1"},"fixed_version":"87.0.4280.88-0.1","urgency":"not yet assigned"}}},"CVE-2020-15976":{"description":"Use after free in WebXR in Google Chrome on Android prior to 86.0.4240.75 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page.","scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"143.0.7499.169-1~deb12u1","bookworm-security":"145.0.7632.159-1~deb12u1"},"fixed_version":"87.0.4280.88-0.1","urgency":"not yet assigned"},"bullseye":{"status":"resolved","repositories":{"bullseye":"120.0.6099.224-1~deb11u1","bullseye-security":"120.0.6099.224-1~deb11u1"},"fixed_version":"87.0.4280.88-0.1","urgency":"not yet assigned"},"forky":{"status":"resolved","repositories":{"forky":"145.0.7632.159-1"},"fixed_version":"87.0.4280.88-0.1","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"146.0.7680.71-1"},"fixed_version":"87.0.4280.88-0.1","urgency":"not yet assigned"},"trixie":{"status":"resolved","repositories":{"trixie":"143.0.7499.169-1~deb13u1","trixie-security":"145.0.7632.159-1~deb13u1"},"fixed_version":"87.0.4280.88-0.1","urgency":"not yet assigned"}}},"CVE-2020-15977":{"description":"Insufficient data validation in dialogs in Google Chrome on OS X prior to 86.0.4240.75 allowed a remote attacker to obtain potentially sensitive information from disk via a crafted HTML page.","scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"143.0.7499.169-1~deb12u1","bookworm-security":"145.0.7632.159-1~deb12u1"},"fixed_version":"87.0.4280.88-0.1","urgency":"not yet assigned"},"bullseye":{"status":"resolved","repositories":{"bullseye":"120.0.6099.224-1~deb11u1","bullseye-security":"120.0.6099.224-1~deb11u1"},"fixed_version":"87.0.4280.88-0.1","urgency":"not yet assigned"},"forky":{"status":"resolved","repositories":{"forky":"145.0.7632.159-1"},"fixed_version":"87.0.4280.88-0.1","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"146.0.7680.71-1"},"fixed_version":"87.0.4280.88-0.1","urgency":"not yet assigned"},"trixie":{"status":"resolved","repositories":{"trixie":"143.0.7499.169-1~deb13u1","trixie-security":"145.0.7632.159-1~deb13u1"},"fixed_version":"87.0.4280.88-0.1","urgency":"not yet assigned"}}},"CVE-2020-15978":{"description":"Insufficient data validation in navigation in Google Chrome on Android prior to 86.0.4240.75 allowed a remote attacker who had compromised the renderer process to bypass navigation restrictions via a crafted HTML page.","scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"143.0.7499.169-1~deb12u1","bookworm-security":"145.0.7632.159-1~deb12u1"},"fixed_version":"87.0.4280.88-0.1","urgency":"not yet assigned"},"bullseye":{"status":"resolved","repositories":{"bullseye":"120.0.6099.224-1~deb11u1","bullseye-security":"120.0.6099.224-1~deb11u1"},"fixed_version":"87.0.4280.88-0.1","urgency":"not yet assigned"},"forky":{"status":"resolved","repositories":{"forky":"145.0.7632.159-1"},"fixed_version":"87.0.4280.88-0.1","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"146.0.7680.71-1"},"fixed_version":"87.0.4280.88-0.1","urgency":"not yet assigned"},"trixie":{"status":"resolved","repositories":{"trixie":"143.0.7499.169-1~deb13u1","trixie-security":"145.0.7632.159-1~deb13u1"},"fixed_version":"87.0.4280.88-0.1","urgency":"not yet assigned"}}},"CVE-2020-15979":{"description":"Inappropriate implementation in V8 in Google Chrome prior to 86.0.4240.75 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page.","scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"143.0.7499.169-1~deb12u1","bookworm-security":"145.0.7632.159-1~deb12u1"},"fixed_version":"87.0.4280.88-0.1","urgency":"not yet assigned"},"bullseye":{"status":"resolved","repositories":{"bullseye":"120.0.6099.224-1~deb11u1","bullseye-security":"120.0.6099.224-1~deb11u1"},"fixed_version":"87.0.4280.88-0.1","urgency":"not yet assigned"},"forky":{"status":"resolved","repositories":{"forky":"145.0.7632.159-1"},"fixed_version":"87.0.4280.88-0.1","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"146.0.7680.71-1"},"fixed_version":"87.0.4280.88-0.1","urgency":"not yet assigned"},"trixie":{"status":"resolved","repositories":{"trixie":"143.0.7499.169-1~deb13u1","trixie-security":"145.0.7632.159-1~deb13u1"},"fixed_version":"87.0.4280.88-0.1","urgency":"not yet assigned"}}},"CVE-2020-15980":{"description":"Insufficient policy enforcement in Intents in Google Chrome on Android prior to 86.0.4240.75 allowed a local attacker to bypass navigation restrictions via crafted Intents.","scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"143.0.7499.169-1~deb12u1","bookworm-security":"145.0.7632.159-1~deb12u1"},"fixed_version":"87.0.4280.88-0.1","urgency":"not yet assigned"},"bullseye":{"status":"resolved","repositories":{"bullseye":"120.0.6099.224-1~deb11u1","bullseye-security":"120.0.6099.224-1~deb11u1"},"fixed_version":"87.0.4280.88-0.1","urgency":"not yet assigned"},"forky":{"status":"resolved","repositories":{"forky":"145.0.7632.159-1"},"fixed_version":"87.0.4280.88-0.1","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"146.0.7680.71-1"},"fixed_version":"87.0.4280.88-0.1","urgency":"not yet assigned"},"trixie":{"status":"resolved","repositories":{"trixie":"143.0.7499.169-1~deb13u1","trixie-security":"145.0.7632.159-1~deb13u1"},"fixed_version":"87.0.4280.88-0.1","urgency":"not yet assigned"}}},"CVE-2020-15981":{"description":"Out of bounds read in audio in Google Chrome prior to 86.0.4240.75 allowed a remote attacker to obtain potentially sensitive information from process memory via a crafted HTML page.","scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"143.0.7499.169-1~deb12u1","bookworm-security":"145.0.7632.159-1~deb12u1"},"fixed_version":"87.0.4280.88-0.1","urgency":"not yet assigned"},"bullseye":{"status":"resolved","repositories":{"bullseye":"120.0.6099.224-1~deb11u1","bullseye-security":"120.0.6099.224-1~deb11u1"},"fixed_version":"87.0.4280.88-0.1","urgency":"not yet assigned"},"forky":{"status":"resolved","repositories":{"forky":"145.0.7632.159-1"},"fixed_version":"87.0.4280.88-0.1","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"146.0.7680.71-1"},"fixed_version":"87.0.4280.88-0.1","urgency":"not yet assigned"},"trixie":{"status":"resolved","repositories":{"trixie":"143.0.7499.169-1~deb13u1","trixie-security":"145.0.7632.159-1~deb13u1"},"fixed_version":"87.0.4280.88-0.1","urgency":"not yet assigned"}}},"CVE-2020-15982":{"description":"Inappropriate implementation in cache in Google Chrome prior to 86.0.4240.75 allowed a remote attacker to obtain potentially sensitive information from process memory via a crafted HTML page.","scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"143.0.7499.169-1~deb12u1","bookworm-security":"145.0.7632.159-1~deb12u1"},"fixed_version":"87.0.4280.88-0.1","urgency":"not yet assigned"},"bullseye":{"status":"resolved","repositories":{"bullseye":"120.0.6099.224-1~deb11u1","bullseye-security":"120.0.6099.224-1~deb11u1"},"fixed_version":"87.0.4280.88-0.1","urgency":"not yet assigned"},"forky":{"status":"resolved","repositories":{"forky":"145.0.7632.159-1"},"fixed_version":"87.0.4280.88-0.1","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"146.0.7680.71-1"},"fixed_version":"87.0.4280.88-0.1","urgency":"not yet assigned"},"trixie":{"status":"resolved","repositories":{"trixie":"143.0.7499.169-1~deb13u1","trixie-security":"145.0.7632.159-1~deb13u1"},"fixed_version":"87.0.4280.88-0.1","urgency":"not yet assigned"}}},"CVE-2020-15983":{"description":"Insufficient data validation in webUI in Google Chrome on ChromeOS prior to 86.0.4240.75 allowed a local attacker to bypass content security policy via a crafted HTML page.","scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"143.0.7499.169-1~deb12u1","bookworm-security":"145.0.7632.159-1~deb12u1"},"fixed_version":"87.0.4280.88-0.1","urgency":"not yet assigned"},"bullseye":{"status":"resolved","repositories":{"bullseye":"120.0.6099.224-1~deb11u1","bullseye-security":"120.0.6099.224-1~deb11u1"},"fixed_version":"87.0.4280.88-0.1","urgency":"not yet assigned"},"forky":{"status":"resolved","repositories":{"forky":"145.0.7632.159-1"},"fixed_version":"87.0.4280.88-0.1","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"146.0.7680.71-1"},"fixed_version":"87.0.4280.88-0.1","urgency":"not yet assigned"},"trixie":{"status":"resolved","repositories":{"trixie":"143.0.7499.169-1~deb13u1","trixie-security":"145.0.7632.159-1~deb13u1"},"fixed_version":"87.0.4280.88-0.1","urgency":"not yet assigned"}}},"CVE-2020-15984":{"description":"Insufficient policy enforcement in Omnibox in Google Chrome on iOS prior to 86.0.4240.75 allowed a remote attacker to spoof the contents of the Omnibox (URL bar) via a crafted URL.","scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"143.0.7499.169-1~deb12u1","bookworm-security":"145.0.7632.159-1~deb12u1"},"fixed_version":"87.0.4280.88-0.1","urgency":"not yet assigned"},"bullseye":{"status":"resolved","repositories":{"bullseye":"120.0.6099.224-1~deb11u1","bullseye-security":"120.0.6099.224-1~deb11u1"},"fixed_version":"87.0.4280.88-0.1","urgency":"not yet assigned"},"forky":{"status":"resolved","repositories":{"forky":"145.0.7632.159-1"},"fixed_version":"87.0.4280.88-0.1","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"146.0.7680.71-1"},"fixed_version":"87.0.4280.88-0.1","urgency":"not yet assigned"},"trixie":{"status":"resolved","repositories":{"trixie":"143.0.7499.169-1~deb13u1","trixie-security":"145.0.7632.159-1~deb13u1"},"fixed_version":"87.0.4280.88-0.1","urgency":"not yet assigned"}}},"CVE-2020-15985":{"description":"Inappropriate implementation in Blink in Google Chrome prior to 86.0.4240.75 allowed a remote attacker to spoof security UI via a crafted HTML page.","scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"143.0.7499.169-1~deb12u1","bookworm-security":"145.0.7632.159-1~deb12u1"},"fixed_version":"87.0.4280.88-0.1","urgency":"not yet assigned"},"bullseye":{"status":"resolved","repositories":{"bullseye":"120.0.6099.224-1~deb11u1","bullseye-security":"120.0.6099.224-1~deb11u1"},"fixed_version":"87.0.4280.88-0.1","urgency":"not yet assigned"},"forky":{"status":"resolved","repositories":{"forky":"145.0.7632.159-1"},"fixed_version":"87.0.4280.88-0.1","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"146.0.7680.71-1"},"fixed_version":"87.0.4280.88-0.1","urgency":"not yet assigned"},"trixie":{"status":"resolved","repositories":{"trixie":"143.0.7499.169-1~deb13u1","trixie-security":"145.0.7632.159-1~deb13u1"},"fixed_version":"87.0.4280.88-0.1","urgency":"not yet assigned"}}},"CVE-2020-15986":{"description":"Integer overflow in media in Google Chrome prior to 86.0.4240.75 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page.","scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"143.0.7499.169-1~deb12u1","bookworm-security":"145.0.7632.159-1~deb12u1"},"fixed_version":"87.0.4280.88-0.1","urgency":"not yet assigned"},"bullseye":{"status":"resolved","repositories":{"bullseye":"120.0.6099.224-1~deb11u1","bullseye-security":"120.0.6099.224-1~deb11u1"},"fixed_version":"87.0.4280.88-0.1","urgency":"not yet assigned"},"forky":{"status":"resolved","repositories":{"forky":"145.0.7632.159-1"},"fixed_version":"87.0.4280.88-0.1","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"146.0.7680.71-1"},"fixed_version":"87.0.4280.88-0.1","urgency":"not yet assigned"},"trixie":{"status":"resolved","repositories":{"trixie":"143.0.7499.169-1~deb13u1","trixie-security":"145.0.7632.159-1~deb13u1"},"fixed_version":"87.0.4280.88-0.1","urgency":"not yet assigned"}}},"CVE-2020-15987":{"description":"Use after free in WebRTC in Google Chrome prior to 86.0.4240.75 allowed a remote attacker to potentially exploit heap corruption via a crafted WebRTC stream.","scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"143.0.7499.169-1~deb12u1","bookworm-security":"145.0.7632.159-1~deb12u1"},"fixed_version":"87.0.4280.88-0.1","urgency":"not yet assigned"},"bullseye":{"status":"resolved","repositories":{"bullseye":"120.0.6099.224-1~deb11u1","bullseye-security":"120.0.6099.224-1~deb11u1"},"fixed_version":"87.0.4280.88-0.1","urgency":"not yet assigned"},"forky":{"status":"resolved","repositories":{"forky":"145.0.7632.159-1"},"fixed_version":"87.0.4280.88-0.1","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"146.0.7680.71-1"},"fixed_version":"87.0.4280.88-0.1","urgency":"not yet assigned"},"trixie":{"status":"resolved","repositories":{"trixie":"143.0.7499.169-1~deb13u1","trixie-security":"145.0.7632.159-1~deb13u1"},"fixed_version":"87.0.4280.88-0.1","urgency":"not yet assigned"}}},"CVE-2020-15988":{"description":"Insufficient policy enforcement in downloads in Google Chrome on Windows prior to 86.0.4240.75 allowed a remote attacker who convinced the user to open files to execute arbitrary code via a crafted HTML page.","scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"143.0.7499.169-1~deb12u1","bookworm-security":"145.0.7632.159-1~deb12u1"},"fixed_version":"87.0.4280.88-0.1","urgency":"not yet assigned"},"bullseye":{"status":"resolved","repositories":{"bullseye":"120.0.6099.224-1~deb11u1","bullseye-security":"120.0.6099.224-1~deb11u1"},"fixed_version":"87.0.4280.88-0.1","urgency":"not yet assigned"},"forky":{"status":"resolved","repositories":{"forky":"145.0.7632.159-1"},"fixed_version":"87.0.4280.88-0.1","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"146.0.7680.71-1"},"fixed_version":"87.0.4280.88-0.1","urgency":"not yet assigned"},"trixie":{"status":"resolved","repositories":{"trixie":"143.0.7499.169-1~deb13u1","trixie-security":"145.0.7632.159-1~deb13u1"},"fixed_version":"87.0.4280.88-0.1","urgency":"not yet assigned"}}},"CVE-2020-15989":{"description":"Uninitialized data in PDFium in Google Chrome prior to 86.0.4240.75 allowed a remote attacker to obtain potentially sensitive information from process memory via a crafted PDF file.","scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"143.0.7499.169-1~deb12u1","bookworm-security":"145.0.7632.159-1~deb12u1"},"fixed_version":"87.0.4280.88-0.1","urgency":"not yet assigned"},"bullseye":{"status":"resolved","repositories":{"bullseye":"120.0.6099.224-1~deb11u1","bullseye-security":"120.0.6099.224-1~deb11u1"},"fixed_version":"87.0.4280.88-0.1","urgency":"not yet assigned"},"forky":{"status":"resolved","repositories":{"forky":"145.0.7632.159-1"},"fixed_version":"87.0.4280.88-0.1","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"146.0.7680.71-1"},"fixed_version":"87.0.4280.88-0.1","urgency":"not yet assigned"},"trixie":{"status":"resolved","repositories":{"trixie":"143.0.7499.169-1~deb13u1","trixie-security":"145.0.7632.159-1~deb13u1"},"fixed_version":"87.0.4280.88-0.1","urgency":"not yet assigned"}}},"CVE-2020-15990":{"description":"Use after free in autofill in Google Chrome prior to 86.0.4240.75 allowed a remote attacker who had compromised the renderer process to potentially perform a sandbox escape via a crafted HTML page.","scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"143.0.7499.169-1~deb12u1","bookworm-security":"145.0.7632.159-1~deb12u1"},"fixed_version":"87.0.4280.88-0.1","urgency":"not yet assigned"},"bullseye":{"status":"resolved","repositories":{"bullseye":"120.0.6099.224-1~deb11u1","bullseye-security":"120.0.6099.224-1~deb11u1"},"fixed_version":"87.0.4280.88-0.1","urgency":"not yet assigned"},"forky":{"status":"resolved","repositories":{"forky":"145.0.7632.159-1"},"fixed_version":"87.0.4280.88-0.1","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"146.0.7680.71-1"},"fixed_version":"87.0.4280.88-0.1","urgency":"not yet assigned"},"trixie":{"status":"resolved","repositories":{"trixie":"143.0.7499.169-1~deb13u1","trixie-security":"145.0.7632.159-1~deb13u1"},"fixed_version":"87.0.4280.88-0.1","urgency":"not yet assigned"}}},"CVE-2020-15991":{"description":"Use after free in password manager in Google Chrome prior to 86.0.4240.75 allowed a remote attacker who had compromised the renderer process to potentially perform a sandbox escape via a crafted HTML page.","scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"143.0.7499.169-1~deb12u1","bookworm-security":"145.0.7632.159-1~deb12u1"},"fixed_version":"87.0.4280.88-0.1","urgency":"not yet assigned"},"bullseye":{"status":"resolved","repositories":{"bullseye":"120.0.6099.224-1~deb11u1","bullseye-security":"120.0.6099.224-1~deb11u1"},"fixed_version":"87.0.4280.88-0.1","urgency":"not yet assigned"},"forky":{"status":"resolved","repositories":{"forky":"145.0.7632.159-1"},"fixed_version":"87.0.4280.88-0.1","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"146.0.7680.71-1"},"fixed_version":"87.0.4280.88-0.1","urgency":"not yet assigned"},"trixie":{"status":"resolved","repositories":{"trixie":"143.0.7499.169-1~deb13u1","trixie-security":"145.0.7632.159-1~deb13u1"},"fixed_version":"87.0.4280.88-0.1","urgency":"not yet assigned"}}},"CVE-2020-15992":{"description":"Insufficient policy enforcement in networking in Google Chrome prior to 86.0.4240.75 allowed a remote attacker who had compromised the renderer process to bypass same origin policy via a crafted HTML page.","scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"143.0.7499.169-1~deb12u1","bookworm-security":"145.0.7632.159-1~deb12u1"},"fixed_version":"87.0.4280.88-0.1","urgency":"not yet assigned"},"bullseye":{"status":"resolved","repositories":{"bullseye":"120.0.6099.224-1~deb11u1","bullseye-security":"120.0.6099.224-1~deb11u1"},"fixed_version":"87.0.4280.88-0.1","urgency":"not yet assigned"},"forky":{"status":"resolved","repositories":{"forky":"145.0.7632.159-1"},"fixed_version":"87.0.4280.88-0.1","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"146.0.7680.71-1"},"fixed_version":"87.0.4280.88-0.1","urgency":"not yet assigned"},"trixie":{"status":"resolved","repositories":{"trixie":"143.0.7499.169-1~deb13u1","trixie-security":"145.0.7632.159-1~deb13u1"},"fixed_version":"87.0.4280.88-0.1","urgency":"not yet assigned"}}},"CVE-2020-15993":{"description":"Use after free in printing in Google Chrome prior to 86.0.4240.99 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page.","scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"143.0.7499.169-1~deb12u1","bookworm-security":"145.0.7632.159-1~deb12u1"},"fixed_version":"0","urgency":"unimportant"},"bullseye":{"status":"resolved","repositories":{"bullseye":"120.0.6099.224-1~deb11u1","bullseye-security":"120.0.6099.224-1~deb11u1"},"fixed_version":"0","urgency":"unimportant"},"forky":{"status":"resolved","repositories":{"forky":"145.0.7632.159-1"},"fixed_version":"0","urgency":"unimportant"},"sid":{"status":"resolved","repositories":{"sid":"146.0.7680.71-1"},"fixed_version":"0","urgency":"unimportant"},"trixie":{"status":"resolved","repositories":{"trixie":"143.0.7499.169-1~deb13u1","trixie-security":"145.0.7632.159-1~deb13u1"},"fixed_version":"0","urgency":"unimportant"}}},"CVE-2020-15994":{"description":"Use after free in V8 in Google Chrome prior to 86.0.4240.99 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page.","scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"143.0.7499.169-1~deb12u1","bookworm-security":"145.0.7632.159-1~deb12u1"},"fixed_version":"0","urgency":"unimportant"},"bullseye":{"status":"resolved","repositories":{"bullseye":"120.0.6099.224-1~deb11u1","bullseye-security":"120.0.6099.224-1~deb11u1"},"fixed_version":"0","urgency":"unimportant"},"forky":{"status":"resolved","repositories":{"forky":"145.0.7632.159-1"},"fixed_version":"0","urgency":"unimportant"},"sid":{"status":"resolved","repositories":{"sid":"146.0.7680.71-1"},"fixed_version":"0","urgency":"unimportant"},"trixie":{"status":"resolved","repositories":{"trixie":"143.0.7499.169-1~deb13u1","trixie-security":"145.0.7632.159-1~deb13u1"},"fixed_version":"0","urgency":"unimportant"}}},"CVE-2020-15995":{"description":"Out of bounds write in V8 in Google Chrome prior to 86.0.4240.99 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page.","debianbug":979533,"scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"143.0.7499.169-1~deb12u1","bookworm-security":"145.0.7632.159-1~deb12u1"},"fixed_version":"87.0.4280.141-0.1","urgency":"not yet assigned"},"bullseye":{"status":"resolved","repositories":{"bullseye":"120.0.6099.224-1~deb11u1","bullseye-security":"120.0.6099.224-1~deb11u1"},"fixed_version":"87.0.4280.141-0.1","urgency":"not yet assigned"},"forky":{"status":"resolved","repositories":{"forky":"145.0.7632.159-1"},"fixed_version":"87.0.4280.141-0.1","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"146.0.7680.71-1"},"fixed_version":"87.0.4280.141-0.1","urgency":"not yet assigned"},"trixie":{"status":"resolved","repositories":{"trixie":"143.0.7499.169-1~deb13u1","trixie-security":"145.0.7632.159-1~deb13u1"},"fixed_version":"87.0.4280.141-0.1","urgency":"not yet assigned"}}},"CVE-2020-15996":{"description":"Use after free in passwords in Google Chrome prior to 86.0.4240.99 allowed a remote attacker who had compromised the renderer process to potentially perform a sandbox escape via a crafted HTML page.","scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"143.0.7499.169-1~deb12u1","bookworm-security":"145.0.7632.159-1~deb12u1"},"fixed_version":"0","urgency":"unimportant"},"bullseye":{"status":"resolved","repositories":{"bullseye":"120.0.6099.224-1~deb11u1","bullseye-security":"120.0.6099.224-1~deb11u1"},"fixed_version":"0","urgency":"unimportant"},"forky":{"status":"resolved","repositories":{"forky":"145.0.7632.159-1"},"fixed_version":"0","urgency":"unimportant"},"sid":{"status":"resolved","repositories":{"sid":"146.0.7680.71-1"},"fixed_version":"0","urgency":"unimportant"},"trixie":{"status":"resolved","repositories":{"trixie":"143.0.7499.169-1~deb13u1","trixie-security":"145.0.7632.159-1~deb13u1"},"fixed_version":"0","urgency":"unimportant"}}},"CVE-2020-15997":{"description":"Use after free in Mojo in Google Chrome prior to 86.0.4240.99 allowed a remote attacker who had compromised the renderer process to potentially perform a sandbox escape via a crafted HTML page.","scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"143.0.7499.169-1~deb12u1","bookworm-security":"145.0.7632.159-1~deb12u1"},"fixed_version":"0","urgency":"unimportant"},"bullseye":{"status":"resolved","repositories":{"bullseye":"120.0.6099.224-1~deb11u1","bullseye-security":"120.0.6099.224-1~deb11u1"},"fixed_version":"0","urgency":"unimportant"},"forky":{"status":"resolved","repositories":{"forky":"145.0.7632.159-1"},"fixed_version":"0","urgency":"unimportant"},"sid":{"status":"resolved","repositories":{"sid":"146.0.7680.71-1"},"fixed_version":"0","urgency":"unimportant"},"trixie":{"status":"resolved","repositories":{"trixie":"143.0.7499.169-1~deb13u1","trixie-security":"145.0.7632.159-1~deb13u1"},"fixed_version":"0","urgency":"unimportant"}}},"CVE-2020-15998":{"description":"Use after free in USB in Google Chrome prior to 86.0.4240.99 allowed a remote attacker who had compromised the renderer process to potentially perform a sandbox escape via a crafted HTML page.","scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"143.0.7499.169-1~deb12u1","bookworm-security":"145.0.7632.159-1~deb12u1"},"fixed_version":"0","urgency":"unimportant"},"bullseye":{"status":"resolved","repositories":{"bullseye":"120.0.6099.224-1~deb11u1","bullseye-security":"120.0.6099.224-1~deb11u1"},"fixed_version":"0","urgency":"unimportant"},"forky":{"status":"resolved","repositories":{"forky":"145.0.7632.159-1"},"fixed_version":"0","urgency":"unimportant"},"sid":{"status":"resolved","repositories":{"sid":"146.0.7680.71-1"},"fixed_version":"0","urgency":"unimportant"},"trixie":{"status":"resolved","repositories":{"trixie":"143.0.7499.169-1~deb13u1","trixie-security":"145.0.7632.159-1~deb13u1"},"fixed_version":"0","urgency":"unimportant"}}},"CVE-2020-16000":{"description":"Inappropriate implementation in Blink in Google Chrome prior to 86.0.4240.111 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page.","scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"143.0.7499.169-1~deb12u1","bookworm-security":"145.0.7632.159-1~deb12u1"},"fixed_version":"87.0.4280.88-0.1","urgency":"not yet assigned"},"bullseye":{"status":"resolved","repositories":{"bullseye":"120.0.6099.224-1~deb11u1","bullseye-security":"120.0.6099.224-1~deb11u1"},"fixed_version":"87.0.4280.88-0.1","urgency":"not yet assigned"},"forky":{"status":"resolved","repositories":{"forky":"145.0.7632.159-1"},"fixed_version":"87.0.4280.88-0.1","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"146.0.7680.71-1"},"fixed_version":"87.0.4280.88-0.1","urgency":"not yet assigned"},"trixie":{"status":"resolved","repositories":{"trixie":"143.0.7499.169-1~deb13u1","trixie-security":"145.0.7632.159-1~deb13u1"},"fixed_version":"87.0.4280.88-0.1","urgency":"not yet assigned"}}},"CVE-2020-16001":{"description":"Use after free in media in Google Chrome prior to 86.0.4240.111 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page.","scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"143.0.7499.169-1~deb12u1","bookworm-security":"145.0.7632.159-1~deb12u1"},"fixed_version":"87.0.4280.88-0.1","urgency":"not yet assigned"},"bullseye":{"status":"resolved","repositories":{"bullseye":"120.0.6099.224-1~deb11u1","bullseye-security":"120.0.6099.224-1~deb11u1"},"fixed_version":"87.0.4280.88-0.1","urgency":"not yet assigned"},"forky":{"status":"resolved","repositories":{"forky":"145.0.7632.159-1"},"fixed_version":"87.0.4280.88-0.1","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"146.0.7680.71-1"},"fixed_version":"87.0.4280.88-0.1","urgency":"not yet assigned"},"trixie":{"status":"resolved","repositories":{"trixie":"143.0.7499.169-1~deb13u1","trixie-security":"145.0.7632.159-1~deb13u1"},"fixed_version":"87.0.4280.88-0.1","urgency":"not yet assigned"}}},"CVE-2020-16002":{"description":"Use after free in PDFium in Google Chrome prior to 86.0.4240.111 allowed a remote attacker to potentially exploit heap corruption via a crafted PDF file.","scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"143.0.7499.169-1~deb12u1","bookworm-security":"145.0.7632.159-1~deb12u1"},"fixed_version":"87.0.4280.88-0.1","urgency":"not yet assigned"},"bullseye":{"status":"resolved","repositories":{"bullseye":"120.0.6099.224-1~deb11u1","bullseye-security":"120.0.6099.224-1~deb11u1"},"fixed_version":"87.0.4280.88-0.1","urgency":"not yet assigned"},"forky":{"status":"resolved","repositories":{"forky":"145.0.7632.159-1"},"fixed_version":"87.0.4280.88-0.1","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"146.0.7680.71-1"},"fixed_version":"87.0.4280.88-0.1","urgency":"not yet assigned"},"trixie":{"status":"resolved","repositories":{"trixie":"143.0.7499.169-1~deb13u1","trixie-security":"145.0.7632.159-1~deb13u1"},"fixed_version":"87.0.4280.88-0.1","urgency":"not yet assigned"}}},"CVE-2020-16003":{"description":"Use after free in printing in Google Chrome prior to 86.0.4240.111 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page.","scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"143.0.7499.169-1~deb12u1","bookworm-security":"145.0.7632.159-1~deb12u1"},"fixed_version":"87.0.4280.88-0.1","urgency":"not yet assigned"},"bullseye":{"status":"resolved","repositories":{"bullseye":"120.0.6099.224-1~deb11u1","bullseye-security":"120.0.6099.224-1~deb11u1"},"fixed_version":"87.0.4280.88-0.1","urgency":"not yet assigned"},"forky":{"status":"resolved","repositories":{"forky":"145.0.7632.159-1"},"fixed_version":"87.0.4280.88-0.1","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"146.0.7680.71-1"},"fixed_version":"87.0.4280.88-0.1","urgency":"not yet assigned"},"trixie":{"status":"resolved","repositories":{"trixie":"143.0.7499.169-1~deb13u1","trixie-security":"145.0.7632.159-1~deb13u1"},"fixed_version":"87.0.4280.88-0.1","urgency":"not yet assigned"}}},"CVE-2020-16004":{"description":"Use after free in user interface in Google Chrome prior to 86.0.4240.183 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page.","scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"143.0.7499.169-1~deb12u1","bookworm-security":"145.0.7632.159-1~deb12u1"},"fixed_version":"87.0.4280.88-0.1","urgency":"not yet assigned"},"bullseye":{"status":"resolved","repositories":{"bullseye":"120.0.6099.224-1~deb11u1","bullseye-security":"120.0.6099.224-1~deb11u1"},"fixed_version":"87.0.4280.88-0.1","urgency":"not yet assigned"},"forky":{"status":"resolved","repositories":{"forky":"145.0.7632.159-1"},"fixed_version":"87.0.4280.88-0.1","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"146.0.7680.71-1"},"fixed_version":"87.0.4280.88-0.1","urgency":"not yet assigned"},"trixie":{"status":"resolved","repositories":{"trixie":"143.0.7499.169-1~deb13u1","trixie-security":"145.0.7632.159-1~deb13u1"},"fixed_version":"87.0.4280.88-0.1","urgency":"not yet assigned"}}},"CVE-2020-16005":{"description":"Insufficient policy enforcement in ANGLE in Google Chrome prior to 86.0.4240.183 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page.","scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"143.0.7499.169-1~deb12u1","bookworm-security":"145.0.7632.159-1~deb12u1"},"fixed_version":"87.0.4280.88-0.1","urgency":"not yet assigned"},"bullseye":{"status":"resolved","repositories":{"bullseye":"120.0.6099.224-1~deb11u1","bullseye-security":"120.0.6099.224-1~deb11u1"},"fixed_version":"87.0.4280.88-0.1","urgency":"not yet assigned"},"forky":{"status":"resolved","repositories":{"forky":"145.0.7632.159-1"},"fixed_version":"87.0.4280.88-0.1","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"146.0.7680.71-1"},"fixed_version":"87.0.4280.88-0.1","urgency":"not yet assigned"},"trixie":{"status":"resolved","repositories":{"trixie":"143.0.7499.169-1~deb13u1","trixie-security":"145.0.7632.159-1~deb13u1"},"fixed_version":"87.0.4280.88-0.1","urgency":"not yet assigned"}}},"CVE-2020-16006":{"description":"Inappropriate implementation in V8 in Google Chrome prior to 86.0.4240.183 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page.","scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"143.0.7499.169-1~deb12u1","bookworm-security":"145.0.7632.159-1~deb12u1"},"fixed_version":"87.0.4280.88-0.1","urgency":"not yet assigned"},"bullseye":{"status":"resolved","repositories":{"bullseye":"120.0.6099.224-1~deb11u1","bullseye-security":"120.0.6099.224-1~deb11u1"},"fixed_version":"87.0.4280.88-0.1","urgency":"not yet assigned"},"forky":{"status":"resolved","repositories":{"forky":"145.0.7632.159-1"},"fixed_version":"87.0.4280.88-0.1","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"146.0.7680.71-1"},"fixed_version":"87.0.4280.88-0.1","urgency":"not yet assigned"},"trixie":{"status":"resolved","repositories":{"trixie":"143.0.7499.169-1~deb13u1","trixie-security":"145.0.7632.159-1~deb13u1"},"fixed_version":"87.0.4280.88-0.1","urgency":"not yet assigned"}}},"CVE-2020-16007":{"description":"Insufficient data validation in installer in Google Chrome prior to 86.0.4240.183 allowed a local attacker to potentially elevate privilege via a crafted filesystem.","scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"143.0.7499.169-1~deb12u1","bookworm-security":"145.0.7632.159-1~deb12u1"},"fixed_version":"0","urgency":"unimportant"},"bullseye":{"status":"resolved","repositories":{"bullseye":"120.0.6099.224-1~deb11u1","bullseye-security":"120.0.6099.224-1~deb11u1"},"fixed_version":"0","urgency":"unimportant"},"forky":{"status":"resolved","repositories":{"forky":"145.0.7632.159-1"},"fixed_version":"0","urgency":"unimportant"},"sid":{"status":"resolved","repositories":{"sid":"146.0.7680.71-1"},"fixed_version":"0","urgency":"unimportant"},"trixie":{"status":"resolved","repositories":{"trixie":"143.0.7499.169-1~deb13u1","trixie-security":"145.0.7632.159-1~deb13u1"},"fixed_version":"0","urgency":"unimportant"}}},"CVE-2020-16008":{"description":"Stack buffer overflow in WebRTC in Google Chrome prior to 86.0.4240.183 allowed a remote attacker to potentially exploit stack corruption via a crafted WebRTC packet.","scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"143.0.7499.169-1~deb12u1","bookworm-security":"145.0.7632.159-1~deb12u1"},"fixed_version":"87.0.4280.88-0.1","urgency":"not yet assigned"},"bullseye":{"status":"resolved","repositories":{"bullseye":"120.0.6099.224-1~deb11u1","bullseye-security":"120.0.6099.224-1~deb11u1"},"fixed_version":"87.0.4280.88-0.1","urgency":"not yet assigned"},"forky":{"status":"resolved","repositories":{"forky":"145.0.7632.159-1"},"fixed_version":"87.0.4280.88-0.1","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"146.0.7680.71-1"},"fixed_version":"87.0.4280.88-0.1","urgency":"not yet assigned"},"trixie":{"status":"resolved","repositories":{"trixie":"143.0.7499.169-1~deb13u1","trixie-security":"145.0.7632.159-1~deb13u1"},"fixed_version":"87.0.4280.88-0.1","urgency":"not yet assigned"}}},"CVE-2020-16009":{"description":"Inappropriate implementation in V8 in Google Chrome prior to 86.0.4240.183 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page.","scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"143.0.7499.169-1~deb12u1","bookworm-security":"145.0.7632.159-1~deb12u1"},"fixed_version":"87.0.4280.88-0.1","urgency":"not yet assigned"},"bullseye":{"status":"resolved","repositories":{"bullseye":"120.0.6099.224-1~deb11u1","bullseye-security":"120.0.6099.224-1~deb11u1"},"fixed_version":"87.0.4280.88-0.1","urgency":"not yet assigned"},"forky":{"status":"resolved","repositories":{"forky":"145.0.7632.159-1"},"fixed_version":"87.0.4280.88-0.1","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"146.0.7680.71-1"},"fixed_version":"87.0.4280.88-0.1","urgency":"not yet assigned"},"trixie":{"status":"resolved","repositories":{"trixie":"143.0.7499.169-1~deb13u1","trixie-security":"145.0.7632.159-1~deb13u1"},"fixed_version":"87.0.4280.88-0.1","urgency":"not yet assigned"}}},"CVE-2020-16010":{"description":"Heap buffer overflow in UI in Google Chrome on Android prior to 86.0.4240.185 allowed a remote attacker who had compromised the renderer process to potentially perform a sandbox escape via a crafted HTML page.","scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"143.0.7499.169-1~deb12u1","bookworm-security":"145.0.7632.159-1~deb12u1"},"fixed_version":"0","urgency":"unimportant"},"bullseye":{"status":"resolved","repositories":{"bullseye":"120.0.6099.224-1~deb11u1","bullseye-security":"120.0.6099.224-1~deb11u1"},"fixed_version":"0","urgency":"unimportant"},"forky":{"status":"resolved","repositories":{"forky":"145.0.7632.159-1"},"fixed_version":"0","urgency":"unimportant"},"sid":{"status":"resolved","repositories":{"sid":"146.0.7680.71-1"},"fixed_version":"0","urgency":"unimportant"},"trixie":{"status":"resolved","repositories":{"trixie":"143.0.7499.169-1~deb13u1","trixie-security":"145.0.7632.159-1~deb13u1"},"fixed_version":"0","urgency":"unimportant"}}},"CVE-2020-16011":{"description":"Heap buffer overflow in UI in Google Chrome on Windows prior to 86.0.4240.183 allowed a remote attacker who had compromised the renderer process to potentially perform a sandbox escape via a crafted HTML page.","scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"143.0.7499.169-1~deb12u1","bookworm-security":"145.0.7632.159-1~deb12u1"},"fixed_version":"0","urgency":"unimportant"},"bullseye":{"status":"resolved","repositories":{"bullseye":"120.0.6099.224-1~deb11u1","bullseye-security":"120.0.6099.224-1~deb11u1"},"fixed_version":"0","urgency":"unimportant"},"forky":{"status":"resolved","repositories":{"forky":"145.0.7632.159-1"},"fixed_version":"0","urgency":"unimportant"},"sid":{"status":"resolved","repositories":{"sid":"146.0.7680.71-1"},"fixed_version":"0","urgency":"unimportant"},"trixie":{"status":"resolved","repositories":{"trixie":"143.0.7499.169-1~deb13u1","trixie-security":"145.0.7632.159-1~deb13u1"},"fixed_version":"0","urgency":"unimportant"}}},"CVE-2020-16012":{"description":"Side-channel information leakage in graphics in Google Chrome prior to 87.0.4280.66 allowed a remote attacker to leak cross-origin data via a crafted HTML page.","scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"143.0.7499.169-1~deb12u1","bookworm-security":"145.0.7632.159-1~deb12u1"},"fixed_version":"87.0.4280.88-0.1","urgency":"not yet assigned"},"bullseye":{"status":"resolved","repositories":{"bullseye":"120.0.6099.224-1~deb11u1","bullseye-security":"120.0.6099.224-1~deb11u1"},"fixed_version":"87.0.4280.88-0.1","urgency":"not yet assigned"},"forky":{"status":"resolved","repositories":{"forky":"145.0.7632.159-1"},"fixed_version":"87.0.4280.88-0.1","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"146.0.7680.71-1"},"fixed_version":"87.0.4280.88-0.1","urgency":"not yet assigned"},"trixie":{"status":"resolved","repositories":{"trixie":"143.0.7499.169-1~deb13u1","trixie-security":"145.0.7632.159-1~deb13u1"},"fixed_version":"87.0.4280.88-0.1","urgency":"not yet assigned"}}},"CVE-2020-16013":{"description":"Inappropriate implementation in V8 in Google Chrome prior to 86.0.4240.198 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page.","scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"143.0.7499.169-1~deb12u1","bookworm-security":"145.0.7632.159-1~deb12u1"},"fixed_version":"87.0.4280.88-0.1","urgency":"not yet assigned"},"bullseye":{"status":"resolved","repositories":{"bullseye":"120.0.6099.224-1~deb11u1","bullseye-security":"120.0.6099.224-1~deb11u1"},"fixed_version":"87.0.4280.88-0.1","urgency":"not yet assigned"},"forky":{"status":"resolved","repositories":{"forky":"145.0.7632.159-1"},"fixed_version":"87.0.4280.88-0.1","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"146.0.7680.71-1"},"fixed_version":"87.0.4280.88-0.1","urgency":"not yet assigned"},"trixie":{"status":"resolved","repositories":{"trixie":"143.0.7499.169-1~deb13u1","trixie-security":"145.0.7632.159-1~deb13u1"},"fixed_version":"87.0.4280.88-0.1","urgency":"not yet assigned"}}},"CVE-2020-16014":{"description":"Use after free in PPAPI in Google Chrome prior to 87.0.4280.66 allowed a remote attacker who had compromised the renderer process to potentially perform a sandbox escape via a crafted HTML page.","scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"143.0.7499.169-1~deb12u1","bookworm-security":"145.0.7632.159-1~deb12u1"},"fixed_version":"87.0.4280.88-0.1","urgency":"not yet assigned"},"bullseye":{"status":"resolved","repositories":{"bullseye":"120.0.6099.224-1~deb11u1","bullseye-security":"120.0.6099.224-1~deb11u1"},"fixed_version":"87.0.4280.88-0.1","urgency":"not yet assigned"},"forky":{"status":"resolved","repositories":{"forky":"145.0.7632.159-1"},"fixed_version":"87.0.4280.88-0.1","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"146.0.7680.71-1"},"fixed_version":"87.0.4280.88-0.1","urgency":"not yet assigned"},"trixie":{"status":"resolved","repositories":{"trixie":"143.0.7499.169-1~deb13u1","trixie-security":"145.0.7632.159-1~deb13u1"},"fixed_version":"87.0.4280.88-0.1","urgency":"not yet assigned"}}},"CVE-2020-16015":{"description":"Insufficient data validation in WASM in Google Chrome prior to 87.0.4280.66 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page.","scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"143.0.7499.169-1~deb12u1","bookworm-security":"145.0.7632.159-1~deb12u1"},"fixed_version":"87.0.4280.88-0.1","urgency":"not yet assigned"},"bullseye":{"status":"resolved","repositories":{"bullseye":"120.0.6099.224-1~deb11u1","bullseye-security":"120.0.6099.224-1~deb11u1"},"fixed_version":"87.0.4280.88-0.1","urgency":"not yet assigned"},"forky":{"status":"resolved","repositories":{"forky":"145.0.7632.159-1"},"fixed_version":"87.0.4280.88-0.1","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"146.0.7680.71-1"},"fixed_version":"87.0.4280.88-0.1","urgency":"not yet assigned"},"trixie":{"status":"resolved","repositories":{"trixie":"143.0.7499.169-1~deb13u1","trixie-security":"145.0.7632.159-1~deb13u1"},"fixed_version":"87.0.4280.88-0.1","urgency":"not yet assigned"}}},"CVE-2020-16016":{"description":"Inappropriate implementation in base in Google Chrome prior to 86.0.4240.193 allowed a remote attacker who had compromised the renderer process to potentially perform a sandbox escape via a crafted HTML page.","scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"143.0.7499.169-1~deb12u1","bookworm-security":"145.0.7632.159-1~deb12u1"},"fixed_version":"87.0.4280.88-0.1","urgency":"not yet assigned"},"bullseye":{"status":"resolved","repositories":{"bullseye":"120.0.6099.224-1~deb11u1","bullseye-security":"120.0.6099.224-1~deb11u1"},"fixed_version":"87.0.4280.88-0.1","urgency":"not yet assigned"},"forky":{"status":"resolved","repositories":{"forky":"145.0.7632.159-1"},"fixed_version":"87.0.4280.88-0.1","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"146.0.7680.71-1"},"fixed_version":"87.0.4280.88-0.1","urgency":"not yet assigned"},"trixie":{"status":"resolved","repositories":{"trixie":"143.0.7499.169-1~deb13u1","trixie-security":"145.0.7632.159-1~deb13u1"},"fixed_version":"87.0.4280.88-0.1","urgency":"not yet assigned"}}},"CVE-2020-16017":{"description":"Use after free in site isolation in Google Chrome prior to 86.0.4240.198 allowed a remote attacker who had compromised the renderer process to potentially perform a sandbox escape via a crafted HTML page.","scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"143.0.7499.169-1~deb12u1","bookworm-security":"145.0.7632.159-1~deb12u1"},"fixed_version":"87.0.4280.88-0.1","urgency":"not yet assigned"},"bullseye":{"status":"resolved","repositories":{"bullseye":"120.0.6099.224-1~deb11u1","bullseye-security":"120.0.6099.224-1~deb11u1"},"fixed_version":"87.0.4280.88-0.1","urgency":"not yet assigned"},"forky":{"status":"resolved","repositories":{"forky":"145.0.7632.159-1"},"fixed_version":"87.0.4280.88-0.1","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"146.0.7680.71-1"},"fixed_version":"87.0.4280.88-0.1","urgency":"not yet assigned"},"trixie":{"status":"resolved","repositories":{"trixie":"143.0.7499.169-1~deb13u1","trixie-security":"145.0.7632.159-1~deb13u1"},"fixed_version":"87.0.4280.88-0.1","urgency":"not yet assigned"}}},"CVE-2020-16018":{"description":"Use after free in payments in Google Chrome prior to 87.0.4280.66 allowed a remote attacker who had compromised the renderer process to potentially perform a sandbox escape via a crafted HTML page.","scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"143.0.7499.169-1~deb12u1","bookworm-security":"145.0.7632.159-1~deb12u1"},"fixed_version":"87.0.4280.88-0.1","urgency":"not yet assigned"},"bullseye":{"status":"resolved","repositories":{"bullseye":"120.0.6099.224-1~deb11u1","bullseye-security":"120.0.6099.224-1~deb11u1"},"fixed_version":"87.0.4280.88-0.1","urgency":"not yet assigned"},"forky":{"status":"resolved","repositories":{"forky":"145.0.7632.159-1"},"fixed_version":"87.0.4280.88-0.1","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"146.0.7680.71-1"},"fixed_version":"87.0.4280.88-0.1","urgency":"not yet assigned"},"trixie":{"status":"resolved","repositories":{"trixie":"143.0.7499.169-1~deb13u1","trixie-security":"145.0.7632.159-1~deb13u1"},"fixed_version":"87.0.4280.88-0.1","urgency":"not yet assigned"}}},"CVE-2020-16019":{"description":"Inappropriate implementation in filesystem in Google Chrome on ChromeOS prior to 87.0.4280.66 allowed a remote attacker who had compromised the browser process to bypass noexec restrictions via a malicious file.","scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"143.0.7499.169-1~deb12u1","bookworm-security":"145.0.7632.159-1~deb12u1"},"fixed_version":"87.0.4280.88-0.1","urgency":"not yet assigned"},"bullseye":{"status":"resolved","repositories":{"bullseye":"120.0.6099.224-1~deb11u1","bullseye-security":"120.0.6099.224-1~deb11u1"},"fixed_version":"87.0.4280.88-0.1","urgency":"not yet assigned"},"forky":{"status":"resolved","repositories":{"forky":"145.0.7632.159-1"},"fixed_version":"87.0.4280.88-0.1","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"146.0.7680.71-1"},"fixed_version":"87.0.4280.88-0.1","urgency":"not yet assigned"},"trixie":{"status":"resolved","repositories":{"trixie":"143.0.7499.169-1~deb13u1","trixie-security":"145.0.7632.159-1~deb13u1"},"fixed_version":"87.0.4280.88-0.1","urgency":"not yet assigned"}}},"CVE-2020-16020":{"description":"Inappropriate implementation in cryptohome in Google Chrome on ChromeOS prior to 87.0.4280.66 allowed a remote attacker who had compromised the browser process to bypass discretionary access control via a malicious file.","scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"143.0.7499.169-1~deb12u1","bookworm-security":"145.0.7632.159-1~deb12u1"},"fixed_version":"87.0.4280.88-0.1","urgency":"not yet assigned"},"bullseye":{"status":"resolved","repositories":{"bullseye":"120.0.6099.224-1~deb11u1","bullseye-security":"120.0.6099.224-1~deb11u1"},"fixed_version":"87.0.4280.88-0.1","urgency":"not yet assigned"},"forky":{"status":"resolved","repositories":{"forky":"145.0.7632.159-1"},"fixed_version":"87.0.4280.88-0.1","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"146.0.7680.71-1"},"fixed_version":"87.0.4280.88-0.1","urgency":"not yet assigned"},"trixie":{"status":"resolved","repositories":{"trixie":"143.0.7499.169-1~deb13u1","trixie-security":"145.0.7632.159-1~deb13u1"},"fixed_version":"87.0.4280.88-0.1","urgency":"not yet assigned"}}},"CVE-2020-16021":{"description":"Race in image burner in Google Chrome on ChromeOS prior to 87.0.4280.66 allowed a remote attacker who had compromised the browser process to perform OS-level privilege escalation via a malicious file.","scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"143.0.7499.169-1~deb12u1","bookworm-security":"145.0.7632.159-1~deb12u1"},"fixed_version":"87.0.4280.88-0.1","urgency":"not yet assigned"},"bullseye":{"status":"resolved","repositories":{"bullseye":"120.0.6099.224-1~deb11u1","bullseye-security":"120.0.6099.224-1~deb11u1"},"fixed_version":"87.0.4280.88-0.1","urgency":"not yet assigned"},"forky":{"status":"resolved","repositories":{"forky":"145.0.7632.159-1"},"fixed_version":"87.0.4280.88-0.1","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"146.0.7680.71-1"},"fixed_version":"87.0.4280.88-0.1","urgency":"not yet assigned"},"trixie":{"status":"resolved","repositories":{"trixie":"143.0.7499.169-1~deb13u1","trixie-security":"145.0.7632.159-1~deb13u1"},"fixed_version":"87.0.4280.88-0.1","urgency":"not yet assigned"}}},"CVE-2020-16022":{"description":"Insufficient policy enforcement in networking in Google Chrome prior to 87.0.4280.66 allowed a remote attacker to potentially bypass firewall controls via a crafted HTML page.","scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"143.0.7499.169-1~deb12u1","bookworm-security":"145.0.7632.159-1~deb12u1"},"fixed_version":"87.0.4280.88-0.1","urgency":"not yet assigned"},"bullseye":{"status":"resolved","repositories":{"bullseye":"120.0.6099.224-1~deb11u1","bullseye-security":"120.0.6099.224-1~deb11u1"},"fixed_version":"87.0.4280.88-0.1","urgency":"not yet assigned"},"forky":{"status":"resolved","repositories":{"forky":"145.0.7632.159-1"},"fixed_version":"87.0.4280.88-0.1","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"146.0.7680.71-1"},"fixed_version":"87.0.4280.88-0.1","urgency":"not yet assigned"},"trixie":{"status":"resolved","repositories":{"trixie":"143.0.7499.169-1~deb13u1","trixie-security":"145.0.7632.159-1~deb13u1"},"fixed_version":"87.0.4280.88-0.1","urgency":"not yet assigned"}}},"CVE-2020-16023":{"description":"Use after free in WebCodecs in Google Chrome prior to 87.0.4280.66 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page.","scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"143.0.7499.169-1~deb12u1","bookworm-security":"145.0.7632.159-1~deb12u1"},"fixed_version":"87.0.4280.88-0.1","urgency":"not yet assigned"},"bullseye":{"status":"resolved","repositories":{"bullseye":"120.0.6099.224-1~deb11u1","bullseye-security":"120.0.6099.224-1~deb11u1"},"fixed_version":"87.0.4280.88-0.1","urgency":"not yet assigned"},"forky":{"status":"resolved","repositories":{"forky":"145.0.7632.159-1"},"fixed_version":"87.0.4280.88-0.1","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"146.0.7680.71-1"},"fixed_version":"87.0.4280.88-0.1","urgency":"not yet assigned"},"trixie":{"status":"resolved","repositories":{"trixie":"143.0.7499.169-1~deb13u1","trixie-security":"145.0.7632.159-1~deb13u1"},"fixed_version":"87.0.4280.88-0.1","urgency":"not yet assigned"}}},"CVE-2020-16024":{"description":"Heap buffer overflow in UI in Google Chrome prior to 87.0.4280.66 allowed a remote attacker who had compromised the renderer process to potentially perform a sandbox escape via a crafted HTML page.","scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"143.0.7499.169-1~deb12u1","bookworm-security":"145.0.7632.159-1~deb12u1"},"fixed_version":"87.0.4280.88-0.1","urgency":"not yet assigned"},"bullseye":{"status":"resolved","repositories":{"bullseye":"120.0.6099.224-1~deb11u1","bullseye-security":"120.0.6099.224-1~deb11u1"},"fixed_version":"87.0.4280.88-0.1","urgency":"not yet assigned"},"forky":{"status":"resolved","repositories":{"forky":"145.0.7632.159-1"},"fixed_version":"87.0.4280.88-0.1","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"146.0.7680.71-1"},"fixed_version":"87.0.4280.88-0.1","urgency":"not yet assigned"},"trixie":{"status":"resolved","repositories":{"trixie":"143.0.7499.169-1~deb13u1","trixie-security":"145.0.7632.159-1~deb13u1"},"fixed_version":"87.0.4280.88-0.1","urgency":"not yet assigned"}}},"CVE-2020-16025":{"description":"Heap buffer overflow in clipboard in Google Chrome prior to 87.0.4280.66 allowed a remote attacker who had compromised the renderer process to potentially perform a sandbox escape via a crafted HTML page.","scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"143.0.7499.169-1~deb12u1","bookworm-security":"145.0.7632.159-1~deb12u1"},"fixed_version":"87.0.4280.88-0.1","urgency":"not yet assigned"},"bullseye":{"status":"resolved","repositories":{"bullseye":"120.0.6099.224-1~deb11u1","bullseye-security":"120.0.6099.224-1~deb11u1"},"fixed_version":"87.0.4280.88-0.1","urgency":"not yet assigned"},"forky":{"status":"resolved","repositories":{"forky":"145.0.7632.159-1"},"fixed_version":"87.0.4280.88-0.1","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"146.0.7680.71-1"},"fixed_version":"87.0.4280.88-0.1","urgency":"not yet assigned"},"trixie":{"status":"resolved","repositories":{"trixie":"143.0.7499.169-1~deb13u1","trixie-security":"145.0.7632.159-1~deb13u1"},"fixed_version":"87.0.4280.88-0.1","urgency":"not yet assigned"}}},"CVE-2020-16026":{"description":"Use after free in WebRTC in Google Chrome prior to 87.0.4280.66 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page.","scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"143.0.7499.169-1~deb12u1","bookworm-security":"145.0.7632.159-1~deb12u1"},"fixed_version":"87.0.4280.88-0.1","urgency":"not yet assigned"},"bullseye":{"status":"resolved","repositories":{"bullseye":"120.0.6099.224-1~deb11u1","bullseye-security":"120.0.6099.224-1~deb11u1"},"fixed_version":"87.0.4280.88-0.1","urgency":"not yet assigned"},"forky":{"status":"resolved","repositories":{"forky":"145.0.7632.159-1"},"fixed_version":"87.0.4280.88-0.1","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"146.0.7680.71-1"},"fixed_version":"87.0.4280.88-0.1","urgency":"not yet assigned"},"trixie":{"status":"resolved","repositories":{"trixie":"143.0.7499.169-1~deb13u1","trixie-security":"145.0.7632.159-1~deb13u1"},"fixed_version":"87.0.4280.88-0.1","urgency":"not yet assigned"}}},"CVE-2020-16027":{"description":"Insufficient policy enforcement in developer tools in Google Chrome prior to 87.0.4280.66 allowed an attacker who convinced a user to install a malicious extension to obtain potentially sensitive information from the user's disk via a crafted Chrome Extension.","scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"143.0.7499.169-1~deb12u1","bookworm-security":"145.0.7632.159-1~deb12u1"},"fixed_version":"87.0.4280.88-0.1","urgency":"not yet assigned"},"bullseye":{"status":"resolved","repositories":{"bullseye":"120.0.6099.224-1~deb11u1","bullseye-security":"120.0.6099.224-1~deb11u1"},"fixed_version":"87.0.4280.88-0.1","urgency":"not yet assigned"},"forky":{"status":"resolved","repositories":{"forky":"145.0.7632.159-1"},"fixed_version":"87.0.4280.88-0.1","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"146.0.7680.71-1"},"fixed_version":"87.0.4280.88-0.1","urgency":"not yet assigned"},"trixie":{"status":"resolved","repositories":{"trixie":"143.0.7499.169-1~deb13u1","trixie-security":"145.0.7632.159-1~deb13u1"},"fixed_version":"87.0.4280.88-0.1","urgency":"not yet assigned"}}},"CVE-2020-16028":{"description":"Heap buffer overflow in WebRTC in Google Chrome prior to 87.0.4280.66 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page.","scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"143.0.7499.169-1~deb12u1","bookworm-security":"145.0.7632.159-1~deb12u1"},"fixed_version":"87.0.4280.88-0.1","urgency":"not yet assigned"},"bullseye":{"status":"resolved","repositories":{"bullseye":"120.0.6099.224-1~deb11u1","bullseye-security":"120.0.6099.224-1~deb11u1"},"fixed_version":"87.0.4280.88-0.1","urgency":"not yet assigned"},"forky":{"status":"resolved","repositories":{"forky":"145.0.7632.159-1"},"fixed_version":"87.0.4280.88-0.1","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"146.0.7680.71-1"},"fixed_version":"87.0.4280.88-0.1","urgency":"not yet assigned"},"trixie":{"status":"resolved","repositories":{"trixie":"143.0.7499.169-1~deb13u1","trixie-security":"145.0.7632.159-1~deb13u1"},"fixed_version":"87.0.4280.88-0.1","urgency":"not yet assigned"}}},"CVE-2020-16029":{"description":"Inappropriate implementation in PDFium in Google Chrome prior to 87.0.4280.66 allowed a remote attacker to bypass navigation restrictions via a crafted PDF file.","scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"143.0.7499.169-1~deb12u1","bookworm-security":"145.0.7632.159-1~deb12u1"},"fixed_version":"87.0.4280.88-0.1","urgency":"not yet assigned"},"bullseye":{"status":"resolved","repositories":{"bullseye":"120.0.6099.224-1~deb11u1","bullseye-security":"120.0.6099.224-1~deb11u1"},"fixed_version":"87.0.4280.88-0.1","urgency":"not yet assigned"},"forky":{"status":"resolved","repositories":{"forky":"145.0.7632.159-1"},"fixed_version":"87.0.4280.88-0.1","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"146.0.7680.71-1"},"fixed_version":"87.0.4280.88-0.1","urgency":"not yet assigned"},"trixie":{"status":"resolved","repositories":{"trixie":"143.0.7499.169-1~deb13u1","trixie-security":"145.0.7632.159-1~deb13u1"},"fixed_version":"87.0.4280.88-0.1","urgency":"not yet assigned"}}},"CVE-2020-16030":{"description":"Insufficient data validation in Blink in Google Chrome prior to 87.0.4280.66 allowed a remote attacker to inject arbitrary scripts or HTML (UXSS) via a crafted HTML page.","scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"143.0.7499.169-1~deb12u1","bookworm-security":"145.0.7632.159-1~deb12u1"},"fixed_version":"87.0.4280.88-0.1","urgency":"not yet assigned"},"bullseye":{"status":"resolved","repositories":{"bullseye":"120.0.6099.224-1~deb11u1","bullseye-security":"120.0.6099.224-1~deb11u1"},"fixed_version":"87.0.4280.88-0.1","urgency":"not yet assigned"},"forky":{"status":"resolved","repositories":{"forky":"145.0.7632.159-1"},"fixed_version":"87.0.4280.88-0.1","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"146.0.7680.71-1"},"fixed_version":"87.0.4280.88-0.1","urgency":"not yet assigned"},"trixie":{"status":"resolved","repositories":{"trixie":"143.0.7499.169-1~deb13u1","trixie-security":"145.0.7632.159-1~deb13u1"},"fixed_version":"87.0.4280.88-0.1","urgency":"not yet assigned"}}},"CVE-2020-16031":{"description":"Insufficient data validation in UI in Google Chrome prior to 87.0.4280.66 allowed a remote attacker to spoof the contents of the Omnibox (URL bar) via a crafted HTML page.","scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"143.0.7499.169-1~deb12u1","bookworm-security":"145.0.7632.159-1~deb12u1"},"fixed_version":"87.0.4280.88-0.1","urgency":"not yet assigned"},"bullseye":{"status":"resolved","repositories":{"bullseye":"120.0.6099.224-1~deb11u1","bullseye-security":"120.0.6099.224-1~deb11u1"},"fixed_version":"87.0.4280.88-0.1","urgency":"not yet assigned"},"forky":{"status":"resolved","repositories":{"forky":"145.0.7632.159-1"},"fixed_version":"87.0.4280.88-0.1","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"146.0.7680.71-1"},"fixed_version":"87.0.4280.88-0.1","urgency":"not yet assigned"},"trixie":{"status":"resolved","repositories":{"trixie":"143.0.7499.169-1~deb13u1","trixie-security":"145.0.7632.159-1~deb13u1"},"fixed_version":"87.0.4280.88-0.1","urgency":"not yet assigned"}}},"CVE-2020-16032":{"description":"Insufficient data validation in sharing in Google Chrome prior to 87.0.4280.66 allowed a remote attacker to spoof the contents of the Omnibox (URL bar) via a crafted HTML page.","scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"143.0.7499.169-1~deb12u1","bookworm-security":"145.0.7632.159-1~deb12u1"},"fixed_version":"87.0.4280.88-0.1","urgency":"not yet assigned"},"bullseye":{"status":"resolved","repositories":{"bullseye":"120.0.6099.224-1~deb11u1","bullseye-security":"120.0.6099.224-1~deb11u1"},"fixed_version":"87.0.4280.88-0.1","urgency":"not yet assigned"},"forky":{"status":"resolved","repositories":{"forky":"145.0.7632.159-1"},"fixed_version":"87.0.4280.88-0.1","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"146.0.7680.71-1"},"fixed_version":"87.0.4280.88-0.1","urgency":"not yet assigned"},"trixie":{"status":"resolved","repositories":{"trixie":"143.0.7499.169-1~deb13u1","trixie-security":"145.0.7632.159-1~deb13u1"},"fixed_version":"87.0.4280.88-0.1","urgency":"not yet assigned"}}},"CVE-2020-16033":{"description":"Inappropriate implementation in WebUSB in Google Chrome prior to 87.0.4280.66 allowed a remote attacker to spoof security UI via a crafted HTML page.","scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"143.0.7499.169-1~deb12u1","bookworm-security":"145.0.7632.159-1~deb12u1"},"fixed_version":"87.0.4280.88-0.1","urgency":"not yet assigned"},"bullseye":{"status":"resolved","repositories":{"bullseye":"120.0.6099.224-1~deb11u1","bullseye-security":"120.0.6099.224-1~deb11u1"},"fixed_version":"87.0.4280.88-0.1","urgency":"not yet assigned"},"forky":{"status":"resolved","repositories":{"forky":"145.0.7632.159-1"},"fixed_version":"87.0.4280.88-0.1","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"146.0.7680.71-1"},"fixed_version":"87.0.4280.88-0.1","urgency":"not yet assigned"},"trixie":{"status":"resolved","repositories":{"trixie":"143.0.7499.169-1~deb13u1","trixie-security":"145.0.7632.159-1~deb13u1"},"fixed_version":"87.0.4280.88-0.1","urgency":"not yet assigned"}}},"CVE-2020-16034":{"description":"Inappropriate implementation in WebRTC in Google Chrome prior to 87.0.4280.66 allowed a local attacker to bypass policy restrictions via a crafted HTML page.","scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"143.0.7499.169-1~deb12u1","bookworm-security":"145.0.7632.159-1~deb12u1"},"fixed_version":"87.0.4280.88-0.1","urgency":"not yet assigned"},"bullseye":{"status":"resolved","repositories":{"bullseye":"120.0.6099.224-1~deb11u1","bullseye-security":"120.0.6099.224-1~deb11u1"},"fixed_version":"87.0.4280.88-0.1","urgency":"not yet assigned"},"forky":{"status":"resolved","repositories":{"forky":"145.0.7632.159-1"},"fixed_version":"87.0.4280.88-0.1","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"146.0.7680.71-1"},"fixed_version":"87.0.4280.88-0.1","urgency":"not yet assigned"},"trixie":{"status":"resolved","repositories":{"trixie":"143.0.7499.169-1~deb13u1","trixie-security":"145.0.7632.159-1~deb13u1"},"fixed_version":"87.0.4280.88-0.1","urgency":"not yet assigned"}}},"CVE-2020-16035":{"description":"Insufficient data validation in cros-disks in Google Chrome on ChromeOS prior to 87.0.4280.66 allowed a remote attacker who had compromised the browser process to bypass noexec restrictions via a malicious file.","scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"143.0.7499.169-1~deb12u1","bookworm-security":"145.0.7632.159-1~deb12u1"},"fixed_version":"87.0.4280.88-0.1","urgency":"not yet assigned"},"bullseye":{"status":"resolved","repositories":{"bullseye":"120.0.6099.224-1~deb11u1","bullseye-security":"120.0.6099.224-1~deb11u1"},"fixed_version":"87.0.4280.88-0.1","urgency":"not yet assigned"},"forky":{"status":"resolved","repositories":{"forky":"145.0.7632.159-1"},"fixed_version":"87.0.4280.88-0.1","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"146.0.7680.71-1"},"fixed_version":"87.0.4280.88-0.1","urgency":"not yet assigned"},"trixie":{"status":"resolved","repositories":{"trixie":"143.0.7499.169-1~deb13u1","trixie-security":"145.0.7632.159-1~deb13u1"},"fixed_version":"87.0.4280.88-0.1","urgency":"not yet assigned"}}},"CVE-2020-16036":{"description":"Inappropriate implementation in cookies in Google Chrome prior to 87.0.4280.66 allowed a remote attacker to bypass cookie restrictions via a crafted HTML page.","scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"143.0.7499.169-1~deb12u1","bookworm-security":"145.0.7632.159-1~deb12u1"},"fixed_version":"87.0.4280.88-0.1","urgency":"not yet assigned"},"bullseye":{"status":"resolved","repositories":{"bullseye":"120.0.6099.224-1~deb11u1","bullseye-security":"120.0.6099.224-1~deb11u1"},"fixed_version":"87.0.4280.88-0.1","urgency":"not yet assigned"},"forky":{"status":"resolved","repositories":{"forky":"145.0.7632.159-1"},"fixed_version":"87.0.4280.88-0.1","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"146.0.7680.71-1"},"fixed_version":"87.0.4280.88-0.1","urgency":"not yet assigned"},"trixie":{"status":"resolved","repositories":{"trixie":"143.0.7499.169-1~deb13u1","trixie-security":"145.0.7632.159-1~deb13u1"},"fixed_version":"87.0.4280.88-0.1","urgency":"not yet assigned"}}},"CVE-2020-16037":{"description":"Use after free in clipboard in Google Chrome prior to 87.0.4280.88 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page.","scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"143.0.7499.169-1~deb12u1","bookworm-security":"145.0.7632.159-1~deb12u1"},"fixed_version":"87.0.4280.88-0.1","urgency":"not yet assigned"},"bullseye":{"status":"resolved","repositories":{"bullseye":"120.0.6099.224-1~deb11u1","bullseye-security":"120.0.6099.224-1~deb11u1"},"fixed_version":"87.0.4280.88-0.1","urgency":"not yet assigned"},"forky":{"status":"resolved","repositories":{"forky":"145.0.7632.159-1"},"fixed_version":"87.0.4280.88-0.1","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"146.0.7680.71-1"},"fixed_version":"87.0.4280.88-0.1","urgency":"not yet assigned"},"trixie":{"status":"resolved","repositories":{"trixie":"143.0.7499.169-1~deb13u1","trixie-security":"145.0.7632.159-1~deb13u1"},"fixed_version":"87.0.4280.88-0.1","urgency":"not yet assigned"}}},"CVE-2020-16038":{"description":"Use after free in media in Google Chrome on OS X prior to 87.0.4280.88 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page.","scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"143.0.7499.169-1~deb12u1","bookworm-security":"145.0.7632.159-1~deb12u1"},"fixed_version":"87.0.4280.88-0.1","urgency":"not yet assigned"},"bullseye":{"status":"resolved","repositories":{"bullseye":"120.0.6099.224-1~deb11u1","bullseye-security":"120.0.6099.224-1~deb11u1"},"fixed_version":"87.0.4280.88-0.1","urgency":"not yet assigned"},"forky":{"status":"resolved","repositories":{"forky":"145.0.7632.159-1"},"fixed_version":"87.0.4280.88-0.1","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"146.0.7680.71-1"},"fixed_version":"87.0.4280.88-0.1","urgency":"not yet assigned"},"trixie":{"status":"resolved","repositories":{"trixie":"143.0.7499.169-1~deb13u1","trixie-security":"145.0.7632.159-1~deb13u1"},"fixed_version":"87.0.4280.88-0.1","urgency":"not yet assigned"}}},"CVE-2020-16039":{"description":"Use after free in extensions in Google Chrome prior to 87.0.4280.88 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page.","scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"143.0.7499.169-1~deb12u1","bookworm-security":"145.0.7632.159-1~deb12u1"},"fixed_version":"87.0.4280.88-0.1","urgency":"not yet assigned"},"bullseye":{"status":"resolved","repositories":{"bullseye":"120.0.6099.224-1~deb11u1","bullseye-security":"120.0.6099.224-1~deb11u1"},"fixed_version":"87.0.4280.88-0.1","urgency":"not yet assigned"},"forky":{"status":"resolved","repositories":{"forky":"145.0.7632.159-1"},"fixed_version":"87.0.4280.88-0.1","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"146.0.7680.71-1"},"fixed_version":"87.0.4280.88-0.1","urgency":"not yet assigned"},"trixie":{"status":"resolved","repositories":{"trixie":"143.0.7499.169-1~deb13u1","trixie-security":"145.0.7632.159-1~deb13u1"},"fixed_version":"87.0.4280.88-0.1","urgency":"not yet assigned"}}},"CVE-2020-16040":{"description":"Insufficient data validation in V8 in Google Chrome prior to 87.0.4280.88 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page.","scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"143.0.7499.169-1~deb12u1","bookworm-security":"145.0.7632.159-1~deb12u1"},"fixed_version":"87.0.4280.88-0.1","urgency":"not yet assigned"},"bullseye":{"status":"resolved","repositories":{"bullseye":"120.0.6099.224-1~deb11u1","bullseye-security":"120.0.6099.224-1~deb11u1"},"fixed_version":"87.0.4280.88-0.1","urgency":"not yet assigned"},"forky":{"status":"resolved","repositories":{"forky":"145.0.7632.159-1"},"fixed_version":"87.0.4280.88-0.1","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"146.0.7680.71-1"},"fixed_version":"87.0.4280.88-0.1","urgency":"not yet assigned"},"trixie":{"status":"resolved","repositories":{"trixie":"143.0.7499.169-1~deb13u1","trixie-security":"145.0.7632.159-1~deb13u1"},"fixed_version":"87.0.4280.88-0.1","urgency":"not yet assigned"}}},"CVE-2020-16041":{"description":"Out of bounds read in networking in Google Chrome prior to 87.0.4280.88 allowed a remote attacker who had compromised the renderer process to obtain potentially sensitive information from process memory via a crafted HTML page.","scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"143.0.7499.169-1~deb12u1","bookworm-security":"145.0.7632.159-1~deb12u1"},"fixed_version":"87.0.4280.88-0.1","urgency":"not yet assigned"},"bullseye":{"status":"resolved","repositories":{"bullseye":"120.0.6099.224-1~deb11u1","bullseye-security":"120.0.6099.224-1~deb11u1"},"fixed_version":"87.0.4280.88-0.1","urgency":"not yet assigned"},"forky":{"status":"resolved","repositories":{"forky":"145.0.7632.159-1"},"fixed_version":"87.0.4280.88-0.1","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"146.0.7680.71-1"},"fixed_version":"87.0.4280.88-0.1","urgency":"not yet assigned"},"trixie":{"status":"resolved","repositories":{"trixie":"143.0.7499.169-1~deb13u1","trixie-security":"145.0.7632.159-1~deb13u1"},"fixed_version":"87.0.4280.88-0.1","urgency":"not yet assigned"}}},"CVE-2020-16042":{"description":"Uninitialized Use in V8 in Google Chrome prior to 87.0.4280.88 allowed a remote attacker to obtain potentially sensitive information from process memory via a crafted HTML page.","scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"143.0.7499.169-1~deb12u1","bookworm-security":"145.0.7632.159-1~deb12u1"},"fixed_version":"87.0.4280.88-0.1","urgency":"not yet assigned"},"bullseye":{"status":"resolved","repositories":{"bullseye":"120.0.6099.224-1~deb11u1","bullseye-security":"120.0.6099.224-1~deb11u1"},"fixed_version":"87.0.4280.88-0.1","urgency":"not yet assigned"},"forky":{"status":"resolved","repositories":{"forky":"145.0.7632.159-1"},"fixed_version":"87.0.4280.88-0.1","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"146.0.7680.71-1"},"fixed_version":"87.0.4280.88-0.1","urgency":"not yet assigned"},"trixie":{"status":"resolved","repositories":{"trixie":"143.0.7499.169-1~deb13u1","trixie-security":"145.0.7632.159-1~deb13u1"},"fixed_version":"87.0.4280.88-0.1","urgency":"not yet assigned"}}},"CVE-2020-16043":{"description":"Insufficient data validation in networking in Google Chrome prior to 87.0.4280.141 allowed a remote attacker to bypass discretionary access control via malicious network traffic.","debianbug":979533,"scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"143.0.7499.169-1~deb12u1","bookworm-security":"145.0.7632.159-1~deb12u1"},"fixed_version":"87.0.4280.141-0.1","urgency":"not yet assigned"},"bullseye":{"status":"resolved","repositories":{"bullseye":"120.0.6099.224-1~deb11u1","bullseye-security":"120.0.6099.224-1~deb11u1"},"fixed_version":"87.0.4280.141-0.1","urgency":"not yet assigned"},"forky":{"status":"resolved","repositories":{"forky":"145.0.7632.159-1"},"fixed_version":"87.0.4280.141-0.1","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"146.0.7680.71-1"},"fixed_version":"87.0.4280.141-0.1","urgency":"not yet assigned"},"trixie":{"status":"resolved","repositories":{"trixie":"143.0.7499.169-1~deb13u1","trixie-security":"145.0.7632.159-1~deb13u1"},"fixed_version":"87.0.4280.141-0.1","urgency":"not yet assigned"}}},"CVE-2020-16045":{"description":"Use after Free in Payments in Google Chrome on Android prior to 87.0.4280.66 allowed a remote attacker who had compromised the renderer process to potentially perform a sandbox escape via a crafted HTML page.","scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"143.0.7499.169-1~deb12u1","bookworm-security":"145.0.7632.159-1~deb12u1"},"fixed_version":"0","urgency":"unimportant"},"bullseye":{"status":"resolved","repositories":{"bullseye":"120.0.6099.224-1~deb11u1","bullseye-security":"120.0.6099.224-1~deb11u1"},"fixed_version":"0","urgency":"unimportant"},"forky":{"status":"resolved","repositories":{"forky":"145.0.7632.159-1"},"fixed_version":"0","urgency":"unimportant"},"sid":{"status":"resolved","repositories":{"sid":"146.0.7680.71-1"},"fixed_version":"0","urgency":"unimportant"},"trixie":{"status":"resolved","repositories":{"trixie":"143.0.7499.169-1~deb13u1","trixie-security":"145.0.7632.159-1~deb13u1"},"fixed_version":"0","urgency":"unimportant"}}},"CVE-2020-16046":{"description":"Script injection in iOSWeb in Google Chrome on iOS prior to 84.0.4147.105 allowed a remote attacker to execute arbitrary code via a crafted HTML page.","scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"143.0.7499.169-1~deb12u1","bookworm-security":"145.0.7632.159-1~deb12u1"},"fixed_version":"0","urgency":"unimportant"},"bullseye":{"status":"resolved","repositories":{"bullseye":"120.0.6099.224-1~deb11u1","bullseye-security":"120.0.6099.224-1~deb11u1"},"fixed_version":"0","urgency":"unimportant"},"forky":{"status":"resolved","repositories":{"forky":"145.0.7632.159-1"},"fixed_version":"0","urgency":"unimportant"},"sid":{"status":"resolved","repositories":{"sid":"146.0.7680.71-1"},"fixed_version":"0","urgency":"unimportant"},"trixie":{"status":"resolved","repositories":{"trixie":"143.0.7499.169-1~deb13u1","trixie-security":"145.0.7632.159-1~deb13u1"},"fixed_version":"0","urgency":"unimportant"}}},"CVE-2020-36765":{"description":"Insufficient policy enforcement in Navigation in Google Chrome prior to 85.0.4183.83 allowed a remote attacker to leak cross-origin data via a crafted HTML page. (Chromium security severity: Medium)","scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"143.0.7499.169-1~deb12u1","bookworm-security":"145.0.7632.159-1~deb12u1"},"fixed_version":"87.0.4280.88-0.1","urgency":"not yet assigned"},"bullseye":{"status":"resolved","repositories":{"bullseye":"120.0.6099.224-1~deb11u1","bullseye-security":"120.0.6099.224-1~deb11u1"},"fixed_version":"87.0.4280.88-0.1","urgency":"not yet assigned"},"forky":{"status":"resolved","repositories":{"forky":"145.0.7632.159-1"},"fixed_version":"87.0.4280.88-0.1","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"146.0.7680.71-1"},"fixed_version":"87.0.4280.88-0.1","urgency":"not yet assigned"},"trixie":{"status":"resolved","repositories":{"trixie":"143.0.7499.169-1~deb13u1","trixie-security":"145.0.7632.159-1~deb13u1"},"fixed_version":"87.0.4280.88-0.1","urgency":"not yet assigned"}}},"CVE-2020-6377":{"description":"Use after free in audio in Google Chrome prior to 79.0.3945.117 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page.","scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"143.0.7499.169-1~deb12u1","bookworm-security":"145.0.7632.159-1~deb12u1"},"fixed_version":"79.0.3945.130-1","urgency":"not yet assigned"},"bullseye":{"status":"resolved","repositories":{"bullseye":"120.0.6099.224-1~deb11u1","bullseye-security":"120.0.6099.224-1~deb11u1"},"fixed_version":"79.0.3945.130-1","urgency":"not yet assigned"},"forky":{"status":"resolved","repositories":{"forky":"145.0.7632.159-1"},"fixed_version":"79.0.3945.130-1","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"146.0.7680.71-1"},"fixed_version":"79.0.3945.130-1","urgency":"not yet assigned"},"trixie":{"status":"resolved","repositories":{"trixie":"143.0.7499.169-1~deb13u1","trixie-security":"145.0.7632.159-1~deb13u1"},"fixed_version":"79.0.3945.130-1","urgency":"not yet assigned"}}},"CVE-2020-6378":{"description":"Use after free in speech in Google Chrome prior to 79.0.3945.130 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page.","scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"143.0.7499.169-1~deb12u1","bookworm-security":"145.0.7632.159-1~deb12u1"},"fixed_version":"79.0.3945.130-1","urgency":"not yet assigned"},"bullseye":{"status":"resolved","repositories":{"bullseye":"120.0.6099.224-1~deb11u1","bullseye-security":"120.0.6099.224-1~deb11u1"},"fixed_version":"79.0.3945.130-1","urgency":"not yet assigned"},"forky":{"status":"resolved","repositories":{"forky":"145.0.7632.159-1"},"fixed_version":"79.0.3945.130-1","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"146.0.7680.71-1"},"fixed_version":"79.0.3945.130-1","urgency":"not yet assigned"},"trixie":{"status":"resolved","repositories":{"trixie":"143.0.7499.169-1~deb13u1","trixie-security":"145.0.7632.159-1~deb13u1"},"fixed_version":"79.0.3945.130-1","urgency":"not yet assigned"}}},"CVE-2020-6379":{"description":"Use after free in V8 in Google Chrome prior to 79.0.3945.130 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page.","scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"143.0.7499.169-1~deb12u1","bookworm-security":"145.0.7632.159-1~deb12u1"},"fixed_version":"79.0.3945.130-1","urgency":"not yet assigned"},"bullseye":{"status":"resolved","repositories":{"bullseye":"120.0.6099.224-1~deb11u1","bullseye-security":"120.0.6099.224-1~deb11u1"},"fixed_version":"79.0.3945.130-1","urgency":"not yet assigned"},"forky":{"status":"resolved","repositories":{"forky":"145.0.7632.159-1"},"fixed_version":"79.0.3945.130-1","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"146.0.7680.71-1"},"fixed_version":"79.0.3945.130-1","urgency":"not yet assigned"},"trixie":{"status":"resolved","repositories":{"trixie":"143.0.7499.169-1~deb13u1","trixie-security":"145.0.7632.159-1~deb13u1"},"fixed_version":"79.0.3945.130-1","urgency":"not yet assigned"}}},"CVE-2020-6380":{"description":"Insufficient policy enforcement in extensions in Google Chrome prior to 79.0.3945.130 allowed a remote attacker who had compromised the renderer process to bypass site isolation via a crafted Chrome Extension.","scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"143.0.7499.169-1~deb12u1","bookworm-security":"145.0.7632.159-1~deb12u1"},"fixed_version":"79.0.3945.130-1","urgency":"not yet assigned"},"bullseye":{"status":"resolved","repositories":{"bullseye":"120.0.6099.224-1~deb11u1","bullseye-security":"120.0.6099.224-1~deb11u1"},"fixed_version":"79.0.3945.130-1","urgency":"not yet assigned"},"forky":{"status":"resolved","repositories":{"forky":"145.0.7632.159-1"},"fixed_version":"79.0.3945.130-1","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"146.0.7680.71-1"},"fixed_version":"79.0.3945.130-1","urgency":"not yet assigned"},"trixie":{"status":"resolved","repositories":{"trixie":"143.0.7499.169-1~deb13u1","trixie-security":"145.0.7632.159-1~deb13u1"},"fixed_version":"79.0.3945.130-1","urgency":"not yet assigned"}}},"CVE-2020-6381":{"description":"Integer overflow in JavaScript in Google Chrome on ChromeOS and Android prior to 80.0.3987.87 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page.","scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"143.0.7499.169-1~deb12u1","bookworm-security":"145.0.7632.159-1~deb12u1"},"fixed_version":"80.0.3987.106-1","urgency":"not yet assigned"},"bullseye":{"status":"resolved","repositories":{"bullseye":"120.0.6099.224-1~deb11u1","bullseye-security":"120.0.6099.224-1~deb11u1"},"fixed_version":"80.0.3987.106-1","urgency":"not yet assigned"},"forky":{"status":"resolved","repositories":{"forky":"145.0.7632.159-1"},"fixed_version":"80.0.3987.106-1","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"146.0.7680.71-1"},"fixed_version":"80.0.3987.106-1","urgency":"not yet assigned"},"trixie":{"status":"resolved","repositories":{"trixie":"143.0.7499.169-1~deb13u1","trixie-security":"145.0.7632.159-1~deb13u1"},"fixed_version":"80.0.3987.106-1","urgency":"not yet assigned"}}},"CVE-2020-6382":{"description":"Type confusion in JavaScript in Google Chrome prior to 80.0.3987.87 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page.","scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"143.0.7499.169-1~deb12u1","bookworm-security":"145.0.7632.159-1~deb12u1"},"fixed_version":"80.0.3987.106-1","urgency":"not yet assigned"},"bullseye":{"status":"resolved","repositories":{"bullseye":"120.0.6099.224-1~deb11u1","bullseye-security":"120.0.6099.224-1~deb11u1"},"fixed_version":"80.0.3987.106-1","urgency":"not yet assigned"},"forky":{"status":"resolved","repositories":{"forky":"145.0.7632.159-1"},"fixed_version":"80.0.3987.106-1","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"146.0.7680.71-1"},"fixed_version":"80.0.3987.106-1","urgency":"not yet assigned"},"trixie":{"status":"resolved","repositories":{"trixie":"143.0.7499.169-1~deb13u1","trixie-security":"145.0.7632.159-1~deb13u1"},"fixed_version":"80.0.3987.106-1","urgency":"not yet assigned"}}},"CVE-2020-6383":{"description":"Type confusion in V8 in Google Chrome prior to 80.0.3987.116 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page.","scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"143.0.7499.169-1~deb12u1","bookworm-security":"145.0.7632.159-1~deb12u1"},"fixed_version":"80.0.3987.116-1","urgency":"not yet assigned"},"bullseye":{"status":"resolved","repositories":{"bullseye":"120.0.6099.224-1~deb11u1","bullseye-security":"120.0.6099.224-1~deb11u1"},"fixed_version":"80.0.3987.116-1","urgency":"not yet assigned"},"forky":{"status":"resolved","repositories":{"forky":"145.0.7632.159-1"},"fixed_version":"80.0.3987.116-1","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"146.0.7680.71-1"},"fixed_version":"80.0.3987.116-1","urgency":"not yet assigned"},"trixie":{"status":"resolved","repositories":{"trixie":"143.0.7499.169-1~deb13u1","trixie-security":"145.0.7632.159-1~deb13u1"},"fixed_version":"80.0.3987.116-1","urgency":"not yet assigned"}}},"CVE-2020-6384":{"description":"Use after free in WebAudio in Google Chrome prior to 80.0.3987.116 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page.","scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"143.0.7499.169-1~deb12u1","bookworm-security":"145.0.7632.159-1~deb12u1"},"fixed_version":"80.0.3987.116-1","urgency":"not yet assigned"},"bullseye":{"status":"resolved","repositories":{"bullseye":"120.0.6099.224-1~deb11u1","bullseye-security":"120.0.6099.224-1~deb11u1"},"fixed_version":"80.0.3987.116-1","urgency":"not yet assigned"},"forky":{"status":"resolved","repositories":{"forky":"145.0.7632.159-1"},"fixed_version":"80.0.3987.116-1","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"146.0.7680.71-1"},"fixed_version":"80.0.3987.116-1","urgency":"not yet assigned"},"trixie":{"status":"resolved","repositories":{"trixie":"143.0.7499.169-1~deb13u1","trixie-security":"145.0.7632.159-1~deb13u1"},"fixed_version":"80.0.3987.116-1","urgency":"not yet assigned"}}},"CVE-2020-6385":{"description":"Insufficient policy enforcement in storage in Google Chrome prior to 80.0.3987.87 allowed a remote attacker to bypass site isolation via a crafted HTML page.","scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"143.0.7499.169-1~deb12u1","bookworm-security":"145.0.7632.159-1~deb12u1"},"fixed_version":"80.0.3987.106-1","urgency":"not yet assigned"},"bullseye":{"status":"resolved","repositories":{"bullseye":"120.0.6099.224-1~deb11u1","bullseye-security":"120.0.6099.224-1~deb11u1"},"fixed_version":"80.0.3987.106-1","urgency":"not yet assigned"},"forky":{"status":"resolved","repositories":{"forky":"145.0.7632.159-1"},"fixed_version":"80.0.3987.106-1","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"146.0.7680.71-1"},"fixed_version":"80.0.3987.106-1","urgency":"not yet assigned"},"trixie":{"status":"resolved","repositories":{"trixie":"143.0.7499.169-1~deb13u1","trixie-security":"145.0.7632.159-1~deb13u1"},"fixed_version":"80.0.3987.106-1","urgency":"not yet assigned"}}},"CVE-2020-6386":{"description":"Use after free in speech in Google Chrome prior to 80.0.3987.116 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page.","scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"143.0.7499.169-1~deb12u1","bookworm-security":"145.0.7632.159-1~deb12u1"},"fixed_version":"80.0.3987.116-1","urgency":"not yet assigned"},"bullseye":{"status":"resolved","repositories":{"bullseye":"120.0.6099.224-1~deb11u1","bullseye-security":"120.0.6099.224-1~deb11u1"},"fixed_version":"80.0.3987.116-1","urgency":"not yet assigned"},"forky":{"status":"resolved","repositories":{"forky":"145.0.7632.159-1"},"fixed_version":"80.0.3987.116-1","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"146.0.7680.71-1"},"fixed_version":"80.0.3987.116-1","urgency":"not yet assigned"},"trixie":{"status":"resolved","repositories":{"trixie":"143.0.7499.169-1~deb13u1","trixie-security":"145.0.7632.159-1~deb13u1"},"fixed_version":"80.0.3987.116-1","urgency":"not yet assigned"}}},"CVE-2020-6387":{"description":"Out of bounds write in WebRTC in Google Chrome prior to 80.0.3987.87 allowed a remote attacker to potentially exploit heap corruption via a crafted video stream.","scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"143.0.7499.169-1~deb12u1","bookworm-security":"145.0.7632.159-1~deb12u1"},"fixed_version":"80.0.3987.106-1","urgency":"not yet assigned"},"bullseye":{"status":"resolved","repositories":{"bullseye":"120.0.6099.224-1~deb11u1","bullseye-security":"120.0.6099.224-1~deb11u1"},"fixed_version":"80.0.3987.106-1","urgency":"not yet assigned"},"forky":{"status":"resolved","repositories":{"forky":"145.0.7632.159-1"},"fixed_version":"80.0.3987.106-1","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"146.0.7680.71-1"},"fixed_version":"80.0.3987.106-1","urgency":"not yet assigned"},"trixie":{"status":"resolved","repositories":{"trixie":"143.0.7499.169-1~deb13u1","trixie-security":"145.0.7632.159-1~deb13u1"},"fixed_version":"80.0.3987.106-1","urgency":"not yet assigned"}}},"CVE-2020-6388":{"description":"Out of bounds access in WebAudio in Google Chrome prior to 80.0.3987.87 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page.","scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"143.0.7499.169-1~deb12u1","bookworm-security":"145.0.7632.159-1~deb12u1"},"fixed_version":"80.0.3987.106-1","urgency":"not yet assigned"},"bullseye":{"status":"resolved","repositories":{"bullseye":"120.0.6099.224-1~deb11u1","bullseye-security":"120.0.6099.224-1~deb11u1"},"fixed_version":"80.0.3987.106-1","urgency":"not yet assigned"},"forky":{"status":"resolved","repositories":{"forky":"145.0.7632.159-1"},"fixed_version":"80.0.3987.106-1","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"146.0.7680.71-1"},"fixed_version":"80.0.3987.106-1","urgency":"not yet assigned"},"trixie":{"status":"resolved","repositories":{"trixie":"143.0.7499.169-1~deb13u1","trixie-security":"145.0.7632.159-1~deb13u1"},"fixed_version":"80.0.3987.106-1","urgency":"not yet assigned"}}},"CVE-2020-6389":{"description":"Out of bounds write in WebRTC in Google Chrome prior to 80.0.3987.87 allowed a remote attacker to potentially exploit heap corruption via a crafted video stream.","scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"143.0.7499.169-1~deb12u1","bookworm-security":"145.0.7632.159-1~deb12u1"},"fixed_version":"80.0.3987.106-1","urgency":"not yet assigned"},"bullseye":{"status":"resolved","repositories":{"bullseye":"120.0.6099.224-1~deb11u1","bullseye-security":"120.0.6099.224-1~deb11u1"},"fixed_version":"80.0.3987.106-1","urgency":"not yet assigned"},"forky":{"status":"resolved","repositories":{"forky":"145.0.7632.159-1"},"fixed_version":"80.0.3987.106-1","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"146.0.7680.71-1"},"fixed_version":"80.0.3987.106-1","urgency":"not yet assigned"},"trixie":{"status":"resolved","repositories":{"trixie":"143.0.7499.169-1~deb13u1","trixie-security":"145.0.7632.159-1~deb13u1"},"fixed_version":"80.0.3987.106-1","urgency":"not yet assigned"}}},"CVE-2020-6390":{"description":"Out of bounds memory access in streams in Google Chrome prior to 80.0.3987.87 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page.","scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"143.0.7499.169-1~deb12u1","bookworm-security":"145.0.7632.159-1~deb12u1"},"fixed_version":"80.0.3987.106-1","urgency":"not yet assigned"},"bullseye":{"status":"resolved","repositories":{"bullseye":"120.0.6099.224-1~deb11u1","bullseye-security":"120.0.6099.224-1~deb11u1"},"fixed_version":"80.0.3987.106-1","urgency":"not yet assigned"},"forky":{"status":"resolved","repositories":{"forky":"145.0.7632.159-1"},"fixed_version":"80.0.3987.106-1","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"146.0.7680.71-1"},"fixed_version":"80.0.3987.106-1","urgency":"not yet assigned"},"trixie":{"status":"resolved","repositories":{"trixie":"143.0.7499.169-1~deb13u1","trixie-security":"145.0.7632.159-1~deb13u1"},"fixed_version":"80.0.3987.106-1","urgency":"not yet assigned"}}},"CVE-2020-6391":{"description":"Insufficient validation of untrusted input in Blink in Google Chrome prior to 80.0.3987.87 allowed a local attacker to bypass content security policy via a crafted HTML page.","scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"143.0.7499.169-1~deb12u1","bookworm-security":"145.0.7632.159-1~deb12u1"},"fixed_version":"80.0.3987.106-1","urgency":"not yet assigned"},"bullseye":{"status":"resolved","repositories":{"bullseye":"120.0.6099.224-1~deb11u1","bullseye-security":"120.0.6099.224-1~deb11u1"},"fixed_version":"80.0.3987.106-1","urgency":"not yet assigned"},"forky":{"status":"resolved","repositories":{"forky":"145.0.7632.159-1"},"fixed_version":"80.0.3987.106-1","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"146.0.7680.71-1"},"fixed_version":"80.0.3987.106-1","urgency":"not yet assigned"},"trixie":{"status":"resolved","repositories":{"trixie":"143.0.7499.169-1~deb13u1","trixie-security":"145.0.7632.159-1~deb13u1"},"fixed_version":"80.0.3987.106-1","urgency":"not yet assigned"}}},"CVE-2020-6392":{"description":"Insufficient policy enforcement in extensions in Google Chrome prior to 80.0.3987.87 allowed an attacker who convinced a user to install a malicious extension to bypass navigation restrictions via a crafted Chrome Extension.","scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"143.0.7499.169-1~deb12u1","bookworm-security":"145.0.7632.159-1~deb12u1"},"fixed_version":"80.0.3987.106-1","urgency":"not yet assigned"},"bullseye":{"status":"resolved","repositories":{"bullseye":"120.0.6099.224-1~deb11u1","bullseye-security":"120.0.6099.224-1~deb11u1"},"fixed_version":"80.0.3987.106-1","urgency":"not yet assigned"},"forky":{"status":"resolved","repositories":{"forky":"145.0.7632.159-1"},"fixed_version":"80.0.3987.106-1","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"146.0.7680.71-1"},"fixed_version":"80.0.3987.106-1","urgency":"not yet assigned"},"trixie":{"status":"resolved","repositories":{"trixie":"143.0.7499.169-1~deb13u1","trixie-security":"145.0.7632.159-1~deb13u1"},"fixed_version":"80.0.3987.106-1","urgency":"not yet assigned"}}},"CVE-2020-6393":{"description":"Insufficient policy enforcement in Blink in Google Chrome prior to 80.0.3987.87 allowed a remote attacker to leak cross-origin data via a crafted HTML page.","scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"143.0.7499.169-1~deb12u1","bookworm-security":"145.0.7632.159-1~deb12u1"},"fixed_version":"80.0.3987.106-1","urgency":"not yet assigned"},"bullseye":{"status":"resolved","repositories":{"bullseye":"120.0.6099.224-1~deb11u1","bullseye-security":"120.0.6099.224-1~deb11u1"},"fixed_version":"80.0.3987.106-1","urgency":"not yet assigned"},"forky":{"status":"resolved","repositories":{"forky":"145.0.7632.159-1"},"fixed_version":"80.0.3987.106-1","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"146.0.7680.71-1"},"fixed_version":"80.0.3987.106-1","urgency":"not yet assigned"},"trixie":{"status":"resolved","repositories":{"trixie":"143.0.7499.169-1~deb13u1","trixie-security":"145.0.7632.159-1~deb13u1"},"fixed_version":"80.0.3987.106-1","urgency":"not yet assigned"}}},"CVE-2020-6394":{"description":"Insufficient policy enforcement in Blink in Google Chrome prior to 80.0.3987.87 allowed a remote attacker to bypass content security policy via a crafted HTML page.","scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"143.0.7499.169-1~deb12u1","bookworm-security":"145.0.7632.159-1~deb12u1"},"fixed_version":"80.0.3987.106-1","urgency":"not yet assigned"},"bullseye":{"status":"resolved","repositories":{"bullseye":"120.0.6099.224-1~deb11u1","bullseye-security":"120.0.6099.224-1~deb11u1"},"fixed_version":"80.0.3987.106-1","urgency":"not yet assigned"},"forky":{"status":"resolved","repositories":{"forky":"145.0.7632.159-1"},"fixed_version":"80.0.3987.106-1","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"146.0.7680.71-1"},"fixed_version":"80.0.3987.106-1","urgency":"not yet assigned"},"trixie":{"status":"resolved","repositories":{"trixie":"143.0.7499.169-1~deb13u1","trixie-security":"145.0.7632.159-1~deb13u1"},"fixed_version":"80.0.3987.106-1","urgency":"not yet assigned"}}},"CVE-2020-6395":{"description":"Out of bounds read in JavaScript in Google Chrome prior to 80.0.3987.87 allowed a remote attacker to obtain potentially sensitive information from process memory via a crafted HTML page.","scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"143.0.7499.169-1~deb12u1","bookworm-security":"145.0.7632.159-1~deb12u1"},"fixed_version":"80.0.3987.106-1","urgency":"not yet assigned"},"bullseye":{"status":"resolved","repositories":{"bullseye":"120.0.6099.224-1~deb11u1","bullseye-security":"120.0.6099.224-1~deb11u1"},"fixed_version":"80.0.3987.106-1","urgency":"not yet assigned"},"forky":{"status":"resolved","repositories":{"forky":"145.0.7632.159-1"},"fixed_version":"80.0.3987.106-1","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"146.0.7680.71-1"},"fixed_version":"80.0.3987.106-1","urgency":"not yet assigned"},"trixie":{"status":"resolved","repositories":{"trixie":"143.0.7499.169-1~deb13u1","trixie-security":"145.0.7632.159-1~deb13u1"},"fixed_version":"80.0.3987.106-1","urgency":"not yet assigned"}}},"CVE-2020-6396":{"description":"Inappropriate implementation in Skia in Google Chrome prior to 80.0.3987.87 allowed a remote attacker to spoof the contents of the Omnibox (URL bar) via a crafted HTML page.","scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"143.0.7499.169-1~deb12u1","bookworm-security":"145.0.7632.159-1~deb12u1"},"fixed_version":"80.0.3987.106-1","urgency":"not yet assigned"},"bullseye":{"status":"resolved","repositories":{"bullseye":"120.0.6099.224-1~deb11u1","bullseye-security":"120.0.6099.224-1~deb11u1"},"fixed_version":"80.0.3987.106-1","urgency":"not yet assigned"},"forky":{"status":"resolved","repositories":{"forky":"145.0.7632.159-1"},"fixed_version":"80.0.3987.106-1","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"146.0.7680.71-1"},"fixed_version":"80.0.3987.106-1","urgency":"not yet assigned"},"trixie":{"status":"resolved","repositories":{"trixie":"143.0.7499.169-1~deb13u1","trixie-security":"145.0.7632.159-1~deb13u1"},"fixed_version":"80.0.3987.106-1","urgency":"not yet assigned"}}},"CVE-2020-6397":{"description":"Inappropriate implementation in sharing in Google Chrome prior to 80.0.3987.87 allowed a remote attacker to spoof security UI via a crafted HTML page.","scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"143.0.7499.169-1~deb12u1","bookworm-security":"145.0.7632.159-1~deb12u1"},"fixed_version":"80.0.3987.106-1","urgency":"not yet assigned"},"bullseye":{"status":"resolved","repositories":{"bullseye":"120.0.6099.224-1~deb11u1","bullseye-security":"120.0.6099.224-1~deb11u1"},"fixed_version":"80.0.3987.106-1","urgency":"not yet assigned"},"forky":{"status":"resolved","repositories":{"forky":"145.0.7632.159-1"},"fixed_version":"80.0.3987.106-1","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"146.0.7680.71-1"},"fixed_version":"80.0.3987.106-1","urgency":"not yet assigned"},"trixie":{"status":"resolved","repositories":{"trixie":"143.0.7499.169-1~deb13u1","trixie-security":"145.0.7632.159-1~deb13u1"},"fixed_version":"80.0.3987.106-1","urgency":"not yet assigned"}}},"CVE-2020-6398":{"description":"Use of uninitialized data in PDFium in Google Chrome prior to 80.0.3987.87 allowed a remote attacker to potentially exploit heap corruption via a crafted PDF file.","scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"143.0.7499.169-1~deb12u1","bookworm-security":"145.0.7632.159-1~deb12u1"},"fixed_version":"80.0.3987.106-1","urgency":"not yet assigned"},"bullseye":{"status":"resolved","repositories":{"bullseye":"120.0.6099.224-1~deb11u1","bullseye-security":"120.0.6099.224-1~deb11u1"},"fixed_version":"80.0.3987.106-1","urgency":"not yet assigned"},"forky":{"status":"resolved","repositories":{"forky":"145.0.7632.159-1"},"fixed_version":"80.0.3987.106-1","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"146.0.7680.71-1"},"fixed_version":"80.0.3987.106-1","urgency":"not yet assigned"},"trixie":{"status":"resolved","repositories":{"trixie":"143.0.7499.169-1~deb13u1","trixie-security":"145.0.7632.159-1~deb13u1"},"fixed_version":"80.0.3987.106-1","urgency":"not yet assigned"}}},"CVE-2020-6399":{"description":"Insufficient policy enforcement in AppCache in Google Chrome prior to 80.0.3987.87 allowed a remote attacker to leak cross-origin data via a crafted HTML page.","scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"143.0.7499.169-1~deb12u1","bookworm-security":"145.0.7632.159-1~deb12u1"},"fixed_version":"80.0.3987.106-1","urgency":"not yet assigned"},"bullseye":{"status":"resolved","repositories":{"bullseye":"120.0.6099.224-1~deb11u1","bullseye-security":"120.0.6099.224-1~deb11u1"},"fixed_version":"80.0.3987.106-1","urgency":"not yet assigned"},"forky":{"status":"resolved","repositories":{"forky":"145.0.7632.159-1"},"fixed_version":"80.0.3987.106-1","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"146.0.7680.71-1"},"fixed_version":"80.0.3987.106-1","urgency":"not yet assigned"},"trixie":{"status":"resolved","repositories":{"trixie":"143.0.7499.169-1~deb13u1","trixie-security":"145.0.7632.159-1~deb13u1"},"fixed_version":"80.0.3987.106-1","urgency":"not yet assigned"}}},"CVE-2020-6400":{"description":"Inappropriate implementation in CORS in Google Chrome prior to 80.0.3987.87 allowed a remote attacker to leak cross-origin data via a crafted HTML page.","scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"143.0.7499.169-1~deb12u1","bookworm-security":"145.0.7632.159-1~deb12u1"},"fixed_version":"80.0.3987.106-1","urgency":"not yet assigned"},"bullseye":{"status":"resolved","repositories":{"bullseye":"120.0.6099.224-1~deb11u1","bullseye-security":"120.0.6099.224-1~deb11u1"},"fixed_version":"80.0.3987.106-1","urgency":"not yet assigned"},"forky":{"status":"resolved","repositories":{"forky":"145.0.7632.159-1"},"fixed_version":"80.0.3987.106-1","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"146.0.7680.71-1"},"fixed_version":"80.0.3987.106-1","urgency":"not yet assigned"},"trixie":{"status":"resolved","repositories":{"trixie":"143.0.7499.169-1~deb13u1","trixie-security":"145.0.7632.159-1~deb13u1"},"fixed_version":"80.0.3987.106-1","urgency":"not yet assigned"}}},"CVE-2020-6401":{"description":"Insufficient validation of untrusted input in Omnibox in Google Chrome prior to 80.0.3987.87 allowed a remote attacker to perform domain spoofing via IDN homographs via a crafted domain name.","scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"143.0.7499.169-1~deb12u1","bookworm-security":"145.0.7632.159-1~deb12u1"},"fixed_version":"80.0.3987.106-1","urgency":"not yet assigned"},"bullseye":{"status":"resolved","repositories":{"bullseye":"120.0.6099.224-1~deb11u1","bullseye-security":"120.0.6099.224-1~deb11u1"},"fixed_version":"80.0.3987.106-1","urgency":"not yet assigned"},"forky":{"status":"resolved","repositories":{"forky":"145.0.7632.159-1"},"fixed_version":"80.0.3987.106-1","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"146.0.7680.71-1"},"fixed_version":"80.0.3987.106-1","urgency":"not yet assigned"},"trixie":{"status":"resolved","repositories":{"trixie":"143.0.7499.169-1~deb13u1","trixie-security":"145.0.7632.159-1~deb13u1"},"fixed_version":"80.0.3987.106-1","urgency":"not yet assigned"}}},"CVE-2020-6402":{"description":"Insufficient policy enforcement in downloads in Google Chrome on OS X prior to 80.0.3987.87 allowed an attacker who convinced a user to install a malicious extension to execute arbitrary code via a crafted Chrome Extension.","scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"143.0.7499.169-1~deb12u1","bookworm-security":"145.0.7632.159-1~deb12u1"},"fixed_version":"80.0.3987.106-1","urgency":"not yet assigned"},"bullseye":{"status":"resolved","repositories":{"bullseye":"120.0.6099.224-1~deb11u1","bullseye-security":"120.0.6099.224-1~deb11u1"},"fixed_version":"80.0.3987.106-1","urgency":"not yet assigned"},"forky":{"status":"resolved","repositories":{"forky":"145.0.7632.159-1"},"fixed_version":"80.0.3987.106-1","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"146.0.7680.71-1"},"fixed_version":"80.0.3987.106-1","urgency":"not yet assigned"},"trixie":{"status":"resolved","repositories":{"trixie":"143.0.7499.169-1~deb13u1","trixie-security":"145.0.7632.159-1~deb13u1"},"fixed_version":"80.0.3987.106-1","urgency":"not yet assigned"}}},"CVE-2020-6403":{"description":"Incorrect implementation in Omnibox in Google Chrome on iOS prior to 80.0.3987.87 allowed a remote attacker to spoof the contents of the Omnibox (URL bar) via a crafted HTML page.","scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"143.0.7499.169-1~deb12u1","bookworm-security":"145.0.7632.159-1~deb12u1"},"fixed_version":"80.0.3987.106-1","urgency":"not yet assigned"},"bullseye":{"status":"resolved","repositories":{"bullseye":"120.0.6099.224-1~deb11u1","bullseye-security":"120.0.6099.224-1~deb11u1"},"fixed_version":"80.0.3987.106-1","urgency":"not yet assigned"},"forky":{"status":"resolved","repositories":{"forky":"145.0.7632.159-1"},"fixed_version":"80.0.3987.106-1","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"146.0.7680.71-1"},"fixed_version":"80.0.3987.106-1","urgency":"not yet assigned"},"trixie":{"status":"resolved","repositories":{"trixie":"143.0.7499.169-1~deb13u1","trixie-security":"145.0.7632.159-1~deb13u1"},"fixed_version":"80.0.3987.106-1","urgency":"not yet assigned"}}},"CVE-2020-6404":{"description":"Inappropriate implementation in Blink in Google Chrome prior to 80.0.3987.87 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page.","scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"143.0.7499.169-1~deb12u1","bookworm-security":"145.0.7632.159-1~deb12u1"},"fixed_version":"80.0.3987.106-1","urgency":"not yet assigned"},"bullseye":{"status":"resolved","repositories":{"bullseye":"120.0.6099.224-1~deb11u1","bullseye-security":"120.0.6099.224-1~deb11u1"},"fixed_version":"80.0.3987.106-1","urgency":"not yet assigned"},"forky":{"status":"resolved","repositories":{"forky":"145.0.7632.159-1"},"fixed_version":"80.0.3987.106-1","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"146.0.7680.71-1"},"fixed_version":"80.0.3987.106-1","urgency":"not yet assigned"},"trixie":{"status":"resolved","repositories":{"trixie":"143.0.7499.169-1~deb13u1","trixie-security":"145.0.7632.159-1~deb13u1"},"fixed_version":"80.0.3987.106-1","urgency":"not yet assigned"}}},"CVE-2020-6405":{"description":"Out of bounds read in SQLite in Google Chrome prior to 80.0.3987.87 allowed a remote attacker to obtain potentially sensitive information from process memory via a crafted HTML page.","scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"143.0.7499.169-1~deb12u1","bookworm-security":"145.0.7632.159-1~deb12u1"},"fixed_version":"80.0.3987.106-1","urgency":"not yet assigned"},"bullseye":{"status":"resolved","repositories":{"bullseye":"120.0.6099.224-1~deb11u1","bullseye-security":"120.0.6099.224-1~deb11u1"},"fixed_version":"80.0.3987.106-1","urgency":"not yet assigned"},"forky":{"status":"resolved","repositories":{"forky":"145.0.7632.159-1"},"fixed_version":"80.0.3987.106-1","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"146.0.7680.71-1"},"fixed_version":"80.0.3987.106-1","urgency":"not yet assigned"},"trixie":{"status":"resolved","repositories":{"trixie":"143.0.7499.169-1~deb13u1","trixie-security":"145.0.7632.159-1~deb13u1"},"fixed_version":"80.0.3987.106-1","urgency":"not yet assigned"}}},"CVE-2020-6406":{"description":"Use after free in audio in Google Chrome prior to 80.0.3987.87 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page.","scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"143.0.7499.169-1~deb12u1","bookworm-security":"145.0.7632.159-1~deb12u1"},"fixed_version":"80.0.3987.106-1","urgency":"not yet assigned"},"bullseye":{"status":"resolved","repositories":{"bullseye":"120.0.6099.224-1~deb11u1","bullseye-security":"120.0.6099.224-1~deb11u1"},"fixed_version":"80.0.3987.106-1","urgency":"not yet assigned"},"forky":{"status":"resolved","repositories":{"forky":"145.0.7632.159-1"},"fixed_version":"80.0.3987.106-1","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"146.0.7680.71-1"},"fixed_version":"80.0.3987.106-1","urgency":"not yet assigned"},"trixie":{"status":"resolved","repositories":{"trixie":"143.0.7499.169-1~deb13u1","trixie-security":"145.0.7632.159-1~deb13u1"},"fixed_version":"80.0.3987.106-1","urgency":"not yet assigned"}}},"CVE-2020-6407":{"description":"Out of bounds memory access in streams in Google Chrome prior to 80.0.3987.122 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page.","scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"143.0.7499.169-1~deb12u1","bookworm-security":"145.0.7632.159-1~deb12u1"},"fixed_version":"80.0.3987.122-1","urgency":"not yet assigned"},"bullseye":{"status":"resolved","repositories":{"bullseye":"120.0.6099.224-1~deb11u1","bullseye-security":"120.0.6099.224-1~deb11u1"},"fixed_version":"80.0.3987.122-1","urgency":"not yet assigned"},"forky":{"status":"resolved","repositories":{"forky":"145.0.7632.159-1"},"fixed_version":"80.0.3987.122-1","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"146.0.7680.71-1"},"fixed_version":"80.0.3987.122-1","urgency":"not yet assigned"},"trixie":{"status":"resolved","repositories":{"trixie":"143.0.7499.169-1~deb13u1","trixie-security":"145.0.7632.159-1~deb13u1"},"fixed_version":"80.0.3987.122-1","urgency":"not yet assigned"}}},"CVE-2020-6408":{"description":"Insufficient policy enforcement in CORS in Google Chrome prior to 80.0.3987.87 allowed a local attacker to obtain potentially sensitive information via a crafted HTML page.","scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"143.0.7499.169-1~deb12u1","bookworm-security":"145.0.7632.159-1~deb12u1"},"fixed_version":"80.0.3987.106-1","urgency":"not yet assigned"},"bullseye":{"status":"resolved","repositories":{"bullseye":"120.0.6099.224-1~deb11u1","bullseye-security":"120.0.6099.224-1~deb11u1"},"fixed_version":"80.0.3987.106-1","urgency":"not yet assigned"},"forky":{"status":"resolved","repositories":{"forky":"145.0.7632.159-1"},"fixed_version":"80.0.3987.106-1","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"146.0.7680.71-1"},"fixed_version":"80.0.3987.106-1","urgency":"not yet assigned"},"trixie":{"status":"resolved","repositories":{"trixie":"143.0.7499.169-1~deb13u1","trixie-security":"145.0.7632.159-1~deb13u1"},"fixed_version":"80.0.3987.106-1","urgency":"not yet assigned"}}},"CVE-2020-6409":{"description":"Inappropriate implementation in Omnibox in Google Chrome prior to 80.0.3987.87 allowed a remote attacker who convinced the user to enter a URI to bypass navigation restrictions via a crafted domain name.","scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"143.0.7499.169-1~deb12u1","bookworm-security":"145.0.7632.159-1~deb12u1"},"fixed_version":"80.0.3987.106-1","urgency":"not yet assigned"},"bullseye":{"status":"resolved","repositories":{"bullseye":"120.0.6099.224-1~deb11u1","bullseye-security":"120.0.6099.224-1~deb11u1"},"fixed_version":"80.0.3987.106-1","urgency":"not yet assigned"},"forky":{"status":"resolved","repositories":{"forky":"145.0.7632.159-1"},"fixed_version":"80.0.3987.106-1","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"146.0.7680.71-1"},"fixed_version":"80.0.3987.106-1","urgency":"not yet assigned"},"trixie":{"status":"resolved","repositories":{"trixie":"143.0.7499.169-1~deb13u1","trixie-security":"145.0.7632.159-1~deb13u1"},"fixed_version":"80.0.3987.106-1","urgency":"not yet assigned"}}},"CVE-2020-6410":{"description":"Insufficient policy enforcement in navigation in Google Chrome prior to 80.0.3987.87 allowed a remote attacker to confuse the user via a crafted domain name.","scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"143.0.7499.169-1~deb12u1","bookworm-security":"145.0.7632.159-1~deb12u1"},"fixed_version":"80.0.3987.106-1","urgency":"not yet assigned"},"bullseye":{"status":"resolved","repositories":{"bullseye":"120.0.6099.224-1~deb11u1","bullseye-security":"120.0.6099.224-1~deb11u1"},"fixed_version":"80.0.3987.106-1","urgency":"not yet assigned"},"forky":{"status":"resolved","repositories":{"forky":"145.0.7632.159-1"},"fixed_version":"80.0.3987.106-1","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"146.0.7680.71-1"},"fixed_version":"80.0.3987.106-1","urgency":"not yet assigned"},"trixie":{"status":"resolved","repositories":{"trixie":"143.0.7499.169-1~deb13u1","trixie-security":"145.0.7632.159-1~deb13u1"},"fixed_version":"80.0.3987.106-1","urgency":"not yet assigned"}}},"CVE-2020-6411":{"description":"Insufficient validation of untrusted input in Omnibox in Google Chrome prior to 80.0.3987.87 allowed a remote attacker to perform domain spoofing via IDN homographs via a crafted domain name.","scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"143.0.7499.169-1~deb12u1","bookworm-security":"145.0.7632.159-1~deb12u1"},"fixed_version":"80.0.3987.106-1","urgency":"not yet assigned"},"bullseye":{"status":"resolved","repositories":{"bullseye":"120.0.6099.224-1~deb11u1","bullseye-security":"120.0.6099.224-1~deb11u1"},"fixed_version":"80.0.3987.106-1","urgency":"not yet assigned"},"forky":{"status":"resolved","repositories":{"forky":"145.0.7632.159-1"},"fixed_version":"80.0.3987.106-1","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"146.0.7680.71-1"},"fixed_version":"80.0.3987.106-1","urgency":"not yet assigned"},"trixie":{"status":"resolved","repositories":{"trixie":"143.0.7499.169-1~deb13u1","trixie-security":"145.0.7632.159-1~deb13u1"},"fixed_version":"80.0.3987.106-1","urgency":"not yet assigned"}}},"CVE-2020-6412":{"description":"Insufficient validation of untrusted input in Omnibox in Google Chrome prior to 80.0.3987.87 allowed a remote attacker to perform domain spoofing via IDN homographs via a crafted domain name.","scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"143.0.7499.169-1~deb12u1","bookworm-security":"145.0.7632.159-1~deb12u1"},"fixed_version":"80.0.3987.106-1","urgency":"not yet assigned"},"bullseye":{"status":"resolved","repositories":{"bullseye":"120.0.6099.224-1~deb11u1","bullseye-security":"120.0.6099.224-1~deb11u1"},"fixed_version":"80.0.3987.106-1","urgency":"not yet assigned"},"forky":{"status":"resolved","repositories":{"forky":"145.0.7632.159-1"},"fixed_version":"80.0.3987.106-1","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"146.0.7680.71-1"},"fixed_version":"80.0.3987.106-1","urgency":"not yet assigned"},"trixie":{"status":"resolved","repositories":{"trixie":"143.0.7499.169-1~deb13u1","trixie-security":"145.0.7632.159-1~deb13u1"},"fixed_version":"80.0.3987.106-1","urgency":"not yet assigned"}}},"CVE-2020-6413":{"description":"Inappropriate implementation in Blink in Google Chrome prior to 80.0.3987.87 allowed a remote attacker to bypass HTML validators via a crafted HTML page.","scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"143.0.7499.169-1~deb12u1","bookworm-security":"145.0.7632.159-1~deb12u1"},"fixed_version":"80.0.3987.106-1","urgency":"not yet assigned"},"bullseye":{"status":"resolved","repositories":{"bullseye":"120.0.6099.224-1~deb11u1","bullseye-security":"120.0.6099.224-1~deb11u1"},"fixed_version":"80.0.3987.106-1","urgency":"not yet assigned"},"forky":{"status":"resolved","repositories":{"forky":"145.0.7632.159-1"},"fixed_version":"80.0.3987.106-1","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"146.0.7680.71-1"},"fixed_version":"80.0.3987.106-1","urgency":"not yet assigned"},"trixie":{"status":"resolved","repositories":{"trixie":"143.0.7499.169-1~deb13u1","trixie-security":"145.0.7632.159-1~deb13u1"},"fixed_version":"80.0.3987.106-1","urgency":"not yet assigned"}}},"CVE-2020-6414":{"description":"Insufficient policy enforcement in Safe Browsing in Google Chrome prior to 80.0.3987.87 allowed a remote attacker to bypass navigation restrictions via a crafted HTML page.","scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"143.0.7499.169-1~deb12u1","bookworm-security":"145.0.7632.159-1~deb12u1"},"fixed_version":"80.0.3987.106-1","urgency":"not yet assigned"},"bullseye":{"status":"resolved","repositories":{"bullseye":"120.0.6099.224-1~deb11u1","bullseye-security":"120.0.6099.224-1~deb11u1"},"fixed_version":"80.0.3987.106-1","urgency":"not yet assigned"},"forky":{"status":"resolved","repositories":{"forky":"145.0.7632.159-1"},"fixed_version":"80.0.3987.106-1","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"146.0.7680.71-1"},"fixed_version":"80.0.3987.106-1","urgency":"not yet assigned"},"trixie":{"status":"resolved","repositories":{"trixie":"143.0.7499.169-1~deb13u1","trixie-security":"145.0.7632.159-1~deb13u1"},"fixed_version":"80.0.3987.106-1","urgency":"not yet assigned"}}},"CVE-2020-6415":{"description":"Inappropriate implementation in JavaScript in Google Chrome prior to 80.0.3987.87 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page.","scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"143.0.7499.169-1~deb12u1","bookworm-security":"145.0.7632.159-1~deb12u1"},"fixed_version":"80.0.3987.106-1","urgency":"not yet assigned"},"bullseye":{"status":"resolved","repositories":{"bullseye":"120.0.6099.224-1~deb11u1","bullseye-security":"120.0.6099.224-1~deb11u1"},"fixed_version":"80.0.3987.106-1","urgency":"not yet assigned"},"forky":{"status":"resolved","repositories":{"forky":"145.0.7632.159-1"},"fixed_version":"80.0.3987.106-1","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"146.0.7680.71-1"},"fixed_version":"80.0.3987.106-1","urgency":"not yet assigned"},"trixie":{"status":"resolved","repositories":{"trixie":"143.0.7499.169-1~deb13u1","trixie-security":"145.0.7632.159-1~deb13u1"},"fixed_version":"80.0.3987.106-1","urgency":"not yet assigned"}}},"CVE-2020-6416":{"description":"Insufficient data validation in streams in Google Chrome prior to 80.0.3987.87 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page.","scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"143.0.7499.169-1~deb12u1","bookworm-security":"145.0.7632.159-1~deb12u1"},"fixed_version":"80.0.3987.106-1","urgency":"not yet assigned"},"bullseye":{"status":"resolved","repositories":{"bullseye":"120.0.6099.224-1~deb11u1","bullseye-security":"120.0.6099.224-1~deb11u1"},"fixed_version":"80.0.3987.106-1","urgency":"not yet assigned"},"forky":{"status":"resolved","repositories":{"forky":"145.0.7632.159-1"},"fixed_version":"80.0.3987.106-1","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"146.0.7680.71-1"},"fixed_version":"80.0.3987.106-1","urgency":"not yet assigned"},"trixie":{"status":"resolved","repositories":{"trixie":"143.0.7499.169-1~deb13u1","trixie-security":"145.0.7632.159-1~deb13u1"},"fixed_version":"80.0.3987.106-1","urgency":"not yet assigned"}}},"CVE-2020-6417":{"description":"Inappropriate implementation in installer in Google Chrome prior to 80.0.3987.87 allowed a local attacker to execute arbitrary code via a crafted registry entry.","scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"143.0.7499.169-1~deb12u1","bookworm-security":"145.0.7632.159-1~deb12u1"},"fixed_version":"0","urgency":"unimportant"},"bullseye":{"status":"resolved","repositories":{"bullseye":"120.0.6099.224-1~deb11u1","bullseye-security":"120.0.6099.224-1~deb11u1"},"fixed_version":"0","urgency":"unimportant"},"forky":{"status":"resolved","repositories":{"forky":"145.0.7632.159-1"},"fixed_version":"0","urgency":"unimportant"},"sid":{"status":"resolved","repositories":{"sid":"146.0.7680.71-1"},"fixed_version":"0","urgency":"unimportant"},"trixie":{"status":"resolved","repositories":{"trixie":"143.0.7499.169-1~deb13u1","trixie-security":"145.0.7632.159-1~deb13u1"},"fixed_version":"0","urgency":"unimportant"}}},"CVE-2020-6418":{"description":"Type confusion in V8 in Google Chrome prior to 80.0.3987.122 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page.","scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"143.0.7499.169-1~deb12u1","bookworm-security":"145.0.7632.159-1~deb12u1"},"fixed_version":"80.0.3987.122-1","urgency":"not yet assigned"},"bullseye":{"status":"resolved","repositories":{"bullseye":"120.0.6099.224-1~deb11u1","bullseye-security":"120.0.6099.224-1~deb11u1"},"fixed_version":"80.0.3987.122-1","urgency":"not yet assigned"},"forky":{"status":"resolved","repositories":{"forky":"145.0.7632.159-1"},"fixed_version":"80.0.3987.122-1","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"146.0.7680.71-1"},"fixed_version":"80.0.3987.122-1","urgency":"not yet assigned"},"trixie":{"status":"resolved","repositories":{"trixie":"143.0.7499.169-1~deb13u1","trixie-security":"145.0.7632.159-1~deb13u1"},"fixed_version":"80.0.3987.122-1","urgency":"not yet assigned"}}},"CVE-2020-6419":{"description":"Out of bounds write in V8 in Google Chrome prior to 81.0.4044.92 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page.","scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"143.0.7499.169-1~deb12u1","bookworm-security":"145.0.7632.159-1~deb12u1"},"fixed_version":"81.0.4044.92-1","urgency":"not yet assigned"},"bullseye":{"status":"resolved","repositories":{"bullseye":"120.0.6099.224-1~deb11u1","bullseye-security":"120.0.6099.224-1~deb11u1"},"fixed_version":"81.0.4044.92-1","urgency":"not yet assigned"},"forky":{"status":"resolved","repositories":{"forky":"145.0.7632.159-1"},"fixed_version":"81.0.4044.92-1","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"146.0.7680.71-1"},"fixed_version":"81.0.4044.92-1","urgency":"not yet assigned"},"trixie":{"status":"resolved","repositories":{"trixie":"143.0.7499.169-1~deb13u1","trixie-security":"145.0.7632.159-1~deb13u1"},"fixed_version":"81.0.4044.92-1","urgency":"not yet assigned"}}},"CVE-2020-6420":{"description":"Insufficient policy enforcement in media in Google Chrome prior to 80.0.3987.132 allowed a remote attacker to bypass same origin policy via a crafted HTML page.","scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"143.0.7499.169-1~deb12u1","bookworm-security":"145.0.7632.159-1~deb12u1"},"fixed_version":"80.0.3987.132-1","urgency":"not yet assigned"},"bullseye":{"status":"resolved","repositories":{"bullseye":"120.0.6099.224-1~deb11u1","bullseye-security":"120.0.6099.224-1~deb11u1"},"fixed_version":"80.0.3987.132-1","urgency":"not yet assigned"},"forky":{"status":"resolved","repositories":{"forky":"145.0.7632.159-1"},"fixed_version":"80.0.3987.132-1","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"146.0.7680.71-1"},"fixed_version":"80.0.3987.132-1","urgency":"not yet assigned"},"trixie":{"status":"resolved","repositories":{"trixie":"143.0.7499.169-1~deb13u1","trixie-security":"145.0.7632.159-1~deb13u1"},"fixed_version":"80.0.3987.132-1","urgency":"not yet assigned"}}},"CVE-2020-6422":{"description":"Use after free in WebGL in Google Chrome prior to 80.0.3987.149 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page.","scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"143.0.7499.169-1~deb12u1","bookworm-security":"145.0.7632.159-1~deb12u1"},"fixed_version":"80.0.3987.149-1","urgency":"not yet assigned"},"bullseye":{"status":"resolved","repositories":{"bullseye":"120.0.6099.224-1~deb11u1","bullseye-security":"120.0.6099.224-1~deb11u1"},"fixed_version":"80.0.3987.149-1","urgency":"not yet assigned"},"forky":{"status":"resolved","repositories":{"forky":"145.0.7632.159-1"},"fixed_version":"80.0.3987.149-1","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"146.0.7680.71-1"},"fixed_version":"80.0.3987.149-1","urgency":"not yet assigned"},"trixie":{"status":"resolved","repositories":{"trixie":"143.0.7499.169-1~deb13u1","trixie-security":"145.0.7632.159-1~deb13u1"},"fixed_version":"80.0.3987.149-1","urgency":"not yet assigned"}}},"CVE-2020-6423":{"description":"Use after free in audio in Google Chrome prior to 81.0.4044.92 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page.","scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"143.0.7499.169-1~deb12u1","bookworm-security":"145.0.7632.159-1~deb12u1"},"fixed_version":"81.0.4044.92-1","urgency":"not yet assigned"},"bullseye":{"status":"resolved","repositories":{"bullseye":"120.0.6099.224-1~deb11u1","bullseye-security":"120.0.6099.224-1~deb11u1"},"fixed_version":"81.0.4044.92-1","urgency":"not yet assigned"},"forky":{"status":"resolved","repositories":{"forky":"145.0.7632.159-1"},"fixed_version":"81.0.4044.92-1","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"146.0.7680.71-1"},"fixed_version":"81.0.4044.92-1","urgency":"not yet assigned"},"trixie":{"status":"resolved","repositories":{"trixie":"143.0.7499.169-1~deb13u1","trixie-security":"145.0.7632.159-1~deb13u1"},"fixed_version":"81.0.4044.92-1","urgency":"not yet assigned"}}},"CVE-2020-6424":{"description":"Use after free in media in Google Chrome prior to 80.0.3987.149 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page.","scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"143.0.7499.169-1~deb12u1","bookworm-security":"145.0.7632.159-1~deb12u1"},"fixed_version":"80.0.3987.149-1","urgency":"not yet assigned"},"bullseye":{"status":"resolved","repositories":{"bullseye":"120.0.6099.224-1~deb11u1","bullseye-security":"120.0.6099.224-1~deb11u1"},"fixed_version":"80.0.3987.149-1","urgency":"not yet assigned"},"forky":{"status":"resolved","repositories":{"forky":"145.0.7632.159-1"},"fixed_version":"80.0.3987.149-1","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"146.0.7680.71-1"},"fixed_version":"80.0.3987.149-1","urgency":"not yet assigned"},"trixie":{"status":"resolved","repositories":{"trixie":"143.0.7499.169-1~deb13u1","trixie-security":"145.0.7632.159-1~deb13u1"},"fixed_version":"80.0.3987.149-1","urgency":"not yet assigned"}}},"CVE-2020-6425":{"description":"Insufficient policy enforcement in extensions in Google Chrome prior to 80.0.3987.149 allowed an attacker who convinced a user to install a malicious extension to bypass site isolation via a crafted Chrome Extension.","scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"143.0.7499.169-1~deb12u1","bookworm-security":"145.0.7632.159-1~deb12u1"},"fixed_version":"80.0.3987.149-1","urgency":"not yet assigned"},"bullseye":{"status":"resolved","repositories":{"bullseye":"120.0.6099.224-1~deb11u1","bullseye-security":"120.0.6099.224-1~deb11u1"},"fixed_version":"80.0.3987.149-1","urgency":"not yet assigned"},"forky":{"status":"resolved","repositories":{"forky":"145.0.7632.159-1"},"fixed_version":"80.0.3987.149-1","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"146.0.7680.71-1"},"fixed_version":"80.0.3987.149-1","urgency":"not yet assigned"},"trixie":{"status":"resolved","repositories":{"trixie":"143.0.7499.169-1~deb13u1","trixie-security":"145.0.7632.159-1~deb13u1"},"fixed_version":"80.0.3987.149-1","urgency":"not yet assigned"}}},"CVE-2020-6426":{"description":"Inappropriate implementation in V8 in Google Chrome prior to 80.0.3987.149 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page.","scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"143.0.7499.169-1~deb12u1","bookworm-security":"145.0.7632.159-1~deb12u1"},"fixed_version":"80.0.3987.149-1","urgency":"not yet assigned"},"bullseye":{"status":"resolved","repositories":{"bullseye":"120.0.6099.224-1~deb11u1","bullseye-security":"120.0.6099.224-1~deb11u1"},"fixed_version":"80.0.3987.149-1","urgency":"not yet assigned"},"forky":{"status":"resolved","repositories":{"forky":"145.0.7632.159-1"},"fixed_version":"80.0.3987.149-1","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"146.0.7680.71-1"},"fixed_version":"80.0.3987.149-1","urgency":"not yet assigned"},"trixie":{"status":"resolved","repositories":{"trixie":"143.0.7499.169-1~deb13u1","trixie-security":"145.0.7632.159-1~deb13u1"},"fixed_version":"80.0.3987.149-1","urgency":"not yet assigned"}}},"CVE-2020-6427":{"description":"Use after free in audio in Google Chrome prior to 80.0.3987.149 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page.","scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"143.0.7499.169-1~deb12u1","bookworm-security":"145.0.7632.159-1~deb12u1"},"fixed_version":"80.0.3987.149-1","urgency":"not yet assigned"},"bullseye":{"status":"resolved","repositories":{"bullseye":"120.0.6099.224-1~deb11u1","bullseye-security":"120.0.6099.224-1~deb11u1"},"fixed_version":"80.0.3987.149-1","urgency":"not yet assigned"},"forky":{"status":"resolved","repositories":{"forky":"145.0.7632.159-1"},"fixed_version":"80.0.3987.149-1","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"146.0.7680.71-1"},"fixed_version":"80.0.3987.149-1","urgency":"not yet assigned"},"trixie":{"status":"resolved","repositories":{"trixie":"143.0.7499.169-1~deb13u1","trixie-security":"145.0.7632.159-1~deb13u1"},"fixed_version":"80.0.3987.149-1","urgency":"not yet assigned"}}},"CVE-2020-6428":{"description":"Use after free in audio in Google Chrome prior to 80.0.3987.149 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page.","scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"143.0.7499.169-1~deb12u1","bookworm-security":"145.0.7632.159-1~deb12u1"},"fixed_version":"80.0.3987.149-1","urgency":"not yet assigned"},"bullseye":{"status":"resolved","repositories":{"bullseye":"120.0.6099.224-1~deb11u1","bullseye-security":"120.0.6099.224-1~deb11u1"},"fixed_version":"80.0.3987.149-1","urgency":"not yet assigned"},"forky":{"status":"resolved","repositories":{"forky":"145.0.7632.159-1"},"fixed_version":"80.0.3987.149-1","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"146.0.7680.71-1"},"fixed_version":"80.0.3987.149-1","urgency":"not yet assigned"},"trixie":{"status":"resolved","repositories":{"trixie":"143.0.7499.169-1~deb13u1","trixie-security":"145.0.7632.159-1~deb13u1"},"fixed_version":"80.0.3987.149-1","urgency":"not yet assigned"}}},"CVE-2020-6429":{"description":"Use after free in audio in Google Chrome prior to 80.0.3987.149 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page.","scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"143.0.7499.169-1~deb12u1","bookworm-security":"145.0.7632.159-1~deb12u1"},"fixed_version":"80.0.3987.149-1","urgency":"not yet assigned"},"bullseye":{"status":"resolved","repositories":{"bullseye":"120.0.6099.224-1~deb11u1","bullseye-security":"120.0.6099.224-1~deb11u1"},"fixed_version":"80.0.3987.149-1","urgency":"not yet assigned"},"forky":{"status":"resolved","repositories":{"forky":"145.0.7632.159-1"},"fixed_version":"80.0.3987.149-1","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"146.0.7680.71-1"},"fixed_version":"80.0.3987.149-1","urgency":"not yet assigned"},"trixie":{"status":"resolved","repositories":{"trixie":"143.0.7499.169-1~deb13u1","trixie-security":"145.0.7632.159-1~deb13u1"},"fixed_version":"80.0.3987.149-1","urgency":"not yet assigned"}}},"CVE-2020-6430":{"description":"Type Confusion in V8 in Google Chrome prior to 81.0.4044.92 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page.","scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"143.0.7499.169-1~deb12u1","bookworm-security":"145.0.7632.159-1~deb12u1"},"fixed_version":"81.0.4044.92-1","urgency":"not yet assigned"},"bullseye":{"status":"resolved","repositories":{"bullseye":"120.0.6099.224-1~deb11u1","bullseye-security":"120.0.6099.224-1~deb11u1"},"fixed_version":"81.0.4044.92-1","urgency":"not yet assigned"},"forky":{"status":"resolved","repositories":{"forky":"145.0.7632.159-1"},"fixed_version":"81.0.4044.92-1","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"146.0.7680.71-1"},"fixed_version":"81.0.4044.92-1","urgency":"not yet assigned"},"trixie":{"status":"resolved","repositories":{"trixie":"143.0.7499.169-1~deb13u1","trixie-security":"145.0.7632.159-1~deb13u1"},"fixed_version":"81.0.4044.92-1","urgency":"not yet assigned"}}},"CVE-2020-6431":{"description":"Insufficient policy enforcement in full screen in Google Chrome prior to 81.0.4044.92 allowed a remote attacker to spoof security UI via a crafted HTML page.","scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"143.0.7499.169-1~deb12u1","bookworm-security":"145.0.7632.159-1~deb12u1"},"fixed_version":"81.0.4044.92-1","urgency":"not yet assigned"},"bullseye":{"status":"resolved","repositories":{"bullseye":"120.0.6099.224-1~deb11u1","bullseye-security":"120.0.6099.224-1~deb11u1"},"fixed_version":"81.0.4044.92-1","urgency":"not yet assigned"},"forky":{"status":"resolved","repositories":{"forky":"145.0.7632.159-1"},"fixed_version":"81.0.4044.92-1","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"146.0.7680.71-1"},"fixed_version":"81.0.4044.92-1","urgency":"not yet assigned"},"trixie":{"status":"resolved","repositories":{"trixie":"143.0.7499.169-1~deb13u1","trixie-security":"145.0.7632.159-1~deb13u1"},"fixed_version":"81.0.4044.92-1","urgency":"not yet assigned"}}},"CVE-2020-6432":{"description":"Insufficient policy enforcement in navigations in Google Chrome prior to 81.0.4044.92 allowed a remote attacker to bypass navigation restrictions via a crafted HTML page.","scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"143.0.7499.169-1~deb12u1","bookworm-security":"145.0.7632.159-1~deb12u1"},"fixed_version":"81.0.4044.92-1","urgency":"not yet assigned"},"bullseye":{"status":"resolved","repositories":{"bullseye":"120.0.6099.224-1~deb11u1","bullseye-security":"120.0.6099.224-1~deb11u1"},"fixed_version":"81.0.4044.92-1","urgency":"not yet assigned"},"forky":{"status":"resolved","repositories":{"forky":"145.0.7632.159-1"},"fixed_version":"81.0.4044.92-1","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"146.0.7680.71-1"},"fixed_version":"81.0.4044.92-1","urgency":"not yet assigned"},"trixie":{"status":"resolved","repositories":{"trixie":"143.0.7499.169-1~deb13u1","trixie-security":"145.0.7632.159-1~deb13u1"},"fixed_version":"81.0.4044.92-1","urgency":"not yet assigned"}}},"CVE-2020-6433":{"description":"Insufficient policy enforcement in extensions in Google Chrome prior to 81.0.4044.92 allowed a remote attacker to bypass navigation restrictions via a crafted HTML page.","scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"143.0.7499.169-1~deb12u1","bookworm-security":"145.0.7632.159-1~deb12u1"},"fixed_version":"81.0.4044.92-1","urgency":"not yet assigned"},"bullseye":{"status":"resolved","repositories":{"bullseye":"120.0.6099.224-1~deb11u1","bullseye-security":"120.0.6099.224-1~deb11u1"},"fixed_version":"81.0.4044.92-1","urgency":"not yet assigned"},"forky":{"status":"resolved","repositories":{"forky":"145.0.7632.159-1"},"fixed_version":"81.0.4044.92-1","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"146.0.7680.71-1"},"fixed_version":"81.0.4044.92-1","urgency":"not yet assigned"},"trixie":{"status":"resolved","repositories":{"trixie":"143.0.7499.169-1~deb13u1","trixie-security":"145.0.7632.159-1~deb13u1"},"fixed_version":"81.0.4044.92-1","urgency":"not yet assigned"}}},"CVE-2020-6434":{"description":"Use after free in devtools in Google Chrome prior to 81.0.4044.92 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page.","scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"143.0.7499.169-1~deb12u1","bookworm-security":"145.0.7632.159-1~deb12u1"},"fixed_version":"81.0.4044.92-1","urgency":"not yet assigned"},"bullseye":{"status":"resolved","repositories":{"bullseye":"120.0.6099.224-1~deb11u1","bullseye-security":"120.0.6099.224-1~deb11u1"},"fixed_version":"81.0.4044.92-1","urgency":"not yet assigned"},"forky":{"status":"resolved","repositories":{"forky":"145.0.7632.159-1"},"fixed_version":"81.0.4044.92-1","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"146.0.7680.71-1"},"fixed_version":"81.0.4044.92-1","urgency":"not yet assigned"},"trixie":{"status":"resolved","repositories":{"trixie":"143.0.7499.169-1~deb13u1","trixie-security":"145.0.7632.159-1~deb13u1"},"fixed_version":"81.0.4044.92-1","urgency":"not yet assigned"}}},"CVE-2020-6435":{"description":"Insufficient policy enforcement in extensions in Google Chrome prior to 81.0.4044.92 allowed a remote attacker who had compromised the renderer process to bypass navigation restrictions via a crafted HTML page.","scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"143.0.7499.169-1~deb12u1","bookworm-security":"145.0.7632.159-1~deb12u1"},"fixed_version":"81.0.4044.92-1","urgency":"not yet assigned"},"bullseye":{"status":"resolved","repositories":{"bullseye":"120.0.6099.224-1~deb11u1","bullseye-security":"120.0.6099.224-1~deb11u1"},"fixed_version":"81.0.4044.92-1","urgency":"not yet assigned"},"forky":{"status":"resolved","repositories":{"forky":"145.0.7632.159-1"},"fixed_version":"81.0.4044.92-1","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"146.0.7680.71-1"},"fixed_version":"81.0.4044.92-1","urgency":"not yet assigned"},"trixie":{"status":"resolved","repositories":{"trixie":"143.0.7499.169-1~deb13u1","trixie-security":"145.0.7632.159-1~deb13u1"},"fixed_version":"81.0.4044.92-1","urgency":"not yet assigned"}}},"CVE-2020-6436":{"description":"Use after free in window management in Google Chrome prior to 81.0.4044.92 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page.","scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"143.0.7499.169-1~deb12u1","bookworm-security":"145.0.7632.159-1~deb12u1"},"fixed_version":"81.0.4044.92-1","urgency":"not yet assigned"},"bullseye":{"status":"resolved","repositories":{"bullseye":"120.0.6099.224-1~deb11u1","bullseye-security":"120.0.6099.224-1~deb11u1"},"fixed_version":"81.0.4044.92-1","urgency":"not yet assigned"},"forky":{"status":"resolved","repositories":{"forky":"145.0.7632.159-1"},"fixed_version":"81.0.4044.92-1","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"146.0.7680.71-1"},"fixed_version":"81.0.4044.92-1","urgency":"not yet assigned"},"trixie":{"status":"resolved","repositories":{"trixie":"143.0.7499.169-1~deb13u1","trixie-security":"145.0.7632.159-1~deb13u1"},"fixed_version":"81.0.4044.92-1","urgency":"not yet assigned"}}},"CVE-2020-6437":{"description":"Inappropriate implementation in WebView in Google Chrome prior to 81.0.4044.92 allowed a remote attacker to spoof security UI via a crafted application.","scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"143.0.7499.169-1~deb12u1","bookworm-security":"145.0.7632.159-1~deb12u1"},"fixed_version":"81.0.4044.92-1","urgency":"not yet assigned"},"bullseye":{"status":"resolved","repositories":{"bullseye":"120.0.6099.224-1~deb11u1","bullseye-security":"120.0.6099.224-1~deb11u1"},"fixed_version":"81.0.4044.92-1","urgency":"not yet assigned"},"forky":{"status":"resolved","repositories":{"forky":"145.0.7632.159-1"},"fixed_version":"81.0.4044.92-1","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"146.0.7680.71-1"},"fixed_version":"81.0.4044.92-1","urgency":"not yet assigned"},"trixie":{"status":"resolved","repositories":{"trixie":"143.0.7499.169-1~deb13u1","trixie-security":"145.0.7632.159-1~deb13u1"},"fixed_version":"81.0.4044.92-1","urgency":"not yet assigned"}}},"CVE-2020-6438":{"description":"Insufficient policy enforcement in extensions in Google Chrome prior to 81.0.4044.92 allowed an attacker who convinced a user to install a malicious extension to obtain potentially sensitive information from process memory via a crafted Chrome Extension.","scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"143.0.7499.169-1~deb12u1","bookworm-security":"145.0.7632.159-1~deb12u1"},"fixed_version":"81.0.4044.92-1","urgency":"not yet assigned"},"bullseye":{"status":"resolved","repositories":{"bullseye":"120.0.6099.224-1~deb11u1","bullseye-security":"120.0.6099.224-1~deb11u1"},"fixed_version":"81.0.4044.92-1","urgency":"not yet assigned"},"forky":{"status":"resolved","repositories":{"forky":"145.0.7632.159-1"},"fixed_version":"81.0.4044.92-1","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"146.0.7680.71-1"},"fixed_version":"81.0.4044.92-1","urgency":"not yet assigned"},"trixie":{"status":"resolved","repositories":{"trixie":"143.0.7499.169-1~deb13u1","trixie-security":"145.0.7632.159-1~deb13u1"},"fixed_version":"81.0.4044.92-1","urgency":"not yet assigned"}}},"CVE-2020-6439":{"description":"Insufficient policy enforcement in navigations in Google Chrome prior to 81.0.4044.92 allowed a remote attacker to bypass security UI via a crafted HTML page.","scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"143.0.7499.169-1~deb12u1","bookworm-security":"145.0.7632.159-1~deb12u1"},"fixed_version":"81.0.4044.92-1","urgency":"not yet assigned"},"bullseye":{"status":"resolved","repositories":{"bullseye":"120.0.6099.224-1~deb11u1","bullseye-security":"120.0.6099.224-1~deb11u1"},"fixed_version":"81.0.4044.92-1","urgency":"not yet assigned"},"forky":{"status":"resolved","repositories":{"forky":"145.0.7632.159-1"},"fixed_version":"81.0.4044.92-1","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"146.0.7680.71-1"},"fixed_version":"81.0.4044.92-1","urgency":"not yet assigned"},"trixie":{"status":"resolved","repositories":{"trixie":"143.0.7499.169-1~deb13u1","trixie-security":"145.0.7632.159-1~deb13u1"},"fixed_version":"81.0.4044.92-1","urgency":"not yet assigned"}}},"CVE-2020-6440":{"description":"Inappropriate implementation in extensions in Google Chrome prior to 81.0.4044.92 allowed an attacker who convinced a user to install a malicious extension to obtain potentially sensitive information via a crafted Chrome Extension.","scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"143.0.7499.169-1~deb12u1","bookworm-security":"145.0.7632.159-1~deb12u1"},"fixed_version":"81.0.4044.92-1","urgency":"not yet assigned"},"bullseye":{"status":"resolved","repositories":{"bullseye":"120.0.6099.224-1~deb11u1","bullseye-security":"120.0.6099.224-1~deb11u1"},"fixed_version":"81.0.4044.92-1","urgency":"not yet assigned"},"forky":{"status":"resolved","repositories":{"forky":"145.0.7632.159-1"},"fixed_version":"81.0.4044.92-1","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"146.0.7680.71-1"},"fixed_version":"81.0.4044.92-1","urgency":"not yet assigned"},"trixie":{"status":"resolved","repositories":{"trixie":"143.0.7499.169-1~deb13u1","trixie-security":"145.0.7632.159-1~deb13u1"},"fixed_version":"81.0.4044.92-1","urgency":"not yet assigned"}}},"CVE-2020-6441":{"description":"Insufficient policy enforcement in omnibox in Google Chrome prior to 81.0.4044.92 allowed a remote attacker to bypass security UI via a crafted HTML page.","scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"143.0.7499.169-1~deb12u1","bookworm-security":"145.0.7632.159-1~deb12u1"},"fixed_version":"81.0.4044.92-1","urgency":"not yet assigned"},"bullseye":{"status":"resolved","repositories":{"bullseye":"120.0.6099.224-1~deb11u1","bullseye-security":"120.0.6099.224-1~deb11u1"},"fixed_version":"81.0.4044.92-1","urgency":"not yet assigned"},"forky":{"status":"resolved","repositories":{"forky":"145.0.7632.159-1"},"fixed_version":"81.0.4044.92-1","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"146.0.7680.71-1"},"fixed_version":"81.0.4044.92-1","urgency":"not yet assigned"},"trixie":{"status":"resolved","repositories":{"trixie":"143.0.7499.169-1~deb13u1","trixie-security":"145.0.7632.159-1~deb13u1"},"fixed_version":"81.0.4044.92-1","urgency":"not yet assigned"}}},"CVE-2020-6442":{"description":"Inappropriate implementation in cache in Google Chrome prior to 81.0.4044.92 allowed a remote attacker to leak cross-origin data via a crafted HTML page.","scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"143.0.7499.169-1~deb12u1","bookworm-security":"145.0.7632.159-1~deb12u1"},"fixed_version":"81.0.4044.92-1","urgency":"not yet assigned"},"bullseye":{"status":"resolved","repositories":{"bullseye":"120.0.6099.224-1~deb11u1","bullseye-security":"120.0.6099.224-1~deb11u1"},"fixed_version":"81.0.4044.92-1","urgency":"not yet assigned"},"forky":{"status":"resolved","repositories":{"forky":"145.0.7632.159-1"},"fixed_version":"81.0.4044.92-1","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"146.0.7680.71-1"},"fixed_version":"81.0.4044.92-1","urgency":"not yet assigned"},"trixie":{"status":"resolved","repositories":{"trixie":"143.0.7499.169-1~deb13u1","trixie-security":"145.0.7632.159-1~deb13u1"},"fixed_version":"81.0.4044.92-1","urgency":"not yet assigned"}}},"CVE-2020-6443":{"description":"Insufficient data validation in developer tools in Google Chrome prior to 81.0.4044.92 allowed a remote attacker who had convinced the user to use devtools to execute arbitrary code via a crafted HTML page.","scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"143.0.7499.169-1~deb12u1","bookworm-security":"145.0.7632.159-1~deb12u1"},"fixed_version":"81.0.4044.92-1","urgency":"not yet assigned"},"bullseye":{"status":"resolved","repositories":{"bullseye":"120.0.6099.224-1~deb11u1","bullseye-security":"120.0.6099.224-1~deb11u1"},"fixed_version":"81.0.4044.92-1","urgency":"not yet assigned"},"forky":{"status":"resolved","repositories":{"forky":"145.0.7632.159-1"},"fixed_version":"81.0.4044.92-1","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"146.0.7680.71-1"},"fixed_version":"81.0.4044.92-1","urgency":"not yet assigned"},"trixie":{"status":"resolved","repositories":{"trixie":"143.0.7499.169-1~deb13u1","trixie-security":"145.0.7632.159-1~deb13u1"},"fixed_version":"81.0.4044.92-1","urgency":"not yet assigned"}}},"CVE-2020-6444":{"description":"Uninitialized use in WebRTC in Google Chrome prior to 81.0.4044.92 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page.","scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"143.0.7499.169-1~deb12u1","bookworm-security":"145.0.7632.159-1~deb12u1"},"fixed_version":"81.0.4044.92-1","urgency":"not yet assigned"},"bullseye":{"status":"resolved","repositories":{"bullseye":"120.0.6099.224-1~deb11u1","bullseye-security":"120.0.6099.224-1~deb11u1"},"fixed_version":"81.0.4044.92-1","urgency":"not yet assigned"},"forky":{"status":"resolved","repositories":{"forky":"145.0.7632.159-1"},"fixed_version":"81.0.4044.92-1","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"146.0.7680.71-1"},"fixed_version":"81.0.4044.92-1","urgency":"not yet assigned"},"trixie":{"status":"resolved","repositories":{"trixie":"143.0.7499.169-1~deb13u1","trixie-security":"145.0.7632.159-1~deb13u1"},"fixed_version":"81.0.4044.92-1","urgency":"not yet assigned"}}},"CVE-2020-6445":{"description":"Insufficient policy enforcement in trusted types in Google Chrome prior to 81.0.4044.92 allowed a remote attacker to bypass content security policy via a crafted HTML page.","scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"143.0.7499.169-1~deb12u1","bookworm-security":"145.0.7632.159-1~deb12u1"},"fixed_version":"81.0.4044.92-1","urgency":"not yet assigned"},"bullseye":{"status":"resolved","repositories":{"bullseye":"120.0.6099.224-1~deb11u1","bullseye-security":"120.0.6099.224-1~deb11u1"},"fixed_version":"81.0.4044.92-1","urgency":"not yet assigned"},"forky":{"status":"resolved","repositories":{"forky":"145.0.7632.159-1"},"fixed_version":"81.0.4044.92-1","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"146.0.7680.71-1"},"fixed_version":"81.0.4044.92-1","urgency":"not yet assigned"},"trixie":{"status":"resolved","repositories":{"trixie":"143.0.7499.169-1~deb13u1","trixie-security":"145.0.7632.159-1~deb13u1"},"fixed_version":"81.0.4044.92-1","urgency":"not yet assigned"}}},"CVE-2020-6446":{"description":"Insufficient policy enforcement in trusted types in Google Chrome prior to 81.0.4044.92 allowed a remote attacker to bypass content security policy via a crafted HTML page.","scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"143.0.7499.169-1~deb12u1","bookworm-security":"145.0.7632.159-1~deb12u1"},"fixed_version":"81.0.4044.92-1","urgency":"not yet assigned"},"bullseye":{"status":"resolved","repositories":{"bullseye":"120.0.6099.224-1~deb11u1","bullseye-security":"120.0.6099.224-1~deb11u1"},"fixed_version":"81.0.4044.92-1","urgency":"not yet assigned"},"forky":{"status":"resolved","repositories":{"forky":"145.0.7632.159-1"},"fixed_version":"81.0.4044.92-1","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"146.0.7680.71-1"},"fixed_version":"81.0.4044.92-1","urgency":"not yet assigned"},"trixie":{"status":"resolved","repositories":{"trixie":"143.0.7499.169-1~deb13u1","trixie-security":"145.0.7632.159-1~deb13u1"},"fixed_version":"81.0.4044.92-1","urgency":"not yet assigned"}}},"CVE-2020-6447":{"description":"Inappropriate implementation in developer tools in Google Chrome prior to 81.0.4044.92 allowed a remote attacker who had convinced the user to use devtools to potentially exploit heap corruption via a crafted HTML page.","scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"143.0.7499.169-1~deb12u1","bookworm-security":"145.0.7632.159-1~deb12u1"},"fixed_version":"81.0.4044.92-1","urgency":"not yet assigned"},"bullseye":{"status":"resolved","repositories":{"bullseye":"120.0.6099.224-1~deb11u1","bullseye-security":"120.0.6099.224-1~deb11u1"},"fixed_version":"81.0.4044.92-1","urgency":"not yet assigned"},"forky":{"status":"resolved","repositories":{"forky":"145.0.7632.159-1"},"fixed_version":"81.0.4044.92-1","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"146.0.7680.71-1"},"fixed_version":"81.0.4044.92-1","urgency":"not yet assigned"},"trixie":{"status":"resolved","repositories":{"trixie":"143.0.7499.169-1~deb13u1","trixie-security":"145.0.7632.159-1~deb13u1"},"fixed_version":"81.0.4044.92-1","urgency":"not yet assigned"}}},"CVE-2020-6448":{"description":"Use after free in V8 in Google Chrome prior to 81.0.4044.92 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page.","scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"143.0.7499.169-1~deb12u1","bookworm-security":"145.0.7632.159-1~deb12u1"},"fixed_version":"81.0.4044.92-1","urgency":"not yet assigned"},"bullseye":{"status":"resolved","repositories":{"bullseye":"120.0.6099.224-1~deb11u1","bullseye-security":"120.0.6099.224-1~deb11u1"},"fixed_version":"81.0.4044.92-1","urgency":"not yet assigned"},"forky":{"status":"resolved","repositories":{"forky":"145.0.7632.159-1"},"fixed_version":"81.0.4044.92-1","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"146.0.7680.71-1"},"fixed_version":"81.0.4044.92-1","urgency":"not yet assigned"},"trixie":{"status":"resolved","repositories":{"trixie":"143.0.7499.169-1~deb13u1","trixie-security":"145.0.7632.159-1~deb13u1"},"fixed_version":"81.0.4044.92-1","urgency":"not yet assigned"}}},"CVE-2020-6449":{"description":"Use after free in audio in Google Chrome prior to 80.0.3987.149 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page.","scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"143.0.7499.169-1~deb12u1","bookworm-security":"145.0.7632.159-1~deb12u1"},"fixed_version":"80.0.3987.149-1","urgency":"not yet assigned"},"bullseye":{"status":"resolved","repositories":{"bullseye":"120.0.6099.224-1~deb11u1","bullseye-security":"120.0.6099.224-1~deb11u1"},"fixed_version":"80.0.3987.149-1","urgency":"not yet assigned"},"forky":{"status":"resolved","repositories":{"forky":"145.0.7632.159-1"},"fixed_version":"80.0.3987.149-1","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"146.0.7680.71-1"},"fixed_version":"80.0.3987.149-1","urgency":"not yet assigned"},"trixie":{"status":"resolved","repositories":{"trixie":"143.0.7499.169-1~deb13u1","trixie-security":"145.0.7632.159-1~deb13u1"},"fixed_version":"80.0.3987.149-1","urgency":"not yet assigned"}}},"CVE-2020-6450":{"description":"Use after free in WebAudio in Google Chrome prior to 80.0.3987.162 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page.","scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"143.0.7499.169-1~deb12u1","bookworm-security":"145.0.7632.159-1~deb12u1"},"fixed_version":"80.0.3987.162-1","urgency":"not yet assigned"},"bullseye":{"status":"resolved","repositories":{"bullseye":"120.0.6099.224-1~deb11u1","bullseye-security":"120.0.6099.224-1~deb11u1"},"fixed_version":"80.0.3987.162-1","urgency":"not yet assigned"},"forky":{"status":"resolved","repositories":{"forky":"145.0.7632.159-1"},"fixed_version":"80.0.3987.162-1","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"146.0.7680.71-1"},"fixed_version":"80.0.3987.162-1","urgency":"not yet assigned"},"trixie":{"status":"resolved","repositories":{"trixie":"143.0.7499.169-1~deb13u1","trixie-security":"145.0.7632.159-1~deb13u1"},"fixed_version":"80.0.3987.162-1","urgency":"not yet assigned"}}},"CVE-2020-6451":{"description":"Use after free in WebAudio in Google Chrome prior to 80.0.3987.162 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page.","scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"143.0.7499.169-1~deb12u1","bookworm-security":"145.0.7632.159-1~deb12u1"},"fixed_version":"80.0.3987.162-1","urgency":"not yet assigned"},"bullseye":{"status":"resolved","repositories":{"bullseye":"120.0.6099.224-1~deb11u1","bullseye-security":"120.0.6099.224-1~deb11u1"},"fixed_version":"80.0.3987.162-1","urgency":"not yet assigned"},"forky":{"status":"resolved","repositories":{"forky":"145.0.7632.159-1"},"fixed_version":"80.0.3987.162-1","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"146.0.7680.71-1"},"fixed_version":"80.0.3987.162-1","urgency":"not yet assigned"},"trixie":{"status":"resolved","repositories":{"trixie":"143.0.7499.169-1~deb13u1","trixie-security":"145.0.7632.159-1~deb13u1"},"fixed_version":"80.0.3987.162-1","urgency":"not yet assigned"}}},"CVE-2020-6452":{"description":"Heap buffer overflow in media in Google Chrome prior to 80.0.3987.162 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page.","scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"143.0.7499.169-1~deb12u1","bookworm-security":"145.0.7632.159-1~deb12u1"},"fixed_version":"80.0.3987.162-1","urgency":"not yet assigned"},"bullseye":{"status":"resolved","repositories":{"bullseye":"120.0.6099.224-1~deb11u1","bullseye-security":"120.0.6099.224-1~deb11u1"},"fixed_version":"80.0.3987.162-1","urgency":"not yet assigned"},"forky":{"status":"resolved","repositories":{"forky":"145.0.7632.159-1"},"fixed_version":"80.0.3987.162-1","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"146.0.7680.71-1"},"fixed_version":"80.0.3987.162-1","urgency":"not yet assigned"},"trixie":{"status":"resolved","repositories":{"trixie":"143.0.7499.169-1~deb13u1","trixie-security":"145.0.7632.159-1~deb13u1"},"fixed_version":"80.0.3987.162-1","urgency":"not yet assigned"}}},"CVE-2020-6453":{"description":"Inappropriate implementation in V8 in Google Chrome prior to 80.0.3987.162 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page.","scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"143.0.7499.169-1~deb12u1","bookworm-security":"145.0.7632.159-1~deb12u1"},"fixed_version":"80.0.3987.162-1","urgency":"not yet assigned"},"bullseye":{"status":"resolved","repositories":{"bullseye":"120.0.6099.224-1~deb11u1","bullseye-security":"120.0.6099.224-1~deb11u1"},"fixed_version":"80.0.3987.162-1","urgency":"not yet assigned"},"forky":{"status":"resolved","repositories":{"forky":"145.0.7632.159-1"},"fixed_version":"80.0.3987.162-1","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"146.0.7680.71-1"},"fixed_version":"80.0.3987.162-1","urgency":"not yet assigned"},"trixie":{"status":"resolved","repositories":{"trixie":"143.0.7499.169-1~deb13u1","trixie-security":"145.0.7632.159-1~deb13u1"},"fixed_version":"80.0.3987.162-1","urgency":"not yet assigned"}}},"CVE-2020-6454":{"description":"Use after free in extensions in Google Chrome prior to 81.0.4044.92 allowed an attacker who convinced a user to install a malicious extension to potentially exploit heap corruption via a crafted Chrome Extension.","scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"143.0.7499.169-1~deb12u1","bookworm-security":"145.0.7632.159-1~deb12u1"},"fixed_version":"81.0.4044.92-1","urgency":"not yet assigned"},"bullseye":{"status":"resolved","repositories":{"bullseye":"120.0.6099.224-1~deb11u1","bullseye-security":"120.0.6099.224-1~deb11u1"},"fixed_version":"81.0.4044.92-1","urgency":"not yet assigned"},"forky":{"status":"resolved","repositories":{"forky":"145.0.7632.159-1"},"fixed_version":"81.0.4044.92-1","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"146.0.7680.71-1"},"fixed_version":"81.0.4044.92-1","urgency":"not yet assigned"},"trixie":{"status":"resolved","repositories":{"trixie":"143.0.7499.169-1~deb13u1","trixie-security":"145.0.7632.159-1~deb13u1"},"fixed_version":"81.0.4044.92-1","urgency":"not yet assigned"}}},"CVE-2020-6455":{"description":"Out of bounds read in WebSQL in Google Chrome prior to 81.0.4044.92 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page.","scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"143.0.7499.169-1~deb12u1","bookworm-security":"145.0.7632.159-1~deb12u1"},"fixed_version":"81.0.4044.92-1","urgency":"not yet assigned"},"bullseye":{"status":"resolved","repositories":{"bullseye":"120.0.6099.224-1~deb11u1","bullseye-security":"120.0.6099.224-1~deb11u1"},"fixed_version":"81.0.4044.92-1","urgency":"not yet assigned"},"forky":{"status":"resolved","repositories":{"forky":"145.0.7632.159-1"},"fixed_version":"81.0.4044.92-1","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"146.0.7680.71-1"},"fixed_version":"81.0.4044.92-1","urgency":"not yet assigned"},"trixie":{"status":"resolved","repositories":{"trixie":"143.0.7499.169-1~deb13u1","trixie-security":"145.0.7632.159-1~deb13u1"},"fixed_version":"81.0.4044.92-1","urgency":"not yet assigned"}}},"CVE-2020-6456":{"description":"Insufficient validation of untrusted input in clipboard in Google Chrome prior to 81.0.4044.92 allowed a local attacker to bypass site isolation via crafted clipboard contents.","scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"143.0.7499.169-1~deb12u1","bookworm-security":"145.0.7632.159-1~deb12u1"},"fixed_version":"81.0.4044.92-1","urgency":"not yet assigned"},"bullseye":{"status":"resolved","repositories":{"bullseye":"120.0.6099.224-1~deb11u1","bullseye-security":"120.0.6099.224-1~deb11u1"},"fixed_version":"81.0.4044.92-1","urgency":"not yet assigned"},"forky":{"status":"resolved","repositories":{"forky":"145.0.7632.159-1"},"fixed_version":"81.0.4044.92-1","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"146.0.7680.71-1"},"fixed_version":"81.0.4044.92-1","urgency":"not yet assigned"},"trixie":{"status":"resolved","repositories":{"trixie":"143.0.7499.169-1~deb13u1","trixie-security":"145.0.7632.159-1~deb13u1"},"fixed_version":"81.0.4044.92-1","urgency":"not yet assigned"}}},"CVE-2020-6457":{"description":"Use after free in speech recognizer in Google Chrome prior to 81.0.4044.113 allowed a remote attacker to potentially perform a sandbox escape via a crafted HTML page.","debianbug":958450,"scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"143.0.7499.169-1~deb12u1","bookworm-security":"145.0.7632.159-1~deb12u1"},"fixed_version":"83.0.4103.83-1","urgency":"not yet assigned"},"bullseye":{"status":"resolved","repositories":{"bullseye":"120.0.6099.224-1~deb11u1","bullseye-security":"120.0.6099.224-1~deb11u1"},"fixed_version":"83.0.4103.83-1","urgency":"not yet assigned"},"forky":{"status":"resolved","repositories":{"forky":"145.0.7632.159-1"},"fixed_version":"83.0.4103.83-1","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"146.0.7680.71-1"},"fixed_version":"83.0.4103.83-1","urgency":"not yet assigned"},"trixie":{"status":"resolved","repositories":{"trixie":"143.0.7499.169-1~deb13u1","trixie-security":"145.0.7632.159-1~deb13u1"},"fixed_version":"83.0.4103.83-1","urgency":"not yet assigned"}}},"CVE-2020-6458":{"description":"Out of bounds read and write in PDFium in Google Chrome prior to 81.0.4044.122 allowed a remote attacker to potentially exploit heap corruption via a crafted PDF file.","scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"143.0.7499.169-1~deb12u1","bookworm-security":"145.0.7632.159-1~deb12u1"},"fixed_version":"83.0.4103.83-1","urgency":"not yet assigned"},"bullseye":{"status":"resolved","repositories":{"bullseye":"120.0.6099.224-1~deb11u1","bullseye-security":"120.0.6099.224-1~deb11u1"},"fixed_version":"83.0.4103.83-1","urgency":"not yet assigned"},"forky":{"status":"resolved","repositories":{"forky":"145.0.7632.159-1"},"fixed_version":"83.0.4103.83-1","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"146.0.7680.71-1"},"fixed_version":"83.0.4103.83-1","urgency":"not yet assigned"},"trixie":{"status":"resolved","repositories":{"trixie":"143.0.7499.169-1~deb13u1","trixie-security":"145.0.7632.159-1~deb13u1"},"fixed_version":"83.0.4103.83-1","urgency":"not yet assigned"}}},"CVE-2020-6459":{"description":"Use after free in payments in Google Chrome prior to 81.0.4044.122 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page.","scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"143.0.7499.169-1~deb12u1","bookworm-security":"145.0.7632.159-1~deb12u1"},"fixed_version":"83.0.4103.83-1","urgency":"not yet assigned"},"bullseye":{"status":"resolved","repositories":{"bullseye":"120.0.6099.224-1~deb11u1","bullseye-security":"120.0.6099.224-1~deb11u1"},"fixed_version":"83.0.4103.83-1","urgency":"not yet assigned"},"forky":{"status":"resolved","repositories":{"forky":"145.0.7632.159-1"},"fixed_version":"83.0.4103.83-1","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"146.0.7680.71-1"},"fixed_version":"83.0.4103.83-1","urgency":"not yet assigned"},"trixie":{"status":"resolved","repositories":{"trixie":"143.0.7499.169-1~deb13u1","trixie-security":"145.0.7632.159-1~deb13u1"},"fixed_version":"83.0.4103.83-1","urgency":"not yet assigned"}}},"CVE-2020-6460":{"description":"Insufficient data validation in URL formatting in Google Chrome prior to 81.0.4044.122 allowed a remote attacker to perform domain spoofing via a crafted domain name.","scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"143.0.7499.169-1~deb12u1","bookworm-security":"145.0.7632.159-1~deb12u1"},"fixed_version":"83.0.4103.83-1","urgency":"not yet assigned"},"bullseye":{"status":"resolved","repositories":{"bullseye":"120.0.6099.224-1~deb11u1","bullseye-security":"120.0.6099.224-1~deb11u1"},"fixed_version":"83.0.4103.83-1","urgency":"not yet assigned"},"forky":{"status":"resolved","repositories":{"forky":"145.0.7632.159-1"},"fixed_version":"83.0.4103.83-1","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"146.0.7680.71-1"},"fixed_version":"83.0.4103.83-1","urgency":"not yet assigned"},"trixie":{"status":"resolved","repositories":{"trixie":"143.0.7499.169-1~deb13u1","trixie-security":"145.0.7632.159-1~deb13u1"},"fixed_version":"83.0.4103.83-1","urgency":"not yet assigned"}}},"CVE-2020-6461":{"description":"Use after free in storage in Google Chrome prior to 81.0.4044.129 allowed a remote attacker who had compromised the renderer process to potentially perform a sandbox escape via a crafted HTML page.","scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"143.0.7499.169-1~deb12u1","bookworm-security":"145.0.7632.159-1~deb12u1"},"fixed_version":"83.0.4103.83-1","urgency":"not yet assigned"},"bullseye":{"status":"resolved","repositories":{"bullseye":"120.0.6099.224-1~deb11u1","bullseye-security":"120.0.6099.224-1~deb11u1"},"fixed_version":"83.0.4103.83-1","urgency":"not yet assigned"},"forky":{"status":"resolved","repositories":{"forky":"145.0.7632.159-1"},"fixed_version":"83.0.4103.83-1","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"146.0.7680.71-1"},"fixed_version":"83.0.4103.83-1","urgency":"not yet assigned"},"trixie":{"status":"resolved","repositories":{"trixie":"143.0.7499.169-1~deb13u1","trixie-security":"145.0.7632.159-1~deb13u1"},"fixed_version":"83.0.4103.83-1","urgency":"not yet assigned"}}},"CVE-2020-6462":{"description":"Use after free in task scheduling in Google Chrome prior to 81.0.4044.129 allowed a remote attacker who had compromised the renderer process to potentially perform a sandbox escape via a crafted HTML page.","scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"143.0.7499.169-1~deb12u1","bookworm-security":"145.0.7632.159-1~deb12u1"},"fixed_version":"83.0.4103.83-1","urgency":"not yet assigned"},"bullseye":{"status":"resolved","repositories":{"bullseye":"120.0.6099.224-1~deb11u1","bullseye-security":"120.0.6099.224-1~deb11u1"},"fixed_version":"83.0.4103.83-1","urgency":"not yet assigned"},"forky":{"status":"resolved","repositories":{"forky":"145.0.7632.159-1"},"fixed_version":"83.0.4103.83-1","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"146.0.7680.71-1"},"fixed_version":"83.0.4103.83-1","urgency":"not yet assigned"},"trixie":{"status":"resolved","repositories":{"trixie":"143.0.7499.169-1~deb13u1","trixie-security":"145.0.7632.159-1~deb13u1"},"fixed_version":"83.0.4103.83-1","urgency":"not yet assigned"}}},"CVE-2020-6463":{"description":"Use after free in ANGLE in Google Chrome prior to 81.0.4044.122 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page.","scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"143.0.7499.169-1~deb12u1","bookworm-security":"145.0.7632.159-1~deb12u1"},"fixed_version":"83.0.4103.83-1","urgency":"not yet assigned"},"bullseye":{"status":"resolved","repositories":{"bullseye":"120.0.6099.224-1~deb11u1","bullseye-security":"120.0.6099.224-1~deb11u1"},"fixed_version":"83.0.4103.83-1","urgency":"not yet assigned"},"forky":{"status":"resolved","repositories":{"forky":"145.0.7632.159-1"},"fixed_version":"83.0.4103.83-1","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"146.0.7680.71-1"},"fixed_version":"83.0.4103.83-1","urgency":"not yet assigned"},"trixie":{"status":"resolved","repositories":{"trixie":"143.0.7499.169-1~deb13u1","trixie-security":"145.0.7632.159-1~deb13u1"},"fixed_version":"83.0.4103.83-1","urgency":"not yet assigned"}}},"CVE-2020-6464":{"description":"Type confusion in Blink in Google Chrome prior to 81.0.4044.138 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page.","scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"143.0.7499.169-1~deb12u1","bookworm-security":"145.0.7632.159-1~deb12u1"},"fixed_version":"83.0.4103.83-1","urgency":"not yet assigned"},"bullseye":{"status":"resolved","repositories":{"bullseye":"120.0.6099.224-1~deb11u1","bullseye-security":"120.0.6099.224-1~deb11u1"},"fixed_version":"83.0.4103.83-1","urgency":"not yet assigned"},"forky":{"status":"resolved","repositories":{"forky":"145.0.7632.159-1"},"fixed_version":"83.0.4103.83-1","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"146.0.7680.71-1"},"fixed_version":"83.0.4103.83-1","urgency":"not yet assigned"},"trixie":{"status":"resolved","repositories":{"trixie":"143.0.7499.169-1~deb13u1","trixie-security":"145.0.7632.159-1~deb13u1"},"fixed_version":"83.0.4103.83-1","urgency":"not yet assigned"}}},"CVE-2020-6465":{"description":"Use after free in reader mode in Google Chrome on Android prior to 83.0.4103.61 allowed a remote attacker who had compromised the renderer process to potentially perform a sandbox escape via a crafted HTML page.","scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"143.0.7499.169-1~deb12u1","bookworm-security":"145.0.7632.159-1~deb12u1"},"fixed_version":"83.0.4103.83-1","urgency":"not yet assigned"},"bullseye":{"status":"resolved","repositories":{"bullseye":"120.0.6099.224-1~deb11u1","bullseye-security":"120.0.6099.224-1~deb11u1"},"fixed_version":"83.0.4103.83-1","urgency":"not yet assigned"},"forky":{"status":"resolved","repositories":{"forky":"145.0.7632.159-1"},"fixed_version":"83.0.4103.83-1","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"146.0.7680.71-1"},"fixed_version":"83.0.4103.83-1","urgency":"not yet assigned"},"trixie":{"status":"resolved","repositories":{"trixie":"143.0.7499.169-1~deb13u1","trixie-security":"145.0.7632.159-1~deb13u1"},"fixed_version":"83.0.4103.83-1","urgency":"not yet assigned"}}},"CVE-2020-6466":{"description":"Use after free in media in Google Chrome prior to 83.0.4103.61 allowed a remote attacker who had compromised the renderer process to potentially perform a sandbox escape via a crafted HTML page.","scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"143.0.7499.169-1~deb12u1","bookworm-security":"145.0.7632.159-1~deb12u1"},"fixed_version":"83.0.4103.83-1","urgency":"not yet assigned"},"bullseye":{"status":"resolved","repositories":{"bullseye":"120.0.6099.224-1~deb11u1","bullseye-security":"120.0.6099.224-1~deb11u1"},"fixed_version":"83.0.4103.83-1","urgency":"not yet assigned"},"forky":{"status":"resolved","repositories":{"forky":"145.0.7632.159-1"},"fixed_version":"83.0.4103.83-1","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"146.0.7680.71-1"},"fixed_version":"83.0.4103.83-1","urgency":"not yet assigned"},"trixie":{"status":"resolved","repositories":{"trixie":"143.0.7499.169-1~deb13u1","trixie-security":"145.0.7632.159-1~deb13u1"},"fixed_version":"83.0.4103.83-1","urgency":"not yet assigned"}}},"CVE-2020-6467":{"description":"Use after free in WebRTC in Google Chrome prior to 83.0.4103.61 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page.","scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"143.0.7499.169-1~deb12u1","bookworm-security":"145.0.7632.159-1~deb12u1"},"fixed_version":"83.0.4103.83-1","urgency":"not yet assigned"},"bullseye":{"status":"resolved","repositories":{"bullseye":"120.0.6099.224-1~deb11u1","bullseye-security":"120.0.6099.224-1~deb11u1"},"fixed_version":"83.0.4103.83-1","urgency":"not yet assigned"},"forky":{"status":"resolved","repositories":{"forky":"145.0.7632.159-1"},"fixed_version":"83.0.4103.83-1","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"146.0.7680.71-1"},"fixed_version":"83.0.4103.83-1","urgency":"not yet assigned"},"trixie":{"status":"resolved","repositories":{"trixie":"143.0.7499.169-1~deb13u1","trixie-security":"145.0.7632.159-1~deb13u1"},"fixed_version":"83.0.4103.83-1","urgency":"not yet assigned"}}},"CVE-2020-6468":{"description":"Type confusion in V8 in Google Chrome prior to 83.0.4103.61 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page.","scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"143.0.7499.169-1~deb12u1","bookworm-security":"145.0.7632.159-1~deb12u1"},"fixed_version":"83.0.4103.83-1","urgency":"not yet assigned"},"bullseye":{"status":"resolved","repositories":{"bullseye":"120.0.6099.224-1~deb11u1","bullseye-security":"120.0.6099.224-1~deb11u1"},"fixed_version":"83.0.4103.83-1","urgency":"not yet assigned"},"forky":{"status":"resolved","repositories":{"forky":"145.0.7632.159-1"},"fixed_version":"83.0.4103.83-1","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"146.0.7680.71-1"},"fixed_version":"83.0.4103.83-1","urgency":"not yet assigned"},"trixie":{"status":"resolved","repositories":{"trixie":"143.0.7499.169-1~deb13u1","trixie-security":"145.0.7632.159-1~deb13u1"},"fixed_version":"83.0.4103.83-1","urgency":"not yet assigned"}}},"CVE-2020-6469":{"description":"Insufficient policy enforcement in developer tools in Google Chrome prior to 83.0.4103.61 allowed an attacker who convinced a user to install a malicious extension to potentially perform a sandbox escape via a crafted Chrome Extension.","scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"143.0.7499.169-1~deb12u1","bookworm-security":"145.0.7632.159-1~deb12u1"},"fixed_version":"83.0.4103.83-1","urgency":"not yet assigned"},"bullseye":{"status":"resolved","repositories":{"bullseye":"120.0.6099.224-1~deb11u1","bullseye-security":"120.0.6099.224-1~deb11u1"},"fixed_version":"83.0.4103.83-1","urgency":"not yet assigned"},"forky":{"status":"resolved","repositories":{"forky":"145.0.7632.159-1"},"fixed_version":"83.0.4103.83-1","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"146.0.7680.71-1"},"fixed_version":"83.0.4103.83-1","urgency":"not yet assigned"},"trixie":{"status":"resolved","repositories":{"trixie":"143.0.7499.169-1~deb13u1","trixie-security":"145.0.7632.159-1~deb13u1"},"fixed_version":"83.0.4103.83-1","urgency":"not yet assigned"}}},"CVE-2020-6470":{"description":"Insufficient validation of untrusted input in clipboard in Google Chrome prior to 83.0.4103.61 allowed a local attacker to inject arbitrary scripts or HTML (UXSS) via crafted clipboard contents.","scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"143.0.7499.169-1~deb12u1","bookworm-security":"145.0.7632.159-1~deb12u1"},"fixed_version":"83.0.4103.83-1","urgency":"not yet assigned"},"bullseye":{"status":"resolved","repositories":{"bullseye":"120.0.6099.224-1~deb11u1","bullseye-security":"120.0.6099.224-1~deb11u1"},"fixed_version":"83.0.4103.83-1","urgency":"not yet assigned"},"forky":{"status":"resolved","repositories":{"forky":"145.0.7632.159-1"},"fixed_version":"83.0.4103.83-1","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"146.0.7680.71-1"},"fixed_version":"83.0.4103.83-1","urgency":"not yet assigned"},"trixie":{"status":"resolved","repositories":{"trixie":"143.0.7499.169-1~deb13u1","trixie-security":"145.0.7632.159-1~deb13u1"},"fixed_version":"83.0.4103.83-1","urgency":"not yet assigned"}}},"CVE-2020-6471":{"description":"Insufficient policy enforcement in developer tools in Google Chrome prior to 83.0.4103.61 allowed an attacker who convinced a user to install a malicious extension to potentially perform a sandbox escape via a crafted Chrome Extension.","scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"143.0.7499.169-1~deb12u1","bookworm-security":"145.0.7632.159-1~deb12u1"},"fixed_version":"83.0.4103.83-1","urgency":"not yet assigned"},"bullseye":{"status":"resolved","repositories":{"bullseye":"120.0.6099.224-1~deb11u1","bullseye-security":"120.0.6099.224-1~deb11u1"},"fixed_version":"83.0.4103.83-1","urgency":"not yet assigned"},"forky":{"status":"resolved","repositories":{"forky":"145.0.7632.159-1"},"fixed_version":"83.0.4103.83-1","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"146.0.7680.71-1"},"fixed_version":"83.0.4103.83-1","urgency":"not yet assigned"},"trixie":{"status":"resolved","repositories":{"trixie":"143.0.7499.169-1~deb13u1","trixie-security":"145.0.7632.159-1~deb13u1"},"fixed_version":"83.0.4103.83-1","urgency":"not yet assigned"}}},"CVE-2020-6472":{"description":"Insufficient policy enforcement in developer tools in Google Chrome prior to 83.0.4103.61 allowed an attacker who convinced a user to install a malicious extension to obtain potentially sensitive information from process memory or disk via a crafted Chrome Extension.","scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"143.0.7499.169-1~deb12u1","bookworm-security":"145.0.7632.159-1~deb12u1"},"fixed_version":"83.0.4103.83-1","urgency":"not yet assigned"},"bullseye":{"status":"resolved","repositories":{"bullseye":"120.0.6099.224-1~deb11u1","bullseye-security":"120.0.6099.224-1~deb11u1"},"fixed_version":"83.0.4103.83-1","urgency":"not yet assigned"},"forky":{"status":"resolved","repositories":{"forky":"145.0.7632.159-1"},"fixed_version":"83.0.4103.83-1","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"146.0.7680.71-1"},"fixed_version":"83.0.4103.83-1","urgency":"not yet assigned"},"trixie":{"status":"resolved","repositories":{"trixie":"143.0.7499.169-1~deb13u1","trixie-security":"145.0.7632.159-1~deb13u1"},"fixed_version":"83.0.4103.83-1","urgency":"not yet assigned"}}},"CVE-2020-6473":{"description":"Insufficient policy enforcement in Blink in Google Chrome prior to 83.0.4103.61 allowed a remote attacker to obtain potentially sensitive information from process memory via a crafted HTML page.","scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"143.0.7499.169-1~deb12u1","bookworm-security":"145.0.7632.159-1~deb12u1"},"fixed_version":"83.0.4103.83-1","urgency":"not yet assigned"},"bullseye":{"status":"resolved","repositories":{"bullseye":"120.0.6099.224-1~deb11u1","bullseye-security":"120.0.6099.224-1~deb11u1"},"fixed_version":"83.0.4103.83-1","urgency":"not yet assigned"},"forky":{"status":"resolved","repositories":{"forky":"145.0.7632.159-1"},"fixed_version":"83.0.4103.83-1","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"146.0.7680.71-1"},"fixed_version":"83.0.4103.83-1","urgency":"not yet assigned"},"trixie":{"status":"resolved","repositories":{"trixie":"143.0.7499.169-1~deb13u1","trixie-security":"145.0.7632.159-1~deb13u1"},"fixed_version":"83.0.4103.83-1","urgency":"not yet assigned"}}},"CVE-2020-6474":{"description":"Use after free in Blink in Google Chrome prior to 83.0.4103.61 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page.","scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"143.0.7499.169-1~deb12u1","bookworm-security":"145.0.7632.159-1~deb12u1"},"fixed_version":"83.0.4103.83-1","urgency":"not yet assigned"},"bullseye":{"status":"resolved","repositories":{"bullseye":"120.0.6099.224-1~deb11u1","bullseye-security":"120.0.6099.224-1~deb11u1"},"fixed_version":"83.0.4103.83-1","urgency":"not yet assigned"},"forky":{"status":"resolved","repositories":{"forky":"145.0.7632.159-1"},"fixed_version":"83.0.4103.83-1","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"146.0.7680.71-1"},"fixed_version":"83.0.4103.83-1","urgency":"not yet assigned"},"trixie":{"status":"resolved","repositories":{"trixie":"143.0.7499.169-1~deb13u1","trixie-security":"145.0.7632.159-1~deb13u1"},"fixed_version":"83.0.4103.83-1","urgency":"not yet assigned"}}},"CVE-2020-6475":{"description":"Incorrect implementation in full screen in Google Chrome prior to 83.0.4103.61 allowed a remote attacker to spoof security UI via a crafted HTML page.","scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"143.0.7499.169-1~deb12u1","bookworm-security":"145.0.7632.159-1~deb12u1"},"fixed_version":"83.0.4103.83-1","urgency":"not yet assigned"},"bullseye":{"status":"resolved","repositories":{"bullseye":"120.0.6099.224-1~deb11u1","bullseye-security":"120.0.6099.224-1~deb11u1"},"fixed_version":"83.0.4103.83-1","urgency":"not yet assigned"},"forky":{"status":"resolved","repositories":{"forky":"145.0.7632.159-1"},"fixed_version":"83.0.4103.83-1","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"146.0.7680.71-1"},"fixed_version":"83.0.4103.83-1","urgency":"not yet assigned"},"trixie":{"status":"resolved","repositories":{"trixie":"143.0.7499.169-1~deb13u1","trixie-security":"145.0.7632.159-1~deb13u1"},"fixed_version":"83.0.4103.83-1","urgency":"not yet assigned"}}},"CVE-2020-6476":{"description":"Insufficient policy enforcement in tab strip in Google Chrome prior to 83.0.4103.61 allowed an attacker who convinced a user to install a malicious extension to bypass navigation restrictions via a crafted Chrome Extension.","scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"143.0.7499.169-1~deb12u1","bookworm-security":"145.0.7632.159-1~deb12u1"},"fixed_version":"83.0.4103.83-1","urgency":"not yet assigned"},"bullseye":{"status":"resolved","repositories":{"bullseye":"120.0.6099.224-1~deb11u1","bullseye-security":"120.0.6099.224-1~deb11u1"},"fixed_version":"83.0.4103.83-1","urgency":"not yet assigned"},"forky":{"status":"resolved","repositories":{"forky":"145.0.7632.159-1"},"fixed_version":"83.0.4103.83-1","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"146.0.7680.71-1"},"fixed_version":"83.0.4103.83-1","urgency":"not yet assigned"},"trixie":{"status":"resolved","repositories":{"trixie":"143.0.7499.169-1~deb13u1","trixie-security":"145.0.7632.159-1~deb13u1"},"fixed_version":"83.0.4103.83-1","urgency":"not yet assigned"}}},"CVE-2020-6477":{"description":"Inappropriate implementation in installer in Google Chrome on OS X prior to 83.0.4103.61 allowed a local attacker to perform privilege escalation via a crafted file.","scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"143.0.7499.169-1~deb12u1","bookworm-security":"145.0.7632.159-1~deb12u1"},"fixed_version":"0","urgency":"unimportant"},"bullseye":{"status":"resolved","repositories":{"bullseye":"120.0.6099.224-1~deb11u1","bullseye-security":"120.0.6099.224-1~deb11u1"},"fixed_version":"0","urgency":"unimportant"},"forky":{"status":"resolved","repositories":{"forky":"145.0.7632.159-1"},"fixed_version":"0","urgency":"unimportant"},"sid":{"status":"resolved","repositories":{"sid":"146.0.7680.71-1"},"fixed_version":"0","urgency":"unimportant"},"trixie":{"status":"resolved","repositories":{"trixie":"143.0.7499.169-1~deb13u1","trixie-security":"145.0.7632.159-1~deb13u1"},"fixed_version":"0","urgency":"unimportant"}}},"CVE-2020-6478":{"description":"Inappropriate implementation in full screen in Google Chrome prior to 83.0.4103.61 allowed a remote attacker to spoof security UI via a crafted HTML page.","scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"143.0.7499.169-1~deb12u1","bookworm-security":"145.0.7632.159-1~deb12u1"},"fixed_version":"83.0.4103.83-1","urgency":"not yet assigned"},"bullseye":{"status":"resolved","repositories":{"bullseye":"120.0.6099.224-1~deb11u1","bullseye-security":"120.0.6099.224-1~deb11u1"},"fixed_version":"83.0.4103.83-1","urgency":"not yet assigned"},"forky":{"status":"resolved","repositories":{"forky":"145.0.7632.159-1"},"fixed_version":"83.0.4103.83-1","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"146.0.7680.71-1"},"fixed_version":"83.0.4103.83-1","urgency":"not yet assigned"},"trixie":{"status":"resolved","repositories":{"trixie":"143.0.7499.169-1~deb13u1","trixie-security":"145.0.7632.159-1~deb13u1"},"fixed_version":"83.0.4103.83-1","urgency":"not yet assigned"}}},"CVE-2020-6479":{"description":"Inappropriate implementation in sharing in Google Chrome prior to 83.0.4103.61 allowed a remote attacker to spoof security UI via a crafted HTML page.","scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"143.0.7499.169-1~deb12u1","bookworm-security":"145.0.7632.159-1~deb12u1"},"fixed_version":"83.0.4103.83-1","urgency":"not yet assigned"},"bullseye":{"status":"resolved","repositories":{"bullseye":"120.0.6099.224-1~deb11u1","bullseye-security":"120.0.6099.224-1~deb11u1"},"fixed_version":"83.0.4103.83-1","urgency":"not yet assigned"},"forky":{"status":"resolved","repositories":{"forky":"145.0.7632.159-1"},"fixed_version":"83.0.4103.83-1","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"146.0.7680.71-1"},"fixed_version":"83.0.4103.83-1","urgency":"not yet assigned"},"trixie":{"status":"resolved","repositories":{"trixie":"143.0.7499.169-1~deb13u1","trixie-security":"145.0.7632.159-1~deb13u1"},"fixed_version":"83.0.4103.83-1","urgency":"not yet assigned"}}},"CVE-2020-6480":{"description":"Insufficient policy enforcement in enterprise in Google Chrome prior to 83.0.4103.61 allowed a local attacker to bypass navigation restrictions via UI actions.","scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"143.0.7499.169-1~deb12u1","bookworm-security":"145.0.7632.159-1~deb12u1"},"fixed_version":"83.0.4103.83-1","urgency":"not yet assigned"},"bullseye":{"status":"resolved","repositories":{"bullseye":"120.0.6099.224-1~deb11u1","bullseye-security":"120.0.6099.224-1~deb11u1"},"fixed_version":"83.0.4103.83-1","urgency":"not yet assigned"},"forky":{"status":"resolved","repositories":{"forky":"145.0.7632.159-1"},"fixed_version":"83.0.4103.83-1","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"146.0.7680.71-1"},"fixed_version":"83.0.4103.83-1","urgency":"not yet assigned"},"trixie":{"status":"resolved","repositories":{"trixie":"143.0.7499.169-1~deb13u1","trixie-security":"145.0.7632.159-1~deb13u1"},"fixed_version":"83.0.4103.83-1","urgency":"not yet assigned"}}},"CVE-2020-6481":{"description":"Insufficient policy enforcement in URL formatting in Google Chrome prior to 83.0.4103.61 allowed a remote attacker to perform domain spoofing via a crafted domain name.","scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"143.0.7499.169-1~deb12u1","bookworm-security":"145.0.7632.159-1~deb12u1"},"fixed_version":"83.0.4103.83-1","urgency":"not yet assigned"},"bullseye":{"status":"resolved","repositories":{"bullseye":"120.0.6099.224-1~deb11u1","bullseye-security":"120.0.6099.224-1~deb11u1"},"fixed_version":"83.0.4103.83-1","urgency":"not yet assigned"},"forky":{"status":"resolved","repositories":{"forky":"145.0.7632.159-1"},"fixed_version":"83.0.4103.83-1","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"146.0.7680.71-1"},"fixed_version":"83.0.4103.83-1","urgency":"not yet assigned"},"trixie":{"status":"resolved","repositories":{"trixie":"143.0.7499.169-1~deb13u1","trixie-security":"145.0.7632.159-1~deb13u1"},"fixed_version":"83.0.4103.83-1","urgency":"not yet assigned"}}},"CVE-2020-6482":{"description":"Insufficient policy enforcement in developer tools in Google Chrome prior to 83.0.4103.61 allowed an attacker who convinced a user to install a malicious extension to bypass navigation restrictions via a crafted Chrome Extension.","scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"143.0.7499.169-1~deb12u1","bookworm-security":"145.0.7632.159-1~deb12u1"},"fixed_version":"83.0.4103.83-1","urgency":"not yet assigned"},"bullseye":{"status":"resolved","repositories":{"bullseye":"120.0.6099.224-1~deb11u1","bullseye-security":"120.0.6099.224-1~deb11u1"},"fixed_version":"83.0.4103.83-1","urgency":"not yet assigned"},"forky":{"status":"resolved","repositories":{"forky":"145.0.7632.159-1"},"fixed_version":"83.0.4103.83-1","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"146.0.7680.71-1"},"fixed_version":"83.0.4103.83-1","urgency":"not yet assigned"},"trixie":{"status":"resolved","repositories":{"trixie":"143.0.7499.169-1~deb13u1","trixie-security":"145.0.7632.159-1~deb13u1"},"fixed_version":"83.0.4103.83-1","urgency":"not yet assigned"}}},"CVE-2020-6483":{"description":"Insufficient policy enforcement in payments in Google Chrome prior to 83.0.4103.61 allowed a remote attacker to bypass navigation restrictions via a crafted HTML page.","scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"143.0.7499.169-1~deb12u1","bookworm-security":"145.0.7632.159-1~deb12u1"},"fixed_version":"83.0.4103.83-1","urgency":"not yet assigned"},"bullseye":{"status":"resolved","repositories":{"bullseye":"120.0.6099.224-1~deb11u1","bullseye-security":"120.0.6099.224-1~deb11u1"},"fixed_version":"83.0.4103.83-1","urgency":"not yet assigned"},"forky":{"status":"resolved","repositories":{"forky":"145.0.7632.159-1"},"fixed_version":"83.0.4103.83-1","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"146.0.7680.71-1"},"fixed_version":"83.0.4103.83-1","urgency":"not yet assigned"},"trixie":{"status":"resolved","repositories":{"trixie":"143.0.7499.169-1~deb13u1","trixie-security":"145.0.7632.159-1~deb13u1"},"fixed_version":"83.0.4103.83-1","urgency":"not yet assigned"}}},"CVE-2020-6484":{"description":"Insufficient data validation in ChromeDriver in Google Chrome prior to 83.0.4103.61 allowed a remote attacker to bypass navigation restrictions via a crafted request.","scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"143.0.7499.169-1~deb12u1","bookworm-security":"145.0.7632.159-1~deb12u1"},"fixed_version":"83.0.4103.83-1","urgency":"not yet assigned"},"bullseye":{"status":"resolved","repositories":{"bullseye":"120.0.6099.224-1~deb11u1","bullseye-security":"120.0.6099.224-1~deb11u1"},"fixed_version":"83.0.4103.83-1","urgency":"not yet assigned"},"forky":{"status":"resolved","repositories":{"forky":"145.0.7632.159-1"},"fixed_version":"83.0.4103.83-1","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"146.0.7680.71-1"},"fixed_version":"83.0.4103.83-1","urgency":"not yet assigned"},"trixie":{"status":"resolved","repositories":{"trixie":"143.0.7499.169-1~deb13u1","trixie-security":"145.0.7632.159-1~deb13u1"},"fixed_version":"83.0.4103.83-1","urgency":"not yet assigned"}}},"CVE-2020-6485":{"description":"Insufficient data validation in media router in Google Chrome prior to 83.0.4103.61 allowed a remote attacker who had compromised the renderer process to bypass navigation restrictions via a crafted HTML page.","scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"143.0.7499.169-1~deb12u1","bookworm-security":"145.0.7632.159-1~deb12u1"},"fixed_version":"83.0.4103.83-1","urgency":"not yet assigned"},"bullseye":{"status":"resolved","repositories":{"bullseye":"120.0.6099.224-1~deb11u1","bullseye-security":"120.0.6099.224-1~deb11u1"},"fixed_version":"83.0.4103.83-1","urgency":"not yet assigned"},"forky":{"status":"resolved","repositories":{"forky":"145.0.7632.159-1"},"fixed_version":"83.0.4103.83-1","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"146.0.7680.71-1"},"fixed_version":"83.0.4103.83-1","urgency":"not yet assigned"},"trixie":{"status":"resolved","repositories":{"trixie":"143.0.7499.169-1~deb13u1","trixie-security":"145.0.7632.159-1~deb13u1"},"fixed_version":"83.0.4103.83-1","urgency":"not yet assigned"}}},"CVE-2020-6486":{"description":"Insufficient policy enforcement in navigations in Google Chrome prior to 83.0.4103.61 allowed a remote attacker to bypass navigation restrictions via a crafted HTML page.","scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"143.0.7499.169-1~deb12u1","bookworm-security":"145.0.7632.159-1~deb12u1"},"fixed_version":"83.0.4103.83-1","urgency":"not yet assigned"},"bullseye":{"status":"resolved","repositories":{"bullseye":"120.0.6099.224-1~deb11u1","bullseye-security":"120.0.6099.224-1~deb11u1"},"fixed_version":"83.0.4103.83-1","urgency":"not yet assigned"},"forky":{"status":"resolved","repositories":{"forky":"145.0.7632.159-1"},"fixed_version":"83.0.4103.83-1","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"146.0.7680.71-1"},"fixed_version":"83.0.4103.83-1","urgency":"not yet assigned"},"trixie":{"status":"resolved","repositories":{"trixie":"143.0.7499.169-1~deb13u1","trixie-security":"145.0.7632.159-1~deb13u1"},"fixed_version":"83.0.4103.83-1","urgency":"not yet assigned"}}},"CVE-2020-6487":{"description":"Insufficient policy enforcement in downloads in Google Chrome prior to 83.0.4103.61 allowed a remote attacker to bypass navigation restrictions via a crafted HTML page.","scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"143.0.7499.169-1~deb12u1","bookworm-security":"145.0.7632.159-1~deb12u1"},"fixed_version":"83.0.4103.83-1","urgency":"not yet assigned"},"bullseye":{"status":"resolved","repositories":{"bullseye":"120.0.6099.224-1~deb11u1","bullseye-security":"120.0.6099.224-1~deb11u1"},"fixed_version":"83.0.4103.83-1","urgency":"not yet assigned"},"forky":{"status":"resolved","repositories":{"forky":"145.0.7632.159-1"},"fixed_version":"83.0.4103.83-1","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"146.0.7680.71-1"},"fixed_version":"83.0.4103.83-1","urgency":"not yet assigned"},"trixie":{"status":"resolved","repositories":{"trixie":"143.0.7499.169-1~deb13u1","trixie-security":"145.0.7632.159-1~deb13u1"},"fixed_version":"83.0.4103.83-1","urgency":"not yet assigned"}}},"CVE-2020-6488":{"description":"Insufficient policy enforcement in downloads in Google Chrome prior to 83.0.4103.61 allowed a remote attacker to bypass navigation restrictions via a crafted HTML page.","scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"143.0.7499.169-1~deb12u1","bookworm-security":"145.0.7632.159-1~deb12u1"},"fixed_version":"83.0.4103.83-1","urgency":"not yet assigned"},"bullseye":{"status":"resolved","repositories":{"bullseye":"120.0.6099.224-1~deb11u1","bullseye-security":"120.0.6099.224-1~deb11u1"},"fixed_version":"83.0.4103.83-1","urgency":"not yet assigned"},"forky":{"status":"resolved","repositories":{"forky":"145.0.7632.159-1"},"fixed_version":"83.0.4103.83-1","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"146.0.7680.71-1"},"fixed_version":"83.0.4103.83-1","urgency":"not yet assigned"},"trixie":{"status":"resolved","repositories":{"trixie":"143.0.7499.169-1~deb13u1","trixie-security":"145.0.7632.159-1~deb13u1"},"fixed_version":"83.0.4103.83-1","urgency":"not yet assigned"}}},"CVE-2020-6489":{"description":"Inappropriate implementation in developer tools in Google Chrome prior to 83.0.4103.61 allowed a remote attacker who had convinced the user to take certain actions in developer tools to obtain potentially sensitive information from disk via a crafted HTML page.","scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"143.0.7499.169-1~deb12u1","bookworm-security":"145.0.7632.159-1~deb12u1"},"fixed_version":"83.0.4103.83-1","urgency":"not yet assigned"},"bullseye":{"status":"resolved","repositories":{"bullseye":"120.0.6099.224-1~deb11u1","bullseye-security":"120.0.6099.224-1~deb11u1"},"fixed_version":"83.0.4103.83-1","urgency":"not yet assigned"},"forky":{"status":"resolved","repositories":{"forky":"145.0.7632.159-1"},"fixed_version":"83.0.4103.83-1","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"146.0.7680.71-1"},"fixed_version":"83.0.4103.83-1","urgency":"not yet assigned"},"trixie":{"status":"resolved","repositories":{"trixie":"143.0.7499.169-1~deb13u1","trixie-security":"145.0.7632.159-1~deb13u1"},"fixed_version":"83.0.4103.83-1","urgency":"not yet assigned"}}},"CVE-2020-6490":{"description":"Insufficient data validation in loader in Google Chrome prior to 83.0.4103.61 allowed a remote attacker who had been able to write to disk to leak cross-origin data via a crafted HTML page.","scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"143.0.7499.169-1~deb12u1","bookworm-security":"145.0.7632.159-1~deb12u1"},"fixed_version":"83.0.4103.83-1","urgency":"not yet assigned"},"bullseye":{"status":"resolved","repositories":{"bullseye":"120.0.6099.224-1~deb11u1","bullseye-security":"120.0.6099.224-1~deb11u1"},"fixed_version":"83.0.4103.83-1","urgency":"not yet assigned"},"forky":{"status":"resolved","repositories":{"forky":"145.0.7632.159-1"},"fixed_version":"83.0.4103.83-1","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"146.0.7680.71-1"},"fixed_version":"83.0.4103.83-1","urgency":"not yet assigned"},"trixie":{"status":"resolved","repositories":{"trixie":"143.0.7499.169-1~deb13u1","trixie-security":"145.0.7632.159-1~deb13u1"},"fixed_version":"83.0.4103.83-1","urgency":"not yet assigned"}}},"CVE-2020-6491":{"description":"Insufficient data validation in site information in Google Chrome prior to 83.0.4103.61 allowed a remote attacker to spoof security UI via a crafted domain name.","scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"143.0.7499.169-1~deb12u1","bookworm-security":"145.0.7632.159-1~deb12u1"},"fixed_version":"83.0.4103.83-1","urgency":"not yet assigned"},"bullseye":{"status":"resolved","repositories":{"bullseye":"120.0.6099.224-1~deb11u1","bullseye-security":"120.0.6099.224-1~deb11u1"},"fixed_version":"83.0.4103.83-1","urgency":"not yet assigned"},"forky":{"status":"resolved","repositories":{"forky":"145.0.7632.159-1"},"fixed_version":"83.0.4103.83-1","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"146.0.7680.71-1"},"fixed_version":"83.0.4103.83-1","urgency":"not yet assigned"},"trixie":{"status":"resolved","repositories":{"trixie":"143.0.7499.169-1~deb13u1","trixie-security":"145.0.7632.159-1~deb13u1"},"fixed_version":"83.0.4103.83-1","urgency":"not yet assigned"}}},"CVE-2020-6492":{"description":"Use after free in ANGLE in Google Chrome prior to 83.0.4103.97 allowed a remote attacker to potentially perform a sandbox escape via a crafted HTML page.","scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"143.0.7499.169-1~deb12u1","bookworm-security":"145.0.7632.159-1~deb12u1"},"fixed_version":"83.0.4103.106-1","urgency":"not yet assigned"},"bullseye":{"status":"resolved","repositories":{"bullseye":"120.0.6099.224-1~deb11u1","bullseye-security":"120.0.6099.224-1~deb11u1"},"fixed_version":"83.0.4103.106-1","urgency":"not yet assigned"},"forky":{"status":"resolved","repositories":{"forky":"145.0.7632.159-1"},"fixed_version":"83.0.4103.106-1","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"146.0.7680.71-1"},"fixed_version":"83.0.4103.106-1","urgency":"not yet assigned"},"trixie":{"status":"resolved","repositories":{"trixie":"143.0.7499.169-1~deb13u1","trixie-security":"145.0.7632.159-1~deb13u1"},"fixed_version":"83.0.4103.106-1","urgency":"not yet assigned"}}},"CVE-2020-6493":{"description":"Use after free in WebAuthentication in Google Chrome prior to 83.0.4103.97 allowed a remote attacker who had compromised the renderer process to potentially perform a sandbox escape via a crafted HTML page.","scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"143.0.7499.169-1~deb12u1","bookworm-security":"145.0.7632.159-1~deb12u1"},"fixed_version":"83.0.4103.106-1","urgency":"not yet assigned"},"bullseye":{"status":"resolved","repositories":{"bullseye":"120.0.6099.224-1~deb11u1","bullseye-security":"120.0.6099.224-1~deb11u1"},"fixed_version":"83.0.4103.106-1","urgency":"not yet assigned"},"forky":{"status":"resolved","repositories":{"forky":"145.0.7632.159-1"},"fixed_version":"83.0.4103.106-1","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"146.0.7680.71-1"},"fixed_version":"83.0.4103.106-1","urgency":"not yet assigned"},"trixie":{"status":"resolved","repositories":{"trixie":"143.0.7499.169-1~deb13u1","trixie-security":"145.0.7632.159-1~deb13u1"},"fixed_version":"83.0.4103.106-1","urgency":"not yet assigned"}}},"CVE-2020-6494":{"description":"Incorrect security UI in payments in Google Chrome on Android prior to 83.0.4103.97 allowed a remote attacker to spoof the contents of the Omnibox (URL bar) via a crafted HTML page.","scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"143.0.7499.169-1~deb12u1","bookworm-security":"145.0.7632.159-1~deb12u1"},"fixed_version":"83.0.4103.106-1","urgency":"not yet assigned"},"bullseye":{"status":"resolved","repositories":{"bullseye":"120.0.6099.224-1~deb11u1","bullseye-security":"120.0.6099.224-1~deb11u1"},"fixed_version":"83.0.4103.106-1","urgency":"not yet assigned"},"forky":{"status":"resolved","repositories":{"forky":"145.0.7632.159-1"},"fixed_version":"83.0.4103.106-1","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"146.0.7680.71-1"},"fixed_version":"83.0.4103.106-1","urgency":"not yet assigned"},"trixie":{"status":"resolved","repositories":{"trixie":"143.0.7499.169-1~deb13u1","trixie-security":"145.0.7632.159-1~deb13u1"},"fixed_version":"83.0.4103.106-1","urgency":"not yet assigned"}}},"CVE-2020-6495":{"description":"Insufficient policy enforcement in developer tools in Google Chrome prior to 83.0.4103.97 allowed an attacker who convinced a user to install a malicious extension to potentially perform a sandbox escape via a crafted Chrome Extension.","scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"143.0.7499.169-1~deb12u1","bookworm-security":"145.0.7632.159-1~deb12u1"},"fixed_version":"83.0.4103.106-1","urgency":"not yet assigned"},"bullseye":{"status":"resolved","repositories":{"bullseye":"120.0.6099.224-1~deb11u1","bullseye-security":"120.0.6099.224-1~deb11u1"},"fixed_version":"83.0.4103.106-1","urgency":"not yet assigned"},"forky":{"status":"resolved","repositories":{"forky":"145.0.7632.159-1"},"fixed_version":"83.0.4103.106-1","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"146.0.7680.71-1"},"fixed_version":"83.0.4103.106-1","urgency":"not yet assigned"},"trixie":{"status":"resolved","repositories":{"trixie":"143.0.7499.169-1~deb13u1","trixie-security":"145.0.7632.159-1~deb13u1"},"fixed_version":"83.0.4103.106-1","urgency":"not yet assigned"}}},"CVE-2020-6496":{"description":"Use after free in payments in Google Chrome on MacOS prior to 83.0.4103.97 allowed a remote attacker to potentially perform a sandbox escape via a crafted HTML page.","scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"143.0.7499.169-1~deb12u1","bookworm-security":"145.0.7632.159-1~deb12u1"},"fixed_version":"83.0.4103.106-1","urgency":"not yet assigned"},"bullseye":{"status":"resolved","repositories":{"bullseye":"120.0.6099.224-1~deb11u1","bullseye-security":"120.0.6099.224-1~deb11u1"},"fixed_version":"83.0.4103.106-1","urgency":"not yet assigned"},"forky":{"status":"resolved","repositories":{"forky":"145.0.7632.159-1"},"fixed_version":"83.0.4103.106-1","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"146.0.7680.71-1"},"fixed_version":"83.0.4103.106-1","urgency":"not yet assigned"},"trixie":{"status":"resolved","repositories":{"trixie":"143.0.7499.169-1~deb13u1","trixie-security":"145.0.7632.159-1~deb13u1"},"fixed_version":"83.0.4103.106-1","urgency":"not yet assigned"}}},"CVE-2020-6497":{"description":"Insufficient policy enforcement in Omnibox in Google Chrome on iOS prior to 83.0.4103.88 allowed a remote attacker to perform domain spoofing via a crafted URI.","scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"143.0.7499.169-1~deb12u1","bookworm-security":"145.0.7632.159-1~deb12u1"},"fixed_version":"83.0.4103.106-1","urgency":"not yet assigned"},"bullseye":{"status":"resolved","repositories":{"bullseye":"120.0.6099.224-1~deb11u1","bullseye-security":"120.0.6099.224-1~deb11u1"},"fixed_version":"83.0.4103.106-1","urgency":"not yet assigned"},"forky":{"status":"resolved","repositories":{"forky":"145.0.7632.159-1"},"fixed_version":"83.0.4103.106-1","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"146.0.7680.71-1"},"fixed_version":"83.0.4103.106-1","urgency":"not yet assigned"},"trixie":{"status":"resolved","repositories":{"trixie":"143.0.7499.169-1~deb13u1","trixie-security":"145.0.7632.159-1~deb13u1"},"fixed_version":"83.0.4103.106-1","urgency":"not yet assigned"}}},"CVE-2020-6498":{"description":"Incorrect implementation in user interface in Google Chrome on iOS prior to 83.0.4103.88 allowed a remote attacker to perform domain spoofing via a crafted HTML page.","scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"143.0.7499.169-1~deb12u1","bookworm-security":"145.0.7632.159-1~deb12u1"},"fixed_version":"83.0.4103.106-1","urgency":"not yet assigned"},"bullseye":{"status":"resolved","repositories":{"bullseye":"120.0.6099.224-1~deb11u1","bullseye-security":"120.0.6099.224-1~deb11u1"},"fixed_version":"83.0.4103.106-1","urgency":"not yet assigned"},"forky":{"status":"resolved","repositories":{"forky":"145.0.7632.159-1"},"fixed_version":"83.0.4103.106-1","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"146.0.7680.71-1"},"fixed_version":"83.0.4103.106-1","urgency":"not yet assigned"},"trixie":{"status":"resolved","repositories":{"trixie":"143.0.7499.169-1~deb13u1","trixie-security":"145.0.7632.159-1~deb13u1"},"fixed_version":"83.0.4103.106-1","urgency":"not yet assigned"}}},"CVE-2020-6499":{"description":"Inappropriate implementation in AppCache in Google Chrome prior to 80.0.3987.87 allowed a remote attacker to bypass AppCache security restrictions via a crafted HTML page.","scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"143.0.7499.169-1~deb12u1","bookworm-security":"145.0.7632.159-1~deb12u1"},"fixed_version":"80.0.3987.106-1","urgency":"not yet assigned"},"bullseye":{"status":"resolved","repositories":{"bullseye":"120.0.6099.224-1~deb11u1","bullseye-security":"120.0.6099.224-1~deb11u1"},"fixed_version":"80.0.3987.106-1","urgency":"not yet assigned"},"forky":{"status":"resolved","repositories":{"forky":"145.0.7632.159-1"},"fixed_version":"80.0.3987.106-1","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"146.0.7680.71-1"},"fixed_version":"80.0.3987.106-1","urgency":"not yet assigned"},"trixie":{"status":"resolved","repositories":{"trixie":"143.0.7499.169-1~deb13u1","trixie-security":"145.0.7632.159-1~deb13u1"},"fixed_version":"80.0.3987.106-1","urgency":"not yet assigned"}}},"CVE-2020-6500":{"description":"Inappropriate implementation in interstitials in Google Chrome prior to 80.0.3987.87 allowed a remote attacker to spoof the contents of the Omnibox (URL bar) via a crafted HTML page.","scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"143.0.7499.169-1~deb12u1","bookworm-security":"145.0.7632.159-1~deb12u1"},"fixed_version":"80.0.3987.106-1","urgency":"not yet assigned"},"bullseye":{"status":"resolved","repositories":{"bullseye":"120.0.6099.224-1~deb11u1","bullseye-security":"120.0.6099.224-1~deb11u1"},"fixed_version":"80.0.3987.106-1","urgency":"not yet assigned"},"forky":{"status":"resolved","repositories":{"forky":"145.0.7632.159-1"},"fixed_version":"80.0.3987.106-1","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"146.0.7680.71-1"},"fixed_version":"80.0.3987.106-1","urgency":"not yet assigned"},"trixie":{"status":"resolved","repositories":{"trixie":"143.0.7499.169-1~deb13u1","trixie-security":"145.0.7632.159-1~deb13u1"},"fixed_version":"80.0.3987.106-1","urgency":"not yet assigned"}}},"CVE-2020-6501":{"description":"Insufficient policy enforcement in CSP in Google Chrome prior to 80.0.3987.87 allowed a remote attacker to bypass content security policy via a crafted HTML page.","scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"143.0.7499.169-1~deb12u1","bookworm-security":"145.0.7632.159-1~deb12u1"},"fixed_version":"80.0.3987.106-1","urgency":"not yet assigned"},"bullseye":{"status":"resolved","repositories":{"bullseye":"120.0.6099.224-1~deb11u1","bullseye-security":"120.0.6099.224-1~deb11u1"},"fixed_version":"80.0.3987.106-1","urgency":"not yet assigned"},"forky":{"status":"resolved","repositories":{"forky":"145.0.7632.159-1"},"fixed_version":"80.0.3987.106-1","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"146.0.7680.71-1"},"fixed_version":"80.0.3987.106-1","urgency":"not yet assigned"},"trixie":{"status":"resolved","repositories":{"trixie":"143.0.7499.169-1~deb13u1","trixie-security":"145.0.7632.159-1~deb13u1"},"fixed_version":"80.0.3987.106-1","urgency":"not yet assigned"}}},"CVE-2020-6502":{"description":"Incorrect implementation in permissions in Google Chrome prior to 80.0.3987.87 allowed a remote attacker to spoof security UI via a crafted HTML page.","scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"143.0.7499.169-1~deb12u1","bookworm-security":"145.0.7632.159-1~deb12u1"},"fixed_version":"80.0.3987.106-1","urgency":"not yet assigned"},"bullseye":{"status":"resolved","repositories":{"bullseye":"120.0.6099.224-1~deb11u1","bullseye-security":"120.0.6099.224-1~deb11u1"},"fixed_version":"80.0.3987.106-1","urgency":"not yet assigned"},"forky":{"status":"resolved","repositories":{"forky":"145.0.7632.159-1"},"fixed_version":"80.0.3987.106-1","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"146.0.7680.71-1"},"fixed_version":"80.0.3987.106-1","urgency":"not yet assigned"},"trixie":{"status":"resolved","repositories":{"trixie":"143.0.7499.169-1~deb13u1","trixie-security":"145.0.7632.159-1~deb13u1"},"fixed_version":"80.0.3987.106-1","urgency":"not yet assigned"}}},"CVE-2020-6503":{"description":"Inappropriate implementation in accessibility in Google Chrome prior to 74.0.3729.108 allowed a remote attacker to obtain potentially sensitive information from process memory via a crafted HTML page.","scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"143.0.7499.169-1~deb12u1","bookworm-security":"145.0.7632.159-1~deb12u1"},"fixed_version":"74.0.3729.108-1","urgency":"not yet assigned"},"bullseye":{"status":"resolved","repositories":{"bullseye":"120.0.6099.224-1~deb11u1","bullseye-security":"120.0.6099.224-1~deb11u1"},"fixed_version":"74.0.3729.108-1","urgency":"not yet assigned"},"forky":{"status":"resolved","repositories":{"forky":"145.0.7632.159-1"},"fixed_version":"74.0.3729.108-1","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"146.0.7680.71-1"},"fixed_version":"74.0.3729.108-1","urgency":"not yet assigned"},"trixie":{"status":"resolved","repositories":{"trixie":"143.0.7499.169-1~deb13u1","trixie-security":"145.0.7632.159-1~deb13u1"},"fixed_version":"74.0.3729.108-1","urgency":"not yet assigned"}}},"CVE-2020-6504":{"description":"Insufficient policy enforcement in notifications in Google Chrome prior to 74.0.3729.108 allowed a remote attacker to bypass notification restrictions via a crafted HTML page.","scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"143.0.7499.169-1~deb12u1","bookworm-security":"145.0.7632.159-1~deb12u1"},"fixed_version":"74.0.3729.108-1","urgency":"not yet assigned"},"bullseye":{"status":"resolved","repositories":{"bullseye":"120.0.6099.224-1~deb11u1","bullseye-security":"120.0.6099.224-1~deb11u1"},"fixed_version":"74.0.3729.108-1","urgency":"not yet assigned"},"forky":{"status":"resolved","repositories":{"forky":"145.0.7632.159-1"},"fixed_version":"74.0.3729.108-1","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"146.0.7680.71-1"},"fixed_version":"74.0.3729.108-1","urgency":"not yet assigned"},"trixie":{"status":"resolved","repositories":{"trixie":"143.0.7499.169-1~deb13u1","trixie-security":"145.0.7632.159-1~deb13u1"},"fixed_version":"74.0.3729.108-1","urgency":"not yet assigned"}}},"CVE-2020-6505":{"description":"Use after free in speech in Google Chrome prior to 83.0.4103.106 allowed a remote attacker to potentially perform a sandbox escape via a crafted HTML page.","scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"143.0.7499.169-1~deb12u1","bookworm-security":"145.0.7632.159-1~deb12u1"},"fixed_version":"83.0.4103.106-1","urgency":"not yet assigned"},"bullseye":{"status":"resolved","repositories":{"bullseye":"120.0.6099.224-1~deb11u1","bullseye-security":"120.0.6099.224-1~deb11u1"},"fixed_version":"83.0.4103.106-1","urgency":"not yet assigned"},"forky":{"status":"resolved","repositories":{"forky":"145.0.7632.159-1"},"fixed_version":"83.0.4103.106-1","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"146.0.7680.71-1"},"fixed_version":"83.0.4103.106-1","urgency":"not yet assigned"},"trixie":{"status":"resolved","repositories":{"trixie":"143.0.7499.169-1~deb13u1","trixie-security":"145.0.7632.159-1~deb13u1"},"fixed_version":"83.0.4103.106-1","urgency":"not yet assigned"}}},"CVE-2020-6506":{"description":"Insufficient policy enforcement in WebView in Google Chrome on Android prior to 83.0.4103.106 allowed a remote attacker to bypass site isolation via a crafted HTML page.","scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"143.0.7499.169-1~deb12u1","bookworm-security":"145.0.7632.159-1~deb12u1"},"fixed_version":"83.0.4103.106-1","urgency":"not yet assigned"},"bullseye":{"status":"resolved","repositories":{"bullseye":"120.0.6099.224-1~deb11u1","bullseye-security":"120.0.6099.224-1~deb11u1"},"fixed_version":"83.0.4103.106-1","urgency":"not yet assigned"},"forky":{"status":"resolved","repositories":{"forky":"145.0.7632.159-1"},"fixed_version":"83.0.4103.106-1","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"146.0.7680.71-1"},"fixed_version":"83.0.4103.106-1","urgency":"not yet assigned"},"trixie":{"status":"resolved","repositories":{"trixie":"143.0.7499.169-1~deb13u1","trixie-security":"145.0.7632.159-1~deb13u1"},"fixed_version":"83.0.4103.106-1","urgency":"not yet assigned"}}},"CVE-2020-6507":{"description":"Out of bounds write in V8 in Google Chrome prior to 83.0.4103.106 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page.","scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"143.0.7499.169-1~deb12u1","bookworm-security":"145.0.7632.159-1~deb12u1"},"fixed_version":"83.0.4103.106-1","urgency":"not yet assigned"},"bullseye":{"status":"resolved","repositories":{"bullseye":"120.0.6099.224-1~deb11u1","bullseye-security":"120.0.6099.224-1~deb11u1"},"fixed_version":"83.0.4103.106-1","urgency":"not yet assigned"},"forky":{"status":"resolved","repositories":{"forky":"145.0.7632.159-1"},"fixed_version":"83.0.4103.106-1","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"146.0.7680.71-1"},"fixed_version":"83.0.4103.106-1","urgency":"not yet assigned"},"trixie":{"status":"resolved","repositories":{"trixie":"143.0.7499.169-1~deb13u1","trixie-security":"145.0.7632.159-1~deb13u1"},"fixed_version":"83.0.4103.106-1","urgency":"not yet assigned"}}},"CVE-2020-6509":{"description":"Use after free in extensions in Google Chrome prior to 83.0.4103.116 allowed an attacker who convinced a user to install a malicious extension to potentially perform a sandbox escape via a crafted Chrome Extension.","scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"143.0.7499.169-1~deb12u1","bookworm-security":"145.0.7632.159-1~deb12u1"},"fixed_version":"83.0.4103.116-1","urgency":"not yet assigned"},"bullseye":{"status":"resolved","repositories":{"bullseye":"120.0.6099.224-1~deb11u1","bullseye-security":"120.0.6099.224-1~deb11u1"},"fixed_version":"83.0.4103.116-1","urgency":"not yet assigned"},"forky":{"status":"resolved","repositories":{"forky":"145.0.7632.159-1"},"fixed_version":"83.0.4103.116-1","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"146.0.7680.71-1"},"fixed_version":"83.0.4103.116-1","urgency":"not yet assigned"},"trixie":{"status":"resolved","repositories":{"trixie":"143.0.7499.169-1~deb13u1","trixie-security":"145.0.7632.159-1~deb13u1"},"fixed_version":"83.0.4103.116-1","urgency":"not yet assigned"}}},"CVE-2020-6510":{"description":"Heap buffer overflow in background fetch in Google Chrome prior to 84.0.4147.89 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page.","scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"143.0.7499.169-1~deb12u1","bookworm-security":"145.0.7632.159-1~deb12u1"},"fixed_version":"87.0.4280.88-0.1","urgency":"not yet assigned"},"bullseye":{"status":"resolved","repositories":{"bullseye":"120.0.6099.224-1~deb11u1","bullseye-security":"120.0.6099.224-1~deb11u1"},"fixed_version":"87.0.4280.88-0.1","urgency":"not yet assigned"},"forky":{"status":"resolved","repositories":{"forky":"145.0.7632.159-1"},"fixed_version":"87.0.4280.88-0.1","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"146.0.7680.71-1"},"fixed_version":"87.0.4280.88-0.1","urgency":"not yet assigned"},"trixie":{"status":"resolved","repositories":{"trixie":"143.0.7499.169-1~deb13u1","trixie-security":"145.0.7632.159-1~deb13u1"},"fixed_version":"87.0.4280.88-0.1","urgency":"not yet assigned"}}},"CVE-2020-6511":{"description":"Information leak in content security policy in Google Chrome prior to 84.0.4147.89 allowed a remote attacker to leak cross-origin data via a crafted HTML page.","scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"143.0.7499.169-1~deb12u1","bookworm-security":"145.0.7632.159-1~deb12u1"},"fixed_version":"87.0.4280.88-0.1","urgency":"not yet assigned"},"bullseye":{"status":"resolved","repositories":{"bullseye":"120.0.6099.224-1~deb11u1","bullseye-security":"120.0.6099.224-1~deb11u1"},"fixed_version":"87.0.4280.88-0.1","urgency":"not yet assigned"},"forky":{"status":"resolved","repositories":{"forky":"145.0.7632.159-1"},"fixed_version":"87.0.4280.88-0.1","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"146.0.7680.71-1"},"fixed_version":"87.0.4280.88-0.1","urgency":"not yet assigned"},"trixie":{"status":"resolved","repositories":{"trixie":"143.0.7499.169-1~deb13u1","trixie-security":"145.0.7632.159-1~deb13u1"},"fixed_version":"87.0.4280.88-0.1","urgency":"not yet assigned"}}},"CVE-2020-6512":{"description":"Type Confusion in V8 in Google Chrome prior to 84.0.4147.89 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page.","scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"143.0.7499.169-1~deb12u1","bookworm-security":"145.0.7632.159-1~deb12u1"},"fixed_version":"87.0.4280.88-0.1","urgency":"not yet assigned"},"bullseye":{"status":"resolved","repositories":{"bullseye":"120.0.6099.224-1~deb11u1","bullseye-security":"120.0.6099.224-1~deb11u1"},"fixed_version":"87.0.4280.88-0.1","urgency":"not yet assigned"},"forky":{"status":"resolved","repositories":{"forky":"145.0.7632.159-1"},"fixed_version":"87.0.4280.88-0.1","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"146.0.7680.71-1"},"fixed_version":"87.0.4280.88-0.1","urgency":"not yet assigned"},"trixie":{"status":"resolved","repositories":{"trixie":"143.0.7499.169-1~deb13u1","trixie-security":"145.0.7632.159-1~deb13u1"},"fixed_version":"87.0.4280.88-0.1","urgency":"not yet assigned"}}},"CVE-2020-6513":{"description":"Heap buffer overflow in PDFium in Google Chrome prior to 84.0.4147.89 allowed a remote attacker to potentially exploit heap corruption via a crafted PDF file.","scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"143.0.7499.169-1~deb12u1","bookworm-security":"145.0.7632.159-1~deb12u1"},"fixed_version":"87.0.4280.88-0.1","urgency":"not yet assigned"},"bullseye":{"status":"resolved","repositories":{"bullseye":"120.0.6099.224-1~deb11u1","bullseye-security":"120.0.6099.224-1~deb11u1"},"fixed_version":"87.0.4280.88-0.1","urgency":"not yet assigned"},"forky":{"status":"resolved","repositories":{"forky":"145.0.7632.159-1"},"fixed_version":"87.0.4280.88-0.1","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"146.0.7680.71-1"},"fixed_version":"87.0.4280.88-0.1","urgency":"not yet assigned"},"trixie":{"status":"resolved","repositories":{"trixie":"143.0.7499.169-1~deb13u1","trixie-security":"145.0.7632.159-1~deb13u1"},"fixed_version":"87.0.4280.88-0.1","urgency":"not yet assigned"}}},"CVE-2020-6514":{"description":"Inappropriate implementation in WebRTC in Google Chrome prior to 84.0.4147.89 allowed an attacker in a privileged network position to potentially exploit heap corruption via a crafted SCTP stream.","scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"143.0.7499.169-1~deb12u1","bookworm-security":"145.0.7632.159-1~deb12u1"},"fixed_version":"87.0.4280.88-0.1","urgency":"not yet assigned"},"bullseye":{"status":"resolved","repositories":{"bullseye":"120.0.6099.224-1~deb11u1","bullseye-security":"120.0.6099.224-1~deb11u1"},"fixed_version":"87.0.4280.88-0.1","urgency":"not yet assigned"},"forky":{"status":"resolved","repositories":{"forky":"145.0.7632.159-1"},"fixed_version":"87.0.4280.88-0.1","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"146.0.7680.71-1"},"fixed_version":"87.0.4280.88-0.1","urgency":"not yet assigned"},"trixie":{"status":"resolved","repositories":{"trixie":"143.0.7499.169-1~deb13u1","trixie-security":"145.0.7632.159-1~deb13u1"},"fixed_version":"87.0.4280.88-0.1","urgency":"not yet assigned"}}},"CVE-2020-6515":{"description":"Use after free in tab strip in Google Chrome prior to 84.0.4147.89 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page.","scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"143.0.7499.169-1~deb12u1","bookworm-security":"145.0.7632.159-1~deb12u1"},"fixed_version":"87.0.4280.88-0.1","urgency":"not yet assigned"},"bullseye":{"status":"resolved","repositories":{"bullseye":"120.0.6099.224-1~deb11u1","bullseye-security":"120.0.6099.224-1~deb11u1"},"fixed_version":"87.0.4280.88-0.1","urgency":"not yet assigned"},"forky":{"status":"resolved","repositories":{"forky":"145.0.7632.159-1"},"fixed_version":"87.0.4280.88-0.1","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"146.0.7680.71-1"},"fixed_version":"87.0.4280.88-0.1","urgency":"not yet assigned"},"trixie":{"status":"resolved","repositories":{"trixie":"143.0.7499.169-1~deb13u1","trixie-security":"145.0.7632.159-1~deb13u1"},"fixed_version":"87.0.4280.88-0.1","urgency":"not yet assigned"}}},"CVE-2020-6516":{"description":"Policy bypass in CORS in Google Chrome prior to 84.0.4147.89 allowed a remote attacker to leak cross-origin data via a crafted HTML page.","scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"143.0.7499.169-1~deb12u1","bookworm-security":"145.0.7632.159-1~deb12u1"},"fixed_version":"87.0.4280.88-0.1","urgency":"not yet assigned"},"bullseye":{"status":"resolved","repositories":{"bullseye":"120.0.6099.224-1~deb11u1","bullseye-security":"120.0.6099.224-1~deb11u1"},"fixed_version":"87.0.4280.88-0.1","urgency":"not yet assigned"},"forky":{"status":"resolved","repositories":{"forky":"145.0.7632.159-1"},"fixed_version":"87.0.4280.88-0.1","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"146.0.7680.71-1"},"fixed_version":"87.0.4280.88-0.1","urgency":"not yet assigned"},"trixie":{"status":"resolved","repositories":{"trixie":"143.0.7499.169-1~deb13u1","trixie-security":"145.0.7632.159-1~deb13u1"},"fixed_version":"87.0.4280.88-0.1","urgency":"not yet assigned"}}},"CVE-2020-6517":{"description":"Heap buffer overflow in history in Google Chrome prior to 84.0.4147.89 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page.","scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"143.0.7499.169-1~deb12u1","bookworm-security":"145.0.7632.159-1~deb12u1"},"fixed_version":"87.0.4280.88-0.1","urgency":"not yet assigned"},"bullseye":{"status":"resolved","repositories":{"bullseye":"120.0.6099.224-1~deb11u1","bullseye-security":"120.0.6099.224-1~deb11u1"},"fixed_version":"87.0.4280.88-0.1","urgency":"not yet assigned"},"forky":{"status":"resolved","repositories":{"forky":"145.0.7632.159-1"},"fixed_version":"87.0.4280.88-0.1","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"146.0.7680.71-1"},"fixed_version":"87.0.4280.88-0.1","urgency":"not yet assigned"},"trixie":{"status":"resolved","repositories":{"trixie":"143.0.7499.169-1~deb13u1","trixie-security":"145.0.7632.159-1~deb13u1"},"fixed_version":"87.0.4280.88-0.1","urgency":"not yet assigned"}}},"CVE-2020-6518":{"description":"Use after free in developer tools in Google Chrome prior to 84.0.4147.89 allowed a remote attacker who had convinced the user to use developer tools to potentially exploit heap corruption via a crafted HTML page.","scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"143.0.7499.169-1~deb12u1","bookworm-security":"145.0.7632.159-1~deb12u1"},"fixed_version":"87.0.4280.88-0.1","urgency":"not yet assigned"},"bullseye":{"status":"resolved","repositories":{"bullseye":"120.0.6099.224-1~deb11u1","bullseye-security":"120.0.6099.224-1~deb11u1"},"fixed_version":"87.0.4280.88-0.1","urgency":"not yet assigned"},"forky":{"status":"resolved","repositories":{"forky":"145.0.7632.159-1"},"fixed_version":"87.0.4280.88-0.1","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"146.0.7680.71-1"},"fixed_version":"87.0.4280.88-0.1","urgency":"not yet assigned"},"trixie":{"status":"resolved","repositories":{"trixie":"143.0.7499.169-1~deb13u1","trixie-security":"145.0.7632.159-1~deb13u1"},"fixed_version":"87.0.4280.88-0.1","urgency":"not yet assigned"}}},"CVE-2020-6519":{"description":"Policy bypass in CSP in Google Chrome prior to 84.0.4147.89 allowed a remote attacker to bypass content security policy via a crafted HTML page.","scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"143.0.7499.169-1~deb12u1","bookworm-security":"145.0.7632.159-1~deb12u1"},"fixed_version":"87.0.4280.88-0.1","urgency":"not yet assigned"},"bullseye":{"status":"resolved","repositories":{"bullseye":"120.0.6099.224-1~deb11u1","bullseye-security":"120.0.6099.224-1~deb11u1"},"fixed_version":"87.0.4280.88-0.1","urgency":"not yet assigned"},"forky":{"status":"resolved","repositories":{"forky":"145.0.7632.159-1"},"fixed_version":"87.0.4280.88-0.1","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"146.0.7680.71-1"},"fixed_version":"87.0.4280.88-0.1","urgency":"not yet assigned"},"trixie":{"status":"resolved","repositories":{"trixie":"143.0.7499.169-1~deb13u1","trixie-security":"145.0.7632.159-1~deb13u1"},"fixed_version":"87.0.4280.88-0.1","urgency":"not yet assigned"}}},"CVE-2020-6520":{"description":"Buffer overflow in Skia in Google Chrome prior to 84.0.4147.89 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page.","scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"143.0.7499.169-1~deb12u1","bookworm-security":"145.0.7632.159-1~deb12u1"},"fixed_version":"87.0.4280.88-0.1","urgency":"not yet assigned"},"bullseye":{"status":"resolved","repositories":{"bullseye":"120.0.6099.224-1~deb11u1","bullseye-security":"120.0.6099.224-1~deb11u1"},"fixed_version":"87.0.4280.88-0.1","urgency":"not yet assigned"},"forky":{"status":"resolved","repositories":{"forky":"145.0.7632.159-1"},"fixed_version":"87.0.4280.88-0.1","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"146.0.7680.71-1"},"fixed_version":"87.0.4280.88-0.1","urgency":"not yet assigned"},"trixie":{"status":"resolved","repositories":{"trixie":"143.0.7499.169-1~deb13u1","trixie-security":"145.0.7632.159-1~deb13u1"},"fixed_version":"87.0.4280.88-0.1","urgency":"not yet assigned"}}},"CVE-2020-6521":{"description":"Side-channel information leakage in autofill in Google Chrome prior to 84.0.4147.89 allowed a remote attacker to obtain potentially sensitive information from process memory via a crafted HTML page.","scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"143.0.7499.169-1~deb12u1","bookworm-security":"145.0.7632.159-1~deb12u1"},"fixed_version":"87.0.4280.88-0.1","urgency":"not yet assigned"},"bullseye":{"status":"resolved","repositories":{"bullseye":"120.0.6099.224-1~deb11u1","bullseye-security":"120.0.6099.224-1~deb11u1"},"fixed_version":"87.0.4280.88-0.1","urgency":"not yet assigned"},"forky":{"status":"resolved","repositories":{"forky":"145.0.7632.159-1"},"fixed_version":"87.0.4280.88-0.1","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"146.0.7680.71-1"},"fixed_version":"87.0.4280.88-0.1","urgency":"not yet assigned"},"trixie":{"status":"resolved","repositories":{"trixie":"143.0.7499.169-1~deb13u1","trixie-security":"145.0.7632.159-1~deb13u1"},"fixed_version":"87.0.4280.88-0.1","urgency":"not yet assigned"}}},"CVE-2020-6522":{"description":"Inappropriate implementation in external protocol handlers in Google Chrome prior to 84.0.4147.89 allowed a remote attacker to potentially perform a sandbox escape via a crafted HTML page.","scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"143.0.7499.169-1~deb12u1","bookworm-security":"145.0.7632.159-1~deb12u1"},"fixed_version":"87.0.4280.88-0.1","urgency":"not yet assigned"},"bullseye":{"status":"resolved","repositories":{"bullseye":"120.0.6099.224-1~deb11u1","bullseye-security":"120.0.6099.224-1~deb11u1"},"fixed_version":"87.0.4280.88-0.1","urgency":"not yet assigned"},"forky":{"status":"resolved","repositories":{"forky":"145.0.7632.159-1"},"fixed_version":"87.0.4280.88-0.1","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"146.0.7680.71-1"},"fixed_version":"87.0.4280.88-0.1","urgency":"not yet assigned"},"trixie":{"status":"resolved","repositories":{"trixie":"143.0.7499.169-1~deb13u1","trixie-security":"145.0.7632.159-1~deb13u1"},"fixed_version":"87.0.4280.88-0.1","urgency":"not yet assigned"}}},"CVE-2020-6523":{"description":"Out of bounds write in Skia in Google Chrome prior to 84.0.4147.89 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page.","scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"143.0.7499.169-1~deb12u1","bookworm-security":"145.0.7632.159-1~deb12u1"},"fixed_version":"87.0.4280.88-0.1","urgency":"not yet assigned"},"bullseye":{"status":"resolved","repositories":{"bullseye":"120.0.6099.224-1~deb11u1","bullseye-security":"120.0.6099.224-1~deb11u1"},"fixed_version":"87.0.4280.88-0.1","urgency":"not yet assigned"},"forky":{"status":"resolved","repositories":{"forky":"145.0.7632.159-1"},"fixed_version":"87.0.4280.88-0.1","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"146.0.7680.71-1"},"fixed_version":"87.0.4280.88-0.1","urgency":"not yet assigned"},"trixie":{"status":"resolved","repositories":{"trixie":"143.0.7499.169-1~deb13u1","trixie-security":"145.0.7632.159-1~deb13u1"},"fixed_version":"87.0.4280.88-0.1","urgency":"not yet assigned"}}},"CVE-2020-6524":{"description":"Heap buffer overflow in WebAudio in Google Chrome prior to 84.0.4147.89 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page.","scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"143.0.7499.169-1~deb12u1","bookworm-security":"145.0.7632.159-1~deb12u1"},"fixed_version":"87.0.4280.88-0.1","urgency":"not yet assigned"},"bullseye":{"status":"resolved","repositories":{"bullseye":"120.0.6099.224-1~deb11u1","bullseye-security":"120.0.6099.224-1~deb11u1"},"fixed_version":"87.0.4280.88-0.1","urgency":"not yet assigned"},"forky":{"status":"resolved","repositories":{"forky":"145.0.7632.159-1"},"fixed_version":"87.0.4280.88-0.1","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"146.0.7680.71-1"},"fixed_version":"87.0.4280.88-0.1","urgency":"not yet assigned"},"trixie":{"status":"resolved","repositories":{"trixie":"143.0.7499.169-1~deb13u1","trixie-security":"145.0.7632.159-1~deb13u1"},"fixed_version":"87.0.4280.88-0.1","urgency":"not yet assigned"}}},"CVE-2020-6525":{"description":"Heap buffer overflow in Skia in Google Chrome prior to 84.0.4147.89 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page.","scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"143.0.7499.169-1~deb12u1","bookworm-security":"145.0.7632.159-1~deb12u1"},"fixed_version":"87.0.4280.88-0.1","urgency":"not yet assigned"},"bullseye":{"status":"resolved","repositories":{"bullseye":"120.0.6099.224-1~deb11u1","bullseye-security":"120.0.6099.224-1~deb11u1"},"fixed_version":"87.0.4280.88-0.1","urgency":"not yet assigned"},"forky":{"status":"resolved","repositories":{"forky":"145.0.7632.159-1"},"fixed_version":"87.0.4280.88-0.1","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"146.0.7680.71-1"},"fixed_version":"87.0.4280.88-0.1","urgency":"not yet assigned"},"trixie":{"status":"resolved","repositories":{"trixie":"143.0.7499.169-1~deb13u1","trixie-security":"145.0.7632.159-1~deb13u1"},"fixed_version":"87.0.4280.88-0.1","urgency":"not yet assigned"}}},"CVE-2020-6526":{"description":"Inappropriate implementation in iframe sandbox in Google Chrome prior to 84.0.4147.89 allowed a remote attacker to bypass navigation restrictions via a crafted HTML page.","scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"143.0.7499.169-1~deb12u1","bookworm-security":"145.0.7632.159-1~deb12u1"},"fixed_version":"87.0.4280.88-0.1","urgency":"not yet assigned"},"bullseye":{"status":"resolved","repositories":{"bullseye":"120.0.6099.224-1~deb11u1","bullseye-security":"120.0.6099.224-1~deb11u1"},"fixed_version":"87.0.4280.88-0.1","urgency":"not yet assigned"},"forky":{"status":"resolved","repositories":{"forky":"145.0.7632.159-1"},"fixed_version":"87.0.4280.88-0.1","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"146.0.7680.71-1"},"fixed_version":"87.0.4280.88-0.1","urgency":"not yet assigned"},"trixie":{"status":"resolved","repositories":{"trixie":"143.0.7499.169-1~deb13u1","trixie-security":"145.0.7632.159-1~deb13u1"},"fixed_version":"87.0.4280.88-0.1","urgency":"not yet assigned"}}},"CVE-2020-6527":{"description":"Insufficient policy enforcement in CSP in Google Chrome prior to 84.0.4147.89 allowed a remote attacker to bypass content security policy via a crafted HTML page.","scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"143.0.7499.169-1~deb12u1","bookworm-security":"145.0.7632.159-1~deb12u1"},"fixed_version":"87.0.4280.88-0.1","urgency":"not yet assigned"},"bullseye":{"status":"resolved","repositories":{"bullseye":"120.0.6099.224-1~deb11u1","bullseye-security":"120.0.6099.224-1~deb11u1"},"fixed_version":"87.0.4280.88-0.1","urgency":"not yet assigned"},"forky":{"status":"resolved","repositories":{"forky":"145.0.7632.159-1"},"fixed_version":"87.0.4280.88-0.1","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"146.0.7680.71-1"},"fixed_version":"87.0.4280.88-0.1","urgency":"not yet assigned"},"trixie":{"status":"resolved","repositories":{"trixie":"143.0.7499.169-1~deb13u1","trixie-security":"145.0.7632.159-1~deb13u1"},"fixed_version":"87.0.4280.88-0.1","urgency":"not yet assigned"}}},"CVE-2020-6528":{"description":"Incorrect security UI in basic auth in Google Chrome on iOS prior to 84.0.4147.89 allowed a remote attacker to spoof the contents of the Omnibox (URL bar) via a crafted HTML page.","scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"143.0.7499.169-1~deb12u1","bookworm-security":"145.0.7632.159-1~deb12u1"},"fixed_version":"87.0.4280.88-0.1","urgency":"not yet assigned"},"bullseye":{"status":"resolved","repositories":{"bullseye":"120.0.6099.224-1~deb11u1","bullseye-security":"120.0.6099.224-1~deb11u1"},"fixed_version":"87.0.4280.88-0.1","urgency":"not yet assigned"},"forky":{"status":"resolved","repositories":{"forky":"145.0.7632.159-1"},"fixed_version":"87.0.4280.88-0.1","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"146.0.7680.71-1"},"fixed_version":"87.0.4280.88-0.1","urgency":"not yet assigned"},"trixie":{"status":"resolved","repositories":{"trixie":"143.0.7499.169-1~deb13u1","trixie-security":"145.0.7632.159-1~deb13u1"},"fixed_version":"87.0.4280.88-0.1","urgency":"not yet assigned"}}},"CVE-2020-6529":{"description":"Inappropriate implementation in WebRTC in Google Chrome prior to 84.0.4147.89 allowed an attacker in a privileged network position to leak cross-origin data via a crafted HTML page.","scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"143.0.7499.169-1~deb12u1","bookworm-security":"145.0.7632.159-1~deb12u1"},"fixed_version":"87.0.4280.88-0.1","urgency":"not yet assigned"},"bullseye":{"status":"resolved","repositories":{"bullseye":"120.0.6099.224-1~deb11u1","bullseye-security":"120.0.6099.224-1~deb11u1"},"fixed_version":"87.0.4280.88-0.1","urgency":"not yet assigned"},"forky":{"status":"resolved","repositories":{"forky":"145.0.7632.159-1"},"fixed_version":"87.0.4280.88-0.1","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"146.0.7680.71-1"},"fixed_version":"87.0.4280.88-0.1","urgency":"not yet assigned"},"trixie":{"status":"resolved","repositories":{"trixie":"143.0.7499.169-1~deb13u1","trixie-security":"145.0.7632.159-1~deb13u1"},"fixed_version":"87.0.4280.88-0.1","urgency":"not yet assigned"}}},"CVE-2020-6530":{"description":"Out of bounds memory access in developer tools in Google Chrome prior to 84.0.4147.89 allowed an attacker who convinced a user to install a malicious extension to potentially exploit heap corruption via a crafted Chrome Extension.","scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"143.0.7499.169-1~deb12u1","bookworm-security":"145.0.7632.159-1~deb12u1"},"fixed_version":"87.0.4280.88-0.1","urgency":"not yet assigned"},"bullseye":{"status":"resolved","repositories":{"bullseye":"120.0.6099.224-1~deb11u1","bullseye-security":"120.0.6099.224-1~deb11u1"},"fixed_version":"87.0.4280.88-0.1","urgency":"not yet assigned"},"forky":{"status":"resolved","repositories":{"forky":"145.0.7632.159-1"},"fixed_version":"87.0.4280.88-0.1","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"146.0.7680.71-1"},"fixed_version":"87.0.4280.88-0.1","urgency":"not yet assigned"},"trixie":{"status":"resolved","repositories":{"trixie":"143.0.7499.169-1~deb13u1","trixie-security":"145.0.7632.159-1~deb13u1"},"fixed_version":"87.0.4280.88-0.1","urgency":"not yet assigned"}}},"CVE-2020-6531":{"description":"Side-channel information leakage in scroll to text in Google Chrome prior to 84.0.4147.89 allowed a remote attacker to leak cross-origin data via a crafted HTML page.","scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"143.0.7499.169-1~deb12u1","bookworm-security":"145.0.7632.159-1~deb12u1"},"fixed_version":"87.0.4280.88-0.1","urgency":"not yet assigned"},"bullseye":{"status":"resolved","repositories":{"bullseye":"120.0.6099.224-1~deb11u1","bullseye-security":"120.0.6099.224-1~deb11u1"},"fixed_version":"87.0.4280.88-0.1","urgency":"not yet assigned"},"forky":{"status":"resolved","repositories":{"forky":"145.0.7632.159-1"},"fixed_version":"87.0.4280.88-0.1","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"146.0.7680.71-1"},"fixed_version":"87.0.4280.88-0.1","urgency":"not yet assigned"},"trixie":{"status":"resolved","repositories":{"trixie":"143.0.7499.169-1~deb13u1","trixie-security":"145.0.7632.159-1~deb13u1"},"fixed_version":"87.0.4280.88-0.1","urgency":"not yet assigned"}}},"CVE-2020-6532":{"description":"Use after free in SCTP in Google Chrome prior to 84.0.4147.105 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page.","scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"143.0.7499.169-1~deb12u1","bookworm-security":"145.0.7632.159-1~deb12u1"},"fixed_version":"87.0.4280.88-0.1","urgency":"not yet assigned"},"bullseye":{"status":"resolved","repositories":{"bullseye":"120.0.6099.224-1~deb11u1","bullseye-security":"120.0.6099.224-1~deb11u1"},"fixed_version":"87.0.4280.88-0.1","urgency":"not yet assigned"},"forky":{"status":"resolved","repositories":{"forky":"145.0.7632.159-1"},"fixed_version":"87.0.4280.88-0.1","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"146.0.7680.71-1"},"fixed_version":"87.0.4280.88-0.1","urgency":"not yet assigned"},"trixie":{"status":"resolved","repositories":{"trixie":"143.0.7499.169-1~deb13u1","trixie-security":"145.0.7632.159-1~deb13u1"},"fixed_version":"87.0.4280.88-0.1","urgency":"not yet assigned"}}},"CVE-2020-6533":{"description":"Type Confusion in V8 in Google Chrome prior to 84.0.4147.89 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page.","scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"143.0.7499.169-1~deb12u1","bookworm-security":"145.0.7632.159-1~deb12u1"},"fixed_version":"87.0.4280.88-0.1","urgency":"not yet assigned"},"bullseye":{"status":"resolved","repositories":{"bullseye":"120.0.6099.224-1~deb11u1","bullseye-security":"120.0.6099.224-1~deb11u1"},"fixed_version":"87.0.4280.88-0.1","urgency":"not yet assigned"},"forky":{"status":"resolved","repositories":{"forky":"145.0.7632.159-1"},"fixed_version":"87.0.4280.88-0.1","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"146.0.7680.71-1"},"fixed_version":"87.0.4280.88-0.1","urgency":"not yet assigned"},"trixie":{"status":"resolved","repositories":{"trixie":"143.0.7499.169-1~deb13u1","trixie-security":"145.0.7632.159-1~deb13u1"},"fixed_version":"87.0.4280.88-0.1","urgency":"not yet assigned"}}},"CVE-2020-6534":{"description":"Heap buffer overflow in WebRTC in Google Chrome prior to 84.0.4147.89 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page.","scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"143.0.7499.169-1~deb12u1","bookworm-security":"145.0.7632.159-1~deb12u1"},"fixed_version":"87.0.4280.88-0.1","urgency":"not yet assigned"},"bullseye":{"status":"resolved","repositories":{"bullseye":"120.0.6099.224-1~deb11u1","bullseye-security":"120.0.6099.224-1~deb11u1"},"fixed_version":"87.0.4280.88-0.1","urgency":"not yet assigned"},"forky":{"status":"resolved","repositories":{"forky":"145.0.7632.159-1"},"fixed_version":"87.0.4280.88-0.1","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"146.0.7680.71-1"},"fixed_version":"87.0.4280.88-0.1","urgency":"not yet assigned"},"trixie":{"status":"resolved","repositories":{"trixie":"143.0.7499.169-1~deb13u1","trixie-security":"145.0.7632.159-1~deb13u1"},"fixed_version":"87.0.4280.88-0.1","urgency":"not yet assigned"}}},"CVE-2020-6535":{"description":"Insufficient data validation in WebUI in Google Chrome prior to 84.0.4147.89 allowed a remote attacker who had compromised the renderer process to inject scripts or HTML into a privileged page via a crafted HTML page.","scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"143.0.7499.169-1~deb12u1","bookworm-security":"145.0.7632.159-1~deb12u1"},"fixed_version":"87.0.4280.88-0.1","urgency":"not yet assigned"},"bullseye":{"status":"resolved","repositories":{"bullseye":"120.0.6099.224-1~deb11u1","bullseye-security":"120.0.6099.224-1~deb11u1"},"fixed_version":"87.0.4280.88-0.1","urgency":"not yet assigned"},"forky":{"status":"resolved","repositories":{"forky":"145.0.7632.159-1"},"fixed_version":"87.0.4280.88-0.1","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"146.0.7680.71-1"},"fixed_version":"87.0.4280.88-0.1","urgency":"not yet assigned"},"trixie":{"status":"resolved","repositories":{"trixie":"143.0.7499.169-1~deb13u1","trixie-security":"145.0.7632.159-1~deb13u1"},"fixed_version":"87.0.4280.88-0.1","urgency":"not yet assigned"}}},"CVE-2020-6536":{"description":"Incorrect security UI in PWAs in Google Chrome prior to 84.0.4147.89 allowed a remote attacker who had persuaded the user to install a PWA to spoof the contents of the Omnibox (URL bar) via a crafted PWA.","scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"143.0.7499.169-1~deb12u1","bookworm-security":"145.0.7632.159-1~deb12u1"},"fixed_version":"87.0.4280.88-0.1","urgency":"not yet assigned"},"bullseye":{"status":"resolved","repositories":{"bullseye":"120.0.6099.224-1~deb11u1","bullseye-security":"120.0.6099.224-1~deb11u1"},"fixed_version":"87.0.4280.88-0.1","urgency":"not yet assigned"},"forky":{"status":"resolved","repositories":{"forky":"145.0.7632.159-1"},"fixed_version":"87.0.4280.88-0.1","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"146.0.7680.71-1"},"fixed_version":"87.0.4280.88-0.1","urgency":"not yet assigned"},"trixie":{"status":"resolved","repositories":{"trixie":"143.0.7499.169-1~deb13u1","trixie-security":"145.0.7632.159-1~deb13u1"},"fixed_version":"87.0.4280.88-0.1","urgency":"not yet assigned"}}},"CVE-2020-6537":{"description":"Type confusion in V8 in Google Chrome prior to 84.0.4147.105 allowed a remote attacker to execute arbitrary code inside a sandbox via a crafted HTML page.","scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"143.0.7499.169-1~deb12u1","bookworm-security":"145.0.7632.159-1~deb12u1"},"fixed_version":"87.0.4280.88-0.1","urgency":"not yet assigned"},"bullseye":{"status":"resolved","repositories":{"bullseye":"120.0.6099.224-1~deb11u1","bullseye-security":"120.0.6099.224-1~deb11u1"},"fixed_version":"87.0.4280.88-0.1","urgency":"not yet assigned"},"forky":{"status":"resolved","repositories":{"forky":"145.0.7632.159-1"},"fixed_version":"87.0.4280.88-0.1","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"146.0.7680.71-1"},"fixed_version":"87.0.4280.88-0.1","urgency":"not yet assigned"},"trixie":{"status":"resolved","repositories":{"trixie":"143.0.7499.169-1~deb13u1","trixie-security":"145.0.7632.159-1~deb13u1"},"fixed_version":"87.0.4280.88-0.1","urgency":"not yet assigned"}}},"CVE-2020-6538":{"description":"Inappropriate implementation in WebView in Google Chrome on Android prior to 84.0.4147.105 allowed a remote attacker to leak cross-origin data via a crafted HTML page.","scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"143.0.7499.169-1~deb12u1","bookworm-security":"145.0.7632.159-1~deb12u1"},"fixed_version":"87.0.4280.88-0.1","urgency":"not yet assigned"},"bullseye":{"status":"resolved","repositories":{"bullseye":"120.0.6099.224-1~deb11u1","bullseye-security":"120.0.6099.224-1~deb11u1"},"fixed_version":"87.0.4280.88-0.1","urgency":"not yet assigned"},"forky":{"status":"resolved","repositories":{"forky":"145.0.7632.159-1"},"fixed_version":"87.0.4280.88-0.1","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"146.0.7680.71-1"},"fixed_version":"87.0.4280.88-0.1","urgency":"not yet assigned"},"trixie":{"status":"resolved","repositories":{"trixie":"143.0.7499.169-1~deb13u1","trixie-security":"145.0.7632.159-1~deb13u1"},"fixed_version":"87.0.4280.88-0.1","urgency":"not yet assigned"}}},"CVE-2020-6539":{"description":"Use after free in CSS in Google Chrome prior to 84.0.4147.105 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page.","scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"143.0.7499.169-1~deb12u1","bookworm-security":"145.0.7632.159-1~deb12u1"},"fixed_version":"87.0.4280.88-0.1","urgency":"not yet assigned"},"bullseye":{"status":"resolved","repositories":{"bullseye":"120.0.6099.224-1~deb11u1","bullseye-security":"120.0.6099.224-1~deb11u1"},"fixed_version":"87.0.4280.88-0.1","urgency":"not yet assigned"},"forky":{"status":"resolved","repositories":{"forky":"145.0.7632.159-1"},"fixed_version":"87.0.4280.88-0.1","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"146.0.7680.71-1"},"fixed_version":"87.0.4280.88-0.1","urgency":"not yet assigned"},"trixie":{"status":"resolved","repositories":{"trixie":"143.0.7499.169-1~deb13u1","trixie-security":"145.0.7632.159-1~deb13u1"},"fixed_version":"87.0.4280.88-0.1","urgency":"not yet assigned"}}},"CVE-2020-6540":{"description":"Buffer overflow in Skia in Google Chrome prior to 84.0.4147.105 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page.","scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"143.0.7499.169-1~deb12u1","bookworm-security":"145.0.7632.159-1~deb12u1"},"fixed_version":"87.0.4280.88-0.1","urgency":"not yet assigned"},"bullseye":{"status":"resolved","repositories":{"bullseye":"120.0.6099.224-1~deb11u1","bullseye-security":"120.0.6099.224-1~deb11u1"},"fixed_version":"87.0.4280.88-0.1","urgency":"not yet assigned"},"forky":{"status":"resolved","repositories":{"forky":"145.0.7632.159-1"},"fixed_version":"87.0.4280.88-0.1","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"146.0.7680.71-1"},"fixed_version":"87.0.4280.88-0.1","urgency":"not yet assigned"},"trixie":{"status":"resolved","repositories":{"trixie":"143.0.7499.169-1~deb13u1","trixie-security":"145.0.7632.159-1~deb13u1"},"fixed_version":"87.0.4280.88-0.1","urgency":"not yet assigned"}}},"CVE-2020-6541":{"description":"Use after free in WebUSB in Google Chrome prior to 84.0.4147.105 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page.","scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"143.0.7499.169-1~deb12u1","bookworm-security":"145.0.7632.159-1~deb12u1"},"fixed_version":"87.0.4280.88-0.1","urgency":"not yet assigned"},"bullseye":{"status":"resolved","repositories":{"bullseye":"120.0.6099.224-1~deb11u1","bullseye-security":"120.0.6099.224-1~deb11u1"},"fixed_version":"87.0.4280.88-0.1","urgency":"not yet assigned"},"forky":{"status":"resolved","repositories":{"forky":"145.0.7632.159-1"},"fixed_version":"87.0.4280.88-0.1","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"146.0.7680.71-1"},"fixed_version":"87.0.4280.88-0.1","urgency":"not yet assigned"},"trixie":{"status":"resolved","repositories":{"trixie":"143.0.7499.169-1~deb13u1","trixie-security":"145.0.7632.159-1~deb13u1"},"fixed_version":"87.0.4280.88-0.1","urgency":"not yet assigned"}}},"CVE-2020-6542":{"description":"Use after free in ANGLE in Google Chrome prior to 84.0.4147.125 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page.","scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"143.0.7499.169-1~deb12u1","bookworm-security":"145.0.7632.159-1~deb12u1"},"fixed_version":"87.0.4280.88-0.1","urgency":"not yet assigned"},"bullseye":{"status":"resolved","repositories":{"bullseye":"120.0.6099.224-1~deb11u1","bullseye-security":"120.0.6099.224-1~deb11u1"},"fixed_version":"87.0.4280.88-0.1","urgency":"not yet assigned"},"forky":{"status":"resolved","repositories":{"forky":"145.0.7632.159-1"},"fixed_version":"87.0.4280.88-0.1","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"146.0.7680.71-1"},"fixed_version":"87.0.4280.88-0.1","urgency":"not yet assigned"},"trixie":{"status":"resolved","repositories":{"trixie":"143.0.7499.169-1~deb13u1","trixie-security":"145.0.7632.159-1~deb13u1"},"fixed_version":"87.0.4280.88-0.1","urgency":"not yet assigned"}}},"CVE-2020-6543":{"description":"Use after free in task scheduling in Google Chrome prior to 84.0.4147.125 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page.","scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"143.0.7499.169-1~deb12u1","bookworm-security":"145.0.7632.159-1~deb12u1"},"fixed_version":"87.0.4280.88-0.1","urgency":"not yet assigned"},"bullseye":{"status":"resolved","repositories":{"bullseye":"120.0.6099.224-1~deb11u1","bullseye-security":"120.0.6099.224-1~deb11u1"},"fixed_version":"87.0.4280.88-0.1","urgency":"not yet assigned"},"forky":{"status":"resolved","repositories":{"forky":"145.0.7632.159-1"},"fixed_version":"87.0.4280.88-0.1","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"146.0.7680.71-1"},"fixed_version":"87.0.4280.88-0.1","urgency":"not yet assigned"},"trixie":{"status":"resolved","repositories":{"trixie":"143.0.7499.169-1~deb13u1","trixie-security":"145.0.7632.159-1~deb13u1"},"fixed_version":"87.0.4280.88-0.1","urgency":"not yet assigned"}}},"CVE-2020-6544":{"description":"Use after free in media in Google Chrome prior to 84.0.4147.125 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page.","scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"143.0.7499.169-1~deb12u1","bookworm-security":"145.0.7632.159-1~deb12u1"},"fixed_version":"87.0.4280.88-0.1","urgency":"not yet assigned"},"bullseye":{"status":"resolved","repositories":{"bullseye":"120.0.6099.224-1~deb11u1","bullseye-security":"120.0.6099.224-1~deb11u1"},"fixed_version":"87.0.4280.88-0.1","urgency":"not yet assigned"},"forky":{"status":"resolved","repositories":{"forky":"145.0.7632.159-1"},"fixed_version":"87.0.4280.88-0.1","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"146.0.7680.71-1"},"fixed_version":"87.0.4280.88-0.1","urgency":"not yet assigned"},"trixie":{"status":"resolved","repositories":{"trixie":"143.0.7499.169-1~deb13u1","trixie-security":"145.0.7632.159-1~deb13u1"},"fixed_version":"87.0.4280.88-0.1","urgency":"not yet assigned"}}},"CVE-2020-6545":{"description":"Use after free in audio in Google Chrome prior to 84.0.4147.125 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page.","scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"143.0.7499.169-1~deb12u1","bookworm-security":"145.0.7632.159-1~deb12u1"},"fixed_version":"87.0.4280.88-0.1","urgency":"not yet assigned"},"bullseye":{"status":"resolved","repositories":{"bullseye":"120.0.6099.224-1~deb11u1","bullseye-security":"120.0.6099.224-1~deb11u1"},"fixed_version":"87.0.4280.88-0.1","urgency":"not yet assigned"},"forky":{"status":"resolved","repositories":{"forky":"145.0.7632.159-1"},"fixed_version":"87.0.4280.88-0.1","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"146.0.7680.71-1"},"fixed_version":"87.0.4280.88-0.1","urgency":"not yet assigned"},"trixie":{"status":"resolved","repositories":{"trixie":"143.0.7499.169-1~deb13u1","trixie-security":"145.0.7632.159-1~deb13u1"},"fixed_version":"87.0.4280.88-0.1","urgency":"not yet assigned"}}},"CVE-2020-6546":{"description":"Inappropriate implementation in installer in Google Chrome prior to 84.0.4147.125 allowed a local attacker to potentially elevate privilege via a crafted filesystem.","scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"143.0.7499.169-1~deb12u1","bookworm-security":"145.0.7632.159-1~deb12u1"},"fixed_version":"0","urgency":"unimportant"},"bullseye":{"status":"resolved","repositories":{"bullseye":"120.0.6099.224-1~deb11u1","bullseye-security":"120.0.6099.224-1~deb11u1"},"fixed_version":"0","urgency":"unimportant"},"forky":{"status":"resolved","repositories":{"forky":"145.0.7632.159-1"},"fixed_version":"0","urgency":"unimportant"},"sid":{"status":"resolved","repositories":{"sid":"146.0.7680.71-1"},"fixed_version":"0","urgency":"unimportant"},"trixie":{"status":"resolved","repositories":{"trixie":"143.0.7499.169-1~deb13u1","trixie-security":"145.0.7632.159-1~deb13u1"},"fixed_version":"0","urgency":"unimportant"}}},"CVE-2020-6547":{"description":"Incorrect security UI in media in Google Chrome prior to 84.0.4147.125 allowed a remote attacker to potentially obtain sensitive information via a crafted HTML page.","scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"143.0.7499.169-1~deb12u1","bookworm-security":"145.0.7632.159-1~deb12u1"},"fixed_version":"87.0.4280.88-0.1","urgency":"not yet assigned"},"bullseye":{"status":"resolved","repositories":{"bullseye":"120.0.6099.224-1~deb11u1","bullseye-security":"120.0.6099.224-1~deb11u1"},"fixed_version":"87.0.4280.88-0.1","urgency":"not yet assigned"},"forky":{"status":"resolved","repositories":{"forky":"145.0.7632.159-1"},"fixed_version":"87.0.4280.88-0.1","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"146.0.7680.71-1"},"fixed_version":"87.0.4280.88-0.1","urgency":"not yet assigned"},"trixie":{"status":"resolved","repositories":{"trixie":"143.0.7499.169-1~deb13u1","trixie-security":"145.0.7632.159-1~deb13u1"},"fixed_version":"87.0.4280.88-0.1","urgency":"not yet assigned"}}},"CVE-2020-6548":{"description":"Heap buffer overflow in Skia in Google Chrome prior to 84.0.4147.125 allowed a remote attacker who had compromised the renderer process to potentially exploit heap corruption via a crafted HTML page.","scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"143.0.7499.169-1~deb12u1","bookworm-security":"145.0.7632.159-1~deb12u1"},"fixed_version":"87.0.4280.88-0.1","urgency":"not yet assigned"},"bullseye":{"status":"resolved","repositories":{"bullseye":"120.0.6099.224-1~deb11u1","bullseye-security":"120.0.6099.224-1~deb11u1"},"fixed_version":"87.0.4280.88-0.1","urgency":"not yet assigned"},"forky":{"status":"resolved","repositories":{"forky":"145.0.7632.159-1"},"fixed_version":"87.0.4280.88-0.1","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"146.0.7680.71-1"},"fixed_version":"87.0.4280.88-0.1","urgency":"not yet assigned"},"trixie":{"status":"resolved","repositories":{"trixie":"143.0.7499.169-1~deb13u1","trixie-security":"145.0.7632.159-1~deb13u1"},"fixed_version":"87.0.4280.88-0.1","urgency":"not yet assigned"}}},"CVE-2020-6549":{"description":"Use after free in media in Google Chrome prior to 84.0.4147.125 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page.","scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"143.0.7499.169-1~deb12u1","bookworm-security":"145.0.7632.159-1~deb12u1"},"fixed_version":"87.0.4280.88-0.1","urgency":"not yet assigned"},"bullseye":{"status":"resolved","repositories":{"bullseye":"120.0.6099.224-1~deb11u1","bullseye-security":"120.0.6099.224-1~deb11u1"},"fixed_version":"87.0.4280.88-0.1","urgency":"not yet assigned"},"forky":{"status":"resolved","repositories":{"forky":"145.0.7632.159-1"},"fixed_version":"87.0.4280.88-0.1","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"146.0.7680.71-1"},"fixed_version":"87.0.4280.88-0.1","urgency":"not yet assigned"},"trixie":{"status":"resolved","repositories":{"trixie":"143.0.7499.169-1~deb13u1","trixie-security":"145.0.7632.159-1~deb13u1"},"fixed_version":"87.0.4280.88-0.1","urgency":"not yet assigned"}}},"CVE-2020-6550":{"description":"Use after free in IndexedDB in Google Chrome prior to 84.0.4147.125 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page.","scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"143.0.7499.169-1~deb12u1","bookworm-security":"145.0.7632.159-1~deb12u1"},"fixed_version":"87.0.4280.88-0.1","urgency":"not yet assigned"},"bullseye":{"status":"resolved","repositories":{"bullseye":"120.0.6099.224-1~deb11u1","bullseye-security":"120.0.6099.224-1~deb11u1"},"fixed_version":"87.0.4280.88-0.1","urgency":"not yet assigned"},"forky":{"status":"resolved","repositories":{"forky":"145.0.7632.159-1"},"fixed_version":"87.0.4280.88-0.1","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"146.0.7680.71-1"},"fixed_version":"87.0.4280.88-0.1","urgency":"not yet assigned"},"trixie":{"status":"resolved","repositories":{"trixie":"143.0.7499.169-1~deb13u1","trixie-security":"145.0.7632.159-1~deb13u1"},"fixed_version":"87.0.4280.88-0.1","urgency":"not yet assigned"}}},"CVE-2020-6551":{"description":"Use after free in WebXR in Google Chrome prior to 84.0.4147.125 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page.","scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"143.0.7499.169-1~deb12u1","bookworm-security":"145.0.7632.159-1~deb12u1"},"fixed_version":"87.0.4280.88-0.1","urgency":"not yet assigned"},"bullseye":{"status":"resolved","repositories":{"bullseye":"120.0.6099.224-1~deb11u1","bullseye-security":"120.0.6099.224-1~deb11u1"},"fixed_version":"87.0.4280.88-0.1","urgency":"not yet assigned"},"forky":{"status":"resolved","repositories":{"forky":"145.0.7632.159-1"},"fixed_version":"87.0.4280.88-0.1","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"146.0.7680.71-1"},"fixed_version":"87.0.4280.88-0.1","urgency":"not yet assigned"},"trixie":{"status":"resolved","repositories":{"trixie":"143.0.7499.169-1~deb13u1","trixie-security":"145.0.7632.159-1~deb13u1"},"fixed_version":"87.0.4280.88-0.1","urgency":"not yet assigned"}}},"CVE-2020-6552":{"description":"Use after free in Blink in Google Chrome prior to 84.0.4147.125 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page.","scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"143.0.7499.169-1~deb12u1","bookworm-security":"145.0.7632.159-1~deb12u1"},"fixed_version":"87.0.4280.88-0.1","urgency":"not yet assigned"},"bullseye":{"status":"resolved","repositories":{"bullseye":"120.0.6099.224-1~deb11u1","bullseye-security":"120.0.6099.224-1~deb11u1"},"fixed_version":"87.0.4280.88-0.1","urgency":"not yet assigned"},"forky":{"status":"resolved","repositories":{"forky":"145.0.7632.159-1"},"fixed_version":"87.0.4280.88-0.1","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"146.0.7680.71-1"},"fixed_version":"87.0.4280.88-0.1","urgency":"not yet assigned"},"trixie":{"status":"resolved","repositories":{"trixie":"143.0.7499.169-1~deb13u1","trixie-security":"145.0.7632.159-1~deb13u1"},"fixed_version":"87.0.4280.88-0.1","urgency":"not yet assigned"}}},"CVE-2020-6553":{"description":"Use after free in offline mode in Google Chrome on iOS prior to 84.0.4147.125 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page.","scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"143.0.7499.169-1~deb12u1","bookworm-security":"145.0.7632.159-1~deb12u1"},"fixed_version":"87.0.4280.88-0.1","urgency":"not yet assigned"},"bullseye":{"status":"resolved","repositories":{"bullseye":"120.0.6099.224-1~deb11u1","bullseye-security":"120.0.6099.224-1~deb11u1"},"fixed_version":"87.0.4280.88-0.1","urgency":"not yet assigned"},"forky":{"status":"resolved","repositories":{"forky":"145.0.7632.159-1"},"fixed_version":"87.0.4280.88-0.1","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"146.0.7680.71-1"},"fixed_version":"87.0.4280.88-0.1","urgency":"not yet assigned"},"trixie":{"status":"resolved","repositories":{"trixie":"143.0.7499.169-1~deb13u1","trixie-security":"145.0.7632.159-1~deb13u1"},"fixed_version":"87.0.4280.88-0.1","urgency":"not yet assigned"}}},"CVE-2020-6554":{"description":"Use after free in extensions in Google Chrome prior to 84.0.4147.125 allowed a remote attacker to potentially perform a sandbox escape via a crafted Chrome Extension.","scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"143.0.7499.169-1~deb12u1","bookworm-security":"145.0.7632.159-1~deb12u1"},"fixed_version":"87.0.4280.88-0.1","urgency":"not yet assigned"},"bullseye":{"status":"resolved","repositories":{"bullseye":"120.0.6099.224-1~deb11u1","bullseye-security":"120.0.6099.224-1~deb11u1"},"fixed_version":"87.0.4280.88-0.1","urgency":"not yet assigned"},"forky":{"status":"resolved","repositories":{"forky":"145.0.7632.159-1"},"fixed_version":"87.0.4280.88-0.1","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"146.0.7680.71-1"},"fixed_version":"87.0.4280.88-0.1","urgency":"not yet assigned"},"trixie":{"status":"resolved","repositories":{"trixie":"143.0.7499.169-1~deb13u1","trixie-security":"145.0.7632.159-1~deb13u1"},"fixed_version":"87.0.4280.88-0.1","urgency":"not yet assigned"}}},"CVE-2020-6555":{"description":"Out of bounds read in WebGL in Google Chrome prior to 84.0.4147.125 allowed a remote attacker to obtain potentially sensitive information from process memory via a crafted HTML page.","scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"143.0.7499.169-1~deb12u1","bookworm-security":"145.0.7632.159-1~deb12u1"},"fixed_version":"87.0.4280.88-0.1","urgency":"not yet assigned"},"bullseye":{"status":"resolved","repositories":{"bullseye":"120.0.6099.224-1~deb11u1","bullseye-security":"120.0.6099.224-1~deb11u1"},"fixed_version":"87.0.4280.88-0.1","urgency":"not yet assigned"},"forky":{"status":"resolved","repositories":{"forky":"145.0.7632.159-1"},"fixed_version":"87.0.4280.88-0.1","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"146.0.7680.71-1"},"fixed_version":"87.0.4280.88-0.1","urgency":"not yet assigned"},"trixie":{"status":"resolved","repositories":{"trixie":"143.0.7499.169-1~deb13u1","trixie-security":"145.0.7632.159-1~deb13u1"},"fixed_version":"87.0.4280.88-0.1","urgency":"not yet assigned"}}},"CVE-2020-6556":{"description":"Heap buffer overflow in SwiftShader in Google Chrome prior to 84.0.4147.135 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page.","scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"143.0.7499.169-1~deb12u1","bookworm-security":"145.0.7632.159-1~deb12u1"},"fixed_version":"87.0.4280.88-0.1","urgency":"not yet assigned"},"bullseye":{"status":"resolved","repositories":{"bullseye":"120.0.6099.224-1~deb11u1","bullseye-security":"120.0.6099.224-1~deb11u1"},"fixed_version":"87.0.4280.88-0.1","urgency":"not yet assigned"},"forky":{"status":"resolved","repositories":{"forky":"145.0.7632.159-1"},"fixed_version":"87.0.4280.88-0.1","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"146.0.7680.71-1"},"fixed_version":"87.0.4280.88-0.1","urgency":"not yet assigned"},"trixie":{"status":"resolved","repositories":{"trixie":"143.0.7499.169-1~deb13u1","trixie-security":"145.0.7632.159-1~deb13u1"},"fixed_version":"87.0.4280.88-0.1","urgency":"not yet assigned"}}},"CVE-2020-6557":{"description":"Inappropriate implementation in networking in Google Chrome prior to 86.0.4240.75 allowed a remote attacker to perform domain spoofing via a crafted HTML page.","scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"143.0.7499.169-1~deb12u1","bookworm-security":"145.0.7632.159-1~deb12u1"},"fixed_version":"87.0.4280.88-0.1","urgency":"not yet assigned"},"bullseye":{"status":"resolved","repositories":{"bullseye":"120.0.6099.224-1~deb11u1","bullseye-security":"120.0.6099.224-1~deb11u1"},"fixed_version":"87.0.4280.88-0.1","urgency":"not yet assigned"},"forky":{"status":"resolved","repositories":{"forky":"145.0.7632.159-1"},"fixed_version":"87.0.4280.88-0.1","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"146.0.7680.71-1"},"fixed_version":"87.0.4280.88-0.1","urgency":"not yet assigned"},"trixie":{"status":"resolved","repositories":{"trixie":"143.0.7499.169-1~deb13u1","trixie-security":"145.0.7632.159-1~deb13u1"},"fixed_version":"87.0.4280.88-0.1","urgency":"not yet assigned"}}},"CVE-2020-6558":{"description":"Insufficient policy enforcement in iOSWeb in Google Chrome on iOS prior to 85.0.4183.83 allowed a remote attacker to bypass navigation restrictions via a crafted HTML page.","scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"143.0.7499.169-1~deb12u1","bookworm-security":"145.0.7632.159-1~deb12u1"},"fixed_version":"0","urgency":"unimportant"},"bullseye":{"status":"resolved","repositories":{"bullseye":"120.0.6099.224-1~deb11u1","bullseye-security":"120.0.6099.224-1~deb11u1"},"fixed_version":"0","urgency":"unimportant"},"forky":{"status":"resolved","repositories":{"forky":"145.0.7632.159-1"},"fixed_version":"0","urgency":"unimportant"},"sid":{"status":"resolved","repositories":{"sid":"146.0.7680.71-1"},"fixed_version":"0","urgency":"unimportant"},"trixie":{"status":"resolved","repositories":{"trixie":"143.0.7499.169-1~deb13u1","trixie-security":"145.0.7632.159-1~deb13u1"},"fixed_version":"0","urgency":"unimportant"}}},"CVE-2020-6559":{"description":"Use after free in presentation API in Google Chrome prior to 85.0.4183.83 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page.","scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"143.0.7499.169-1~deb12u1","bookworm-security":"145.0.7632.159-1~deb12u1"},"fixed_version":"87.0.4280.88-0.1","urgency":"not yet assigned"},"bullseye":{"status":"resolved","repositories":{"bullseye":"120.0.6099.224-1~deb11u1","bullseye-security":"120.0.6099.224-1~deb11u1"},"fixed_version":"87.0.4280.88-0.1","urgency":"not yet assigned"},"forky":{"status":"resolved","repositories":{"forky":"145.0.7632.159-1"},"fixed_version":"87.0.4280.88-0.1","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"146.0.7680.71-1"},"fixed_version":"87.0.4280.88-0.1","urgency":"not yet assigned"},"trixie":{"status":"resolved","repositories":{"trixie":"143.0.7499.169-1~deb13u1","trixie-security":"145.0.7632.159-1~deb13u1"},"fixed_version":"87.0.4280.88-0.1","urgency":"not yet assigned"}}},"CVE-2020-6560":{"description":"Insufficient policy enforcement in autofill in Google Chrome prior to 85.0.4183.83 allowed a remote attacker to leak cross-origin data via a crafted HTML page.","scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"143.0.7499.169-1~deb12u1","bookworm-security":"145.0.7632.159-1~deb12u1"},"fixed_version":"87.0.4280.88-0.1","urgency":"not yet assigned"},"bullseye":{"status":"resolved","repositories":{"bullseye":"120.0.6099.224-1~deb11u1","bullseye-security":"120.0.6099.224-1~deb11u1"},"fixed_version":"87.0.4280.88-0.1","urgency":"not yet assigned"},"forky":{"status":"resolved","repositories":{"forky":"145.0.7632.159-1"},"fixed_version":"87.0.4280.88-0.1","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"146.0.7680.71-1"},"fixed_version":"87.0.4280.88-0.1","urgency":"not yet assigned"},"trixie":{"status":"resolved","repositories":{"trixie":"143.0.7499.169-1~deb13u1","trixie-security":"145.0.7632.159-1~deb13u1"},"fixed_version":"87.0.4280.88-0.1","urgency":"not yet assigned"}}},"CVE-2020-6561":{"description":"Inappropriate implementation in Content Security Policy in Google Chrome prior to 85.0.4183.83 allowed a remote attacker to leak cross-origin data via a crafted HTML page.","scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"143.0.7499.169-1~deb12u1","bookworm-security":"145.0.7632.159-1~deb12u1"},"fixed_version":"87.0.4280.88-0.1","urgency":"not yet assigned"},"bullseye":{"status":"resolved","repositories":{"bullseye":"120.0.6099.224-1~deb11u1","bullseye-security":"120.0.6099.224-1~deb11u1"},"fixed_version":"87.0.4280.88-0.1","urgency":"not yet assigned"},"forky":{"status":"resolved","repositories":{"forky":"145.0.7632.159-1"},"fixed_version":"87.0.4280.88-0.1","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"146.0.7680.71-1"},"fixed_version":"87.0.4280.88-0.1","urgency":"not yet assigned"},"trixie":{"status":"resolved","repositories":{"trixie":"143.0.7499.169-1~deb13u1","trixie-security":"145.0.7632.159-1~deb13u1"},"fixed_version":"87.0.4280.88-0.1","urgency":"not yet assigned"}}},"CVE-2020-6562":{"description":"Insufficient policy enforcement in Blink in Google Chrome prior to 85.0.4183.83 allowed a remote attacker to leak cross-origin data via a crafted HTML page.","scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"143.0.7499.169-1~deb12u1","bookworm-security":"145.0.7632.159-1~deb12u1"},"fixed_version":"87.0.4280.88-0.1","urgency":"not yet assigned"},"bullseye":{"status":"resolved","repositories":{"bullseye":"120.0.6099.224-1~deb11u1","bullseye-security":"120.0.6099.224-1~deb11u1"},"fixed_version":"87.0.4280.88-0.1","urgency":"not yet assigned"},"forky":{"status":"resolved","repositories":{"forky":"145.0.7632.159-1"},"fixed_version":"87.0.4280.88-0.1","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"146.0.7680.71-1"},"fixed_version":"87.0.4280.88-0.1","urgency":"not yet assigned"},"trixie":{"status":"resolved","repositories":{"trixie":"143.0.7499.169-1~deb13u1","trixie-security":"145.0.7632.159-1~deb13u1"},"fixed_version":"87.0.4280.88-0.1","urgency":"not yet assigned"}}},"CVE-2020-6563":{"description":"Insufficient policy enforcement in intent handling in Google Chrome on Android prior to 85.0.4183.83 allowed a remote attacker to obtain potentially sensitive information from disk via a crafted HTML page.","scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"143.0.7499.169-1~deb12u1","bookworm-security":"145.0.7632.159-1~deb12u1"},"fixed_version":"87.0.4280.88-0.1","urgency":"not yet assigned"},"bullseye":{"status":"resolved","repositories":{"bullseye":"120.0.6099.224-1~deb11u1","bullseye-security":"120.0.6099.224-1~deb11u1"},"fixed_version":"87.0.4280.88-0.1","urgency":"not yet assigned"},"forky":{"status":"resolved","repositories":{"forky":"145.0.7632.159-1"},"fixed_version":"87.0.4280.88-0.1","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"146.0.7680.71-1"},"fixed_version":"87.0.4280.88-0.1","urgency":"not yet assigned"},"trixie":{"status":"resolved","repositories":{"trixie":"143.0.7499.169-1~deb13u1","trixie-security":"145.0.7632.159-1~deb13u1"},"fixed_version":"87.0.4280.88-0.1","urgency":"not yet assigned"}}},"CVE-2020-6564":{"description":"Inappropriate implementation in permissions in Google Chrome prior to 85.0.4183.83 allowed a remote attacker to spoof the contents of a permission dialog via a crafted HTML page.","scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"143.0.7499.169-1~deb12u1","bookworm-security":"145.0.7632.159-1~deb12u1"},"fixed_version":"87.0.4280.88-0.1","urgency":"not yet assigned"},"bullseye":{"status":"resolved","repositories":{"bullseye":"120.0.6099.224-1~deb11u1","bullseye-security":"120.0.6099.224-1~deb11u1"},"fixed_version":"87.0.4280.88-0.1","urgency":"not yet assigned"},"forky":{"status":"resolved","repositories":{"forky":"145.0.7632.159-1"},"fixed_version":"87.0.4280.88-0.1","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"146.0.7680.71-1"},"fixed_version":"87.0.4280.88-0.1","urgency":"not yet assigned"},"trixie":{"status":"resolved","repositories":{"trixie":"143.0.7499.169-1~deb13u1","trixie-security":"145.0.7632.159-1~deb13u1"},"fixed_version":"87.0.4280.88-0.1","urgency":"not yet assigned"}}},"CVE-2020-6565":{"description":"Inappropriate implementation in Omnibox in Google Chrome on iOS prior to 85.0.4183.83 allowed a remote attacker to spoof the contents of the Omnibox (URL bar) via a crafted HTML page.","scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"143.0.7499.169-1~deb12u1","bookworm-security":"145.0.7632.159-1~deb12u1"},"fixed_version":"87.0.4280.88-0.1","urgency":"not yet assigned"},"bullseye":{"status":"resolved","repositories":{"bullseye":"120.0.6099.224-1~deb11u1","bullseye-security":"120.0.6099.224-1~deb11u1"},"fixed_version":"87.0.4280.88-0.1","urgency":"not yet assigned"},"forky":{"status":"resolved","repositories":{"forky":"145.0.7632.159-1"},"fixed_version":"87.0.4280.88-0.1","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"146.0.7680.71-1"},"fixed_version":"87.0.4280.88-0.1","urgency":"not yet assigned"},"trixie":{"status":"resolved","repositories":{"trixie":"143.0.7499.169-1~deb13u1","trixie-security":"145.0.7632.159-1~deb13u1"},"fixed_version":"87.0.4280.88-0.1","urgency":"not yet assigned"}}},"CVE-2020-6566":{"description":"Insufficient policy enforcement in media in Google Chrome prior to 85.0.4183.83 allowed a remote attacker to leak cross-origin data via a crafted HTML page.","scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"143.0.7499.169-1~deb12u1","bookworm-security":"145.0.7632.159-1~deb12u1"},"fixed_version":"87.0.4280.88-0.1","urgency":"not yet assigned"},"bullseye":{"status":"resolved","repositories":{"bullseye":"120.0.6099.224-1~deb11u1","bullseye-security":"120.0.6099.224-1~deb11u1"},"fixed_version":"87.0.4280.88-0.1","urgency":"not yet assigned"},"forky":{"status":"resolved","repositories":{"forky":"145.0.7632.159-1"},"fixed_version":"87.0.4280.88-0.1","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"146.0.7680.71-1"},"fixed_version":"87.0.4280.88-0.1","urgency":"not yet assigned"},"trixie":{"status":"resolved","repositories":{"trixie":"143.0.7499.169-1~deb13u1","trixie-security":"145.0.7632.159-1~deb13u1"},"fixed_version":"87.0.4280.88-0.1","urgency":"not yet assigned"}}},"CVE-2020-6567":{"description":"Insufficient validation of untrusted input in command line handling in Google Chrome on Windows prior to 85.0.4183.83 allowed a remote attacker to bypass navigation restrictions via a crafted HTML page.","scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"143.0.7499.169-1~deb12u1","bookworm-security":"145.0.7632.159-1~deb12u1"},"fixed_version":"87.0.4280.88-0.1","urgency":"not yet assigned"},"bullseye":{"status":"resolved","repositories":{"bullseye":"120.0.6099.224-1~deb11u1","bullseye-security":"120.0.6099.224-1~deb11u1"},"fixed_version":"87.0.4280.88-0.1","urgency":"not yet assigned"},"forky":{"status":"resolved","repositories":{"forky":"145.0.7632.159-1"},"fixed_version":"87.0.4280.88-0.1","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"146.0.7680.71-1"},"fixed_version":"87.0.4280.88-0.1","urgency":"not yet assigned"},"trixie":{"status":"resolved","repositories":{"trixie":"143.0.7499.169-1~deb13u1","trixie-security":"145.0.7632.159-1~deb13u1"},"fixed_version":"87.0.4280.88-0.1","urgency":"not yet assigned"}}},"CVE-2020-6568":{"description":"Insufficient policy enforcement in intent handling in Google Chrome on Android prior to 85.0.4183.83 allowed a remote attacker to bypass navigation restrictions via a crafted HTML page.","scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"143.0.7499.169-1~deb12u1","bookworm-security":"145.0.7632.159-1~deb12u1"},"fixed_version":"87.0.4280.88-0.1","urgency":"not yet assigned"},"bullseye":{"status":"resolved","repositories":{"bullseye":"120.0.6099.224-1~deb11u1","bullseye-security":"120.0.6099.224-1~deb11u1"},"fixed_version":"87.0.4280.88-0.1","urgency":"not yet assigned"},"forky":{"status":"resolved","repositories":{"forky":"145.0.7632.159-1"},"fixed_version":"87.0.4280.88-0.1","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"146.0.7680.71-1"},"fixed_version":"87.0.4280.88-0.1","urgency":"not yet assigned"},"trixie":{"status":"resolved","repositories":{"trixie":"143.0.7499.169-1~deb13u1","trixie-security":"145.0.7632.159-1~deb13u1"},"fixed_version":"87.0.4280.88-0.1","urgency":"not yet assigned"}}},"CVE-2020-6569":{"description":"Integer overflow in WebUSB in Google Chrome prior to 85.0.4183.83 allowed a remote attacker who had compromised the renderer process to potentially exploit heap corruption via a crafted HTML page.","scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"143.0.7499.169-1~deb12u1","bookworm-security":"145.0.7632.159-1~deb12u1"},"fixed_version":"87.0.4280.88-0.1","urgency":"not yet assigned"},"bullseye":{"status":"resolved","repositories":{"bullseye":"120.0.6099.224-1~deb11u1","bullseye-security":"120.0.6099.224-1~deb11u1"},"fixed_version":"87.0.4280.88-0.1","urgency":"not yet assigned"},"forky":{"status":"resolved","repositories":{"forky":"145.0.7632.159-1"},"fixed_version":"87.0.4280.88-0.1","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"146.0.7680.71-1"},"fixed_version":"87.0.4280.88-0.1","urgency":"not yet assigned"},"trixie":{"status":"resolved","repositories":{"trixie":"143.0.7499.169-1~deb13u1","trixie-security":"145.0.7632.159-1~deb13u1"},"fixed_version":"87.0.4280.88-0.1","urgency":"not yet assigned"}}},"CVE-2020-6570":{"description":"Information leakage in WebRTC in Google Chrome prior to 85.0.4183.83 allowed a remote attacker to obtain potentially sensitive information via a crafted WebRTC interaction.","scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"143.0.7499.169-1~deb12u1","bookworm-security":"145.0.7632.159-1~deb12u1"},"fixed_version":"87.0.4280.88-0.1","urgency":"not yet assigned"},"bullseye":{"status":"resolved","repositories":{"bullseye":"120.0.6099.224-1~deb11u1","bullseye-security":"120.0.6099.224-1~deb11u1"},"fixed_version":"87.0.4280.88-0.1","urgency":"not yet assigned"},"forky":{"status":"resolved","repositories":{"forky":"145.0.7632.159-1"},"fixed_version":"87.0.4280.88-0.1","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"146.0.7680.71-1"},"fixed_version":"87.0.4280.88-0.1","urgency":"not yet assigned"},"trixie":{"status":"resolved","repositories":{"trixie":"143.0.7499.169-1~deb13u1","trixie-security":"145.0.7632.159-1~deb13u1"},"fixed_version":"87.0.4280.88-0.1","urgency":"not yet assigned"}}},"CVE-2020-6571":{"description":"Insufficient data validation in Omnibox in Google Chrome prior to 85.0.4183.83 allowed a remote attacker to perform domain spoofing via IDN homographs via a crafted domain name.","scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"143.0.7499.169-1~deb12u1","bookworm-security":"145.0.7632.159-1~deb12u1"},"fixed_version":"87.0.4280.88-0.1","urgency":"not yet assigned"},"bullseye":{"status":"resolved","repositories":{"bullseye":"120.0.6099.224-1~deb11u1","bullseye-security":"120.0.6099.224-1~deb11u1"},"fixed_version":"87.0.4280.88-0.1","urgency":"not yet assigned"},"forky":{"status":"resolved","repositories":{"forky":"145.0.7632.159-1"},"fixed_version":"87.0.4280.88-0.1","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"146.0.7680.71-1"},"fixed_version":"87.0.4280.88-0.1","urgency":"not yet assigned"},"trixie":{"status":"resolved","repositories":{"trixie":"143.0.7499.169-1~deb13u1","trixie-security":"145.0.7632.159-1~deb13u1"},"fixed_version":"87.0.4280.88-0.1","urgency":"not yet assigned"}}},"CVE-2020-6572":{"description":"Use after free in Media in Google Chrome prior to 81.0.4044.92 allowed a remote attacker to execute arbitrary code via a crafted HTML page.","scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"143.0.7499.169-1~deb12u1","bookworm-security":"145.0.7632.159-1~deb12u1"},"fixed_version":"81.0.4044.92-1","urgency":"not yet assigned"},"bullseye":{"status":"resolved","repositories":{"bullseye":"120.0.6099.224-1~deb11u1","bullseye-security":"120.0.6099.224-1~deb11u1"},"fixed_version":"81.0.4044.92-1","urgency":"not yet assigned"},"forky":{"status":"resolved","repositories":{"forky":"145.0.7632.159-1"},"fixed_version":"81.0.4044.92-1","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"146.0.7680.71-1"},"fixed_version":"81.0.4044.92-1","urgency":"not yet assigned"},"trixie":{"status":"resolved","repositories":{"trixie":"143.0.7499.169-1~deb13u1","trixie-security":"145.0.7632.159-1~deb13u1"},"fixed_version":"81.0.4044.92-1","urgency":"not yet assigned"}}},"CVE-2020-6573":{"description":"Use after free in video in Google Chrome on Android prior to 85.0.4183.102 allowed a remote attacker who had compromised the renderer process to potentially perform a sandbox escape via a crafted HTML page.","scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"143.0.7499.169-1~deb12u1","bookworm-security":"145.0.7632.159-1~deb12u1"},"fixed_version":"87.0.4280.88-0.1","urgency":"not yet assigned"},"bullseye":{"status":"resolved","repositories":{"bullseye":"120.0.6099.224-1~deb11u1","bullseye-security":"120.0.6099.224-1~deb11u1"},"fixed_version":"87.0.4280.88-0.1","urgency":"not yet assigned"},"forky":{"status":"resolved","repositories":{"forky":"145.0.7632.159-1"},"fixed_version":"87.0.4280.88-0.1","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"146.0.7680.71-1"},"fixed_version":"87.0.4280.88-0.1","urgency":"not yet assigned"},"trixie":{"status":"resolved","repositories":{"trixie":"143.0.7499.169-1~deb13u1","trixie-security":"145.0.7632.159-1~deb13u1"},"fixed_version":"87.0.4280.88-0.1","urgency":"not yet assigned"}}},"CVE-2020-6574":{"description":"Insufficient policy enforcement in installer in Google Chrome on OS X prior to 85.0.4183.102 allowed a local attacker to potentially achieve privilege escalation via a crafted binary.","scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"143.0.7499.169-1~deb12u1","bookworm-security":"145.0.7632.159-1~deb12u1"},"fixed_version":"0","urgency":"unimportant"},"bullseye":{"status":"resolved","repositories":{"bullseye":"120.0.6099.224-1~deb11u1","bullseye-security":"120.0.6099.224-1~deb11u1"},"fixed_version":"0","urgency":"unimportant"},"forky":{"status":"resolved","repositories":{"forky":"145.0.7632.159-1"},"fixed_version":"0","urgency":"unimportant"},"sid":{"status":"resolved","repositories":{"sid":"146.0.7680.71-1"},"fixed_version":"0","urgency":"unimportant"},"trixie":{"status":"resolved","repositories":{"trixie":"143.0.7499.169-1~deb13u1","trixie-security":"145.0.7632.159-1~deb13u1"},"fixed_version":"0","urgency":"unimportant"}}},"CVE-2020-6575":{"description":"Race in Mojo in Google Chrome prior to 85.0.4183.102 allowed a remote attacker who had compromised the renderer process to potentially perform a sandbox escape via a crafted HTML page.","scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"143.0.7499.169-1~deb12u1","bookworm-security":"145.0.7632.159-1~deb12u1"},"fixed_version":"87.0.4280.88-0.1","urgency":"not yet assigned"},"bullseye":{"status":"resolved","repositories":{"bullseye":"120.0.6099.224-1~deb11u1","bullseye-security":"120.0.6099.224-1~deb11u1"},"fixed_version":"87.0.4280.88-0.1","urgency":"not yet assigned"},"forky":{"status":"resolved","repositories":{"forky":"145.0.7632.159-1"},"fixed_version":"87.0.4280.88-0.1","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"146.0.7680.71-1"},"fixed_version":"87.0.4280.88-0.1","urgency":"not yet assigned"},"trixie":{"status":"resolved","repositories":{"trixie":"143.0.7499.169-1~deb13u1","trixie-security":"145.0.7632.159-1~deb13u1"},"fixed_version":"87.0.4280.88-0.1","urgency":"not yet assigned"}}},"CVE-2020-6576":{"description":"Use after free in offscreen canvas in Google Chrome prior to 85.0.4183.102 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page.","scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"143.0.7499.169-1~deb12u1","bookworm-security":"145.0.7632.159-1~deb12u1"},"fixed_version":"87.0.4280.88-0.1","urgency":"not yet assigned"},"bullseye":{"status":"resolved","repositories":{"bullseye":"120.0.6099.224-1~deb11u1","bullseye-security":"120.0.6099.224-1~deb11u1"},"fixed_version":"87.0.4280.88-0.1","urgency":"not yet assigned"},"forky":{"status":"resolved","repositories":{"forky":"145.0.7632.159-1"},"fixed_version":"87.0.4280.88-0.1","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"146.0.7680.71-1"},"fixed_version":"87.0.4280.88-0.1","urgency":"not yet assigned"},"trixie":{"status":"resolved","repositories":{"trixie":"143.0.7499.169-1~deb13u1","trixie-security":"145.0.7632.159-1~deb13u1"},"fixed_version":"87.0.4280.88-0.1","urgency":"not yet assigned"}}},"CVE-2020-6831":{"description":"A buffer overflow could occur when parsing and validating SCTP chunks in WebRTC. This could have led to memory corruption and a potentially exploitable crash. This vulnerability affects Firefox ESR < 68.8, Firefox < 76, and Thunderbird < 68.8.0.","scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"143.0.7499.169-1~deb12u1","bookworm-security":"145.0.7632.159-1~deb12u1"},"fixed_version":"83.0.4103.83-1","urgency":"not yet assigned"},"bullseye":{"status":"resolved","repositories":{"bullseye":"120.0.6099.224-1~deb11u1","bullseye-security":"120.0.6099.224-1~deb11u1"},"fixed_version":"83.0.4103.83-1","urgency":"not yet assigned"},"forky":{"status":"resolved","repositories":{"forky":"145.0.7632.159-1"},"fixed_version":"83.0.4103.83-1","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"146.0.7680.71-1"},"fixed_version":"83.0.4103.83-1","urgency":"not yet assigned"},"trixie":{"status":"resolved","repositories":{"trixie":"143.0.7499.169-1~deb13u1","trixie-security":"145.0.7632.159-1~deb13u1"},"fixed_version":"83.0.4103.83-1","urgency":"not yet assigned"}}},"CVE-2021-21106":{"description":"Use after free in autofill in Google Chrome prior to 87.0.4280.141 allowed a remote attacker who had compromised the renderer process to potentially perform a sandbox escape via a crafted HTML page.","debianbug":979533,"scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"143.0.7499.169-1~deb12u1","bookworm-security":"145.0.7632.159-1~deb12u1"},"fixed_version":"87.0.4280.141-0.1","urgency":"not yet assigned"},"bullseye":{"status":"resolved","repositories":{"bullseye":"120.0.6099.224-1~deb11u1","bullseye-security":"120.0.6099.224-1~deb11u1"},"fixed_version":"87.0.4280.141-0.1","urgency":"not yet assigned"},"forky":{"status":"resolved","repositories":{"forky":"145.0.7632.159-1"},"fixed_version":"87.0.4280.141-0.1","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"146.0.7680.71-1"},"fixed_version":"87.0.4280.141-0.1","urgency":"not yet assigned"},"trixie":{"status":"resolved","repositories":{"trixie":"143.0.7499.169-1~deb13u1","trixie-security":"145.0.7632.159-1~deb13u1"},"fixed_version":"87.0.4280.141-0.1","urgency":"not yet assigned"}}},"CVE-2021-21107":{"description":"Use after free in drag and drop in Google Chrome on Linux prior to 87.0.4280.141 allowed a remote attacker who had compromised the renderer process to potentially perform a sandbox escape via a crafted HTML page.","debianbug":979533,"scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"143.0.7499.169-1~deb12u1","bookworm-security":"145.0.7632.159-1~deb12u1"},"fixed_version":"87.0.4280.141-0.1","urgency":"not yet assigned"},"bullseye":{"status":"resolved","repositories":{"bullseye":"120.0.6099.224-1~deb11u1","bullseye-security":"120.0.6099.224-1~deb11u1"},"fixed_version":"87.0.4280.141-0.1","urgency":"not yet assigned"},"forky":{"status":"resolved","repositories":{"forky":"145.0.7632.159-1"},"fixed_version":"87.0.4280.141-0.1","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"146.0.7680.71-1"},"fixed_version":"87.0.4280.141-0.1","urgency":"not yet assigned"},"trixie":{"status":"resolved","repositories":{"trixie":"143.0.7499.169-1~deb13u1","trixie-security":"145.0.7632.159-1~deb13u1"},"fixed_version":"87.0.4280.141-0.1","urgency":"not yet assigned"}}},"CVE-2021-21108":{"description":"Use after free in media in Google Chrome prior to 87.0.4280.141 allowed a remote attacker who had compromised the renderer process to potentially perform a sandbox escape via a crafted HTML page.","debianbug":979533,"scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"143.0.7499.169-1~deb12u1","bookworm-security":"145.0.7632.159-1~deb12u1"},"fixed_version":"87.0.4280.141-0.1","urgency":"not yet assigned"},"bullseye":{"status":"resolved","repositories":{"bullseye":"120.0.6099.224-1~deb11u1","bullseye-security":"120.0.6099.224-1~deb11u1"},"fixed_version":"87.0.4280.141-0.1","urgency":"not yet assigned"},"forky":{"status":"resolved","repositories":{"forky":"145.0.7632.159-1"},"fixed_version":"87.0.4280.141-0.1","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"146.0.7680.71-1"},"fixed_version":"87.0.4280.141-0.1","urgency":"not yet assigned"},"trixie":{"status":"resolved","repositories":{"trixie":"143.0.7499.169-1~deb13u1","trixie-security":"145.0.7632.159-1~deb13u1"},"fixed_version":"87.0.4280.141-0.1","urgency":"not yet assigned"}}},"CVE-2021-21109":{"description":"Use after free in payments in Google Chrome prior to 87.0.4280.141 allowed a remote attacker who had compromised the renderer process to potentially perform a sandbox escape via a crafted HTML page.","debianbug":979533,"scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"143.0.7499.169-1~deb12u1","bookworm-security":"145.0.7632.159-1~deb12u1"},"fixed_version":"87.0.4280.141-0.1","urgency":"not yet assigned"},"bullseye":{"status":"resolved","repositories":{"bullseye":"120.0.6099.224-1~deb11u1","bullseye-security":"120.0.6099.224-1~deb11u1"},"fixed_version":"87.0.4280.141-0.1","urgency":"not yet assigned"},"forky":{"status":"resolved","repositories":{"forky":"145.0.7632.159-1"},"fixed_version":"87.0.4280.141-0.1","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"146.0.7680.71-1"},"fixed_version":"87.0.4280.141-0.1","urgency":"not yet assigned"},"trixie":{"status":"resolved","repositories":{"trixie":"143.0.7499.169-1~deb13u1","trixie-security":"145.0.7632.159-1~deb13u1"},"fixed_version":"87.0.4280.141-0.1","urgency":"not yet assigned"}}},"CVE-2021-21110":{"description":"Use after free in safe browsing in Google Chrome prior to 87.0.4280.141 allowed a remote attacker to potentially perform a sandbox escape via a crafted HTML page.","debianbug":979533,"scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"143.0.7499.169-1~deb12u1","bookworm-security":"145.0.7632.159-1~deb12u1"},"fixed_version":"87.0.4280.141-0.1","urgency":"not yet assigned"},"bullseye":{"status":"resolved","repositories":{"bullseye":"120.0.6099.224-1~deb11u1","bullseye-security":"120.0.6099.224-1~deb11u1"},"fixed_version":"87.0.4280.141-0.1","urgency":"not yet assigned"},"forky":{"status":"resolved","repositories":{"forky":"145.0.7632.159-1"},"fixed_version":"87.0.4280.141-0.1","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"146.0.7680.71-1"},"fixed_version":"87.0.4280.141-0.1","urgency":"not yet assigned"},"trixie":{"status":"resolved","repositories":{"trixie":"143.0.7499.169-1~deb13u1","trixie-security":"145.0.7632.159-1~deb13u1"},"fixed_version":"87.0.4280.141-0.1","urgency":"not yet assigned"}}},"CVE-2021-21111":{"description":"Insufficient policy enforcement in WebUI in Google Chrome prior to 87.0.4280.141 allowed an attacker who convinced a user to install a malicious extension to potentially perform a sandbox escape via a crafted Chrome Extension.","debianbug":979533,"scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"143.0.7499.169-1~deb12u1","bookworm-security":"145.0.7632.159-1~deb12u1"},"fixed_version":"87.0.4280.141-0.1","urgency":"not yet assigned"},"bullseye":{"status":"resolved","repositories":{"bullseye":"120.0.6099.224-1~deb11u1","bullseye-security":"120.0.6099.224-1~deb11u1"},"fixed_version":"87.0.4280.141-0.1","urgency":"not yet assigned"},"forky":{"status":"resolved","repositories":{"forky":"145.0.7632.159-1"},"fixed_version":"87.0.4280.141-0.1","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"146.0.7680.71-1"},"fixed_version":"87.0.4280.141-0.1","urgency":"not yet assigned"},"trixie":{"status":"resolved","repositories":{"trixie":"143.0.7499.169-1~deb13u1","trixie-security":"145.0.7632.159-1~deb13u1"},"fixed_version":"87.0.4280.141-0.1","urgency":"not yet assigned"}}},"CVE-2021-21112":{"description":"Use after free in Blink in Google Chrome prior to 87.0.4280.141 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page.","debianbug":979533,"scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"143.0.7499.169-1~deb12u1","bookworm-security":"145.0.7632.159-1~deb12u1"},"fixed_version":"87.0.4280.141-0.1","urgency":"not yet assigned"},"bullseye":{"status":"resolved","repositories":{"bullseye":"120.0.6099.224-1~deb11u1","bullseye-security":"120.0.6099.224-1~deb11u1"},"fixed_version":"87.0.4280.141-0.1","urgency":"not yet assigned"},"forky":{"status":"resolved","repositories":{"forky":"145.0.7632.159-1"},"fixed_version":"87.0.4280.141-0.1","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"146.0.7680.71-1"},"fixed_version":"87.0.4280.141-0.1","urgency":"not yet assigned"},"trixie":{"status":"resolved","repositories":{"trixie":"143.0.7499.169-1~deb13u1","trixie-security":"145.0.7632.159-1~deb13u1"},"fixed_version":"87.0.4280.141-0.1","urgency":"not yet assigned"}}},"CVE-2021-21113":{"description":"Heap buffer overflow in Skia in Google Chrome prior to 87.0.4280.141 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page.","debianbug":979533,"scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"143.0.7499.169-1~deb12u1","bookworm-security":"145.0.7632.159-1~deb12u1"},"fixed_version":"87.0.4280.141-0.1","urgency":"not yet assigned"},"bullseye":{"status":"resolved","repositories":{"bullseye":"120.0.6099.224-1~deb11u1","bullseye-security":"120.0.6099.224-1~deb11u1"},"fixed_version":"87.0.4280.141-0.1","urgency":"not yet assigned"},"forky":{"status":"resolved","repositories":{"forky":"145.0.7632.159-1"},"fixed_version":"87.0.4280.141-0.1","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"146.0.7680.71-1"},"fixed_version":"87.0.4280.141-0.1","urgency":"not yet assigned"},"trixie":{"status":"resolved","repositories":{"trixie":"143.0.7499.169-1~deb13u1","trixie-security":"145.0.7632.159-1~deb13u1"},"fixed_version":"87.0.4280.141-0.1","urgency":"not yet assigned"}}},"CVE-2021-21114":{"description":"Use after free in audio in Google Chrome prior to 87.0.4280.141 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page.","debianbug":979533,"scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"143.0.7499.169-1~deb12u1","bookworm-security":"145.0.7632.159-1~deb12u1"},"fixed_version":"87.0.4280.141-0.1","urgency":"not yet assigned"},"bullseye":{"status":"resolved","repositories":{"bullseye":"120.0.6099.224-1~deb11u1","bullseye-security":"120.0.6099.224-1~deb11u1"},"fixed_version":"87.0.4280.141-0.1","urgency":"not yet assigned"},"forky":{"status":"resolved","repositories":{"forky":"145.0.7632.159-1"},"fixed_version":"87.0.4280.141-0.1","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"146.0.7680.71-1"},"fixed_version":"87.0.4280.141-0.1","urgency":"not yet assigned"},"trixie":{"status":"resolved","repositories":{"trixie":"143.0.7499.169-1~deb13u1","trixie-security":"145.0.7632.159-1~deb13u1"},"fixed_version":"87.0.4280.141-0.1","urgency":"not yet assigned"}}},"CVE-2021-21115":{"description":"User after free in safe browsing in Google Chrome prior to 87.0.4280.141 allowed a remote attacker who had compromised the renderer process to potentially perform a sandbox escape via a crafted HTML page.","debianbug":979533,"scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"143.0.7499.169-1~deb12u1","bookworm-security":"145.0.7632.159-1~deb12u1"},"fixed_version":"87.0.4280.141-0.1","urgency":"not yet assigned"},"bullseye":{"status":"resolved","repositories":{"bullseye":"120.0.6099.224-1~deb11u1","bullseye-security":"120.0.6099.224-1~deb11u1"},"fixed_version":"87.0.4280.141-0.1","urgency":"not yet assigned"},"forky":{"status":"resolved","repositories":{"forky":"145.0.7632.159-1"},"fixed_version":"87.0.4280.141-0.1","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"146.0.7680.71-1"},"fixed_version":"87.0.4280.141-0.1","urgency":"not yet assigned"},"trixie":{"status":"resolved","repositories":{"trixie":"143.0.7499.169-1~deb13u1","trixie-security":"145.0.7632.159-1~deb13u1"},"fixed_version":"87.0.4280.141-0.1","urgency":"not yet assigned"}}},"CVE-2021-21116":{"description":"Heap buffer overflow in audio in Google Chrome prior to 87.0.4280.141 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page.","debianbug":979533,"scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"143.0.7499.169-1~deb12u1","bookworm-security":"145.0.7632.159-1~deb12u1"},"fixed_version":"87.0.4280.141-0.1","urgency":"not yet assigned"},"bullseye":{"status":"resolved","repositories":{"bullseye":"120.0.6099.224-1~deb11u1","bullseye-security":"120.0.6099.224-1~deb11u1"},"fixed_version":"87.0.4280.141-0.1","urgency":"not yet assigned"},"forky":{"status":"resolved","repositories":{"forky":"145.0.7632.159-1"},"fixed_version":"87.0.4280.141-0.1","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"146.0.7680.71-1"},"fixed_version":"87.0.4280.141-0.1","urgency":"not yet assigned"},"trixie":{"status":"resolved","repositories":{"trixie":"143.0.7499.169-1~deb13u1","trixie-security":"145.0.7632.159-1~deb13u1"},"fixed_version":"87.0.4280.141-0.1","urgency":"not yet assigned"}}},"CVE-2021-21117":{"description":"Insufficient policy enforcement in Cryptohome in Google Chrome prior to 88.0.4324.96 allowed a local attacker to perform OS-level privilege escalation via a crafted file.","debianbug":980564,"scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"143.0.7499.169-1~deb12u1","bookworm-security":"145.0.7632.159-1~deb12u1"},"fixed_version":"88.0.4324.96-0.1","urgency":"not yet assigned"},"bullseye":{"status":"resolved","repositories":{"bullseye":"120.0.6099.224-1~deb11u1","bullseye-security":"120.0.6099.224-1~deb11u1"},"fixed_version":"88.0.4324.96-0.1","urgency":"not yet assigned"},"forky":{"status":"resolved","repositories":{"forky":"145.0.7632.159-1"},"fixed_version":"88.0.4324.96-0.1","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"146.0.7680.71-1"},"fixed_version":"88.0.4324.96-0.1","urgency":"not yet assigned"},"trixie":{"status":"resolved","repositories":{"trixie":"143.0.7499.169-1~deb13u1","trixie-security":"145.0.7632.159-1~deb13u1"},"fixed_version":"88.0.4324.96-0.1","urgency":"not yet assigned"}}},"CVE-2021-21118":{"description":"Insufficient data validation in V8 in Google Chrome prior to 88.0.4324.96 allowed a remote attacker to potentially perform out of bounds memory access via a crafted HTML page.","debianbug":980564,"scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"143.0.7499.169-1~deb12u1","bookworm-security":"145.0.7632.159-1~deb12u1"},"fixed_version":"88.0.4324.96-0.1","urgency":"not yet assigned"},"bullseye":{"status":"resolved","repositories":{"bullseye":"120.0.6099.224-1~deb11u1","bullseye-security":"120.0.6099.224-1~deb11u1"},"fixed_version":"88.0.4324.96-0.1","urgency":"not yet assigned"},"forky":{"status":"resolved","repositories":{"forky":"145.0.7632.159-1"},"fixed_version":"88.0.4324.96-0.1","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"146.0.7680.71-1"},"fixed_version":"88.0.4324.96-0.1","urgency":"not yet assigned"},"trixie":{"status":"resolved","repositories":{"trixie":"143.0.7499.169-1~deb13u1","trixie-security":"145.0.7632.159-1~deb13u1"},"fixed_version":"88.0.4324.96-0.1","urgency":"not yet assigned"}}},"CVE-2021-21119":{"description":"Use after free in Media in Google Chrome prior to 88.0.4324.96 allowed a remote attacker who had compromised the renderer process to potentially exploit heap corruption via a crafted HTML page.","debianbug":980564,"scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"143.0.7499.169-1~deb12u1","bookworm-security":"145.0.7632.159-1~deb12u1"},"fixed_version":"88.0.4324.96-0.1","urgency":"not yet assigned"},"bullseye":{"status":"resolved","repositories":{"bullseye":"120.0.6099.224-1~deb11u1","bullseye-security":"120.0.6099.224-1~deb11u1"},"fixed_version":"88.0.4324.96-0.1","urgency":"not yet assigned"},"forky":{"status":"resolved","repositories":{"forky":"145.0.7632.159-1"},"fixed_version":"88.0.4324.96-0.1","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"146.0.7680.71-1"},"fixed_version":"88.0.4324.96-0.1","urgency":"not yet assigned"},"trixie":{"status":"resolved","repositories":{"trixie":"143.0.7499.169-1~deb13u1","trixie-security":"145.0.7632.159-1~deb13u1"},"fixed_version":"88.0.4324.96-0.1","urgency":"not yet assigned"}}},"CVE-2021-21120":{"description":"Use after free in WebSQL in Google Chrome prior to 88.0.4324.96 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page.","debianbug":980564,"scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"143.0.7499.169-1~deb12u1","bookworm-security":"145.0.7632.159-1~deb12u1"},"fixed_version":"88.0.4324.96-0.1","urgency":"not yet assigned"},"bullseye":{"status":"resolved","repositories":{"bullseye":"120.0.6099.224-1~deb11u1","bullseye-security":"120.0.6099.224-1~deb11u1"},"fixed_version":"88.0.4324.96-0.1","urgency":"not yet assigned"},"forky":{"status":"resolved","repositories":{"forky":"145.0.7632.159-1"},"fixed_version":"88.0.4324.96-0.1","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"146.0.7680.71-1"},"fixed_version":"88.0.4324.96-0.1","urgency":"not yet assigned"},"trixie":{"status":"resolved","repositories":{"trixie":"143.0.7499.169-1~deb13u1","trixie-security":"145.0.7632.159-1~deb13u1"},"fixed_version":"88.0.4324.96-0.1","urgency":"not yet assigned"}}},"CVE-2021-21121":{"description":"Use after free in Omnibox in Google Chrome on Linux prior to 88.0.4324.96 allowed a remote attacker to potentially perform a sandbox escape via a crafted HTML page.","debianbug":980564,"scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"143.0.7499.169-1~deb12u1","bookworm-security":"145.0.7632.159-1~deb12u1"},"fixed_version":"88.0.4324.96-0.1","urgency":"not yet assigned"},"bullseye":{"status":"resolved","repositories":{"bullseye":"120.0.6099.224-1~deb11u1","bullseye-security":"120.0.6099.224-1~deb11u1"},"fixed_version":"88.0.4324.96-0.1","urgency":"not yet assigned"},"forky":{"status":"resolved","repositories":{"forky":"145.0.7632.159-1"},"fixed_version":"88.0.4324.96-0.1","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"146.0.7680.71-1"},"fixed_version":"88.0.4324.96-0.1","urgency":"not yet assigned"},"trixie":{"status":"resolved","repositories":{"trixie":"143.0.7499.169-1~deb13u1","trixie-security":"145.0.7632.159-1~deb13u1"},"fixed_version":"88.0.4324.96-0.1","urgency":"not yet assigned"}}},"CVE-2021-21122":{"description":"Use after free in Blink in Google Chrome prior to 88.0.4324.96 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page.","debianbug":980564,"scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"143.0.7499.169-1~deb12u1","bookworm-security":"145.0.7632.159-1~deb12u1"},"fixed_version":"88.0.4324.96-0.1","urgency":"not yet assigned"},"bullseye":{"status":"resolved","repositories":{"bullseye":"120.0.6099.224-1~deb11u1","bullseye-security":"120.0.6099.224-1~deb11u1"},"fixed_version":"88.0.4324.96-0.1","urgency":"not yet assigned"},"forky":{"status":"resolved","repositories":{"forky":"145.0.7632.159-1"},"fixed_version":"88.0.4324.96-0.1","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"146.0.7680.71-1"},"fixed_version":"88.0.4324.96-0.1","urgency":"not yet assigned"},"trixie":{"status":"resolved","repositories":{"trixie":"143.0.7499.169-1~deb13u1","trixie-security":"145.0.7632.159-1~deb13u1"},"fixed_version":"88.0.4324.96-0.1","urgency":"not yet assigned"}}},"CVE-2021-21123":{"description":"Insufficient data validation in File System API in Google Chrome prior to 88.0.4324.96 allowed a remote attacker to bypass filesystem restrictions via a crafted HTML page.","debianbug":980564,"scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"143.0.7499.169-1~deb12u1","bookworm-security":"145.0.7632.159-1~deb12u1"},"fixed_version":"88.0.4324.96-0.1","urgency":"not yet assigned"},"bullseye":{"status":"resolved","repositories":{"bullseye":"120.0.6099.224-1~deb11u1","bullseye-security":"120.0.6099.224-1~deb11u1"},"fixed_version":"88.0.4324.96-0.1","urgency":"not yet assigned"},"forky":{"status":"resolved","repositories":{"forky":"145.0.7632.159-1"},"fixed_version":"88.0.4324.96-0.1","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"146.0.7680.71-1"},"fixed_version":"88.0.4324.96-0.1","urgency":"not yet assigned"},"trixie":{"status":"resolved","repositories":{"trixie":"143.0.7499.169-1~deb13u1","trixie-security":"145.0.7632.159-1~deb13u1"},"fixed_version":"88.0.4324.96-0.1","urgency":"not yet assigned"}}},"CVE-2021-21124":{"description":"Potential user after free in Speech Recognizer in Google Chrome on Android prior to 88.0.4324.96 allowed a remote attacker to potentially perform a sandbox escape via a crafted HTML page.","debianbug":980564,"scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"143.0.7499.169-1~deb12u1","bookworm-security":"145.0.7632.159-1~deb12u1"},"fixed_version":"88.0.4324.96-0.1","urgency":"not yet assigned"},"bullseye":{"status":"resolved","repositories":{"bullseye":"120.0.6099.224-1~deb11u1","bullseye-security":"120.0.6099.224-1~deb11u1"},"fixed_version":"88.0.4324.96-0.1","urgency":"not yet assigned"},"forky":{"status":"resolved","repositories":{"forky":"145.0.7632.159-1"},"fixed_version":"88.0.4324.96-0.1","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"146.0.7680.71-1"},"fixed_version":"88.0.4324.96-0.1","urgency":"not yet assigned"},"trixie":{"status":"resolved","repositories":{"trixie":"143.0.7499.169-1~deb13u1","trixie-security":"145.0.7632.159-1~deb13u1"},"fixed_version":"88.0.4324.96-0.1","urgency":"not yet assigned"}}},"CVE-2021-21125":{"description":"Insufficient policy enforcement in File System API in Google Chrome on Windows prior to 88.0.4324.96 allowed a remote attacker to bypass filesystem restrictions via a crafted HTML page.","debianbug":980564,"scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"143.0.7499.169-1~deb12u1","bookworm-security":"145.0.7632.159-1~deb12u1"},"fixed_version":"88.0.4324.96-0.1","urgency":"not yet assigned"},"bullseye":{"status":"resolved","repositories":{"bullseye":"120.0.6099.224-1~deb11u1","bullseye-security":"120.0.6099.224-1~deb11u1"},"fixed_version":"88.0.4324.96-0.1","urgency":"not yet assigned"},"forky":{"status":"resolved","repositories":{"forky":"145.0.7632.159-1"},"fixed_version":"88.0.4324.96-0.1","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"146.0.7680.71-1"},"fixed_version":"88.0.4324.96-0.1","urgency":"not yet assigned"},"trixie":{"status":"resolved","repositories":{"trixie":"143.0.7499.169-1~deb13u1","trixie-security":"145.0.7632.159-1~deb13u1"},"fixed_version":"88.0.4324.96-0.1","urgency":"not yet assigned"}}},"CVE-2021-21126":{"description":"Insufficient policy enforcement in extensions in Google Chrome prior to 88.0.4324.96 allowed a remote attacker to bypass site isolation via a crafted Chrome Extension.","debianbug":980564,"scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"143.0.7499.169-1~deb12u1","bookworm-security":"145.0.7632.159-1~deb12u1"},"fixed_version":"88.0.4324.96-0.1","urgency":"not yet assigned"},"bullseye":{"status":"resolved","repositories":{"bullseye":"120.0.6099.224-1~deb11u1","bullseye-security":"120.0.6099.224-1~deb11u1"},"fixed_version":"88.0.4324.96-0.1","urgency":"not yet assigned"},"forky":{"status":"resolved","repositories":{"forky":"145.0.7632.159-1"},"fixed_version":"88.0.4324.96-0.1","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"146.0.7680.71-1"},"fixed_version":"88.0.4324.96-0.1","urgency":"not yet assigned"},"trixie":{"status":"resolved","repositories":{"trixie":"143.0.7499.169-1~deb13u1","trixie-security":"145.0.7632.159-1~deb13u1"},"fixed_version":"88.0.4324.96-0.1","urgency":"not yet assigned"}}},"CVE-2021-21127":{"description":"Insufficient policy enforcement in extensions in Google Chrome prior to 88.0.4324.96 allowed a remote attacker to bypass content security policy via a crafted Chrome Extension.","debianbug":980564,"scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"143.0.7499.169-1~deb12u1","bookworm-security":"145.0.7632.159-1~deb12u1"},"fixed_version":"88.0.4324.96-0.1","urgency":"not yet assigned"},"bullseye":{"status":"resolved","repositories":{"bullseye":"120.0.6099.224-1~deb11u1","bullseye-security":"120.0.6099.224-1~deb11u1"},"fixed_version":"88.0.4324.96-0.1","urgency":"not yet assigned"},"forky":{"status":"resolved","repositories":{"forky":"145.0.7632.159-1"},"fixed_version":"88.0.4324.96-0.1","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"146.0.7680.71-1"},"fixed_version":"88.0.4324.96-0.1","urgency":"not yet assigned"},"trixie":{"status":"resolved","repositories":{"trixie":"143.0.7499.169-1~deb13u1","trixie-security":"145.0.7632.159-1~deb13u1"},"fixed_version":"88.0.4324.96-0.1","urgency":"not yet assigned"}}},"CVE-2021-21128":{"description":"Heap buffer overflow in Blink in Google Chrome prior to 88.0.4324.96 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page.","debianbug":980564,"scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"143.0.7499.169-1~deb12u1","bookworm-security":"145.0.7632.159-1~deb12u1"},"fixed_version":"88.0.4324.96-0.1","urgency":"not yet assigned"},"bullseye":{"status":"resolved","repositories":{"bullseye":"120.0.6099.224-1~deb11u1","bullseye-security":"120.0.6099.224-1~deb11u1"},"fixed_version":"88.0.4324.96-0.1","urgency":"not yet assigned"},"forky":{"status":"resolved","repositories":{"forky":"145.0.7632.159-1"},"fixed_version":"88.0.4324.96-0.1","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"146.0.7680.71-1"},"fixed_version":"88.0.4324.96-0.1","urgency":"not yet assigned"},"trixie":{"status":"resolved","repositories":{"trixie":"143.0.7499.169-1~deb13u1","trixie-security":"145.0.7632.159-1~deb13u1"},"fixed_version":"88.0.4324.96-0.1","urgency":"not yet assigned"}}},"CVE-2021-21129":{"description":"Insufficient policy enforcement in File System API in Google Chrome prior to 88.0.4324.96 allowed a remote attacker to bypass filesystem restrictions via a crafted HTML page.","debianbug":980564,"scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"143.0.7499.169-1~deb12u1","bookworm-security":"145.0.7632.159-1~deb12u1"},"fixed_version":"88.0.4324.96-0.1","urgency":"not yet assigned"},"bullseye":{"status":"resolved","repositories":{"bullseye":"120.0.6099.224-1~deb11u1","bullseye-security":"120.0.6099.224-1~deb11u1"},"fixed_version":"88.0.4324.96-0.1","urgency":"not yet assigned"},"forky":{"status":"resolved","repositories":{"forky":"145.0.7632.159-1"},"fixed_version":"88.0.4324.96-0.1","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"146.0.7680.71-1"},"fixed_version":"88.0.4324.96-0.1","urgency":"not yet assigned"},"trixie":{"status":"resolved","repositories":{"trixie":"143.0.7499.169-1~deb13u1","trixie-security":"145.0.7632.159-1~deb13u1"},"fixed_version":"88.0.4324.96-0.1","urgency":"not yet assigned"}}},"CVE-2021-21130":{"description":"Insufficient policy enforcement in File System API in Google Chrome prior to 88.0.4324.96 allowed a remote attacker to bypass filesystem restrictions via a crafted HTML page.","debianbug":980564,"scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"143.0.7499.169-1~deb12u1","bookworm-security":"145.0.7632.159-1~deb12u1"},"fixed_version":"88.0.4324.96-0.1","urgency":"not yet assigned"},"bullseye":{"status":"resolved","repositories":{"bullseye":"120.0.6099.224-1~deb11u1","bullseye-security":"120.0.6099.224-1~deb11u1"},"fixed_version":"88.0.4324.96-0.1","urgency":"not yet assigned"},"forky":{"status":"resolved","repositories":{"forky":"145.0.7632.159-1"},"fixed_version":"88.0.4324.96-0.1","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"146.0.7680.71-1"},"fixed_version":"88.0.4324.96-0.1","urgency":"not yet assigned"},"trixie":{"status":"resolved","repositories":{"trixie":"143.0.7499.169-1~deb13u1","trixie-security":"145.0.7632.159-1~deb13u1"},"fixed_version":"88.0.4324.96-0.1","urgency":"not yet assigned"}}},"CVE-2021-21131":{"description":"Insufficient policy enforcement in File System API in Google Chrome prior to 88.0.4324.96 allowed a remote attacker to bypass filesystem restrictions via a crafted HTML page.","debianbug":980564,"scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"143.0.7499.169-1~deb12u1","bookworm-security":"145.0.7632.159-1~deb12u1"},"fixed_version":"88.0.4324.96-0.1","urgency":"not yet assigned"},"bullseye":{"status":"resolved","repositories":{"bullseye":"120.0.6099.224-1~deb11u1","bullseye-security":"120.0.6099.224-1~deb11u1"},"fixed_version":"88.0.4324.96-0.1","urgency":"not yet assigned"},"forky":{"status":"resolved","repositories":{"forky":"145.0.7632.159-1"},"fixed_version":"88.0.4324.96-0.1","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"146.0.7680.71-1"},"fixed_version":"88.0.4324.96-0.1","urgency":"not yet assigned"},"trixie":{"status":"resolved","repositories":{"trixie":"143.0.7499.169-1~deb13u1","trixie-security":"145.0.7632.159-1~deb13u1"},"fixed_version":"88.0.4324.96-0.1","urgency":"not yet assigned"}}},"CVE-2021-21132":{"description":"Inappropriate implementation in DevTools in Google Chrome prior to 88.0.4324.96 allowed a remote attacker to potentially perform a sandbox escape via a crafted Chrome Extension.","debianbug":980564,"scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"143.0.7499.169-1~deb12u1","bookworm-security":"145.0.7632.159-1~deb12u1"},"fixed_version":"88.0.4324.96-0.1","urgency":"not yet assigned"},"bullseye":{"status":"resolved","repositories":{"bullseye":"120.0.6099.224-1~deb11u1","bullseye-security":"120.0.6099.224-1~deb11u1"},"fixed_version":"88.0.4324.96-0.1","urgency":"not yet assigned"},"forky":{"status":"resolved","repositories":{"forky":"145.0.7632.159-1"},"fixed_version":"88.0.4324.96-0.1","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"146.0.7680.71-1"},"fixed_version":"88.0.4324.96-0.1","urgency":"not yet assigned"},"trixie":{"status":"resolved","repositories":{"trixie":"143.0.7499.169-1~deb13u1","trixie-security":"145.0.7632.159-1~deb13u1"},"fixed_version":"88.0.4324.96-0.1","urgency":"not yet assigned"}}},"CVE-2021-21133":{"description":"Insufficient policy enforcement in Downloads in Google Chrome prior to 88.0.4324.96 allowed an attacker who convinced a user to download files to bypass navigation restrictions via a crafted HTML page.","debianbug":980564,"scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"143.0.7499.169-1~deb12u1","bookworm-security":"145.0.7632.159-1~deb12u1"},"fixed_version":"88.0.4324.96-0.1","urgency":"not yet assigned"},"bullseye":{"status":"resolved","repositories":{"bullseye":"120.0.6099.224-1~deb11u1","bullseye-security":"120.0.6099.224-1~deb11u1"},"fixed_version":"88.0.4324.96-0.1","urgency":"not yet assigned"},"forky":{"status":"resolved","repositories":{"forky":"145.0.7632.159-1"},"fixed_version":"88.0.4324.96-0.1","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"146.0.7680.71-1"},"fixed_version":"88.0.4324.96-0.1","urgency":"not yet assigned"},"trixie":{"status":"resolved","repositories":{"trixie":"143.0.7499.169-1~deb13u1","trixie-security":"145.0.7632.159-1~deb13u1"},"fixed_version":"88.0.4324.96-0.1","urgency":"not yet assigned"}}},"CVE-2021-21134":{"description":"Incorrect security UI in Page Info in Google Chrome on iOS prior to 88.0.4324.96 allowed a remote attacker to spoof security UI via a crafted HTML page.","debianbug":980564,"scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"143.0.7499.169-1~deb12u1","bookworm-security":"145.0.7632.159-1~deb12u1"},"fixed_version":"88.0.4324.96-0.1","urgency":"not yet assigned"},"bullseye":{"status":"resolved","repositories":{"bullseye":"120.0.6099.224-1~deb11u1","bullseye-security":"120.0.6099.224-1~deb11u1"},"fixed_version":"88.0.4324.96-0.1","urgency":"not yet assigned"},"forky":{"status":"resolved","repositories":{"forky":"145.0.7632.159-1"},"fixed_version":"88.0.4324.96-0.1","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"146.0.7680.71-1"},"fixed_version":"88.0.4324.96-0.1","urgency":"not yet assigned"},"trixie":{"status":"resolved","repositories":{"trixie":"143.0.7499.169-1~deb13u1","trixie-security":"145.0.7632.159-1~deb13u1"},"fixed_version":"88.0.4324.96-0.1","urgency":"not yet assigned"}}},"CVE-2021-21135":{"description":"Inappropriate implementation in Performance API in Google Chrome prior to 88.0.4324.96 allowed a remote attacker to leak cross-origin data via a crafted HTML page.","debianbug":980564,"scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"143.0.7499.169-1~deb12u1","bookworm-security":"145.0.7632.159-1~deb12u1"},"fixed_version":"88.0.4324.96-0.1","urgency":"not yet assigned"},"bullseye":{"status":"resolved","repositories":{"bullseye":"120.0.6099.224-1~deb11u1","bullseye-security":"120.0.6099.224-1~deb11u1"},"fixed_version":"88.0.4324.96-0.1","urgency":"not yet assigned"},"forky":{"status":"resolved","repositories":{"forky":"145.0.7632.159-1"},"fixed_version":"88.0.4324.96-0.1","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"146.0.7680.71-1"},"fixed_version":"88.0.4324.96-0.1","urgency":"not yet assigned"},"trixie":{"status":"resolved","repositories":{"trixie":"143.0.7499.169-1~deb13u1","trixie-security":"145.0.7632.159-1~deb13u1"},"fixed_version":"88.0.4324.96-0.1","urgency":"not yet assigned"}}},"CVE-2021-21136":{"description":"Insufficient policy enforcement in WebView in Google Chrome on Android prior to 88.0.4324.96 allowed a remote attacker to leak cross-origin data via a crafted HTML page.","debianbug":980564,"scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"143.0.7499.169-1~deb12u1","bookworm-security":"145.0.7632.159-1~deb12u1"},"fixed_version":"88.0.4324.96-0.1","urgency":"not yet assigned"},"bullseye":{"status":"resolved","repositories":{"bullseye":"120.0.6099.224-1~deb11u1","bullseye-security":"120.0.6099.224-1~deb11u1"},"fixed_version":"88.0.4324.96-0.1","urgency":"not yet assigned"},"forky":{"status":"resolved","repositories":{"forky":"145.0.7632.159-1"},"fixed_version":"88.0.4324.96-0.1","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"146.0.7680.71-1"},"fixed_version":"88.0.4324.96-0.1","urgency":"not yet assigned"},"trixie":{"status":"resolved","repositories":{"trixie":"143.0.7499.169-1~deb13u1","trixie-security":"145.0.7632.159-1~deb13u1"},"fixed_version":"88.0.4324.96-0.1","urgency":"not yet assigned"}}},"CVE-2021-21137":{"description":"Inappropriate implementation in DevTools in Google Chrome prior to 88.0.4324.96 allowed a remote attacker to obtain potentially sensitive information from disk via a crafted HTML page.","debianbug":980564,"scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"143.0.7499.169-1~deb12u1","bookworm-security":"145.0.7632.159-1~deb12u1"},"fixed_version":"88.0.4324.96-0.1","urgency":"not yet assigned"},"bullseye":{"status":"resolved","repositories":{"bullseye":"120.0.6099.224-1~deb11u1","bullseye-security":"120.0.6099.224-1~deb11u1"},"fixed_version":"88.0.4324.96-0.1","urgency":"not yet assigned"},"forky":{"status":"resolved","repositories":{"forky":"145.0.7632.159-1"},"fixed_version":"88.0.4324.96-0.1","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"146.0.7680.71-1"},"fixed_version":"88.0.4324.96-0.1","urgency":"not yet assigned"},"trixie":{"status":"resolved","repositories":{"trixie":"143.0.7499.169-1~deb13u1","trixie-security":"145.0.7632.159-1~deb13u1"},"fixed_version":"88.0.4324.96-0.1","urgency":"not yet assigned"}}},"CVE-2021-21138":{"description":"Use after free in DevTools in Google Chrome prior to 88.0.4324.96 allowed a local attacker to potentially perform a sandbox escape via a crafted file.","debianbug":980564,"scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"143.0.7499.169-1~deb12u1","bookworm-security":"145.0.7632.159-1~deb12u1"},"fixed_version":"88.0.4324.96-0.1","urgency":"not yet assigned"},"bullseye":{"status":"resolved","repositories":{"bullseye":"120.0.6099.224-1~deb11u1","bullseye-security":"120.0.6099.224-1~deb11u1"},"fixed_version":"88.0.4324.96-0.1","urgency":"not yet assigned"},"forky":{"status":"resolved","repositories":{"forky":"145.0.7632.159-1"},"fixed_version":"88.0.4324.96-0.1","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"146.0.7680.71-1"},"fixed_version":"88.0.4324.96-0.1","urgency":"not yet assigned"},"trixie":{"status":"resolved","repositories":{"trixie":"143.0.7499.169-1~deb13u1","trixie-security":"145.0.7632.159-1~deb13u1"},"fixed_version":"88.0.4324.96-0.1","urgency":"not yet assigned"}}},"CVE-2021-21139":{"description":"Inappropriate implementation in iframe sandbox in Google Chrome prior to 88.0.4324.96 allowed a remote attacker to bypass navigation restrictions via a crafted HTML page.","debianbug":980564,"scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"143.0.7499.169-1~deb12u1","bookworm-security":"145.0.7632.159-1~deb12u1"},"fixed_version":"88.0.4324.96-0.1","urgency":"not yet assigned"},"bullseye":{"status":"resolved","repositories":{"bullseye":"120.0.6099.224-1~deb11u1","bullseye-security":"120.0.6099.224-1~deb11u1"},"fixed_version":"88.0.4324.96-0.1","urgency":"not yet assigned"},"forky":{"status":"resolved","repositories":{"forky":"145.0.7632.159-1"},"fixed_version":"88.0.4324.96-0.1","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"146.0.7680.71-1"},"fixed_version":"88.0.4324.96-0.1","urgency":"not yet assigned"},"trixie":{"status":"resolved","repositories":{"trixie":"143.0.7499.169-1~deb13u1","trixie-security":"145.0.7632.159-1~deb13u1"},"fixed_version":"88.0.4324.96-0.1","urgency":"not yet assigned"}}},"CVE-2021-21140":{"description":"Uninitialized use in USB in Google Chrome prior to 88.0.4324.96 allowed a local attacker to potentially perform out of bounds memory access via via a USB device.","debianbug":980564,"scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"143.0.7499.169-1~deb12u1","bookworm-security":"145.0.7632.159-1~deb12u1"},"fixed_version":"88.0.4324.96-0.1","urgency":"not yet assigned"},"bullseye":{"status":"resolved","repositories":{"bullseye":"120.0.6099.224-1~deb11u1","bullseye-security":"120.0.6099.224-1~deb11u1"},"fixed_version":"88.0.4324.96-0.1","urgency":"not yet assigned"},"forky":{"status":"resolved","repositories":{"forky":"145.0.7632.159-1"},"fixed_version":"88.0.4324.96-0.1","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"146.0.7680.71-1"},"fixed_version":"88.0.4324.96-0.1","urgency":"not yet assigned"},"trixie":{"status":"resolved","repositories":{"trixie":"143.0.7499.169-1~deb13u1","trixie-security":"145.0.7632.159-1~deb13u1"},"fixed_version":"88.0.4324.96-0.1","urgency":"not yet assigned"}}},"CVE-2021-21141":{"description":"Insufficient policy enforcement in File System API in Google Chrome prior to 88.0.4324.96 allowed a remote attacker to bypass file extension policy via a crafted HTML page.","debianbug":980564,"scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"143.0.7499.169-1~deb12u1","bookworm-security":"145.0.7632.159-1~deb12u1"},"fixed_version":"88.0.4324.96-0.1","urgency":"not yet assigned"},"bullseye":{"status":"resolved","repositories":{"bullseye":"120.0.6099.224-1~deb11u1","bullseye-security":"120.0.6099.224-1~deb11u1"},"fixed_version":"88.0.4324.96-0.1","urgency":"not yet assigned"},"forky":{"status":"resolved","repositories":{"forky":"145.0.7632.159-1"},"fixed_version":"88.0.4324.96-0.1","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"146.0.7680.71-1"},"fixed_version":"88.0.4324.96-0.1","urgency":"not yet assigned"},"trixie":{"status":"resolved","repositories":{"trixie":"143.0.7499.169-1~deb13u1","trixie-security":"145.0.7632.159-1~deb13u1"},"fixed_version":"88.0.4324.96-0.1","urgency":"not yet assigned"}}},"CVE-2021-21142":{"description":"Use after free in Payments in Google Chrome on Mac prior to 88.0.4324.146 allowed a remote attacker to potentially perform a sandbox escape via a crafted HTML page.","scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"143.0.7499.169-1~deb12u1","bookworm-security":"145.0.7632.159-1~deb12u1"},"fixed_version":"88.0.4324.146-1","urgency":"not yet assigned"},"bullseye":{"status":"resolved","repositories":{"bullseye":"120.0.6099.224-1~deb11u1","bullseye-security":"120.0.6099.224-1~deb11u1"},"fixed_version":"88.0.4324.146-1","urgency":"not yet assigned"},"forky":{"status":"resolved","repositories":{"forky":"145.0.7632.159-1"},"fixed_version":"88.0.4324.146-1","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"146.0.7680.71-1"},"fixed_version":"88.0.4324.146-1","urgency":"not yet assigned"},"trixie":{"status":"resolved","repositories":{"trixie":"143.0.7499.169-1~deb13u1","trixie-security":"145.0.7632.159-1~deb13u1"},"fixed_version":"88.0.4324.146-1","urgency":"not yet assigned"}}},"CVE-2021-21143":{"description":"Heap buffer overflow in Extensions in Google Chrome prior to 88.0.4324.146 allowed an attacker who convinced a user to install a malicious extension to potentially exploit heap corruption via a crafted Chrome Extension.","scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"143.0.7499.169-1~deb12u1","bookworm-security":"145.0.7632.159-1~deb12u1"},"fixed_version":"88.0.4324.146-1","urgency":"not yet assigned"},"bullseye":{"status":"resolved","repositories":{"bullseye":"120.0.6099.224-1~deb11u1","bullseye-security":"120.0.6099.224-1~deb11u1"},"fixed_version":"88.0.4324.146-1","urgency":"not yet assigned"},"forky":{"status":"resolved","repositories":{"forky":"145.0.7632.159-1"},"fixed_version":"88.0.4324.146-1","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"146.0.7680.71-1"},"fixed_version":"88.0.4324.146-1","urgency":"not yet assigned"},"trixie":{"status":"resolved","repositories":{"trixie":"143.0.7499.169-1~deb13u1","trixie-security":"145.0.7632.159-1~deb13u1"},"fixed_version":"88.0.4324.146-1","urgency":"not yet assigned"}}},"CVE-2021-21144":{"description":"Heap buffer overflow in Tab Groups in Google Chrome prior to 88.0.4324.146 allowed an attacker who convinced a user to install a malicious extension to potentially exploit heap corruption via a crafted Chrome Extension.","scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"143.0.7499.169-1~deb12u1","bookworm-security":"145.0.7632.159-1~deb12u1"},"fixed_version":"88.0.4324.146-1","urgency":"not yet assigned"},"bullseye":{"status":"resolved","repositories":{"bullseye":"120.0.6099.224-1~deb11u1","bullseye-security":"120.0.6099.224-1~deb11u1"},"fixed_version":"88.0.4324.146-1","urgency":"not yet assigned"},"forky":{"status":"resolved","repositories":{"forky":"145.0.7632.159-1"},"fixed_version":"88.0.4324.146-1","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"146.0.7680.71-1"},"fixed_version":"88.0.4324.146-1","urgency":"not yet assigned"},"trixie":{"status":"resolved","repositories":{"trixie":"143.0.7499.169-1~deb13u1","trixie-security":"145.0.7632.159-1~deb13u1"},"fixed_version":"88.0.4324.146-1","urgency":"not yet assigned"}}},"CVE-2021-21145":{"description":"Use after free in Fonts in Google Chrome prior to 88.0.4324.146 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page.","scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"143.0.7499.169-1~deb12u1","bookworm-security":"145.0.7632.159-1~deb12u1"},"fixed_version":"88.0.4324.146-1","urgency":"not yet assigned"},"bullseye":{"status":"resolved","repositories":{"bullseye":"120.0.6099.224-1~deb11u1","bullseye-security":"120.0.6099.224-1~deb11u1"},"fixed_version":"88.0.4324.146-1","urgency":"not yet assigned"},"forky":{"status":"resolved","repositories":{"forky":"145.0.7632.159-1"},"fixed_version":"88.0.4324.146-1","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"146.0.7680.71-1"},"fixed_version":"88.0.4324.146-1","urgency":"not yet assigned"},"trixie":{"status":"resolved","repositories":{"trixie":"143.0.7499.169-1~deb13u1","trixie-security":"145.0.7632.159-1~deb13u1"},"fixed_version":"88.0.4324.146-1","urgency":"not yet assigned"}}},"CVE-2021-21146":{"description":"Use after free in Navigation in Google Chrome prior to 88.0.4324.146 allowed a remote attacker who had compromised the renderer process to potentially perform a sandbox escape via a crafted HTML page.","scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"143.0.7499.169-1~deb12u1","bookworm-security":"145.0.7632.159-1~deb12u1"},"fixed_version":"88.0.4324.146-1","urgency":"not yet assigned"},"bullseye":{"status":"resolved","repositories":{"bullseye":"120.0.6099.224-1~deb11u1","bullseye-security":"120.0.6099.224-1~deb11u1"},"fixed_version":"88.0.4324.146-1","urgency":"not yet assigned"},"forky":{"status":"resolved","repositories":{"forky":"145.0.7632.159-1"},"fixed_version":"88.0.4324.146-1","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"146.0.7680.71-1"},"fixed_version":"88.0.4324.146-1","urgency":"not yet assigned"},"trixie":{"status":"resolved","repositories":{"trixie":"143.0.7499.169-1~deb13u1","trixie-security":"145.0.7632.159-1~deb13u1"},"fixed_version":"88.0.4324.146-1","urgency":"not yet assigned"}}},"CVE-2021-21147":{"description":"Inappropriate implementation in Skia in Google Chrome prior to 88.0.4324.146 allowed a local attacker to spoof the contents of the Omnibox (URL bar) via a crafted HTML page.","scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"143.0.7499.169-1~deb12u1","bookworm-security":"145.0.7632.159-1~deb12u1"},"fixed_version":"88.0.4324.146-1","urgency":"not yet assigned"},"bullseye":{"status":"resolved","repositories":{"bullseye":"120.0.6099.224-1~deb11u1","bullseye-security":"120.0.6099.224-1~deb11u1"},"fixed_version":"88.0.4324.146-1","urgency":"not yet assigned"},"forky":{"status":"resolved","repositories":{"forky":"145.0.7632.159-1"},"fixed_version":"88.0.4324.146-1","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"146.0.7680.71-1"},"fixed_version":"88.0.4324.146-1","urgency":"not yet assigned"},"trixie":{"status":"resolved","repositories":{"trixie":"143.0.7499.169-1~deb13u1","trixie-security":"145.0.7632.159-1~deb13u1"},"fixed_version":"88.0.4324.146-1","urgency":"not yet assigned"}}},"CVE-2021-21148":{"description":"Heap buffer overflow in V8 in Google Chrome prior to 88.0.4324.150 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page.","scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"143.0.7499.169-1~deb12u1","bookworm-security":"145.0.7632.159-1~deb12u1"},"fixed_version":"88.0.4324.150-1","urgency":"not yet assigned"},"bullseye":{"status":"resolved","repositories":{"bullseye":"120.0.6099.224-1~deb11u1","bullseye-security":"120.0.6099.224-1~deb11u1"},"fixed_version":"88.0.4324.150-1","urgency":"not yet assigned"},"forky":{"status":"resolved","repositories":{"forky":"145.0.7632.159-1"},"fixed_version":"88.0.4324.150-1","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"146.0.7680.71-1"},"fixed_version":"88.0.4324.150-1","urgency":"not yet assigned"},"trixie":{"status":"resolved","repositories":{"trixie":"143.0.7499.169-1~deb13u1","trixie-security":"145.0.7632.159-1~deb13u1"},"fixed_version":"88.0.4324.150-1","urgency":"not yet assigned"}}},"CVE-2021-21149":{"description":"Stack buffer overflow in Data Transfer in Google Chrome on Linux prior to 88.0.4324.182 allowed a remote attacker to perform out of bounds memory access via a crafted HTML page.","scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"143.0.7499.169-1~deb12u1","bookworm-security":"145.0.7632.159-1~deb12u1"},"fixed_version":"88.0.4324.182-1","urgency":"not yet assigned"},"bullseye":{"status":"resolved","repositories":{"bullseye":"120.0.6099.224-1~deb11u1","bullseye-security":"120.0.6099.224-1~deb11u1"},"fixed_version":"88.0.4324.182-1","urgency":"not yet assigned"},"forky":{"status":"resolved","repositories":{"forky":"145.0.7632.159-1"},"fixed_version":"88.0.4324.182-1","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"146.0.7680.71-1"},"fixed_version":"88.0.4324.182-1","urgency":"not yet assigned"},"trixie":{"status":"resolved","repositories":{"trixie":"143.0.7499.169-1~deb13u1","trixie-security":"145.0.7632.159-1~deb13u1"},"fixed_version":"88.0.4324.182-1","urgency":"not yet assigned"}}},"CVE-2021-21150":{"description":"Use after free in Downloads in Google Chrome on Windows prior to 88.0.4324.182 allowed a remote attacker who had compromised the renderer process to potentially perform a sandbox escape via a crafted HTML page.","scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"143.0.7499.169-1~deb12u1","bookworm-security":"145.0.7632.159-1~deb12u1"},"fixed_version":"88.0.4324.182-1","urgency":"not yet assigned"},"bullseye":{"status":"resolved","repositories":{"bullseye":"120.0.6099.224-1~deb11u1","bullseye-security":"120.0.6099.224-1~deb11u1"},"fixed_version":"88.0.4324.182-1","urgency":"not yet assigned"},"forky":{"status":"resolved","repositories":{"forky":"145.0.7632.159-1"},"fixed_version":"88.0.4324.182-1","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"146.0.7680.71-1"},"fixed_version":"88.0.4324.182-1","urgency":"not yet assigned"},"trixie":{"status":"resolved","repositories":{"trixie":"143.0.7499.169-1~deb13u1","trixie-security":"145.0.7632.159-1~deb13u1"},"fixed_version":"88.0.4324.182-1","urgency":"not yet assigned"}}},"CVE-2021-21151":{"description":"Use after free in Payments in Google Chrome prior to 88.0.4324.182 allowed a remote attacker to potentially perform a sandbox escape via a crafted HTML page.","scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"143.0.7499.169-1~deb12u1","bookworm-security":"145.0.7632.159-1~deb12u1"},"fixed_version":"88.0.4324.182-1","urgency":"not yet assigned"},"bullseye":{"status":"resolved","repositories":{"bullseye":"120.0.6099.224-1~deb11u1","bullseye-security":"120.0.6099.224-1~deb11u1"},"fixed_version":"88.0.4324.182-1","urgency":"not yet assigned"},"forky":{"status":"resolved","repositories":{"forky":"145.0.7632.159-1"},"fixed_version":"88.0.4324.182-1","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"146.0.7680.71-1"},"fixed_version":"88.0.4324.182-1","urgency":"not yet assigned"},"trixie":{"status":"resolved","repositories":{"trixie":"143.0.7499.169-1~deb13u1","trixie-security":"145.0.7632.159-1~deb13u1"},"fixed_version":"88.0.4324.182-1","urgency":"not yet assigned"}}},"CVE-2021-21152":{"description":"Heap buffer overflow in Media in Google Chrome on Linux prior to 88.0.4324.182 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page.","scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"143.0.7499.169-1~deb12u1","bookworm-security":"145.0.7632.159-1~deb12u1"},"fixed_version":"88.0.4324.182-1","urgency":"not yet assigned"},"bullseye":{"status":"resolved","repositories":{"bullseye":"120.0.6099.224-1~deb11u1","bullseye-security":"120.0.6099.224-1~deb11u1"},"fixed_version":"88.0.4324.182-1","urgency":"not yet assigned"},"forky":{"status":"resolved","repositories":{"forky":"145.0.7632.159-1"},"fixed_version":"88.0.4324.182-1","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"146.0.7680.71-1"},"fixed_version":"88.0.4324.182-1","urgency":"not yet assigned"},"trixie":{"status":"resolved","repositories":{"trixie":"143.0.7499.169-1~deb13u1","trixie-security":"145.0.7632.159-1~deb13u1"},"fixed_version":"88.0.4324.182-1","urgency":"not yet assigned"}}},"CVE-2021-21153":{"description":"Stack buffer overflow in GPU Process in Google Chrome on Linux prior to 88.0.4324.182 allowed a remote attacker to potentially perform out of bounds memory access via a crafted HTML page.","scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"143.0.7499.169-1~deb12u1","bookworm-security":"145.0.7632.159-1~deb12u1"},"fixed_version":"88.0.4324.182-1","urgency":"not yet assigned"},"bullseye":{"status":"resolved","repositories":{"bullseye":"120.0.6099.224-1~deb11u1","bullseye-security":"120.0.6099.224-1~deb11u1"},"fixed_version":"88.0.4324.182-1","urgency":"not yet assigned"},"forky":{"status":"resolved","repositories":{"forky":"145.0.7632.159-1"},"fixed_version":"88.0.4324.182-1","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"146.0.7680.71-1"},"fixed_version":"88.0.4324.182-1","urgency":"not yet assigned"},"trixie":{"status":"resolved","repositories":{"trixie":"143.0.7499.169-1~deb13u1","trixie-security":"145.0.7632.159-1~deb13u1"},"fixed_version":"88.0.4324.182-1","urgency":"not yet assigned"}}},"CVE-2021-21154":{"description":"Heap buffer overflow in Tab Strip in Google Chrome prior to 88.0.4324.182 allowed a remote attacker who had compromised the renderer process to potentially perform a sandbox escape via a crafted HTML page.","scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"143.0.7499.169-1~deb12u1","bookworm-security":"145.0.7632.159-1~deb12u1"},"fixed_version":"88.0.4324.182-1","urgency":"not yet assigned"},"bullseye":{"status":"resolved","repositories":{"bullseye":"120.0.6099.224-1~deb11u1","bullseye-security":"120.0.6099.224-1~deb11u1"},"fixed_version":"88.0.4324.182-1","urgency":"not yet assigned"},"forky":{"status":"resolved","repositories":{"forky":"145.0.7632.159-1"},"fixed_version":"88.0.4324.182-1","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"146.0.7680.71-1"},"fixed_version":"88.0.4324.182-1","urgency":"not yet assigned"},"trixie":{"status":"resolved","repositories":{"trixie":"143.0.7499.169-1~deb13u1","trixie-security":"145.0.7632.159-1~deb13u1"},"fixed_version":"88.0.4324.182-1","urgency":"not yet assigned"}}},"CVE-2021-21155":{"description":"Heap buffer overflow in Tab Strip in Google Chrome on Windows prior to 88.0.4324.182 allowed a remote attacker who had compromised the renderer process to potentially perform a sandbox escape via a crafted HTML page.","scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"143.0.7499.169-1~deb12u1","bookworm-security":"145.0.7632.159-1~deb12u1"},"fixed_version":"88.0.4324.182-1","urgency":"not yet assigned"},"bullseye":{"status":"resolved","repositories":{"bullseye":"120.0.6099.224-1~deb11u1","bullseye-security":"120.0.6099.224-1~deb11u1"},"fixed_version":"88.0.4324.182-1","urgency":"not yet assigned"},"forky":{"status":"resolved","repositories":{"forky":"145.0.7632.159-1"},"fixed_version":"88.0.4324.182-1","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"146.0.7680.71-1"},"fixed_version":"88.0.4324.182-1","urgency":"not yet assigned"},"trixie":{"status":"resolved","repositories":{"trixie":"143.0.7499.169-1~deb13u1","trixie-security":"145.0.7632.159-1~deb13u1"},"fixed_version":"88.0.4324.182-1","urgency":"not yet assigned"}}},"CVE-2021-21156":{"description":"Heap buffer overflow in V8 in Google Chrome prior to 88.0.4324.182 allowed a remote attacker to potentially exploit heap corruption via a crafted script.","scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"143.0.7499.169-1~deb12u1","bookworm-security":"145.0.7632.159-1~deb12u1"},"fixed_version":"88.0.4324.182-1","urgency":"not yet assigned"},"bullseye":{"status":"resolved","repositories":{"bullseye":"120.0.6099.224-1~deb11u1","bullseye-security":"120.0.6099.224-1~deb11u1"},"fixed_version":"88.0.4324.182-1","urgency":"not yet assigned"},"forky":{"status":"resolved","repositories":{"forky":"145.0.7632.159-1"},"fixed_version":"88.0.4324.182-1","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"146.0.7680.71-1"},"fixed_version":"88.0.4324.182-1","urgency":"not yet assigned"},"trixie":{"status":"resolved","repositories":{"trixie":"143.0.7499.169-1~deb13u1","trixie-security":"145.0.7632.159-1~deb13u1"},"fixed_version":"88.0.4324.182-1","urgency":"not yet assigned"}}},"CVE-2021-21157":{"description":"Use after free in Web Sockets in Google Chrome on Linux prior to 88.0.4324.182 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page.","scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"143.0.7499.169-1~deb12u1","bookworm-security":"145.0.7632.159-1~deb12u1"},"fixed_version":"88.0.4324.182-1","urgency":"not yet assigned"},"bullseye":{"status":"resolved","repositories":{"bullseye":"120.0.6099.224-1~deb11u1","bullseye-security":"120.0.6099.224-1~deb11u1"},"fixed_version":"88.0.4324.182-1","urgency":"not yet assigned"},"forky":{"status":"resolved","repositories":{"forky":"145.0.7632.159-1"},"fixed_version":"88.0.4324.182-1","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"146.0.7680.71-1"},"fixed_version":"88.0.4324.182-1","urgency":"not yet assigned"},"trixie":{"status":"resolved","repositories":{"trixie":"143.0.7499.169-1~deb13u1","trixie-security":"145.0.7632.159-1~deb13u1"},"fixed_version":"88.0.4324.182-1","urgency":"not yet assigned"}}},"CVE-2021-21159":{"description":"Heap buffer overflow in TabStrip in Google Chrome prior to 89.0.4389.72 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page.","scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"143.0.7499.169-1~deb12u1","bookworm-security":"145.0.7632.159-1~deb12u1"},"fixed_version":"89.0.4389.82-1","urgency":"not yet assigned"},"bullseye":{"status":"resolved","repositories":{"bullseye":"120.0.6099.224-1~deb11u1","bullseye-security":"120.0.6099.224-1~deb11u1"},"fixed_version":"89.0.4389.82-1","urgency":"not yet assigned"},"forky":{"status":"resolved","repositories":{"forky":"145.0.7632.159-1"},"fixed_version":"89.0.4389.82-1","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"146.0.7680.71-1"},"fixed_version":"89.0.4389.82-1","urgency":"not yet assigned"},"trixie":{"status":"resolved","repositories":{"trixie":"143.0.7499.169-1~deb13u1","trixie-security":"145.0.7632.159-1~deb13u1"},"fixed_version":"89.0.4389.82-1","urgency":"not yet assigned"}}},"CVE-2021-21160":{"description":"Heap buffer overflow in WebAudio in Google Chrome prior to 89.0.4389.72 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page.","scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"143.0.7499.169-1~deb12u1","bookworm-security":"145.0.7632.159-1~deb12u1"},"fixed_version":"89.0.4389.82-1","urgency":"not yet assigned"},"bullseye":{"status":"resolved","repositories":{"bullseye":"120.0.6099.224-1~deb11u1","bullseye-security":"120.0.6099.224-1~deb11u1"},"fixed_version":"89.0.4389.82-1","urgency":"not yet assigned"},"forky":{"status":"resolved","repositories":{"forky":"145.0.7632.159-1"},"fixed_version":"89.0.4389.82-1","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"146.0.7680.71-1"},"fixed_version":"89.0.4389.82-1","urgency":"not yet assigned"},"trixie":{"status":"resolved","repositories":{"trixie":"143.0.7499.169-1~deb13u1","trixie-security":"145.0.7632.159-1~deb13u1"},"fixed_version":"89.0.4389.82-1","urgency":"not yet assigned"}}},"CVE-2021-21161":{"description":"Heap buffer overflow in TabStrip in Google Chrome prior to 89.0.4389.72 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page.","scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"143.0.7499.169-1~deb12u1","bookworm-security":"145.0.7632.159-1~deb12u1"},"fixed_version":"89.0.4389.82-1","urgency":"not yet assigned"},"bullseye":{"status":"resolved","repositories":{"bullseye":"120.0.6099.224-1~deb11u1","bullseye-security":"120.0.6099.224-1~deb11u1"},"fixed_version":"89.0.4389.82-1","urgency":"not yet assigned"},"forky":{"status":"resolved","repositories":{"forky":"145.0.7632.159-1"},"fixed_version":"89.0.4389.82-1","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"146.0.7680.71-1"},"fixed_version":"89.0.4389.82-1","urgency":"not yet assigned"},"trixie":{"status":"resolved","repositories":{"trixie":"143.0.7499.169-1~deb13u1","trixie-security":"145.0.7632.159-1~deb13u1"},"fixed_version":"89.0.4389.82-1","urgency":"not yet assigned"}}},"CVE-2021-21162":{"description":"Use after free in WebRTC in Google Chrome prior to 89.0.4389.72 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page.","scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"143.0.7499.169-1~deb12u1","bookworm-security":"145.0.7632.159-1~deb12u1"},"fixed_version":"89.0.4389.82-1","urgency":"not yet assigned"},"bullseye":{"status":"resolved","repositories":{"bullseye":"120.0.6099.224-1~deb11u1","bullseye-security":"120.0.6099.224-1~deb11u1"},"fixed_version":"89.0.4389.82-1","urgency":"not yet assigned"},"forky":{"status":"resolved","repositories":{"forky":"145.0.7632.159-1"},"fixed_version":"89.0.4389.82-1","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"146.0.7680.71-1"},"fixed_version":"89.0.4389.82-1","urgency":"not yet assigned"},"trixie":{"status":"resolved","repositories":{"trixie":"143.0.7499.169-1~deb13u1","trixie-security":"145.0.7632.159-1~deb13u1"},"fixed_version":"89.0.4389.82-1","urgency":"not yet assigned"}}},"CVE-2021-21163":{"description":"Insufficient data validation in Reader Mode in Google Chrome on iOS prior to 89.0.4389.72 allowed a remote attacker to leak cross-origin data via a crafted HTML page and a malicious server.","scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"143.0.7499.169-1~deb12u1","bookworm-security":"145.0.7632.159-1~deb12u1"},"fixed_version":"89.0.4389.82-1","urgency":"not yet assigned"},"bullseye":{"status":"resolved","repositories":{"bullseye":"120.0.6099.224-1~deb11u1","bullseye-security":"120.0.6099.224-1~deb11u1"},"fixed_version":"89.0.4389.82-1","urgency":"not yet assigned"},"forky":{"status":"resolved","repositories":{"forky":"145.0.7632.159-1"},"fixed_version":"89.0.4389.82-1","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"146.0.7680.71-1"},"fixed_version":"89.0.4389.82-1","urgency":"not yet assigned"},"trixie":{"status":"resolved","repositories":{"trixie":"143.0.7499.169-1~deb13u1","trixie-security":"145.0.7632.159-1~deb13u1"},"fixed_version":"89.0.4389.82-1","urgency":"not yet assigned"}}},"CVE-2021-21164":{"description":"Insufficient data validation in Chrome on iOS in Google Chrome on iOS prior to 89.0.4389.72 allowed a remote attacker to leak cross-origin data via a crafted HTML page.","scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"143.0.7499.169-1~deb12u1","bookworm-security":"145.0.7632.159-1~deb12u1"},"fixed_version":"0","urgency":"unimportant"},"bullseye":{"status":"resolved","repositories":{"bullseye":"120.0.6099.224-1~deb11u1","bullseye-security":"120.0.6099.224-1~deb11u1"},"fixed_version":"0","urgency":"unimportant"},"forky":{"status":"resolved","repositories":{"forky":"145.0.7632.159-1"},"fixed_version":"0","urgency":"unimportant"},"sid":{"status":"resolved","repositories":{"sid":"146.0.7680.71-1"},"fixed_version":"0","urgency":"unimportant"},"trixie":{"status":"resolved","repositories":{"trixie":"143.0.7499.169-1~deb13u1","trixie-security":"145.0.7632.159-1~deb13u1"},"fixed_version":"0","urgency":"unimportant"}}},"CVE-2021-21165":{"description":"Data race in audio in Google Chrome prior to 89.0.4389.72 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page.","scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"143.0.7499.169-1~deb12u1","bookworm-security":"145.0.7632.159-1~deb12u1"},"fixed_version":"89.0.4389.82-1","urgency":"not yet assigned"},"bullseye":{"status":"resolved","repositories":{"bullseye":"120.0.6099.224-1~deb11u1","bullseye-security":"120.0.6099.224-1~deb11u1"},"fixed_version":"89.0.4389.82-1","urgency":"not yet assigned"},"forky":{"status":"resolved","repositories":{"forky":"145.0.7632.159-1"},"fixed_version":"89.0.4389.82-1","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"146.0.7680.71-1"},"fixed_version":"89.0.4389.82-1","urgency":"not yet assigned"},"trixie":{"status":"resolved","repositories":{"trixie":"143.0.7499.169-1~deb13u1","trixie-security":"145.0.7632.159-1~deb13u1"},"fixed_version":"89.0.4389.82-1","urgency":"not yet assigned"}}},"CVE-2021-21166":{"description":"Data race in audio in Google Chrome prior to 89.0.4389.72 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page.","scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"143.0.7499.169-1~deb12u1","bookworm-security":"145.0.7632.159-1~deb12u1"},"fixed_version":"89.0.4389.82-1","urgency":"not yet assigned"},"bullseye":{"status":"resolved","repositories":{"bullseye":"120.0.6099.224-1~deb11u1","bullseye-security":"120.0.6099.224-1~deb11u1"},"fixed_version":"89.0.4389.82-1","urgency":"not yet assigned"},"forky":{"status":"resolved","repositories":{"forky":"145.0.7632.159-1"},"fixed_version":"89.0.4389.82-1","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"146.0.7680.71-1"},"fixed_version":"89.0.4389.82-1","urgency":"not yet assigned"},"trixie":{"status":"resolved","repositories":{"trixie":"143.0.7499.169-1~deb13u1","trixie-security":"145.0.7632.159-1~deb13u1"},"fixed_version":"89.0.4389.82-1","urgency":"not yet assigned"}}},"CVE-2021-21167":{"description":"Use after free in bookmarks in Google Chrome prior to 89.0.4389.72 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page.","scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"143.0.7499.169-1~deb12u1","bookworm-security":"145.0.7632.159-1~deb12u1"},"fixed_version":"89.0.4389.82-1","urgency":"not yet assigned"},"bullseye":{"status":"resolved","repositories":{"bullseye":"120.0.6099.224-1~deb11u1","bullseye-security":"120.0.6099.224-1~deb11u1"},"fixed_version":"89.0.4389.82-1","urgency":"not yet assigned"},"forky":{"status":"resolved","repositories":{"forky":"145.0.7632.159-1"},"fixed_version":"89.0.4389.82-1","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"146.0.7680.71-1"},"fixed_version":"89.0.4389.82-1","urgency":"not yet assigned"},"trixie":{"status":"resolved","repositories":{"trixie":"143.0.7499.169-1~deb13u1","trixie-security":"145.0.7632.159-1~deb13u1"},"fixed_version":"89.0.4389.82-1","urgency":"not yet assigned"}}},"CVE-2021-21168":{"description":"Insufficient policy enforcement in appcache in Google Chrome prior to 89.0.4389.72 allowed a remote attacker to obtain potentially sensitive information from process memory via a crafted HTML page.","scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"143.0.7499.169-1~deb12u1","bookworm-security":"145.0.7632.159-1~deb12u1"},"fixed_version":"89.0.4389.82-1","urgency":"not yet assigned"},"bullseye":{"status":"resolved","repositories":{"bullseye":"120.0.6099.224-1~deb11u1","bullseye-security":"120.0.6099.224-1~deb11u1"},"fixed_version":"89.0.4389.82-1","urgency":"not yet assigned"},"forky":{"status":"resolved","repositories":{"forky":"145.0.7632.159-1"},"fixed_version":"89.0.4389.82-1","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"146.0.7680.71-1"},"fixed_version":"89.0.4389.82-1","urgency":"not yet assigned"},"trixie":{"status":"resolved","repositories":{"trixie":"143.0.7499.169-1~deb13u1","trixie-security":"145.0.7632.159-1~deb13u1"},"fixed_version":"89.0.4389.82-1","urgency":"not yet assigned"}}},"CVE-2021-21169":{"description":"Out of bounds memory access in V8 in Google Chrome prior to 89.0.4389.72 allowed a remote attacker to potentially perform out of bounds memory access via a crafted HTML page.","scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"143.0.7499.169-1~deb12u1","bookworm-security":"145.0.7632.159-1~deb12u1"},"fixed_version":"89.0.4389.82-1","urgency":"not yet assigned"},"bullseye":{"status":"resolved","repositories":{"bullseye":"120.0.6099.224-1~deb11u1","bullseye-security":"120.0.6099.224-1~deb11u1"},"fixed_version":"89.0.4389.82-1","urgency":"not yet assigned"},"forky":{"status":"resolved","repositories":{"forky":"145.0.7632.159-1"},"fixed_version":"89.0.4389.82-1","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"146.0.7680.71-1"},"fixed_version":"89.0.4389.82-1","urgency":"not yet assigned"},"trixie":{"status":"resolved","repositories":{"trixie":"143.0.7499.169-1~deb13u1","trixie-security":"145.0.7632.159-1~deb13u1"},"fixed_version":"89.0.4389.82-1","urgency":"not yet assigned"}}},"CVE-2021-21170":{"description":"Incorrect security UI in Loader in Google Chrome prior to 89.0.4389.72 allowed a remote attacker who had compromised the renderer process to spoof the contents of the Omnibox (URL bar) via a crafted HTML page.","scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"143.0.7499.169-1~deb12u1","bookworm-security":"145.0.7632.159-1~deb12u1"},"fixed_version":"89.0.4389.82-1","urgency":"not yet assigned"},"bullseye":{"status":"resolved","repositories":{"bullseye":"120.0.6099.224-1~deb11u1","bullseye-security":"120.0.6099.224-1~deb11u1"},"fixed_version":"89.0.4389.82-1","urgency":"not yet assigned"},"forky":{"status":"resolved","repositories":{"forky":"145.0.7632.159-1"},"fixed_version":"89.0.4389.82-1","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"146.0.7680.71-1"},"fixed_version":"89.0.4389.82-1","urgency":"not yet assigned"},"trixie":{"status":"resolved","repositories":{"trixie":"143.0.7499.169-1~deb13u1","trixie-security":"145.0.7632.159-1~deb13u1"},"fixed_version":"89.0.4389.82-1","urgency":"not yet assigned"}}},"CVE-2021-21171":{"description":"Incorrect security UI in TabStrip and Navigation in Google Chrome on Android prior to 89.0.4389.72 allowed a remote attacker to spoof the contents of the Omnibox (URL bar) via a crafted HTML page.","scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"143.0.7499.169-1~deb12u1","bookworm-security":"145.0.7632.159-1~deb12u1"},"fixed_version":"89.0.4389.82-1","urgency":"not yet assigned"},"bullseye":{"status":"resolved","repositories":{"bullseye":"120.0.6099.224-1~deb11u1","bullseye-security":"120.0.6099.224-1~deb11u1"},"fixed_version":"89.0.4389.82-1","urgency":"not yet assigned"},"forky":{"status":"resolved","repositories":{"forky":"145.0.7632.159-1"},"fixed_version":"89.0.4389.82-1","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"146.0.7680.71-1"},"fixed_version":"89.0.4389.82-1","urgency":"not yet assigned"},"trixie":{"status":"resolved","repositories":{"trixie":"143.0.7499.169-1~deb13u1","trixie-security":"145.0.7632.159-1~deb13u1"},"fixed_version":"89.0.4389.82-1","urgency":"not yet assigned"}}},"CVE-2021-21172":{"description":"Insufficient policy enforcement in File System API in Google Chrome on Windows prior to 89.0.4389.72 allowed a remote attacker to bypass filesystem restrictions via a crafted HTML page.","scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"143.0.7499.169-1~deb12u1","bookworm-security":"145.0.7632.159-1~deb12u1"},"fixed_version":"89.0.4389.82-1","urgency":"not yet assigned"},"bullseye":{"status":"resolved","repositories":{"bullseye":"120.0.6099.224-1~deb11u1","bullseye-security":"120.0.6099.224-1~deb11u1"},"fixed_version":"89.0.4389.82-1","urgency":"not yet assigned"},"forky":{"status":"resolved","repositories":{"forky":"145.0.7632.159-1"},"fixed_version":"89.0.4389.82-1","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"146.0.7680.71-1"},"fixed_version":"89.0.4389.82-1","urgency":"not yet assigned"},"trixie":{"status":"resolved","repositories":{"trixie":"143.0.7499.169-1~deb13u1","trixie-security":"145.0.7632.159-1~deb13u1"},"fixed_version":"89.0.4389.82-1","urgency":"not yet assigned"}}},"CVE-2021-21173":{"description":"Side-channel information leakage in Network Internals in Google Chrome prior to 89.0.4389.72 allowed a remote attacker to leak cross-origin data via a crafted HTML page.","scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"143.0.7499.169-1~deb12u1","bookworm-security":"145.0.7632.159-1~deb12u1"},"fixed_version":"89.0.4389.82-1","urgency":"not yet assigned"},"bullseye":{"status":"resolved","repositories":{"bullseye":"120.0.6099.224-1~deb11u1","bullseye-security":"120.0.6099.224-1~deb11u1"},"fixed_version":"89.0.4389.82-1","urgency":"not yet assigned"},"forky":{"status":"resolved","repositories":{"forky":"145.0.7632.159-1"},"fixed_version":"89.0.4389.82-1","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"146.0.7680.71-1"},"fixed_version":"89.0.4389.82-1","urgency":"not yet assigned"},"trixie":{"status":"resolved","repositories":{"trixie":"143.0.7499.169-1~deb13u1","trixie-security":"145.0.7632.159-1~deb13u1"},"fixed_version":"89.0.4389.82-1","urgency":"not yet assigned"}}},"CVE-2021-21174":{"description":"Inappropriate implementation in Referrer in Google Chrome prior to 89.0.4389.72 allowed a remote attacker to bypass navigation restrictions via a crafted HTML page.","scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"143.0.7499.169-1~deb12u1","bookworm-security":"145.0.7632.159-1~deb12u1"},"fixed_version":"89.0.4389.82-1","urgency":"not yet assigned"},"bullseye":{"status":"resolved","repositories":{"bullseye":"120.0.6099.224-1~deb11u1","bullseye-security":"120.0.6099.224-1~deb11u1"},"fixed_version":"89.0.4389.82-1","urgency":"not yet assigned"},"forky":{"status":"resolved","repositories":{"forky":"145.0.7632.159-1"},"fixed_version":"89.0.4389.82-1","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"146.0.7680.71-1"},"fixed_version":"89.0.4389.82-1","urgency":"not yet assigned"},"trixie":{"status":"resolved","repositories":{"trixie":"143.0.7499.169-1~deb13u1","trixie-security":"145.0.7632.159-1~deb13u1"},"fixed_version":"89.0.4389.82-1","urgency":"not yet assigned"}}},"CVE-2021-21175":{"description":"Inappropriate implementation in Site isolation in Google Chrome prior to 89.0.4389.72 allowed a remote attacker to leak cross-origin data via a crafted HTML page.","scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"143.0.7499.169-1~deb12u1","bookworm-security":"145.0.7632.159-1~deb12u1"},"fixed_version":"89.0.4389.82-1","urgency":"not yet assigned"},"bullseye":{"status":"resolved","repositories":{"bullseye":"120.0.6099.224-1~deb11u1","bullseye-security":"120.0.6099.224-1~deb11u1"},"fixed_version":"89.0.4389.82-1","urgency":"not yet assigned"},"forky":{"status":"resolved","repositories":{"forky":"145.0.7632.159-1"},"fixed_version":"89.0.4389.82-1","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"146.0.7680.71-1"},"fixed_version":"89.0.4389.82-1","urgency":"not yet assigned"},"trixie":{"status":"resolved","repositories":{"trixie":"143.0.7499.169-1~deb13u1","trixie-security":"145.0.7632.159-1~deb13u1"},"fixed_version":"89.0.4389.82-1","urgency":"not yet assigned"}}},"CVE-2021-21176":{"description":"Inappropriate implementation in full screen mode in Google Chrome prior to 89.0.4389.72 allowed a remote attacker to spoof the contents of the Omnibox (URL bar) via a crafted HTML page.","scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"143.0.7499.169-1~deb12u1","bookworm-security":"145.0.7632.159-1~deb12u1"},"fixed_version":"89.0.4389.82-1","urgency":"not yet assigned"},"bullseye":{"status":"resolved","repositories":{"bullseye":"120.0.6099.224-1~deb11u1","bullseye-security":"120.0.6099.224-1~deb11u1"},"fixed_version":"89.0.4389.82-1","urgency":"not yet assigned"},"forky":{"status":"resolved","repositories":{"forky":"145.0.7632.159-1"},"fixed_version":"89.0.4389.82-1","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"146.0.7680.71-1"},"fixed_version":"89.0.4389.82-1","urgency":"not yet assigned"},"trixie":{"status":"resolved","repositories":{"trixie":"143.0.7499.169-1~deb13u1","trixie-security":"145.0.7632.159-1~deb13u1"},"fixed_version":"89.0.4389.82-1","urgency":"not yet assigned"}}},"CVE-2021-21177":{"description":"Insufficient policy enforcement in Autofill in Google Chrome prior to 89.0.4389.72 allowed a remote attacker to obtain potentially sensitive information from process memory via a crafted HTML page.","scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"143.0.7499.169-1~deb12u1","bookworm-security":"145.0.7632.159-1~deb12u1"},"fixed_version":"89.0.4389.82-1","urgency":"not yet assigned"},"bullseye":{"status":"resolved","repositories":{"bullseye":"120.0.6099.224-1~deb11u1","bullseye-security":"120.0.6099.224-1~deb11u1"},"fixed_version":"89.0.4389.82-1","urgency":"not yet assigned"},"forky":{"status":"resolved","repositories":{"forky":"145.0.7632.159-1"},"fixed_version":"89.0.4389.82-1","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"146.0.7680.71-1"},"fixed_version":"89.0.4389.82-1","urgency":"not yet assigned"},"trixie":{"status":"resolved","repositories":{"trixie":"143.0.7499.169-1~deb13u1","trixie-security":"145.0.7632.159-1~deb13u1"},"fixed_version":"89.0.4389.82-1","urgency":"not yet assigned"}}},"CVE-2021-21178":{"description":"Inappropriate implementation in Compositing in Google Chrome on Linux and Windows prior to 89.0.4389.72 allowed a remote attacker to spoof the contents of the Omnibox (URL bar) via a crafted HTML page.","scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"143.0.7499.169-1~deb12u1","bookworm-security":"145.0.7632.159-1~deb12u1"},"fixed_version":"89.0.4389.82-1","urgency":"not yet assigned"},"bullseye":{"status":"resolved","repositories":{"bullseye":"120.0.6099.224-1~deb11u1","bullseye-security":"120.0.6099.224-1~deb11u1"},"fixed_version":"89.0.4389.82-1","urgency":"not yet assigned"},"forky":{"status":"resolved","repositories":{"forky":"145.0.7632.159-1"},"fixed_version":"89.0.4389.82-1","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"146.0.7680.71-1"},"fixed_version":"89.0.4389.82-1","urgency":"not yet assigned"},"trixie":{"status":"resolved","repositories":{"trixie":"143.0.7499.169-1~deb13u1","trixie-security":"145.0.7632.159-1~deb13u1"},"fixed_version":"89.0.4389.82-1","urgency":"not yet assigned"}}},"CVE-2021-21179":{"description":"Use after free in Network Internals in Google Chrome on Linux prior to 89.0.4389.72 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page.","scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"143.0.7499.169-1~deb12u1","bookworm-security":"145.0.7632.159-1~deb12u1"},"fixed_version":"89.0.4389.82-1","urgency":"not yet assigned"},"bullseye":{"status":"resolved","repositories":{"bullseye":"120.0.6099.224-1~deb11u1","bullseye-security":"120.0.6099.224-1~deb11u1"},"fixed_version":"89.0.4389.82-1","urgency":"not yet assigned"},"forky":{"status":"resolved","repositories":{"forky":"145.0.7632.159-1"},"fixed_version":"89.0.4389.82-1","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"146.0.7680.71-1"},"fixed_version":"89.0.4389.82-1","urgency":"not yet assigned"},"trixie":{"status":"resolved","repositories":{"trixie":"143.0.7499.169-1~deb13u1","trixie-security":"145.0.7632.159-1~deb13u1"},"fixed_version":"89.0.4389.82-1","urgency":"not yet assigned"}}},"CVE-2021-21180":{"description":"Use after free in tab search in Google Chrome prior to 89.0.4389.72 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page.","scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"143.0.7499.169-1~deb12u1","bookworm-security":"145.0.7632.159-1~deb12u1"},"fixed_version":"89.0.4389.82-1","urgency":"not yet assigned"},"bullseye":{"status":"resolved","repositories":{"bullseye":"120.0.6099.224-1~deb11u1","bullseye-security":"120.0.6099.224-1~deb11u1"},"fixed_version":"89.0.4389.82-1","urgency":"not yet assigned"},"forky":{"status":"resolved","repositories":{"forky":"145.0.7632.159-1"},"fixed_version":"89.0.4389.82-1","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"146.0.7680.71-1"},"fixed_version":"89.0.4389.82-1","urgency":"not yet assigned"},"trixie":{"status":"resolved","repositories":{"trixie":"143.0.7499.169-1~deb13u1","trixie-security":"145.0.7632.159-1~deb13u1"},"fixed_version":"89.0.4389.82-1","urgency":"not yet assigned"}}},"CVE-2021-21181":{"description":"Side-channel information leakage in autofill in Google Chrome prior to 89.0.4389.72 allowed a remote attacker to obtain potentially sensitive information from process memory via a crafted HTML page.","scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"143.0.7499.169-1~deb12u1","bookworm-security":"145.0.7632.159-1~deb12u1"},"fixed_version":"89.0.4389.82-1","urgency":"not yet assigned"},"bullseye":{"status":"resolved","repositories":{"bullseye":"120.0.6099.224-1~deb11u1","bullseye-security":"120.0.6099.224-1~deb11u1"},"fixed_version":"89.0.4389.82-1","urgency":"not yet assigned"},"forky":{"status":"resolved","repositories":{"forky":"145.0.7632.159-1"},"fixed_version":"89.0.4389.82-1","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"146.0.7680.71-1"},"fixed_version":"89.0.4389.82-1","urgency":"not yet assigned"},"trixie":{"status":"resolved","repositories":{"trixie":"143.0.7499.169-1~deb13u1","trixie-security":"145.0.7632.159-1~deb13u1"},"fixed_version":"89.0.4389.82-1","urgency":"not yet assigned"}}},"CVE-2021-21182":{"description":"Insufficient policy enforcement in navigations in Google Chrome prior to 89.0.4389.72 allowed a remote attacker who had compromised the renderer process to bypass navigation restrictions via a crafted HTML page.","scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"143.0.7499.169-1~deb12u1","bookworm-security":"145.0.7632.159-1~deb12u1"},"fixed_version":"89.0.4389.82-1","urgency":"not yet assigned"},"bullseye":{"status":"resolved","repositories":{"bullseye":"120.0.6099.224-1~deb11u1","bullseye-security":"120.0.6099.224-1~deb11u1"},"fixed_version":"89.0.4389.82-1","urgency":"not yet assigned"},"forky":{"status":"resolved","repositories":{"forky":"145.0.7632.159-1"},"fixed_version":"89.0.4389.82-1","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"146.0.7680.71-1"},"fixed_version":"89.0.4389.82-1","urgency":"not yet assigned"},"trixie":{"status":"resolved","repositories":{"trixie":"143.0.7499.169-1~deb13u1","trixie-security":"145.0.7632.159-1~deb13u1"},"fixed_version":"89.0.4389.82-1","urgency":"not yet assigned"}}},"CVE-2021-21183":{"description":"Inappropriate implementation in performance APIs in Google Chrome prior to 89.0.4389.72 allowed a remote attacker to leak cross-origin data via a crafted HTML page.","scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"143.0.7499.169-1~deb12u1","bookworm-security":"145.0.7632.159-1~deb12u1"},"fixed_version":"89.0.4389.82-1","urgency":"not yet assigned"},"bullseye":{"status":"resolved","repositories":{"bullseye":"120.0.6099.224-1~deb11u1","bullseye-security":"120.0.6099.224-1~deb11u1"},"fixed_version":"89.0.4389.82-1","urgency":"not yet assigned"},"forky":{"status":"resolved","repositories":{"forky":"145.0.7632.159-1"},"fixed_version":"89.0.4389.82-1","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"146.0.7680.71-1"},"fixed_version":"89.0.4389.82-1","urgency":"not yet assigned"},"trixie":{"status":"resolved","repositories":{"trixie":"143.0.7499.169-1~deb13u1","trixie-security":"145.0.7632.159-1~deb13u1"},"fixed_version":"89.0.4389.82-1","urgency":"not yet assigned"}}},"CVE-2021-21184":{"description":"Inappropriate implementation in performance APIs in Google Chrome prior to 89.0.4389.72 allowed a remote attacker to leak cross-origin data via a crafted HTML page.","scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"143.0.7499.169-1~deb12u1","bookworm-security":"145.0.7632.159-1~deb12u1"},"fixed_version":"89.0.4389.82-1","urgency":"not yet assigned"},"bullseye":{"status":"resolved","repositories":{"bullseye":"120.0.6099.224-1~deb11u1","bullseye-security":"120.0.6099.224-1~deb11u1"},"fixed_version":"89.0.4389.82-1","urgency":"not yet assigned"},"forky":{"status":"resolved","repositories":{"forky":"145.0.7632.159-1"},"fixed_version":"89.0.4389.82-1","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"146.0.7680.71-1"},"fixed_version":"89.0.4389.82-1","urgency":"not yet assigned"},"trixie":{"status":"resolved","repositories":{"trixie":"143.0.7499.169-1~deb13u1","trixie-security":"145.0.7632.159-1~deb13u1"},"fixed_version":"89.0.4389.82-1","urgency":"not yet assigned"}}},"CVE-2021-21185":{"description":"Insufficient policy enforcement in extensions in Google Chrome prior to 89.0.4389.72 allowed an attacker who convinced a user to install a malicious extension to obtain sensitive information via a crafted Chrome Extension.","scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"143.0.7499.169-1~deb12u1","bookworm-security":"145.0.7632.159-1~deb12u1"},"fixed_version":"89.0.4389.82-1","urgency":"not yet assigned"},"bullseye":{"status":"resolved","repositories":{"bullseye":"120.0.6099.224-1~deb11u1","bullseye-security":"120.0.6099.224-1~deb11u1"},"fixed_version":"89.0.4389.82-1","urgency":"not yet assigned"},"forky":{"status":"resolved","repositories":{"forky":"145.0.7632.159-1"},"fixed_version":"89.0.4389.82-1","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"146.0.7680.71-1"},"fixed_version":"89.0.4389.82-1","urgency":"not yet assigned"},"trixie":{"status":"resolved","repositories":{"trixie":"143.0.7499.169-1~deb13u1","trixie-security":"145.0.7632.159-1~deb13u1"},"fixed_version":"89.0.4389.82-1","urgency":"not yet assigned"}}},"CVE-2021-21186":{"description":"Insufficient policy enforcement in QR scanning in Google Chrome on iOS prior to 89.0.4389.72 allowed an attacker who convinced the user to scan a QR code to bypass navigation restrictions via a crafted QR code.","scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"143.0.7499.169-1~deb12u1","bookworm-security":"145.0.7632.159-1~deb12u1"},"fixed_version":"89.0.4389.82-1","urgency":"not yet assigned"},"bullseye":{"status":"resolved","repositories":{"bullseye":"120.0.6099.224-1~deb11u1","bullseye-security":"120.0.6099.224-1~deb11u1"},"fixed_version":"89.0.4389.82-1","urgency":"not yet assigned"},"forky":{"status":"resolved","repositories":{"forky":"145.0.7632.159-1"},"fixed_version":"89.0.4389.82-1","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"146.0.7680.71-1"},"fixed_version":"89.0.4389.82-1","urgency":"not yet assigned"},"trixie":{"status":"resolved","repositories":{"trixie":"143.0.7499.169-1~deb13u1","trixie-security":"145.0.7632.159-1~deb13u1"},"fixed_version":"89.0.4389.82-1","urgency":"not yet assigned"}}},"CVE-2021-21187":{"description":"Insufficient data validation in URL formatting in Google Chrome prior to 89.0.4389.72 allowed a remote attacker to perform domain spoofing via IDN homographs via a crafted domain name.","scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"143.0.7499.169-1~deb12u1","bookworm-security":"145.0.7632.159-1~deb12u1"},"fixed_version":"89.0.4389.82-1","urgency":"not yet assigned"},"bullseye":{"status":"resolved","repositories":{"bullseye":"120.0.6099.224-1~deb11u1","bullseye-security":"120.0.6099.224-1~deb11u1"},"fixed_version":"89.0.4389.82-1","urgency":"not yet assigned"},"forky":{"status":"resolved","repositories":{"forky":"145.0.7632.159-1"},"fixed_version":"89.0.4389.82-1","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"146.0.7680.71-1"},"fixed_version":"89.0.4389.82-1","urgency":"not yet assigned"},"trixie":{"status":"resolved","repositories":{"trixie":"143.0.7499.169-1~deb13u1","trixie-security":"145.0.7632.159-1~deb13u1"},"fixed_version":"89.0.4389.82-1","urgency":"not yet assigned"}}},"CVE-2021-21188":{"description":"Use after free in Blink in Google Chrome prior to 89.0.4389.72 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page.","scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"143.0.7499.169-1~deb12u1","bookworm-security":"145.0.7632.159-1~deb12u1"},"fixed_version":"89.0.4389.82-1","urgency":"not yet assigned"},"bullseye":{"status":"resolved","repositories":{"bullseye":"120.0.6099.224-1~deb11u1","bullseye-security":"120.0.6099.224-1~deb11u1"},"fixed_version":"89.0.4389.82-1","urgency":"not yet assigned"},"forky":{"status":"resolved","repositories":{"forky":"145.0.7632.159-1"},"fixed_version":"89.0.4389.82-1","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"146.0.7680.71-1"},"fixed_version":"89.0.4389.82-1","urgency":"not yet assigned"},"trixie":{"status":"resolved","repositories":{"trixie":"143.0.7499.169-1~deb13u1","trixie-security":"145.0.7632.159-1~deb13u1"},"fixed_version":"89.0.4389.82-1","urgency":"not yet assigned"}}},"CVE-2021-21189":{"description":"Insufficient policy enforcement in payments in Google Chrome prior to 89.0.4389.72 allowed a remote attacker to bypass navigation restrictions via a crafted HTML page.","scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"143.0.7499.169-1~deb12u1","bookworm-security":"145.0.7632.159-1~deb12u1"},"fixed_version":"89.0.4389.82-1","urgency":"not yet assigned"},"bullseye":{"status":"resolved","repositories":{"bullseye":"120.0.6099.224-1~deb11u1","bullseye-security":"120.0.6099.224-1~deb11u1"},"fixed_version":"89.0.4389.82-1","urgency":"not yet assigned"},"forky":{"status":"resolved","repositories":{"forky":"145.0.7632.159-1"},"fixed_version":"89.0.4389.82-1","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"146.0.7680.71-1"},"fixed_version":"89.0.4389.82-1","urgency":"not yet assigned"},"trixie":{"status":"resolved","repositories":{"trixie":"143.0.7499.169-1~deb13u1","trixie-security":"145.0.7632.159-1~deb13u1"},"fixed_version":"89.0.4389.82-1","urgency":"not yet assigned"}}},"CVE-2021-21190":{"description":"Uninitialized data in PDFium in Google Chrome prior to 89.0.4389.72 allowed a remote attacker to obtain potentially sensitive information from process memory via a crafted PDF file.","scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"143.0.7499.169-1~deb12u1","bookworm-security":"145.0.7632.159-1~deb12u1"},"fixed_version":"89.0.4389.82-1","urgency":"not yet assigned"},"bullseye":{"status":"resolved","repositories":{"bullseye":"120.0.6099.224-1~deb11u1","bullseye-security":"120.0.6099.224-1~deb11u1"},"fixed_version":"89.0.4389.82-1","urgency":"not yet assigned"},"forky":{"status":"resolved","repositories":{"forky":"145.0.7632.159-1"},"fixed_version":"89.0.4389.82-1","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"146.0.7680.71-1"},"fixed_version":"89.0.4389.82-1","urgency":"not yet assigned"},"trixie":{"status":"resolved","repositories":{"trixie":"143.0.7499.169-1~deb13u1","trixie-security":"145.0.7632.159-1~deb13u1"},"fixed_version":"89.0.4389.82-1","urgency":"not yet assigned"}}},"CVE-2021-21191":{"description":"Use after free in WebRTC in Google Chrome prior to 89.0.4389.90 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page.","scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"143.0.7499.169-1~deb12u1","bookworm-security":"145.0.7632.159-1~deb12u1"},"fixed_version":"89.0.4389.90-1","urgency":"not yet assigned"},"bullseye":{"status":"resolved","repositories":{"bullseye":"120.0.6099.224-1~deb11u1","bullseye-security":"120.0.6099.224-1~deb11u1"},"fixed_version":"89.0.4389.90-1","urgency":"not yet assigned"},"forky":{"status":"resolved","repositories":{"forky":"145.0.7632.159-1"},"fixed_version":"89.0.4389.90-1","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"146.0.7680.71-1"},"fixed_version":"89.0.4389.90-1","urgency":"not yet assigned"},"trixie":{"status":"resolved","repositories":{"trixie":"143.0.7499.169-1~deb13u1","trixie-security":"145.0.7632.159-1~deb13u1"},"fixed_version":"89.0.4389.90-1","urgency":"not yet assigned"}}},"CVE-2021-21192":{"description":"Heap buffer overflow in tab groups in Google Chrome prior to 89.0.4389.90 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page.","scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"143.0.7499.169-1~deb12u1","bookworm-security":"145.0.7632.159-1~deb12u1"},"fixed_version":"89.0.4389.90-1","urgency":"not yet assigned"},"bullseye":{"status":"resolved","repositories":{"bullseye":"120.0.6099.224-1~deb11u1","bullseye-security":"120.0.6099.224-1~deb11u1"},"fixed_version":"89.0.4389.90-1","urgency":"not yet assigned"},"forky":{"status":"resolved","repositories":{"forky":"145.0.7632.159-1"},"fixed_version":"89.0.4389.90-1","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"146.0.7680.71-1"},"fixed_version":"89.0.4389.90-1","urgency":"not yet assigned"},"trixie":{"status":"resolved","repositories":{"trixie":"143.0.7499.169-1~deb13u1","trixie-security":"145.0.7632.159-1~deb13u1"},"fixed_version":"89.0.4389.90-1","urgency":"not yet assigned"}}},"CVE-2021-21193":{"description":"Use after free in Blink in Google Chrome prior to 89.0.4389.90 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page.","debianbug":985142,"scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"143.0.7499.169-1~deb12u1","bookworm-security":"145.0.7632.159-1~deb12u1"},"fixed_version":"89.0.4389.90-1","urgency":"not yet assigned"},"bullseye":{"status":"resolved","repositories":{"bullseye":"120.0.6099.224-1~deb11u1","bullseye-security":"120.0.6099.224-1~deb11u1"},"fixed_version":"89.0.4389.90-1","urgency":"not yet assigned"},"forky":{"status":"resolved","repositories":{"forky":"145.0.7632.159-1"},"fixed_version":"89.0.4389.90-1","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"146.0.7680.71-1"},"fixed_version":"89.0.4389.90-1","urgency":"not yet assigned"},"trixie":{"status":"resolved","repositories":{"trixie":"143.0.7499.169-1~deb13u1","trixie-security":"145.0.7632.159-1~deb13u1"},"fixed_version":"89.0.4389.90-1","urgency":"not yet assigned"}}},"CVE-2021-21194":{"description":"Use after free in screen sharing in Google Chrome prior to 89.0.4389.114 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page.","scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"143.0.7499.169-1~deb12u1","bookworm-security":"145.0.7632.159-1~deb12u1"},"fixed_version":"89.0.4389.114-1","urgency":"not yet assigned"},"bullseye":{"status":"resolved","repositories":{"bullseye":"120.0.6099.224-1~deb11u1","bullseye-security":"120.0.6099.224-1~deb11u1"},"fixed_version":"89.0.4389.114-1","urgency":"not yet assigned"},"forky":{"status":"resolved","repositories":{"forky":"145.0.7632.159-1"},"fixed_version":"89.0.4389.114-1","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"146.0.7680.71-1"},"fixed_version":"89.0.4389.114-1","urgency":"not yet assigned"},"trixie":{"status":"resolved","repositories":{"trixie":"143.0.7499.169-1~deb13u1","trixie-security":"145.0.7632.159-1~deb13u1"},"fixed_version":"89.0.4389.114-1","urgency":"not yet assigned"}}},"CVE-2021-21195":{"description":"Use after free in V8 in Google Chrome prior to 89.0.4389.114 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page.","scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"143.0.7499.169-1~deb12u1","bookworm-security":"145.0.7632.159-1~deb12u1"},"fixed_version":"89.0.4389.114-1","urgency":"not yet assigned"},"bullseye":{"status":"resolved","repositories":{"bullseye":"120.0.6099.224-1~deb11u1","bullseye-security":"120.0.6099.224-1~deb11u1"},"fixed_version":"89.0.4389.114-1","urgency":"not yet assigned"},"forky":{"status":"resolved","repositories":{"forky":"145.0.7632.159-1"},"fixed_version":"89.0.4389.114-1","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"146.0.7680.71-1"},"fixed_version":"89.0.4389.114-1","urgency":"not yet assigned"},"trixie":{"status":"resolved","repositories":{"trixie":"143.0.7499.169-1~deb13u1","trixie-security":"145.0.7632.159-1~deb13u1"},"fixed_version":"89.0.4389.114-1","urgency":"not yet assigned"}}},"CVE-2021-21196":{"description":"Heap buffer overflow in TabStrip in Google Chrome on Windows prior to 89.0.4389.114 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page.","scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"143.0.7499.169-1~deb12u1","bookworm-security":"145.0.7632.159-1~deb12u1"},"fixed_version":"89.0.4389.114-1","urgency":"not yet assigned"},"bullseye":{"status":"resolved","repositories":{"bullseye":"120.0.6099.224-1~deb11u1","bullseye-security":"120.0.6099.224-1~deb11u1"},"fixed_version":"89.0.4389.114-1","urgency":"not yet assigned"},"forky":{"status":"resolved","repositories":{"forky":"145.0.7632.159-1"},"fixed_version":"89.0.4389.114-1","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"146.0.7680.71-1"},"fixed_version":"89.0.4389.114-1","urgency":"not yet assigned"},"trixie":{"status":"resolved","repositories":{"trixie":"143.0.7499.169-1~deb13u1","trixie-security":"145.0.7632.159-1~deb13u1"},"fixed_version":"89.0.4389.114-1","urgency":"not yet assigned"}}},"CVE-2021-21197":{"description":"Heap buffer overflow in TabStrip in Google Chrome prior to 89.0.4389.114 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page.","scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"143.0.7499.169-1~deb12u1","bookworm-security":"145.0.7632.159-1~deb12u1"},"fixed_version":"89.0.4389.114-1","urgency":"not yet assigned"},"bullseye":{"status":"resolved","repositories":{"bullseye":"120.0.6099.224-1~deb11u1","bullseye-security":"120.0.6099.224-1~deb11u1"},"fixed_version":"89.0.4389.114-1","urgency":"not yet assigned"},"forky":{"status":"resolved","repositories":{"forky":"145.0.7632.159-1"},"fixed_version":"89.0.4389.114-1","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"146.0.7680.71-1"},"fixed_version":"89.0.4389.114-1","urgency":"not yet assigned"},"trixie":{"status":"resolved","repositories":{"trixie":"143.0.7499.169-1~deb13u1","trixie-security":"145.0.7632.159-1~deb13u1"},"fixed_version":"89.0.4389.114-1","urgency":"not yet assigned"}}},"CVE-2021-21198":{"description":"Out of bounds read in IPC in Google Chrome prior to 89.0.4389.114 allowed a remote attacker who had compromised the renderer process to potentially perform a sandbox escape via a crafted HTML page.","scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"143.0.7499.169-1~deb12u1","bookworm-security":"145.0.7632.159-1~deb12u1"},"fixed_version":"89.0.4389.114-1","urgency":"not yet assigned"},"bullseye":{"status":"resolved","repositories":{"bullseye":"120.0.6099.224-1~deb11u1","bullseye-security":"120.0.6099.224-1~deb11u1"},"fixed_version":"89.0.4389.114-1","urgency":"not yet assigned"},"forky":{"status":"resolved","repositories":{"forky":"145.0.7632.159-1"},"fixed_version":"89.0.4389.114-1","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"146.0.7680.71-1"},"fixed_version":"89.0.4389.114-1","urgency":"not yet assigned"},"trixie":{"status":"resolved","repositories":{"trixie":"143.0.7499.169-1~deb13u1","trixie-security":"145.0.7632.159-1~deb13u1"},"fixed_version":"89.0.4389.114-1","urgency":"not yet assigned"}}},"CVE-2021-21199":{"description":"Use after free in Aura in Google Chrome on Linux prior to 89.0.4389.114 allowed a remote attacker who had compromised the renderer process to potentially exploit heap corruption via a crafted HTML page.","scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"143.0.7499.169-1~deb12u1","bookworm-security":"145.0.7632.159-1~deb12u1"},"fixed_version":"89.0.4389.114-1","urgency":"not yet assigned"},"bullseye":{"status":"resolved","repositories":{"bullseye":"120.0.6099.224-1~deb11u1","bullseye-security":"120.0.6099.224-1~deb11u1"},"fixed_version":"89.0.4389.114-1","urgency":"not yet assigned"},"forky":{"status":"resolved","repositories":{"forky":"145.0.7632.159-1"},"fixed_version":"89.0.4389.114-1","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"146.0.7680.71-1"},"fixed_version":"89.0.4389.114-1","urgency":"not yet assigned"},"trixie":{"status":"resolved","repositories":{"trixie":"143.0.7499.169-1~deb13u1","trixie-security":"145.0.7632.159-1~deb13u1"},"fixed_version":"89.0.4389.114-1","urgency":"not yet assigned"}}},"CVE-2021-21200":{"description":"Out of bounds read in WebUI Settings in Google Chrome prior to 89.0.4389.72 allowed a remote attacker to perform an out of bounds memory read via a crafted HTML page. (Chrome security severity: Low)","scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"143.0.7499.169-1~deb12u1","bookworm-security":"145.0.7632.159-1~deb12u1"},"fixed_version":"89.0.4389.82-1","urgency":"not yet assigned"},"bullseye":{"status":"resolved","repositories":{"bullseye":"120.0.6099.224-1~deb11u1","bullseye-security":"120.0.6099.224-1~deb11u1"},"fixed_version":"89.0.4389.82-1","urgency":"not yet assigned"},"forky":{"status":"resolved","repositories":{"forky":"145.0.7632.159-1"},"fixed_version":"89.0.4389.82-1","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"146.0.7680.71-1"},"fixed_version":"89.0.4389.82-1","urgency":"not yet assigned"},"trixie":{"status":"resolved","repositories":{"trixie":"143.0.7499.169-1~deb13u1","trixie-security":"145.0.7632.159-1~deb13u1"},"fixed_version":"89.0.4389.82-1","urgency":"not yet assigned"}}},"CVE-2021-21201":{"description":"Use after free in permissions in Google Chrome prior to 90.0.4430.72 allowed a remote attacker who had compromised the renderer process to potentially perform a sandbox escape via a crafted HTML page.","debianbug":987053,"scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"143.0.7499.169-1~deb12u1","bookworm-security":"145.0.7632.159-1~deb12u1"},"fixed_version":"90.0.4430.72-1","urgency":"not yet assigned"},"bullseye":{"status":"resolved","repositories":{"bullseye":"120.0.6099.224-1~deb11u1","bullseye-security":"120.0.6099.224-1~deb11u1"},"fixed_version":"90.0.4430.72-1","urgency":"not yet assigned"},"forky":{"status":"resolved","repositories":{"forky":"145.0.7632.159-1"},"fixed_version":"90.0.4430.72-1","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"146.0.7680.71-1"},"fixed_version":"90.0.4430.72-1","urgency":"not yet assigned"},"trixie":{"status":"resolved","repositories":{"trixie":"143.0.7499.169-1~deb13u1","trixie-security":"145.0.7632.159-1~deb13u1"},"fixed_version":"90.0.4430.72-1","urgency":"not yet assigned"}}},"CVE-2021-21202":{"description":"Use after free in extensions in Google Chrome prior to 90.0.4430.72 allowed an attacker who convinced a user to install a malicious extension to potentially perform a sandbox escape via a crafted Chrome Extension.","debianbug":987053,"scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"143.0.7499.169-1~deb12u1","bookworm-security":"145.0.7632.159-1~deb12u1"},"fixed_version":"90.0.4430.72-1","urgency":"not yet assigned"},"bullseye":{"status":"resolved","repositories":{"bullseye":"120.0.6099.224-1~deb11u1","bullseye-security":"120.0.6099.224-1~deb11u1"},"fixed_version":"90.0.4430.72-1","urgency":"not yet assigned"},"forky":{"status":"resolved","repositories":{"forky":"145.0.7632.159-1"},"fixed_version":"90.0.4430.72-1","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"146.0.7680.71-1"},"fixed_version":"90.0.4430.72-1","urgency":"not yet assigned"},"trixie":{"status":"resolved","repositories":{"trixie":"143.0.7499.169-1~deb13u1","trixie-security":"145.0.7632.159-1~deb13u1"},"fixed_version":"90.0.4430.72-1","urgency":"not yet assigned"}}},"CVE-2021-21203":{"description":"Use after free in Blink in Google Chrome prior to 90.0.4430.72 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page.","debianbug":987053,"scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"143.0.7499.169-1~deb12u1","bookworm-security":"145.0.7632.159-1~deb12u1"},"fixed_version":"90.0.4430.72-1","urgency":"not yet assigned"},"bullseye":{"status":"resolved","repositories":{"bullseye":"120.0.6099.224-1~deb11u1","bullseye-security":"120.0.6099.224-1~deb11u1"},"fixed_version":"90.0.4430.72-1","urgency":"not yet assigned"},"forky":{"status":"resolved","repositories":{"forky":"145.0.7632.159-1"},"fixed_version":"90.0.4430.72-1","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"146.0.7680.71-1"},"fixed_version":"90.0.4430.72-1","urgency":"not yet assigned"},"trixie":{"status":"resolved","repositories":{"trixie":"143.0.7499.169-1~deb13u1","trixie-security":"145.0.7632.159-1~deb13u1"},"fixed_version":"90.0.4430.72-1","urgency":"not yet assigned"}}},"CVE-2021-21204":{"description":"Use after free in Blink in Google Chrome on OS X prior to 90.0.4430.72 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page.","debianbug":987053,"scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"143.0.7499.169-1~deb12u1","bookworm-security":"145.0.7632.159-1~deb12u1"},"fixed_version":"90.0.4430.72-1","urgency":"not yet assigned"},"bullseye":{"status":"resolved","repositories":{"bullseye":"120.0.6099.224-1~deb11u1","bullseye-security":"120.0.6099.224-1~deb11u1"},"fixed_version":"90.0.4430.72-1","urgency":"not yet assigned"},"forky":{"status":"resolved","repositories":{"forky":"145.0.7632.159-1"},"fixed_version":"90.0.4430.72-1","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"146.0.7680.71-1"},"fixed_version":"90.0.4430.72-1","urgency":"not yet assigned"},"trixie":{"status":"resolved","repositories":{"trixie":"143.0.7499.169-1~deb13u1","trixie-security":"145.0.7632.159-1~deb13u1"},"fixed_version":"90.0.4430.72-1","urgency":"not yet assigned"}}},"CVE-2021-21205":{"description":"Insufficient policy enforcement in navigation in Google Chrome on iOS prior to 90.0.4430.72 allowed a remote attacker to bypass navigation restrictions via a crafted HTML page.","debianbug":987053,"scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"143.0.7499.169-1~deb12u1","bookworm-security":"145.0.7632.159-1~deb12u1"},"fixed_version":"90.0.4430.72-1","urgency":"not yet assigned"},"bullseye":{"status":"resolved","repositories":{"bullseye":"120.0.6099.224-1~deb11u1","bullseye-security":"120.0.6099.224-1~deb11u1"},"fixed_version":"90.0.4430.72-1","urgency":"not yet assigned"},"forky":{"status":"resolved","repositories":{"forky":"145.0.7632.159-1"},"fixed_version":"90.0.4430.72-1","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"146.0.7680.71-1"},"fixed_version":"90.0.4430.72-1","urgency":"not yet assigned"},"trixie":{"status":"resolved","repositories":{"trixie":"143.0.7499.169-1~deb13u1","trixie-security":"145.0.7632.159-1~deb13u1"},"fixed_version":"90.0.4430.72-1","urgency":"not yet assigned"}}},"CVE-2021-21206":{"description":"Use after free in Blink in Google Chrome prior to 89.0.4389.128 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page.","debianbug":987053,"scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"143.0.7499.169-1~deb12u1","bookworm-security":"145.0.7632.159-1~deb12u1"},"fixed_version":"90.0.4430.72-1","urgency":"not yet assigned"},"bullseye":{"status":"resolved","repositories":{"bullseye":"120.0.6099.224-1~deb11u1","bullseye-security":"120.0.6099.224-1~deb11u1"},"fixed_version":"90.0.4430.72-1","urgency":"not yet assigned"},"forky":{"status":"resolved","repositories":{"forky":"145.0.7632.159-1"},"fixed_version":"90.0.4430.72-1","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"146.0.7680.71-1"},"fixed_version":"90.0.4430.72-1","urgency":"not yet assigned"},"trixie":{"status":"resolved","repositories":{"trixie":"143.0.7499.169-1~deb13u1","trixie-security":"145.0.7632.159-1~deb13u1"},"fixed_version":"90.0.4430.72-1","urgency":"not yet assigned"}}},"CVE-2021-21207":{"description":"Use after free in IndexedDB in Google Chrome prior to 90.0.4430.72 allowed an attacker who convinced a user to install a malicious extension to potentially perform a sandbox escape via a crafted Chrome Extension.","debianbug":987053,"scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"143.0.7499.169-1~deb12u1","bookworm-security":"145.0.7632.159-1~deb12u1"},"fixed_version":"90.0.4430.72-1","urgency":"not yet assigned"},"bullseye":{"status":"resolved","repositories":{"bullseye":"120.0.6099.224-1~deb11u1","bullseye-security":"120.0.6099.224-1~deb11u1"},"fixed_version":"90.0.4430.72-1","urgency":"not yet assigned"},"forky":{"status":"resolved","repositories":{"forky":"145.0.7632.159-1"},"fixed_version":"90.0.4430.72-1","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"146.0.7680.71-1"},"fixed_version":"90.0.4430.72-1","urgency":"not yet assigned"},"trixie":{"status":"resolved","repositories":{"trixie":"143.0.7499.169-1~deb13u1","trixie-security":"145.0.7632.159-1~deb13u1"},"fixed_version":"90.0.4430.72-1","urgency":"not yet assigned"}}},"CVE-2021-21208":{"description":"Insufficient data validation in QR scanner in Google Chrome on iOS prior to 90.0.4430.72 allowed an attacker displaying a QR code to perform domain spoofing via a crafted QR code.","debianbug":987053,"scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"143.0.7499.169-1~deb12u1","bookworm-security":"145.0.7632.159-1~deb12u1"},"fixed_version":"90.0.4430.72-1","urgency":"not yet assigned"},"bullseye":{"status":"resolved","repositories":{"bullseye":"120.0.6099.224-1~deb11u1","bullseye-security":"120.0.6099.224-1~deb11u1"},"fixed_version":"90.0.4430.72-1","urgency":"not yet assigned"},"forky":{"status":"resolved","repositories":{"forky":"145.0.7632.159-1"},"fixed_version":"90.0.4430.72-1","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"146.0.7680.71-1"},"fixed_version":"90.0.4430.72-1","urgency":"not yet assigned"},"trixie":{"status":"resolved","repositories":{"trixie":"143.0.7499.169-1~deb13u1","trixie-security":"145.0.7632.159-1~deb13u1"},"fixed_version":"90.0.4430.72-1","urgency":"not yet assigned"}}},"CVE-2021-21209":{"description":"Inappropriate implementation in storage in Google Chrome prior to 90.0.4430.72 allowed a remote attacker to leak cross-origin data via a crafted HTML page.","debianbug":987053,"scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"143.0.7499.169-1~deb12u1","bookworm-security":"145.0.7632.159-1~deb12u1"},"fixed_version":"90.0.4430.72-1","urgency":"not yet assigned"},"bullseye":{"status":"resolved","repositories":{"bullseye":"120.0.6099.224-1~deb11u1","bullseye-security":"120.0.6099.224-1~deb11u1"},"fixed_version":"90.0.4430.72-1","urgency":"not yet assigned"},"forky":{"status":"resolved","repositories":{"forky":"145.0.7632.159-1"},"fixed_version":"90.0.4430.72-1","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"146.0.7680.71-1"},"fixed_version":"90.0.4430.72-1","urgency":"not yet assigned"},"trixie":{"status":"resolved","repositories":{"trixie":"143.0.7499.169-1~deb13u1","trixie-security":"145.0.7632.159-1~deb13u1"},"fixed_version":"90.0.4430.72-1","urgency":"not yet assigned"}}},"CVE-2021-21210":{"description":"Inappropriate implementation in Network in Google Chrome prior to 90.0.4430.72 allowed a remote attacker to potentially access local UDP ports via a crafted HTML page.","debianbug":987053,"scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"143.0.7499.169-1~deb12u1","bookworm-security":"145.0.7632.159-1~deb12u1"},"fixed_version":"90.0.4430.72-1","urgency":"not yet assigned"},"bullseye":{"status":"resolved","repositories":{"bullseye":"120.0.6099.224-1~deb11u1","bullseye-security":"120.0.6099.224-1~deb11u1"},"fixed_version":"90.0.4430.72-1","urgency":"not yet assigned"},"forky":{"status":"resolved","repositories":{"forky":"145.0.7632.159-1"},"fixed_version":"90.0.4430.72-1","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"146.0.7680.71-1"},"fixed_version":"90.0.4430.72-1","urgency":"not yet assigned"},"trixie":{"status":"resolved","repositories":{"trixie":"143.0.7499.169-1~deb13u1","trixie-security":"145.0.7632.159-1~deb13u1"},"fixed_version":"90.0.4430.72-1","urgency":"not yet assigned"}}},"CVE-2021-21211":{"description":"Inappropriate implementation in Navigation in Google Chrome on iOS prior to 90.0.4430.72 allowed a remote attacker to leak cross-origin data via a crafted HTML page.","debianbug":987053,"scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"143.0.7499.169-1~deb12u1","bookworm-security":"145.0.7632.159-1~deb12u1"},"fixed_version":"90.0.4430.72-1","urgency":"not yet assigned"},"bullseye":{"status":"resolved","repositories":{"bullseye":"120.0.6099.224-1~deb11u1","bullseye-security":"120.0.6099.224-1~deb11u1"},"fixed_version":"90.0.4430.72-1","urgency":"not yet assigned"},"forky":{"status":"resolved","repositories":{"forky":"145.0.7632.159-1"},"fixed_version":"90.0.4430.72-1","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"146.0.7680.71-1"},"fixed_version":"90.0.4430.72-1","urgency":"not yet assigned"},"trixie":{"status":"resolved","repositories":{"trixie":"143.0.7499.169-1~deb13u1","trixie-security":"145.0.7632.159-1~deb13u1"},"fixed_version":"90.0.4430.72-1","urgency":"not yet assigned"}}},"CVE-2021-21212":{"description":"Incorrect security UI in Network Config UI in Google Chrome on ChromeOS prior to 90.0.4430.72 allowed a remote attacker to potentially compromise WiFi connection security via a malicious WAP.","debianbug":987053,"scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"143.0.7499.169-1~deb12u1","bookworm-security":"145.0.7632.159-1~deb12u1"},"fixed_version":"90.0.4430.72-1","urgency":"not yet assigned"},"bullseye":{"status":"resolved","repositories":{"bullseye":"120.0.6099.224-1~deb11u1","bullseye-security":"120.0.6099.224-1~deb11u1"},"fixed_version":"90.0.4430.72-1","urgency":"not yet assigned"},"forky":{"status":"resolved","repositories":{"forky":"145.0.7632.159-1"},"fixed_version":"90.0.4430.72-1","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"146.0.7680.71-1"},"fixed_version":"90.0.4430.72-1","urgency":"not yet assigned"},"trixie":{"status":"resolved","repositories":{"trixie":"143.0.7499.169-1~deb13u1","trixie-security":"145.0.7632.159-1~deb13u1"},"fixed_version":"90.0.4430.72-1","urgency":"not yet assigned"}}},"CVE-2021-21213":{"description":"Use after free in WebMIDI in Google Chrome prior to 90.0.4430.72 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page.","debianbug":987053,"scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"143.0.7499.169-1~deb12u1","bookworm-security":"145.0.7632.159-1~deb12u1"},"fixed_version":"90.0.4430.72-1","urgency":"not yet assigned"},"bullseye":{"status":"resolved","repositories":{"bullseye":"120.0.6099.224-1~deb11u1","bullseye-security":"120.0.6099.224-1~deb11u1"},"fixed_version":"90.0.4430.72-1","urgency":"not yet assigned"},"forky":{"status":"resolved","repositories":{"forky":"145.0.7632.159-1"},"fixed_version":"90.0.4430.72-1","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"146.0.7680.71-1"},"fixed_version":"90.0.4430.72-1","urgency":"not yet assigned"},"trixie":{"status":"resolved","repositories":{"trixie":"143.0.7499.169-1~deb13u1","trixie-security":"145.0.7632.159-1~deb13u1"},"fixed_version":"90.0.4430.72-1","urgency":"not yet assigned"}}},"CVE-2021-21214":{"description":"Use after free in Network API in Google Chrome prior to 90.0.4430.72 allowed a remote attacker to potentially exploit heap corruption via a crafted Chrome Extension.","debianbug":987053,"scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"143.0.7499.169-1~deb12u1","bookworm-security":"145.0.7632.159-1~deb12u1"},"fixed_version":"90.0.4430.72-1","urgency":"not yet assigned"},"bullseye":{"status":"resolved","repositories":{"bullseye":"120.0.6099.224-1~deb11u1","bullseye-security":"120.0.6099.224-1~deb11u1"},"fixed_version":"90.0.4430.72-1","urgency":"not yet assigned"},"forky":{"status":"resolved","repositories":{"forky":"145.0.7632.159-1"},"fixed_version":"90.0.4430.72-1","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"146.0.7680.71-1"},"fixed_version":"90.0.4430.72-1","urgency":"not yet assigned"},"trixie":{"status":"resolved","repositories":{"trixie":"143.0.7499.169-1~deb13u1","trixie-security":"145.0.7632.159-1~deb13u1"},"fixed_version":"90.0.4430.72-1","urgency":"not yet assigned"}}},"CVE-2021-21215":{"description":"Inappropriate implementation in Autofill in Google Chrome prior to 90.0.4430.72 allowed a remote attacker to spoof security UI via a crafted HTML page.","debianbug":987053,"scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"143.0.7499.169-1~deb12u1","bookworm-security":"145.0.7632.159-1~deb12u1"},"fixed_version":"90.0.4430.72-1","urgency":"not yet assigned"},"bullseye":{"status":"resolved","repositories":{"bullseye":"120.0.6099.224-1~deb11u1","bullseye-security":"120.0.6099.224-1~deb11u1"},"fixed_version":"90.0.4430.72-1","urgency":"not yet assigned"},"forky":{"status":"resolved","repositories":{"forky":"145.0.7632.159-1"},"fixed_version":"90.0.4430.72-1","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"146.0.7680.71-1"},"fixed_version":"90.0.4430.72-1","urgency":"not yet assigned"},"trixie":{"status":"resolved","repositories":{"trixie":"143.0.7499.169-1~deb13u1","trixie-security":"145.0.7632.159-1~deb13u1"},"fixed_version":"90.0.4430.72-1","urgency":"not yet assigned"}}},"CVE-2021-21216":{"description":"Inappropriate implementation in Autofill in Google Chrome prior to 90.0.4430.72 allowed a remote attacker to spoof security UI via a crafted HTML page.","debianbug":987053,"scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"143.0.7499.169-1~deb12u1","bookworm-security":"145.0.7632.159-1~deb12u1"},"fixed_version":"90.0.4430.72-1","urgency":"not yet assigned"},"bullseye":{"status":"resolved","repositories":{"bullseye":"120.0.6099.224-1~deb11u1","bullseye-security":"120.0.6099.224-1~deb11u1"},"fixed_version":"90.0.4430.72-1","urgency":"not yet assigned"},"forky":{"status":"resolved","repositories":{"forky":"145.0.7632.159-1"},"fixed_version":"90.0.4430.72-1","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"146.0.7680.71-1"},"fixed_version":"90.0.4430.72-1","urgency":"not yet assigned"},"trixie":{"status":"resolved","repositories":{"trixie":"143.0.7499.169-1~deb13u1","trixie-security":"145.0.7632.159-1~deb13u1"},"fixed_version":"90.0.4430.72-1","urgency":"not yet assigned"}}},"CVE-2021-21217":{"description":"Uninitialized data in PDFium in Google Chrome prior to 90.0.4430.72 allowed a remote attacker to obtain potentially sensitive information from process memory via a crafted PDF file.","debianbug":987053,"scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"143.0.7499.169-1~deb12u1","bookworm-security":"145.0.7632.159-1~deb12u1"},"fixed_version":"90.0.4430.72-1","urgency":"not yet assigned"},"bullseye":{"status":"resolved","repositories":{"bullseye":"120.0.6099.224-1~deb11u1","bullseye-security":"120.0.6099.224-1~deb11u1"},"fixed_version":"90.0.4430.72-1","urgency":"not yet assigned"},"forky":{"status":"resolved","repositories":{"forky":"145.0.7632.159-1"},"fixed_version":"90.0.4430.72-1","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"146.0.7680.71-1"},"fixed_version":"90.0.4430.72-1","urgency":"not yet assigned"},"trixie":{"status":"resolved","repositories":{"trixie":"143.0.7499.169-1~deb13u1","trixie-security":"145.0.7632.159-1~deb13u1"},"fixed_version":"90.0.4430.72-1","urgency":"not yet assigned"}}},"CVE-2021-21218":{"description":"Uninitialized data in PDFium in Google Chrome prior to 90.0.4430.72 allowed a remote attacker to obtain potentially sensitive information from process memory via a crafted PDF file.","debianbug":987053,"scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"143.0.7499.169-1~deb12u1","bookworm-security":"145.0.7632.159-1~deb12u1"},"fixed_version":"90.0.4430.72-1","urgency":"not yet assigned"},"bullseye":{"status":"resolved","repositories":{"bullseye":"120.0.6099.224-1~deb11u1","bullseye-security":"120.0.6099.224-1~deb11u1"},"fixed_version":"90.0.4430.72-1","urgency":"not yet assigned"},"forky":{"status":"resolved","repositories":{"forky":"145.0.7632.159-1"},"fixed_version":"90.0.4430.72-1","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"146.0.7680.71-1"},"fixed_version":"90.0.4430.72-1","urgency":"not yet assigned"},"trixie":{"status":"resolved","repositories":{"trixie":"143.0.7499.169-1~deb13u1","trixie-security":"145.0.7632.159-1~deb13u1"},"fixed_version":"90.0.4430.72-1","urgency":"not yet assigned"}}},"CVE-2021-21219":{"description":"Uninitialized data in PDFium in Google Chrome prior to 90.0.4430.72 allowed a remote attacker to obtain potentially sensitive information from process memory via a crafted PDF file.","debianbug":987053,"scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"143.0.7499.169-1~deb12u1","bookworm-security":"145.0.7632.159-1~deb12u1"},"fixed_version":"90.0.4430.72-1","urgency":"not yet assigned"},"bullseye":{"status":"resolved","repositories":{"bullseye":"120.0.6099.224-1~deb11u1","bullseye-security":"120.0.6099.224-1~deb11u1"},"fixed_version":"90.0.4430.72-1","urgency":"not yet assigned"},"forky":{"status":"resolved","repositories":{"forky":"145.0.7632.159-1"},"fixed_version":"90.0.4430.72-1","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"146.0.7680.71-1"},"fixed_version":"90.0.4430.72-1","urgency":"not yet assigned"},"trixie":{"status":"resolved","repositories":{"trixie":"143.0.7499.169-1~deb13u1","trixie-security":"145.0.7632.159-1~deb13u1"},"fixed_version":"90.0.4430.72-1","urgency":"not yet assigned"}}},"CVE-2021-21220":{"description":"Insufficient validation of untrusted input in V8 in Google Chrome prior to 89.0.4389.128 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page.","debianbug":987053,"scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"143.0.7499.169-1~deb12u1","bookworm-security":"145.0.7632.159-1~deb12u1"},"fixed_version":"90.0.4430.72-1","urgency":"not yet assigned"},"bullseye":{"status":"resolved","repositories":{"bullseye":"120.0.6099.224-1~deb11u1","bullseye-security":"120.0.6099.224-1~deb11u1"},"fixed_version":"90.0.4430.72-1","urgency":"not yet assigned"},"forky":{"status":"resolved","repositories":{"forky":"145.0.7632.159-1"},"fixed_version":"90.0.4430.72-1","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"146.0.7680.71-1"},"fixed_version":"90.0.4430.72-1","urgency":"not yet assigned"},"trixie":{"status":"resolved","repositories":{"trixie":"143.0.7499.169-1~deb13u1","trixie-security":"145.0.7632.159-1~deb13u1"},"fixed_version":"90.0.4430.72-1","urgency":"not yet assigned"}}},"CVE-2021-21221":{"description":"Insufficient validation of untrusted input in Mojo in Google Chrome prior to 90.0.4430.72 allowed a remote attacker who had compromised the renderer process to leak cross-origin data via a crafted HTML page.","debianbug":987053,"scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"143.0.7499.169-1~deb12u1","bookworm-security":"145.0.7632.159-1~deb12u1"},"fixed_version":"90.0.4430.72-1","urgency":"not yet assigned"},"bullseye":{"status":"resolved","repositories":{"bullseye":"120.0.6099.224-1~deb11u1","bullseye-security":"120.0.6099.224-1~deb11u1"},"fixed_version":"90.0.4430.72-1","urgency":"not yet assigned"},"forky":{"status":"resolved","repositories":{"forky":"145.0.7632.159-1"},"fixed_version":"90.0.4430.72-1","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"146.0.7680.71-1"},"fixed_version":"90.0.4430.72-1","urgency":"not yet assigned"},"trixie":{"status":"resolved","repositories":{"trixie":"143.0.7499.169-1~deb13u1","trixie-security":"145.0.7632.159-1~deb13u1"},"fixed_version":"90.0.4430.72-1","urgency":"not yet assigned"}}},"CVE-2021-21222":{"description":"Heap buffer overflow in V8 in Google Chrome prior to 90.0.4430.85 allowed a remote attacker who had compromised the renderer process to bypass site isolation via a crafted HTML page.","debianbug":987358,"scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"143.0.7499.169-1~deb12u1","bookworm-security":"145.0.7632.159-1~deb12u1"},"fixed_version":"90.0.4430.85-1","urgency":"not yet assigned"},"bullseye":{"status":"resolved","repositories":{"bullseye":"120.0.6099.224-1~deb11u1","bullseye-security":"120.0.6099.224-1~deb11u1"},"fixed_version":"90.0.4430.85-1","urgency":"not yet assigned"},"forky":{"status":"resolved","repositories":{"forky":"145.0.7632.159-1"},"fixed_version":"90.0.4430.85-1","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"146.0.7680.71-1"},"fixed_version":"90.0.4430.85-1","urgency":"not yet assigned"},"trixie":{"status":"resolved","repositories":{"trixie":"143.0.7499.169-1~deb13u1","trixie-security":"145.0.7632.159-1~deb13u1"},"fixed_version":"90.0.4430.85-1","urgency":"not yet assigned"}}},"CVE-2021-21223":{"description":"Integer overflow in Mojo in Google Chrome prior to 90.0.4430.85 allowed a remote attacker who had compromised the renderer process to potentially perform a sandbox escape via a crafted HTML page.","debianbug":987358,"scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"143.0.7499.169-1~deb12u1","bookworm-security":"145.0.7632.159-1~deb12u1"},"fixed_version":"90.0.4430.85-1","urgency":"not yet assigned"},"bullseye":{"status":"resolved","repositories":{"bullseye":"120.0.6099.224-1~deb11u1","bullseye-security":"120.0.6099.224-1~deb11u1"},"fixed_version":"90.0.4430.85-1","urgency":"not yet assigned"},"forky":{"status":"resolved","repositories":{"forky":"145.0.7632.159-1"},"fixed_version":"90.0.4430.85-1","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"146.0.7680.71-1"},"fixed_version":"90.0.4430.85-1","urgency":"not yet assigned"},"trixie":{"status":"resolved","repositories":{"trixie":"143.0.7499.169-1~deb13u1","trixie-security":"145.0.7632.159-1~deb13u1"},"fixed_version":"90.0.4430.85-1","urgency":"not yet assigned"}}},"CVE-2021-21224":{"description":"Type confusion in V8 in Google Chrome prior to 90.0.4430.85 allowed a remote attacker to execute arbitrary code inside a sandbox via a crafted HTML page.","debianbug":987358,"scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"143.0.7499.169-1~deb12u1","bookworm-security":"145.0.7632.159-1~deb12u1"},"fixed_version":"90.0.4430.85-1","urgency":"not yet assigned"},"bullseye":{"status":"resolved","repositories":{"bullseye":"120.0.6099.224-1~deb11u1","bullseye-security":"120.0.6099.224-1~deb11u1"},"fixed_version":"90.0.4430.85-1","urgency":"not yet assigned"},"forky":{"status":"resolved","repositories":{"forky":"145.0.7632.159-1"},"fixed_version":"90.0.4430.85-1","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"146.0.7680.71-1"},"fixed_version":"90.0.4430.85-1","urgency":"not yet assigned"},"trixie":{"status":"resolved","repositories":{"trixie":"143.0.7499.169-1~deb13u1","trixie-security":"145.0.7632.159-1~deb13u1"},"fixed_version":"90.0.4430.85-1","urgency":"not yet assigned"}}},"CVE-2021-21225":{"description":"Out of bounds memory access in V8 in Google Chrome prior to 90.0.4430.85 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page.","debianbug":987358,"scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"143.0.7499.169-1~deb12u1","bookworm-security":"145.0.7632.159-1~deb12u1"},"fixed_version":"90.0.4430.85-1","urgency":"not yet assigned"},"bullseye":{"status":"resolved","repositories":{"bullseye":"120.0.6099.224-1~deb11u1","bullseye-security":"120.0.6099.224-1~deb11u1"},"fixed_version":"90.0.4430.85-1","urgency":"not yet assigned"},"forky":{"status":"resolved","repositories":{"forky":"145.0.7632.159-1"},"fixed_version":"90.0.4430.85-1","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"146.0.7680.71-1"},"fixed_version":"90.0.4430.85-1","urgency":"not yet assigned"},"trixie":{"status":"resolved","repositories":{"trixie":"143.0.7499.169-1~deb13u1","trixie-security":"145.0.7632.159-1~deb13u1"},"fixed_version":"90.0.4430.85-1","urgency":"not yet assigned"}}},"CVE-2021-21226":{"description":"Use after free in navigation in Google Chrome prior to 90.0.4430.85 allowed a remote attacker who had compromised the renderer process to potentially perform a sandbox escape via a crafted HTML page.","debianbug":987358,"scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"143.0.7499.169-1~deb12u1","bookworm-security":"145.0.7632.159-1~deb12u1"},"fixed_version":"90.0.4430.85-1","urgency":"not yet assigned"},"bullseye":{"status":"resolved","repositories":{"bullseye":"120.0.6099.224-1~deb11u1","bullseye-security":"120.0.6099.224-1~deb11u1"},"fixed_version":"90.0.4430.85-1","urgency":"not yet assigned"},"forky":{"status":"resolved","repositories":{"forky":"145.0.7632.159-1"},"fixed_version":"90.0.4430.85-1","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"146.0.7680.71-1"},"fixed_version":"90.0.4430.85-1","urgency":"not yet assigned"},"trixie":{"status":"resolved","repositories":{"trixie":"143.0.7499.169-1~deb13u1","trixie-security":"145.0.7632.159-1~deb13u1"},"fixed_version":"90.0.4430.85-1","urgency":"not yet assigned"}}},"CVE-2021-21227":{"description":"Insufficient data validation in V8 in Google Chrome prior to 90.0.4430.93 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page.","debianbug":987715,"scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"143.0.7499.169-1~deb12u1","bookworm-security":"145.0.7632.159-1~deb12u1"},"fixed_version":"90.0.4430.93-1","urgency":"not yet assigned"},"bullseye":{"status":"resolved","repositories":{"bullseye":"120.0.6099.224-1~deb11u1","bullseye-security":"120.0.6099.224-1~deb11u1"},"fixed_version":"90.0.4430.93-1","urgency":"not yet assigned"},"forky":{"status":"resolved","repositories":{"forky":"145.0.7632.159-1"},"fixed_version":"90.0.4430.93-1","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"146.0.7680.71-1"},"fixed_version":"90.0.4430.93-1","urgency":"not yet assigned"},"trixie":{"status":"resolved","repositories":{"trixie":"143.0.7499.169-1~deb13u1","trixie-security":"145.0.7632.159-1~deb13u1"},"fixed_version":"90.0.4430.93-1","urgency":"not yet assigned"}}},"CVE-2021-21228":{"description":"Insufficient policy enforcement in extensions in Google Chrome prior to 90.0.4430.93 allowed an attacker who convinced a user to install a malicious extension to bypass navigation restrictions via a crafted Chrome Extension.","debianbug":987715,"scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"143.0.7499.169-1~deb12u1","bookworm-security":"145.0.7632.159-1~deb12u1"},"fixed_version":"90.0.4430.93-1","urgency":"not yet assigned"},"bullseye":{"status":"resolved","repositories":{"bullseye":"120.0.6099.224-1~deb11u1","bullseye-security":"120.0.6099.224-1~deb11u1"},"fixed_version":"90.0.4430.93-1","urgency":"not yet assigned"},"forky":{"status":"resolved","repositories":{"forky":"145.0.7632.159-1"},"fixed_version":"90.0.4430.93-1","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"146.0.7680.71-1"},"fixed_version":"90.0.4430.93-1","urgency":"not yet assigned"},"trixie":{"status":"resolved","repositories":{"trixie":"143.0.7499.169-1~deb13u1","trixie-security":"145.0.7632.159-1~deb13u1"},"fixed_version":"90.0.4430.93-1","urgency":"not yet assigned"}}},"CVE-2021-21229":{"description":"Incorrect security UI in downloads in Google Chrome on Android prior to 90.0.4430.93 allowed a remote attacker to perform domain spoofing via a crafted HTML page.","debianbug":987715,"scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"143.0.7499.169-1~deb12u1","bookworm-security":"145.0.7632.159-1~deb12u1"},"fixed_version":"90.0.4430.93-1","urgency":"not yet assigned"},"bullseye":{"status":"resolved","repositories":{"bullseye":"120.0.6099.224-1~deb11u1","bullseye-security":"120.0.6099.224-1~deb11u1"},"fixed_version":"90.0.4430.93-1","urgency":"not yet assigned"},"forky":{"status":"resolved","repositories":{"forky":"145.0.7632.159-1"},"fixed_version":"90.0.4430.93-1","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"146.0.7680.71-1"},"fixed_version":"90.0.4430.93-1","urgency":"not yet assigned"},"trixie":{"status":"resolved","repositories":{"trixie":"143.0.7499.169-1~deb13u1","trixie-security":"145.0.7632.159-1~deb13u1"},"fixed_version":"90.0.4430.93-1","urgency":"not yet assigned"}}},"CVE-2021-21230":{"description":"Type confusion in V8 in Google Chrome prior to 90.0.4430.93 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page.","debianbug":987715,"scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"143.0.7499.169-1~deb12u1","bookworm-security":"145.0.7632.159-1~deb12u1"},"fixed_version":"90.0.4430.93-1","urgency":"not yet assigned"},"bullseye":{"status":"resolved","repositories":{"bullseye":"120.0.6099.224-1~deb11u1","bullseye-security":"120.0.6099.224-1~deb11u1"},"fixed_version":"90.0.4430.93-1","urgency":"not yet assigned"},"forky":{"status":"resolved","repositories":{"forky":"145.0.7632.159-1"},"fixed_version":"90.0.4430.93-1","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"146.0.7680.71-1"},"fixed_version":"90.0.4430.93-1","urgency":"not yet assigned"},"trixie":{"status":"resolved","repositories":{"trixie":"143.0.7499.169-1~deb13u1","trixie-security":"145.0.7632.159-1~deb13u1"},"fixed_version":"90.0.4430.93-1","urgency":"not yet assigned"}}},"CVE-2021-21231":{"description":"Insufficient data validation in V8 in Google Chrome prior to 90.0.4430.93 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page.","debianbug":987715,"scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"143.0.7499.169-1~deb12u1","bookworm-security":"145.0.7632.159-1~deb12u1"},"fixed_version":"90.0.4430.93-1","urgency":"not yet assigned"},"bullseye":{"status":"resolved","repositories":{"bullseye":"120.0.6099.224-1~deb11u1","bullseye-security":"120.0.6099.224-1~deb11u1"},"fixed_version":"90.0.4430.93-1","urgency":"not yet assigned"},"forky":{"status":"resolved","repositories":{"forky":"145.0.7632.159-1"},"fixed_version":"90.0.4430.93-1","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"146.0.7680.71-1"},"fixed_version":"90.0.4430.93-1","urgency":"not yet assigned"},"trixie":{"status":"resolved","repositories":{"trixie":"143.0.7499.169-1~deb13u1","trixie-security":"145.0.7632.159-1~deb13u1"},"fixed_version":"90.0.4430.93-1","urgency":"not yet assigned"}}},"CVE-2021-21232":{"description":"Use after free in Dev Tools in Google Chrome prior to 90.0.4430.93 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page.","debianbug":987715,"scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"143.0.7499.169-1~deb12u1","bookworm-security":"145.0.7632.159-1~deb12u1"},"fixed_version":"90.0.4430.93-1","urgency":"not yet assigned"},"bullseye":{"status":"resolved","repositories":{"bullseye":"120.0.6099.224-1~deb11u1","bullseye-security":"120.0.6099.224-1~deb11u1"},"fixed_version":"90.0.4430.93-1","urgency":"not yet assigned"},"forky":{"status":"resolved","repositories":{"forky":"145.0.7632.159-1"},"fixed_version":"90.0.4430.93-1","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"146.0.7680.71-1"},"fixed_version":"90.0.4430.93-1","urgency":"not yet assigned"},"trixie":{"status":"resolved","repositories":{"trixie":"143.0.7499.169-1~deb13u1","trixie-security":"145.0.7632.159-1~deb13u1"},"fixed_version":"90.0.4430.93-1","urgency":"not yet assigned"}}},"CVE-2021-21233":{"description":"Heap buffer overflow in ANGLE in Google Chrome on Windows prior to 90.0.4430.93 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page.","debianbug":987715,"scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"143.0.7499.169-1~deb12u1","bookworm-security":"145.0.7632.159-1~deb12u1"},"fixed_version":"90.0.4430.93-1","urgency":"not yet assigned"},"bullseye":{"status":"resolved","repositories":{"bullseye":"120.0.6099.224-1~deb11u1","bullseye-security":"120.0.6099.224-1~deb11u1"},"fixed_version":"90.0.4430.93-1","urgency":"not yet assigned"},"forky":{"status":"resolved","repositories":{"forky":"145.0.7632.159-1"},"fixed_version":"90.0.4430.93-1","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"146.0.7680.71-1"},"fixed_version":"90.0.4430.93-1","urgency":"not yet assigned"},"trixie":{"status":"resolved","repositories":{"trixie":"143.0.7499.169-1~deb13u1","trixie-security":"145.0.7632.159-1~deb13u1"},"fixed_version":"90.0.4430.93-1","urgency":"not yet assigned"}}},"CVE-2021-30506":{"description":"Incorrect security UI in Web App Installs in Google Chrome on Android prior to 90.0.4430.212 allowed an attacker who convinced a user to install a web application to inject scripts or HTML into a privileged page via a crafted HTML page.","scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"143.0.7499.169-1~deb12u1","bookworm-security":"145.0.7632.159-1~deb12u1"},"fixed_version":"90.0.4430.212-1","urgency":"not yet assigned"},"bullseye":{"status":"resolved","repositories":{"bullseye":"120.0.6099.224-1~deb11u1","bullseye-security":"120.0.6099.224-1~deb11u1"},"fixed_version":"90.0.4430.212-1","urgency":"not yet assigned"},"forky":{"status":"resolved","repositories":{"forky":"145.0.7632.159-1"},"fixed_version":"90.0.4430.212-1","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"146.0.7680.71-1"},"fixed_version":"90.0.4430.212-1","urgency":"not yet assigned"},"trixie":{"status":"resolved","repositories":{"trixie":"143.0.7499.169-1~deb13u1","trixie-security":"145.0.7632.159-1~deb13u1"},"fixed_version":"90.0.4430.212-1","urgency":"not yet assigned"}}},"CVE-2021-30507":{"description":"Inappropriate implementation in Offline in Google Chrome on Android prior to 90.0.4430.212 allowed a remote attacker who had compromised the renderer process to bypass site isolation via a crafted HTML page.","scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"143.0.7499.169-1~deb12u1","bookworm-security":"145.0.7632.159-1~deb12u1"},"fixed_version":"90.0.4430.212-1","urgency":"not yet assigned"},"bullseye":{"status":"resolved","repositories":{"bullseye":"120.0.6099.224-1~deb11u1","bullseye-security":"120.0.6099.224-1~deb11u1"},"fixed_version":"90.0.4430.212-1","urgency":"not yet assigned"},"forky":{"status":"resolved","repositories":{"forky":"145.0.7632.159-1"},"fixed_version":"90.0.4430.212-1","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"146.0.7680.71-1"},"fixed_version":"90.0.4430.212-1","urgency":"not yet assigned"},"trixie":{"status":"resolved","repositories":{"trixie":"143.0.7499.169-1~deb13u1","trixie-security":"145.0.7632.159-1~deb13u1"},"fixed_version":"90.0.4430.212-1","urgency":"not yet assigned"}}},"CVE-2021-30508":{"description":"Heap buffer overflow in Media Feeds in Google Chrome prior to 90.0.4430.212 allowed an attacker who convinced a user to enable certain features in Chrome to potentially exploit heap corruption via a crafted HTML page.","scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"143.0.7499.169-1~deb12u1","bookworm-security":"145.0.7632.159-1~deb12u1"},"fixed_version":"90.0.4430.212-1","urgency":"not yet assigned"},"bullseye":{"status":"resolved","repositories":{"bullseye":"120.0.6099.224-1~deb11u1","bullseye-security":"120.0.6099.224-1~deb11u1"},"fixed_version":"90.0.4430.212-1","urgency":"not yet assigned"},"forky":{"status":"resolved","repositories":{"forky":"145.0.7632.159-1"},"fixed_version":"90.0.4430.212-1","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"146.0.7680.71-1"},"fixed_version":"90.0.4430.212-1","urgency":"not yet assigned"},"trixie":{"status":"resolved","repositories":{"trixie":"143.0.7499.169-1~deb13u1","trixie-security":"145.0.7632.159-1~deb13u1"},"fixed_version":"90.0.4430.212-1","urgency":"not yet assigned"}}},"CVE-2021-30509":{"description":"Out of bounds write in Tab Strip in Google Chrome prior to 90.0.4430.212 allowed an attacker who convinced a user to install a malicious extension to perform an out of bounds memory write via a crafted HTML page and a crafted Chrome extension.","scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"143.0.7499.169-1~deb12u1","bookworm-security":"145.0.7632.159-1~deb12u1"},"fixed_version":"90.0.4430.212-1","urgency":"not yet assigned"},"bullseye":{"status":"resolved","repositories":{"bullseye":"120.0.6099.224-1~deb11u1","bullseye-security":"120.0.6099.224-1~deb11u1"},"fixed_version":"90.0.4430.212-1","urgency":"not yet assigned"},"forky":{"status":"resolved","repositories":{"forky":"145.0.7632.159-1"},"fixed_version":"90.0.4430.212-1","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"146.0.7680.71-1"},"fixed_version":"90.0.4430.212-1","urgency":"not yet assigned"},"trixie":{"status":"resolved","repositories":{"trixie":"143.0.7499.169-1~deb13u1","trixie-security":"145.0.7632.159-1~deb13u1"},"fixed_version":"90.0.4430.212-1","urgency":"not yet assigned"}}},"CVE-2021-30510":{"description":"Use after free in Aura in Google Chrome prior to 90.0.4430.212 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page.","scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"143.0.7499.169-1~deb12u1","bookworm-security":"145.0.7632.159-1~deb12u1"},"fixed_version":"90.0.4430.212-1","urgency":"not yet assigned"},"bullseye":{"status":"resolved","repositories":{"bullseye":"120.0.6099.224-1~deb11u1","bullseye-security":"120.0.6099.224-1~deb11u1"},"fixed_version":"90.0.4430.212-1","urgency":"not yet assigned"},"forky":{"status":"resolved","repositories":{"forky":"145.0.7632.159-1"},"fixed_version":"90.0.4430.212-1","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"146.0.7680.71-1"},"fixed_version":"90.0.4430.212-1","urgency":"not yet assigned"},"trixie":{"status":"resolved","repositories":{"trixie":"143.0.7499.169-1~deb13u1","trixie-security":"145.0.7632.159-1~deb13u1"},"fixed_version":"90.0.4430.212-1","urgency":"not yet assigned"}}},"CVE-2021-30511":{"description":"Out of bounds read in Tab Groups in Google Chrome prior to 90.0.4430.212 allowed an attacker who convinced a user to install a malicious extension to perform an out of bounds memory read via a crafted HTML page.","scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"143.0.7499.169-1~deb12u1","bookworm-security":"145.0.7632.159-1~deb12u1"},"fixed_version":"90.0.4430.212-1","urgency":"not yet assigned"},"bullseye":{"status":"resolved","repositories":{"bullseye":"120.0.6099.224-1~deb11u1","bullseye-security":"120.0.6099.224-1~deb11u1"},"fixed_version":"90.0.4430.212-1","urgency":"not yet assigned"},"forky":{"status":"resolved","repositories":{"forky":"145.0.7632.159-1"},"fixed_version":"90.0.4430.212-1","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"146.0.7680.71-1"},"fixed_version":"90.0.4430.212-1","urgency":"not yet assigned"},"trixie":{"status":"resolved","repositories":{"trixie":"143.0.7499.169-1~deb13u1","trixie-security":"145.0.7632.159-1~deb13u1"},"fixed_version":"90.0.4430.212-1","urgency":"not yet assigned"}}},"CVE-2021-30512":{"description":"Use after free in Notifications in Google Chrome prior to 90.0.4430.212 allowed a remote attacker who had compromised the renderer process to potentially exploit heap corruption via a crafted HTML page.","scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"143.0.7499.169-1~deb12u1","bookworm-security":"145.0.7632.159-1~deb12u1"},"fixed_version":"90.0.4430.212-1","urgency":"not yet assigned"},"bullseye":{"status":"resolved","repositories":{"bullseye":"120.0.6099.224-1~deb11u1","bullseye-security":"120.0.6099.224-1~deb11u1"},"fixed_version":"90.0.4430.212-1","urgency":"not yet assigned"},"forky":{"status":"resolved","repositories":{"forky":"145.0.7632.159-1"},"fixed_version":"90.0.4430.212-1","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"146.0.7680.71-1"},"fixed_version":"90.0.4430.212-1","urgency":"not yet assigned"},"trixie":{"status":"resolved","repositories":{"trixie":"143.0.7499.169-1~deb13u1","trixie-security":"145.0.7632.159-1~deb13u1"},"fixed_version":"90.0.4430.212-1","urgency":"not yet assigned"}}},"CVE-2021-30513":{"description":"Type confusion in V8 in Google Chrome prior to 90.0.4430.212 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page.","scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"143.0.7499.169-1~deb12u1","bookworm-security":"145.0.7632.159-1~deb12u1"},"fixed_version":"90.0.4430.212-1","urgency":"not yet assigned"},"bullseye":{"status":"resolved","repositories":{"bullseye":"120.0.6099.224-1~deb11u1","bullseye-security":"120.0.6099.224-1~deb11u1"},"fixed_version":"90.0.4430.212-1","urgency":"not yet assigned"},"forky":{"status":"resolved","repositories":{"forky":"145.0.7632.159-1"},"fixed_version":"90.0.4430.212-1","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"146.0.7680.71-1"},"fixed_version":"90.0.4430.212-1","urgency":"not yet assigned"},"trixie":{"status":"resolved","repositories":{"trixie":"143.0.7499.169-1~deb13u1","trixie-security":"145.0.7632.159-1~deb13u1"},"fixed_version":"90.0.4430.212-1","urgency":"not yet assigned"}}},"CVE-2021-30514":{"description":"Use after free in Autofill in Google Chrome prior to 90.0.4430.212 allowed a remote attacker who had compromised the renderer process to potentially exploit heap corruption via a crafted HTML page.","scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"143.0.7499.169-1~deb12u1","bookworm-security":"145.0.7632.159-1~deb12u1"},"fixed_version":"90.0.4430.212-1","urgency":"not yet assigned"},"bullseye":{"status":"resolved","repositories":{"bullseye":"120.0.6099.224-1~deb11u1","bullseye-security":"120.0.6099.224-1~deb11u1"},"fixed_version":"90.0.4430.212-1","urgency":"not yet assigned"},"forky":{"status":"resolved","repositories":{"forky":"145.0.7632.159-1"},"fixed_version":"90.0.4430.212-1","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"146.0.7680.71-1"},"fixed_version":"90.0.4430.212-1","urgency":"not yet assigned"},"trixie":{"status":"resolved","repositories":{"trixie":"143.0.7499.169-1~deb13u1","trixie-security":"145.0.7632.159-1~deb13u1"},"fixed_version":"90.0.4430.212-1","urgency":"not yet assigned"}}},"CVE-2021-30515":{"description":"Use after free in File API in Google Chrome prior to 90.0.4430.212 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page.","scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"143.0.7499.169-1~deb12u1","bookworm-security":"145.0.7632.159-1~deb12u1"},"fixed_version":"90.0.4430.212-1","urgency":"not yet assigned"},"bullseye":{"status":"resolved","repositories":{"bullseye":"120.0.6099.224-1~deb11u1","bullseye-security":"120.0.6099.224-1~deb11u1"},"fixed_version":"90.0.4430.212-1","urgency":"not yet assigned"},"forky":{"status":"resolved","repositories":{"forky":"145.0.7632.159-1"},"fixed_version":"90.0.4430.212-1","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"146.0.7680.71-1"},"fixed_version":"90.0.4430.212-1","urgency":"not yet assigned"},"trixie":{"status":"resolved","repositories":{"trixie":"143.0.7499.169-1~deb13u1","trixie-security":"145.0.7632.159-1~deb13u1"},"fixed_version":"90.0.4430.212-1","urgency":"not yet assigned"}}},"CVE-2021-30516":{"description":"Heap buffer overflow in History in Google Chrome prior to 90.0.4430.212 allowed a remote attacker who had compromised the renderer process to potentially exploit heap corruption via a crafted HTML page.","scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"143.0.7499.169-1~deb12u1","bookworm-security":"145.0.7632.159-1~deb12u1"},"fixed_version":"90.0.4430.212-1","urgency":"not yet assigned"},"bullseye":{"status":"resolved","repositories":{"bullseye":"120.0.6099.224-1~deb11u1","bullseye-security":"120.0.6099.224-1~deb11u1"},"fixed_version":"90.0.4430.212-1","urgency":"not yet assigned"},"forky":{"status":"resolved","repositories":{"forky":"145.0.7632.159-1"},"fixed_version":"90.0.4430.212-1","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"146.0.7680.71-1"},"fixed_version":"90.0.4430.212-1","urgency":"not yet assigned"},"trixie":{"status":"resolved","repositories":{"trixie":"143.0.7499.169-1~deb13u1","trixie-security":"145.0.7632.159-1~deb13u1"},"fixed_version":"90.0.4430.212-1","urgency":"not yet assigned"}}},"CVE-2021-30517":{"description":"Type confusion in V8 in Google Chrome prior to 90.0.4430.212 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page.","scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"143.0.7499.169-1~deb12u1","bookworm-security":"145.0.7632.159-1~deb12u1"},"fixed_version":"90.0.4430.212-1","urgency":"not yet assigned"},"bullseye":{"status":"resolved","repositories":{"bullseye":"120.0.6099.224-1~deb11u1","bullseye-security":"120.0.6099.224-1~deb11u1"},"fixed_version":"90.0.4430.212-1","urgency":"not yet assigned"},"forky":{"status":"resolved","repositories":{"forky":"145.0.7632.159-1"},"fixed_version":"90.0.4430.212-1","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"146.0.7680.71-1"},"fixed_version":"90.0.4430.212-1","urgency":"not yet assigned"},"trixie":{"status":"resolved","repositories":{"trixie":"143.0.7499.169-1~deb13u1","trixie-security":"145.0.7632.159-1~deb13u1"},"fixed_version":"90.0.4430.212-1","urgency":"not yet assigned"}}},"CVE-2021-30518":{"description":"Heap buffer overflow in Reader Mode in Google Chrome prior to 90.0.4430.212 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page.","scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"143.0.7499.169-1~deb12u1","bookworm-security":"145.0.7632.159-1~deb12u1"},"fixed_version":"90.0.4430.212-1","urgency":"not yet assigned"},"bullseye":{"status":"resolved","repositories":{"bullseye":"120.0.6099.224-1~deb11u1","bullseye-security":"120.0.6099.224-1~deb11u1"},"fixed_version":"90.0.4430.212-1","urgency":"not yet assigned"},"forky":{"status":"resolved","repositories":{"forky":"145.0.7632.159-1"},"fixed_version":"90.0.4430.212-1","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"146.0.7680.71-1"},"fixed_version":"90.0.4430.212-1","urgency":"not yet assigned"},"trixie":{"status":"resolved","repositories":{"trixie":"143.0.7499.169-1~deb13u1","trixie-security":"145.0.7632.159-1~deb13u1"},"fixed_version":"90.0.4430.212-1","urgency":"not yet assigned"}}},"CVE-2021-30519":{"description":"Use after free in Payments in Google Chrome prior to 90.0.4430.212 allowed an attacker who convinced a user to install a malicious payments app to potentially exploit heap corruption via a crafted HTML page.","scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"143.0.7499.169-1~deb12u1","bookworm-security":"145.0.7632.159-1~deb12u1"},"fixed_version":"90.0.4430.212-1","urgency":"not yet assigned"},"bullseye":{"status":"resolved","repositories":{"bullseye":"120.0.6099.224-1~deb11u1","bullseye-security":"120.0.6099.224-1~deb11u1"},"fixed_version":"90.0.4430.212-1","urgency":"not yet assigned"},"forky":{"status":"resolved","repositories":{"forky":"145.0.7632.159-1"},"fixed_version":"90.0.4430.212-1","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"146.0.7680.71-1"},"fixed_version":"90.0.4430.212-1","urgency":"not yet assigned"},"trixie":{"status":"resolved","repositories":{"trixie":"143.0.7499.169-1~deb13u1","trixie-security":"145.0.7632.159-1~deb13u1"},"fixed_version":"90.0.4430.212-1","urgency":"not yet assigned"}}},"CVE-2021-30520":{"description":"Use after free in Tab Strip in Google Chrome prior to 90.0.4430.212 allowed an attacker who convinced a user to install a malicious extension to potentially exploit heap corruption via a crafted HTML page.","scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"143.0.7499.169-1~deb12u1","bookworm-security":"145.0.7632.159-1~deb12u1"},"fixed_version":"90.0.4430.212-1","urgency":"not yet assigned"},"bullseye":{"status":"resolved","repositories":{"bullseye":"120.0.6099.224-1~deb11u1","bullseye-security":"120.0.6099.224-1~deb11u1"},"fixed_version":"90.0.4430.212-1","urgency":"not yet assigned"},"forky":{"status":"resolved","repositories":{"forky":"145.0.7632.159-1"},"fixed_version":"90.0.4430.212-1","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"146.0.7680.71-1"},"fixed_version":"90.0.4430.212-1","urgency":"not yet assigned"},"trixie":{"status":"resolved","repositories":{"trixie":"143.0.7499.169-1~deb13u1","trixie-security":"145.0.7632.159-1~deb13u1"},"fixed_version":"90.0.4430.212-1","urgency":"not yet assigned"}}},"CVE-2021-30521":{"description":"Heap buffer overflow in Autofill in Google Chrome on Android prior to 91.0.4472.77 allowed a remote attacker to perform out of bounds memory access via a crafted HTML page.","debianbug":990079,"scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"143.0.7499.169-1~deb12u1","bookworm-security":"145.0.7632.159-1~deb12u1"},"fixed_version":"93.0.4577.82-1","urgency":"not yet assigned"},"bullseye":{"status":"resolved","repositories":{"bullseye":"120.0.6099.224-1~deb11u1","bullseye-security":"120.0.6099.224-1~deb11u1"},"fixed_version":"93.0.4577.82-1","urgency":"not yet assigned"},"forky":{"status":"resolved","repositories":{"forky":"145.0.7632.159-1"},"fixed_version":"93.0.4577.82-1","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"146.0.7680.71-1"},"fixed_version":"93.0.4577.82-1","urgency":"not yet assigned"},"trixie":{"status":"resolved","repositories":{"trixie":"143.0.7499.169-1~deb13u1","trixie-security":"145.0.7632.159-1~deb13u1"},"fixed_version":"93.0.4577.82-1","urgency":"not yet assigned"}}},"CVE-2021-30522":{"description":"Use after free in WebAudio in Google Chrome prior to 91.0.4472.77 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page.","debianbug":990079,"scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"143.0.7499.169-1~deb12u1","bookworm-security":"145.0.7632.159-1~deb12u1"},"fixed_version":"93.0.4577.82-1","urgency":"not yet assigned"},"bullseye":{"status":"resolved","repositories":{"bullseye":"120.0.6099.224-1~deb11u1","bullseye-security":"120.0.6099.224-1~deb11u1"},"fixed_version":"93.0.4577.82-1","urgency":"not yet assigned"},"forky":{"status":"resolved","repositories":{"forky":"145.0.7632.159-1"},"fixed_version":"93.0.4577.82-1","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"146.0.7680.71-1"},"fixed_version":"93.0.4577.82-1","urgency":"not yet assigned"},"trixie":{"status":"resolved","repositories":{"trixie":"143.0.7499.169-1~deb13u1","trixie-security":"145.0.7632.159-1~deb13u1"},"fixed_version":"93.0.4577.82-1","urgency":"not yet assigned"}}},"CVE-2021-30523":{"description":"Use after free in WebRTC in Google Chrome prior to 91.0.4472.77 allowed a remote attacker to potentially exploit heap corruption via a crafted SCTP packet.","debianbug":990079,"scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"143.0.7499.169-1~deb12u1","bookworm-security":"145.0.7632.159-1~deb12u1"},"fixed_version":"93.0.4577.82-1","urgency":"not yet assigned"},"bullseye":{"status":"resolved","repositories":{"bullseye":"120.0.6099.224-1~deb11u1","bullseye-security":"120.0.6099.224-1~deb11u1"},"fixed_version":"93.0.4577.82-1","urgency":"not yet assigned"},"forky":{"status":"resolved","repositories":{"forky":"145.0.7632.159-1"},"fixed_version":"93.0.4577.82-1","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"146.0.7680.71-1"},"fixed_version":"93.0.4577.82-1","urgency":"not yet assigned"},"trixie":{"status":"resolved","repositories":{"trixie":"143.0.7499.169-1~deb13u1","trixie-security":"145.0.7632.159-1~deb13u1"},"fixed_version":"93.0.4577.82-1","urgency":"not yet assigned"}}},"CVE-2021-30524":{"description":"Use after free in TabStrip in Google Chrome prior to 91.0.4472.77 allowed an attacker who convinced a user to install a malicious extension to potentially exploit heap corruption via a crafted HTML page.","debianbug":990079,"scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"143.0.7499.169-1~deb12u1","bookworm-security":"145.0.7632.159-1~deb12u1"},"fixed_version":"93.0.4577.82-1","urgency":"not yet assigned"},"bullseye":{"status":"resolved","repositories":{"bullseye":"120.0.6099.224-1~deb11u1","bullseye-security":"120.0.6099.224-1~deb11u1"},"fixed_version":"93.0.4577.82-1","urgency":"not yet assigned"},"forky":{"status":"resolved","repositories":{"forky":"145.0.7632.159-1"},"fixed_version":"93.0.4577.82-1","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"146.0.7680.71-1"},"fixed_version":"93.0.4577.82-1","urgency":"not yet assigned"},"trixie":{"status":"resolved","repositories":{"trixie":"143.0.7499.169-1~deb13u1","trixie-security":"145.0.7632.159-1~deb13u1"},"fixed_version":"93.0.4577.82-1","urgency":"not yet assigned"}}},"CVE-2021-30525":{"description":"Use after free in TabGroups in Google Chrome prior to 91.0.4472.77 allowed an attacker who convinced a user to install a malicious extension to potentially exploit heap corruption via a crafted HTML page.","debianbug":990079,"scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"143.0.7499.169-1~deb12u1","bookworm-security":"145.0.7632.159-1~deb12u1"},"fixed_version":"93.0.4577.82-1","urgency":"not yet assigned"},"bullseye":{"status":"resolved","repositories":{"bullseye":"120.0.6099.224-1~deb11u1","bullseye-security":"120.0.6099.224-1~deb11u1"},"fixed_version":"93.0.4577.82-1","urgency":"not yet assigned"},"forky":{"status":"resolved","repositories":{"forky":"145.0.7632.159-1"},"fixed_version":"93.0.4577.82-1","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"146.0.7680.71-1"},"fixed_version":"93.0.4577.82-1","urgency":"not yet assigned"},"trixie":{"status":"resolved","repositories":{"trixie":"143.0.7499.169-1~deb13u1","trixie-security":"145.0.7632.159-1~deb13u1"},"fixed_version":"93.0.4577.82-1","urgency":"not yet assigned"}}},"CVE-2021-30526":{"description":"Out of bounds write in TabStrip in Google Chrome prior to 91.0.4472.77 allowed an attacker who convinced a user to install a malicious extension to perform an out of bounds memory write via a crafted HTML page.","debianbug":990079,"scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"143.0.7499.169-1~deb12u1","bookworm-security":"145.0.7632.159-1~deb12u1"},"fixed_version":"93.0.4577.82-1","urgency":"not yet assigned"},"bullseye":{"status":"resolved","repositories":{"bullseye":"120.0.6099.224-1~deb11u1","bullseye-security":"120.0.6099.224-1~deb11u1"},"fixed_version":"93.0.4577.82-1","urgency":"not yet assigned"},"forky":{"status":"resolved","repositories":{"forky":"145.0.7632.159-1"},"fixed_version":"93.0.4577.82-1","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"146.0.7680.71-1"},"fixed_version":"93.0.4577.82-1","urgency":"not yet assigned"},"trixie":{"status":"resolved","repositories":{"trixie":"143.0.7499.169-1~deb13u1","trixie-security":"145.0.7632.159-1~deb13u1"},"fixed_version":"93.0.4577.82-1","urgency":"not yet assigned"}}},"CVE-2021-30527":{"description":"Use after free in WebUI in Google Chrome prior to 91.0.4472.77 allowed an attacker who convinced a user to install a malicious extension to potentially exploit heap corruption via a crafted HTML page.","debianbug":990079,"scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"143.0.7499.169-1~deb12u1","bookworm-security":"145.0.7632.159-1~deb12u1"},"fixed_version":"93.0.4577.82-1","urgency":"not yet assigned"},"bullseye":{"status":"resolved","repositories":{"bullseye":"120.0.6099.224-1~deb11u1","bullseye-security":"120.0.6099.224-1~deb11u1"},"fixed_version":"93.0.4577.82-1","urgency":"not yet assigned"},"forky":{"status":"resolved","repositories":{"forky":"145.0.7632.159-1"},"fixed_version":"93.0.4577.82-1","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"146.0.7680.71-1"},"fixed_version":"93.0.4577.82-1","urgency":"not yet assigned"},"trixie":{"status":"resolved","repositories":{"trixie":"143.0.7499.169-1~deb13u1","trixie-security":"145.0.7632.159-1~deb13u1"},"fixed_version":"93.0.4577.82-1","urgency":"not yet assigned"}}},"CVE-2021-30528":{"description":"Use after free in WebAuthentication in Google Chrome on Android prior to 91.0.4472.77 allowed a remote attacker who had compromised the renderer process of a user who had saved a credit card in their Google account to potentially exploit heap corruption via a crafted HTML page.","debianbug":990079,"scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"143.0.7499.169-1~deb12u1","bookworm-security":"145.0.7632.159-1~deb12u1"},"fixed_version":"93.0.4577.82-1","urgency":"not yet assigned"},"bullseye":{"status":"resolved","repositories":{"bullseye":"120.0.6099.224-1~deb11u1","bullseye-security":"120.0.6099.224-1~deb11u1"},"fixed_version":"93.0.4577.82-1","urgency":"not yet assigned"},"forky":{"status":"resolved","repositories":{"forky":"145.0.7632.159-1"},"fixed_version":"93.0.4577.82-1","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"146.0.7680.71-1"},"fixed_version":"93.0.4577.82-1","urgency":"not yet assigned"},"trixie":{"status":"resolved","repositories":{"trixie":"143.0.7499.169-1~deb13u1","trixie-security":"145.0.7632.159-1~deb13u1"},"fixed_version":"93.0.4577.82-1","urgency":"not yet assigned"}}},"CVE-2021-30529":{"description":"Use after free in Bookmarks in Google Chrome prior to 91.0.4472.77 allowed an attacker who convinced a user to install a malicious extension to potentially exploit heap corruption via a crafted HTML page.","debianbug":990079,"scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"143.0.7499.169-1~deb12u1","bookworm-security":"145.0.7632.159-1~deb12u1"},"fixed_version":"93.0.4577.82-1","urgency":"not yet assigned"},"bullseye":{"status":"resolved","repositories":{"bullseye":"120.0.6099.224-1~deb11u1","bullseye-security":"120.0.6099.224-1~deb11u1"},"fixed_version":"93.0.4577.82-1","urgency":"not yet assigned"},"forky":{"status":"resolved","repositories":{"forky":"145.0.7632.159-1"},"fixed_version":"93.0.4577.82-1","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"146.0.7680.71-1"},"fixed_version":"93.0.4577.82-1","urgency":"not yet assigned"},"trixie":{"status":"resolved","repositories":{"trixie":"143.0.7499.169-1~deb13u1","trixie-security":"145.0.7632.159-1~deb13u1"},"fixed_version":"93.0.4577.82-1","urgency":"not yet assigned"}}},"CVE-2021-30530":{"description":"Out of bounds memory access in WebAudio in Google Chrome prior to 91.0.4472.77 allowed a remote attacker to perform out of bounds memory access via a crafted HTML page.","debianbug":990079,"scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"143.0.7499.169-1~deb12u1","bookworm-security":"145.0.7632.159-1~deb12u1"},"fixed_version":"93.0.4577.82-1","urgency":"not yet assigned"},"bullseye":{"status":"resolved","repositories":{"bullseye":"120.0.6099.224-1~deb11u1","bullseye-security":"120.0.6099.224-1~deb11u1"},"fixed_version":"93.0.4577.82-1","urgency":"not yet assigned"},"forky":{"status":"resolved","repositories":{"forky":"145.0.7632.159-1"},"fixed_version":"93.0.4577.82-1","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"146.0.7680.71-1"},"fixed_version":"93.0.4577.82-1","urgency":"not yet assigned"},"trixie":{"status":"resolved","repositories":{"trixie":"143.0.7499.169-1~deb13u1","trixie-security":"145.0.7632.159-1~deb13u1"},"fixed_version":"93.0.4577.82-1","urgency":"not yet assigned"}}},"CVE-2021-30531":{"description":"Insufficient policy enforcement in Content Security Policy in Google Chrome prior to 91.0.4472.77 allowed a remote attacker to bypass content security policy via a crafted HTML page.","debianbug":990079,"scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"143.0.7499.169-1~deb12u1","bookworm-security":"145.0.7632.159-1~deb12u1"},"fixed_version":"93.0.4577.82-1","urgency":"not yet assigned"},"bullseye":{"status":"resolved","repositories":{"bullseye":"120.0.6099.224-1~deb11u1","bullseye-security":"120.0.6099.224-1~deb11u1"},"fixed_version":"93.0.4577.82-1","urgency":"not yet assigned"},"forky":{"status":"resolved","repositories":{"forky":"145.0.7632.159-1"},"fixed_version":"93.0.4577.82-1","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"146.0.7680.71-1"},"fixed_version":"93.0.4577.82-1","urgency":"not yet assigned"},"trixie":{"status":"resolved","repositories":{"trixie":"143.0.7499.169-1~deb13u1","trixie-security":"145.0.7632.159-1~deb13u1"},"fixed_version":"93.0.4577.82-1","urgency":"not yet assigned"}}},"CVE-2021-30532":{"description":"Insufficient policy enforcement in Content Security Policy in Google Chrome prior to 91.0.4472.77 allowed a remote attacker to bypass content security policy via a crafted HTML page.","debianbug":990079,"scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"143.0.7499.169-1~deb12u1","bookworm-security":"145.0.7632.159-1~deb12u1"},"fixed_version":"93.0.4577.82-1","urgency":"not yet assigned"},"bullseye":{"status":"resolved","repositories":{"bullseye":"120.0.6099.224-1~deb11u1","bullseye-security":"120.0.6099.224-1~deb11u1"},"fixed_version":"93.0.4577.82-1","urgency":"not yet assigned"},"forky":{"status":"resolved","repositories":{"forky":"145.0.7632.159-1"},"fixed_version":"93.0.4577.82-1","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"146.0.7680.71-1"},"fixed_version":"93.0.4577.82-1","urgency":"not yet assigned"},"trixie":{"status":"resolved","repositories":{"trixie":"143.0.7499.169-1~deb13u1","trixie-security":"145.0.7632.159-1~deb13u1"},"fixed_version":"93.0.4577.82-1","urgency":"not yet assigned"}}},"CVE-2021-30533":{"description":"Insufficient policy enforcement in PopupBlocker in Google Chrome prior to 91.0.4472.77 allowed a remote attacker to bypass navigation restrictions via a crafted iframe.","debianbug":990079,"scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"143.0.7499.169-1~deb12u1","bookworm-security":"145.0.7632.159-1~deb12u1"},"fixed_version":"93.0.4577.82-1","urgency":"not yet assigned"},"bullseye":{"status":"resolved","repositories":{"bullseye":"120.0.6099.224-1~deb11u1","bullseye-security":"120.0.6099.224-1~deb11u1"},"fixed_version":"93.0.4577.82-1","urgency":"not yet assigned"},"forky":{"status":"resolved","repositories":{"forky":"145.0.7632.159-1"},"fixed_version":"93.0.4577.82-1","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"146.0.7680.71-1"},"fixed_version":"93.0.4577.82-1","urgency":"not yet assigned"},"trixie":{"status":"resolved","repositories":{"trixie":"143.0.7499.169-1~deb13u1","trixie-security":"145.0.7632.159-1~deb13u1"},"fixed_version":"93.0.4577.82-1","urgency":"not yet assigned"}}},"CVE-2021-30534":{"description":"Insufficient policy enforcement in iFrameSandbox in Google Chrome prior to 91.0.4472.77 allowed a remote attacker to bypass navigation restrictions via a crafted HTML page.","debianbug":990079,"scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"143.0.7499.169-1~deb12u1","bookworm-security":"145.0.7632.159-1~deb12u1"},"fixed_version":"93.0.4577.82-1","urgency":"not yet assigned"},"bullseye":{"status":"resolved","repositories":{"bullseye":"120.0.6099.224-1~deb11u1","bullseye-security":"120.0.6099.224-1~deb11u1"},"fixed_version":"93.0.4577.82-1","urgency":"not yet assigned"},"forky":{"status":"resolved","repositories":{"forky":"145.0.7632.159-1"},"fixed_version":"93.0.4577.82-1","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"146.0.7680.71-1"},"fixed_version":"93.0.4577.82-1","urgency":"not yet assigned"},"trixie":{"status":"resolved","repositories":{"trixie":"143.0.7499.169-1~deb13u1","trixie-security":"145.0.7632.159-1~deb13u1"},"fixed_version":"93.0.4577.82-1","urgency":"not yet assigned"}}},"CVE-2021-30535":{"description":"Double free in ICU in Google Chrome prior to 91.0.4472.77 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page.","debianbug":990079,"scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"143.0.7499.169-1~deb12u1","bookworm-security":"145.0.7632.159-1~deb12u1"},"fixed_version":"93.0.4577.82-1","urgency":"not yet assigned"},"bullseye":{"status":"resolved","repositories":{"bullseye":"120.0.6099.224-1~deb11u1","bullseye-security":"120.0.6099.224-1~deb11u1"},"fixed_version":"93.0.4577.82-1","urgency":"not yet assigned"},"forky":{"status":"resolved","repositories":{"forky":"145.0.7632.159-1"},"fixed_version":"93.0.4577.82-1","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"146.0.7680.71-1"},"fixed_version":"93.0.4577.82-1","urgency":"not yet assigned"},"trixie":{"status":"resolved","repositories":{"trixie":"143.0.7499.169-1~deb13u1","trixie-security":"145.0.7632.159-1~deb13u1"},"fixed_version":"93.0.4577.82-1","urgency":"not yet assigned"}}},"CVE-2021-30536":{"description":"Out of bounds read in V8 in Google Chrome prior to 91.0.4472.77 allowed a remote attacker to potentially exploit stack corruption via a crafted HTML page.","debianbug":990079,"scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"143.0.7499.169-1~deb12u1","bookworm-security":"145.0.7632.159-1~deb12u1"},"fixed_version":"93.0.4577.82-1","urgency":"not yet assigned"},"bullseye":{"status":"resolved","repositories":{"bullseye":"120.0.6099.224-1~deb11u1","bullseye-security":"120.0.6099.224-1~deb11u1"},"fixed_version":"93.0.4577.82-1","urgency":"not yet assigned"},"forky":{"status":"resolved","repositories":{"forky":"145.0.7632.159-1"},"fixed_version":"93.0.4577.82-1","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"146.0.7680.71-1"},"fixed_version":"93.0.4577.82-1","urgency":"not yet assigned"},"trixie":{"status":"resolved","repositories":{"trixie":"143.0.7499.169-1~deb13u1","trixie-security":"145.0.7632.159-1~deb13u1"},"fixed_version":"93.0.4577.82-1","urgency":"not yet assigned"}}},"CVE-2021-30537":{"description":"Insufficient policy enforcement in cookies in Google Chrome prior to 91.0.4472.77 allowed a remote attacker to bypass cookie policy via a crafted HTML page.","debianbug":990079,"scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"143.0.7499.169-1~deb12u1","bookworm-security":"145.0.7632.159-1~deb12u1"},"fixed_version":"93.0.4577.82-1","urgency":"not yet assigned"},"bullseye":{"status":"resolved","repositories":{"bullseye":"120.0.6099.224-1~deb11u1","bullseye-security":"120.0.6099.224-1~deb11u1"},"fixed_version":"93.0.4577.82-1","urgency":"not yet assigned"},"forky":{"status":"resolved","repositories":{"forky":"145.0.7632.159-1"},"fixed_version":"93.0.4577.82-1","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"146.0.7680.71-1"},"fixed_version":"93.0.4577.82-1","urgency":"not yet assigned"},"trixie":{"status":"resolved","repositories":{"trixie":"143.0.7499.169-1~deb13u1","trixie-security":"145.0.7632.159-1~deb13u1"},"fixed_version":"93.0.4577.82-1","urgency":"not yet assigned"}}},"CVE-2021-30538":{"description":"Insufficient policy enforcement in content security policy in Google Chrome prior to 91.0.4472.77 allowed a remote attacker to bypass content security policy via a crafted HTML page.","debianbug":990079,"scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"143.0.7499.169-1~deb12u1","bookworm-security":"145.0.7632.159-1~deb12u1"},"fixed_version":"93.0.4577.82-1","urgency":"not yet assigned"},"bullseye":{"status":"resolved","repositories":{"bullseye":"120.0.6099.224-1~deb11u1","bullseye-security":"120.0.6099.224-1~deb11u1"},"fixed_version":"93.0.4577.82-1","urgency":"not yet assigned"},"forky":{"status":"resolved","repositories":{"forky":"145.0.7632.159-1"},"fixed_version":"93.0.4577.82-1","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"146.0.7680.71-1"},"fixed_version":"93.0.4577.82-1","urgency":"not yet assigned"},"trixie":{"status":"resolved","repositories":{"trixie":"143.0.7499.169-1~deb13u1","trixie-security":"145.0.7632.159-1~deb13u1"},"fixed_version":"93.0.4577.82-1","urgency":"not yet assigned"}}},"CVE-2021-30539":{"description":"Insufficient policy enforcement in content security policy in Google Chrome prior to 91.0.4472.77 allowed a remote attacker to bypass content security policy via a crafted HTML page.","debianbug":990079,"scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"143.0.7499.169-1~deb12u1","bookworm-security":"145.0.7632.159-1~deb12u1"},"fixed_version":"93.0.4577.82-1","urgency":"not yet assigned"},"bullseye":{"status":"resolved","repositories":{"bullseye":"120.0.6099.224-1~deb11u1","bullseye-security":"120.0.6099.224-1~deb11u1"},"fixed_version":"93.0.4577.82-1","urgency":"not yet assigned"},"forky":{"status":"resolved","repositories":{"forky":"145.0.7632.159-1"},"fixed_version":"93.0.4577.82-1","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"146.0.7680.71-1"},"fixed_version":"93.0.4577.82-1","urgency":"not yet assigned"},"trixie":{"status":"resolved","repositories":{"trixie":"143.0.7499.169-1~deb13u1","trixie-security":"145.0.7632.159-1~deb13u1"},"fixed_version":"93.0.4577.82-1","urgency":"not yet assigned"}}},"CVE-2021-30540":{"description":"Incorrect security UI in payments in Google Chrome on Android prior to 91.0.4472.77 allowed a remote attacker to perform domain spoofing via a crafted HTML page.","debianbug":990079,"scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"143.0.7499.169-1~deb12u1","bookworm-security":"145.0.7632.159-1~deb12u1"},"fixed_version":"93.0.4577.82-1","urgency":"not yet assigned"},"bullseye":{"status":"resolved","repositories":{"bullseye":"120.0.6099.224-1~deb11u1","bullseye-security":"120.0.6099.224-1~deb11u1"},"fixed_version":"93.0.4577.82-1","urgency":"not yet assigned"},"forky":{"status":"resolved","repositories":{"forky":"145.0.7632.159-1"},"fixed_version":"93.0.4577.82-1","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"146.0.7680.71-1"},"fixed_version":"93.0.4577.82-1","urgency":"not yet assigned"},"trixie":{"status":"resolved","repositories":{"trixie":"143.0.7499.169-1~deb13u1","trixie-security":"145.0.7632.159-1~deb13u1"},"fixed_version":"93.0.4577.82-1","urgency":"not yet assigned"}}},"CVE-2021-30541":{"description":"Use after free in V8 in Google Chrome prior to 91.0.4472.164 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page.","debianbug":990079,"scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"143.0.7499.169-1~deb12u1","bookworm-security":"145.0.7632.159-1~deb12u1"},"fixed_version":"93.0.4577.82-1","urgency":"not yet assigned"},"bullseye":{"status":"resolved","repositories":{"bullseye":"120.0.6099.224-1~deb11u1","bullseye-security":"120.0.6099.224-1~deb11u1"},"fixed_version":"93.0.4577.82-1","urgency":"not yet assigned"},"forky":{"status":"resolved","repositories":{"forky":"145.0.7632.159-1"},"fixed_version":"93.0.4577.82-1","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"146.0.7680.71-1"},"fixed_version":"93.0.4577.82-1","urgency":"not yet assigned"},"trixie":{"status":"resolved","repositories":{"trixie":"143.0.7499.169-1~deb13u1","trixie-security":"145.0.7632.159-1~deb13u1"},"fixed_version":"93.0.4577.82-1","urgency":"not yet assigned"}}},"CVE-2021-30542":{"description":"Use after free in Tab Strip in Google Chrome prior to 91.0.4472.77 allowed an attacker who convinced a user to install a malicious extension to potentially exploit heap corruption via a crafted HTML page.","debianbug":990079,"scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"143.0.7499.169-1~deb12u1","bookworm-security":"145.0.7632.159-1~deb12u1"},"fixed_version":"93.0.4577.82-1","urgency":"not yet assigned"},"bullseye":{"status":"resolved","repositories":{"bullseye":"120.0.6099.224-1~deb11u1","bullseye-security":"120.0.6099.224-1~deb11u1"},"fixed_version":"93.0.4577.82-1","urgency":"not yet assigned"},"forky":{"status":"resolved","repositories":{"forky":"145.0.7632.159-1"},"fixed_version":"93.0.4577.82-1","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"146.0.7680.71-1"},"fixed_version":"93.0.4577.82-1","urgency":"not yet assigned"},"trixie":{"status":"resolved","repositories":{"trixie":"143.0.7499.169-1~deb13u1","trixie-security":"145.0.7632.159-1~deb13u1"},"fixed_version":"93.0.4577.82-1","urgency":"not yet assigned"}}},"CVE-2021-30543":{"description":"Use after free in Tab Strip in Google Chrome prior to 91.0.4472.77 allowed an attacker who convinced a user to install a malicious extension to potentially exploit heap corruption via a crafted HTML page.","debianbug":990079,"scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"143.0.7499.169-1~deb12u1","bookworm-security":"145.0.7632.159-1~deb12u1"},"fixed_version":"93.0.4577.82-1","urgency":"not yet assigned"},"bullseye":{"status":"resolved","repositories":{"bullseye":"120.0.6099.224-1~deb11u1","bullseye-security":"120.0.6099.224-1~deb11u1"},"fixed_version":"93.0.4577.82-1","urgency":"not yet assigned"},"forky":{"status":"resolved","repositories":{"forky":"145.0.7632.159-1"},"fixed_version":"93.0.4577.82-1","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"146.0.7680.71-1"},"fixed_version":"93.0.4577.82-1","urgency":"not yet assigned"},"trixie":{"status":"resolved","repositories":{"trixie":"143.0.7499.169-1~deb13u1","trixie-security":"145.0.7632.159-1~deb13u1"},"fixed_version":"93.0.4577.82-1","urgency":"not yet assigned"}}},"CVE-2021-30544":{"description":"Use after free in BFCache in Google Chrome prior to 91.0.4472.101 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page.","debianbug":990079,"scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"143.0.7499.169-1~deb12u1","bookworm-security":"145.0.7632.159-1~deb12u1"},"fixed_version":"93.0.4577.82-1","urgency":"not yet assigned"},"bullseye":{"status":"resolved","repositories":{"bullseye":"120.0.6099.224-1~deb11u1","bullseye-security":"120.0.6099.224-1~deb11u1"},"fixed_version":"93.0.4577.82-1","urgency":"not yet assigned"},"forky":{"status":"resolved","repositories":{"forky":"145.0.7632.159-1"},"fixed_version":"93.0.4577.82-1","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"146.0.7680.71-1"},"fixed_version":"93.0.4577.82-1","urgency":"not yet assigned"},"trixie":{"status":"resolved","repositories":{"trixie":"143.0.7499.169-1~deb13u1","trixie-security":"145.0.7632.159-1~deb13u1"},"fixed_version":"93.0.4577.82-1","urgency":"not yet assigned"}}},"CVE-2021-30545":{"description":"Use after free in Extensions in Google Chrome prior to 91.0.4472.101 allowed a remote attacker who had compromised the renderer process to potentially exploit heap corruption via a crafted HTML page.","debianbug":990079,"scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"143.0.7499.169-1~deb12u1","bookworm-security":"145.0.7632.159-1~deb12u1"},"fixed_version":"93.0.4577.82-1","urgency":"not yet assigned"},"bullseye":{"status":"resolved","repositories":{"bullseye":"120.0.6099.224-1~deb11u1","bullseye-security":"120.0.6099.224-1~deb11u1"},"fixed_version":"93.0.4577.82-1","urgency":"not yet assigned"},"forky":{"status":"resolved","repositories":{"forky":"145.0.7632.159-1"},"fixed_version":"93.0.4577.82-1","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"146.0.7680.71-1"},"fixed_version":"93.0.4577.82-1","urgency":"not yet assigned"},"trixie":{"status":"resolved","repositories":{"trixie":"143.0.7499.169-1~deb13u1","trixie-security":"145.0.7632.159-1~deb13u1"},"fixed_version":"93.0.4577.82-1","urgency":"not yet assigned"}}},"CVE-2021-30546":{"description":"Use after free in Autofill in Google Chrome prior to 91.0.4472.101 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page.","debianbug":990079,"scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"143.0.7499.169-1~deb12u1","bookworm-security":"145.0.7632.159-1~deb12u1"},"fixed_version":"93.0.4577.82-1","urgency":"not yet assigned"},"bullseye":{"status":"resolved","repositories":{"bullseye":"120.0.6099.224-1~deb11u1","bullseye-security":"120.0.6099.224-1~deb11u1"},"fixed_version":"93.0.4577.82-1","urgency":"not yet assigned"},"forky":{"status":"resolved","repositories":{"forky":"145.0.7632.159-1"},"fixed_version":"93.0.4577.82-1","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"146.0.7680.71-1"},"fixed_version":"93.0.4577.82-1","urgency":"not yet assigned"},"trixie":{"status":"resolved","repositories":{"trixie":"143.0.7499.169-1~deb13u1","trixie-security":"145.0.7632.159-1~deb13u1"},"fixed_version":"93.0.4577.82-1","urgency":"not yet assigned"}}},"CVE-2021-30547":{"description":"Out of bounds write in ANGLE in Google Chrome prior to 91.0.4472.101 allowed a remote attacker to potentially perform out of bounds memory access via a crafted HTML page.","debianbug":990079,"scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"143.0.7499.169-1~deb12u1","bookworm-security":"145.0.7632.159-1~deb12u1"},"fixed_version":"93.0.4577.82-1","urgency":"not yet assigned"},"bullseye":{"status":"resolved","repositories":{"bullseye":"120.0.6099.224-1~deb11u1","bullseye-security":"120.0.6099.224-1~deb11u1"},"fixed_version":"93.0.4577.82-1","urgency":"not yet assigned"},"forky":{"status":"resolved","repositories":{"forky":"145.0.7632.159-1"},"fixed_version":"93.0.4577.82-1","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"146.0.7680.71-1"},"fixed_version":"93.0.4577.82-1","urgency":"not yet assigned"},"trixie":{"status":"resolved","repositories":{"trixie":"143.0.7499.169-1~deb13u1","trixie-security":"145.0.7632.159-1~deb13u1"},"fixed_version":"93.0.4577.82-1","urgency":"not yet assigned"}}},"CVE-2021-30548":{"description":"Use after free in Loader in Google Chrome prior to 91.0.4472.101 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page.","debianbug":990079,"scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"143.0.7499.169-1~deb12u1","bookworm-security":"145.0.7632.159-1~deb12u1"},"fixed_version":"93.0.4577.82-1","urgency":"not yet assigned"},"bullseye":{"status":"resolved","repositories":{"bullseye":"120.0.6099.224-1~deb11u1","bullseye-security":"120.0.6099.224-1~deb11u1"},"fixed_version":"93.0.4577.82-1","urgency":"not yet assigned"},"forky":{"status":"resolved","repositories":{"forky":"145.0.7632.159-1"},"fixed_version":"93.0.4577.82-1","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"146.0.7680.71-1"},"fixed_version":"93.0.4577.82-1","urgency":"not yet assigned"},"trixie":{"status":"resolved","repositories":{"trixie":"143.0.7499.169-1~deb13u1","trixie-security":"145.0.7632.159-1~deb13u1"},"fixed_version":"93.0.4577.82-1","urgency":"not yet assigned"}}},"CVE-2021-30549":{"description":"Use after free in Spell check in Google Chrome prior to 91.0.4472.101 allowed an attacker who convinced a user to install a malicious extension to potentially exploit heap corruption via a crafted HTML page.","debianbug":990079,"scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"143.0.7499.169-1~deb12u1","bookworm-security":"145.0.7632.159-1~deb12u1"},"fixed_version":"93.0.4577.82-1","urgency":"not yet assigned"},"bullseye":{"status":"resolved","repositories":{"bullseye":"120.0.6099.224-1~deb11u1","bullseye-security":"120.0.6099.224-1~deb11u1"},"fixed_version":"93.0.4577.82-1","urgency":"not yet assigned"},"forky":{"status":"resolved","repositories":{"forky":"145.0.7632.159-1"},"fixed_version":"93.0.4577.82-1","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"146.0.7680.71-1"},"fixed_version":"93.0.4577.82-1","urgency":"not yet assigned"},"trixie":{"status":"resolved","repositories":{"trixie":"143.0.7499.169-1~deb13u1","trixie-security":"145.0.7632.159-1~deb13u1"},"fixed_version":"93.0.4577.82-1","urgency":"not yet assigned"}}},"CVE-2021-30550":{"description":"Use after free in Accessibility in Google Chrome prior to 91.0.4472.101 allowed an attacker who convinced a user to install a malicious extension to potentially exploit heap corruption via a crafted HTML page.","debianbug":990079,"scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"143.0.7499.169-1~deb12u1","bookworm-security":"145.0.7632.159-1~deb12u1"},"fixed_version":"93.0.4577.82-1","urgency":"not yet assigned"},"bullseye":{"status":"resolved","repositories":{"bullseye":"120.0.6099.224-1~deb11u1","bullseye-security":"120.0.6099.224-1~deb11u1"},"fixed_version":"93.0.4577.82-1","urgency":"not yet assigned"},"forky":{"status":"resolved","repositories":{"forky":"145.0.7632.159-1"},"fixed_version":"93.0.4577.82-1","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"146.0.7680.71-1"},"fixed_version":"93.0.4577.82-1","urgency":"not yet assigned"},"trixie":{"status":"resolved","repositories":{"trixie":"143.0.7499.169-1~deb13u1","trixie-security":"145.0.7632.159-1~deb13u1"},"fixed_version":"93.0.4577.82-1","urgency":"not yet assigned"}}},"CVE-2021-30551":{"description":"Type confusion in V8 in Google Chrome prior to 91.0.4472.101 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page.","debianbug":990079,"scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"143.0.7499.169-1~deb12u1","bookworm-security":"145.0.7632.159-1~deb12u1"},"fixed_version":"93.0.4577.82-1","urgency":"not yet assigned"},"bullseye":{"status":"resolved","repositories":{"bullseye":"120.0.6099.224-1~deb11u1","bullseye-security":"120.0.6099.224-1~deb11u1"},"fixed_version":"93.0.4577.82-1","urgency":"not yet assigned"},"forky":{"status":"resolved","repositories":{"forky":"145.0.7632.159-1"},"fixed_version":"93.0.4577.82-1","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"146.0.7680.71-1"},"fixed_version":"93.0.4577.82-1","urgency":"not yet assigned"},"trixie":{"status":"resolved","repositories":{"trixie":"143.0.7499.169-1~deb13u1","trixie-security":"145.0.7632.159-1~deb13u1"},"fixed_version":"93.0.4577.82-1","urgency":"not yet assigned"}}},"CVE-2021-30552":{"description":"Use after free in Extensions in Google Chrome prior to 91.0.4472.101 allowed an attacker who convinced a user to install a malicious extension to potentially exploit heap corruption via a crafted HTML page.","debianbug":990079,"scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"143.0.7499.169-1~deb12u1","bookworm-security":"145.0.7632.159-1~deb12u1"},"fixed_version":"93.0.4577.82-1","urgency":"not yet assigned"},"bullseye":{"status":"resolved","repositories":{"bullseye":"120.0.6099.224-1~deb11u1","bullseye-security":"120.0.6099.224-1~deb11u1"},"fixed_version":"93.0.4577.82-1","urgency":"not yet assigned"},"forky":{"status":"resolved","repositories":{"forky":"145.0.7632.159-1"},"fixed_version":"93.0.4577.82-1","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"146.0.7680.71-1"},"fixed_version":"93.0.4577.82-1","urgency":"not yet assigned"},"trixie":{"status":"resolved","repositories":{"trixie":"143.0.7499.169-1~deb13u1","trixie-security":"145.0.7632.159-1~deb13u1"},"fixed_version":"93.0.4577.82-1","urgency":"not yet assigned"}}},"CVE-2021-30553":{"description":"Use after free in Network service in Google Chrome prior to 91.0.4472.101 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page.","debianbug":990079,"scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"143.0.7499.169-1~deb12u1","bookworm-security":"145.0.7632.159-1~deb12u1"},"fixed_version":"93.0.4577.82-1","urgency":"not yet assigned"},"bullseye":{"status":"resolved","repositories":{"bullseye":"120.0.6099.224-1~deb11u1","bullseye-security":"120.0.6099.224-1~deb11u1"},"fixed_version":"93.0.4577.82-1","urgency":"not yet assigned"},"forky":{"status":"resolved","repositories":{"forky":"145.0.7632.159-1"},"fixed_version":"93.0.4577.82-1","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"146.0.7680.71-1"},"fixed_version":"93.0.4577.82-1","urgency":"not yet assigned"},"trixie":{"status":"resolved","repositories":{"trixie":"143.0.7499.169-1~deb13u1","trixie-security":"145.0.7632.159-1~deb13u1"},"fixed_version":"93.0.4577.82-1","urgency":"not yet assigned"}}},"CVE-2021-30554":{"description":"Use after free in WebGL in Google Chrome prior to 91.0.4472.114 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page.","debianbug":990079,"scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"143.0.7499.169-1~deb12u1","bookworm-security":"145.0.7632.159-1~deb12u1"},"fixed_version":"93.0.4577.82-1","urgency":"not yet assigned"},"bullseye":{"status":"resolved","repositories":{"bullseye":"120.0.6099.224-1~deb11u1","bullseye-security":"120.0.6099.224-1~deb11u1"},"fixed_version":"93.0.4577.82-1","urgency":"not yet assigned"},"forky":{"status":"resolved","repositories":{"forky":"145.0.7632.159-1"},"fixed_version":"93.0.4577.82-1","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"146.0.7680.71-1"},"fixed_version":"93.0.4577.82-1","urgency":"not yet assigned"},"trixie":{"status":"resolved","repositories":{"trixie":"143.0.7499.169-1~deb13u1","trixie-security":"145.0.7632.159-1~deb13u1"},"fixed_version":"93.0.4577.82-1","urgency":"not yet assigned"}}},"CVE-2021-30555":{"description":"Use after free in Sharing in Google Chrome prior to 91.0.4472.114 allowed an attacker who convinced a user to install a malicious extension to potentially exploit heap corruption via a crafted HTML page and user gesture.","debianbug":990079,"scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"143.0.7499.169-1~deb12u1","bookworm-security":"145.0.7632.159-1~deb12u1"},"fixed_version":"93.0.4577.82-1","urgency":"not yet assigned"},"bullseye":{"status":"resolved","repositories":{"bullseye":"120.0.6099.224-1~deb11u1","bullseye-security":"120.0.6099.224-1~deb11u1"},"fixed_version":"93.0.4577.82-1","urgency":"not yet assigned"},"forky":{"status":"resolved","repositories":{"forky":"145.0.7632.159-1"},"fixed_version":"93.0.4577.82-1","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"146.0.7680.71-1"},"fixed_version":"93.0.4577.82-1","urgency":"not yet assigned"},"trixie":{"status":"resolved","repositories":{"trixie":"143.0.7499.169-1~deb13u1","trixie-security":"145.0.7632.159-1~deb13u1"},"fixed_version":"93.0.4577.82-1","urgency":"not yet assigned"}}},"CVE-2021-30556":{"description":"Use after free in WebAudio in Google Chrome prior to 91.0.4472.114 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page.","debianbug":990079,"scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"143.0.7499.169-1~deb12u1","bookworm-security":"145.0.7632.159-1~deb12u1"},"fixed_version":"93.0.4577.82-1","urgency":"not yet assigned"},"bullseye":{"status":"resolved","repositories":{"bullseye":"120.0.6099.224-1~deb11u1","bullseye-security":"120.0.6099.224-1~deb11u1"},"fixed_version":"93.0.4577.82-1","urgency":"not yet assigned"},"forky":{"status":"resolved","repositories":{"forky":"145.0.7632.159-1"},"fixed_version":"93.0.4577.82-1","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"146.0.7680.71-1"},"fixed_version":"93.0.4577.82-1","urgency":"not yet assigned"},"trixie":{"status":"resolved","repositories":{"trixie":"143.0.7499.169-1~deb13u1","trixie-security":"145.0.7632.159-1~deb13u1"},"fixed_version":"93.0.4577.82-1","urgency":"not yet assigned"}}},"CVE-2021-30557":{"description":"Use after free in TabGroups in Google Chrome prior to 91.0.4472.114 allowed an attacker who convinced a user to install a malicious extension to potentially exploit heap corruption via a crafted HTML page.","debianbug":990079,"scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"143.0.7499.169-1~deb12u1","bookworm-security":"145.0.7632.159-1~deb12u1"},"fixed_version":"93.0.4577.82-1","urgency":"not yet assigned"},"bullseye":{"status":"resolved","repositories":{"bullseye":"120.0.6099.224-1~deb11u1","bullseye-security":"120.0.6099.224-1~deb11u1"},"fixed_version":"93.0.4577.82-1","urgency":"not yet assigned"},"forky":{"status":"resolved","repositories":{"forky":"145.0.7632.159-1"},"fixed_version":"93.0.4577.82-1","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"146.0.7680.71-1"},"fixed_version":"93.0.4577.82-1","urgency":"not yet assigned"},"trixie":{"status":"resolved","repositories":{"trixie":"143.0.7499.169-1~deb13u1","trixie-security":"145.0.7632.159-1~deb13u1"},"fixed_version":"93.0.4577.82-1","urgency":"not yet assigned"}}},"CVE-2021-30558":{"description":"Insufficient policy enforcement in content security policy in Google Chrome prior to 91.0.4472.77 allowed a remote attacker to bypass content security policy via a crafted HTML page. (Chrome security severity: Medium)","debianbug":990079,"scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"143.0.7499.169-1~deb12u1","bookworm-security":"145.0.7632.159-1~deb12u1"},"fixed_version":"93.0.4577.82-1","urgency":"not yet assigned"},"bullseye":{"status":"resolved","repositories":{"bullseye":"120.0.6099.224-1~deb11u1","bullseye-security":"120.0.6099.224-1~deb11u1"},"fixed_version":"97.0.4692.71-0.1~deb11u1","urgency":"not yet assigned"},"forky":{"status":"resolved","repositories":{"forky":"145.0.7632.159-1"},"fixed_version":"93.0.4577.82-1","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"146.0.7680.71-1"},"fixed_version":"93.0.4577.82-1","urgency":"not yet assigned"},"trixie":{"status":"resolved","repositories":{"trixie":"143.0.7499.169-1~deb13u1","trixie-security":"145.0.7632.159-1~deb13u1"},"fixed_version":"93.0.4577.82-1","urgency":"not yet assigned"}}},"CVE-2021-30559":{"description":"Out of bounds write in ANGLE in Google Chrome prior to 91.0.4472.164 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page.","debianbug":990079,"scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"143.0.7499.169-1~deb12u1","bookworm-security":"145.0.7632.159-1~deb12u1"},"fixed_version":"93.0.4577.82-1","urgency":"not yet assigned"},"bullseye":{"status":"resolved","repositories":{"bullseye":"120.0.6099.224-1~deb11u1","bullseye-security":"120.0.6099.224-1~deb11u1"},"fixed_version":"93.0.4577.82-1","urgency":"not yet assigned"},"forky":{"status":"resolved","repositories":{"forky":"145.0.7632.159-1"},"fixed_version":"93.0.4577.82-1","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"146.0.7680.71-1"},"fixed_version":"93.0.4577.82-1","urgency":"not yet assigned"},"trixie":{"status":"resolved","repositories":{"trixie":"143.0.7499.169-1~deb13u1","trixie-security":"145.0.7632.159-1~deb13u1"},"fixed_version":"93.0.4577.82-1","urgency":"not yet assigned"}}},"CVE-2021-30560":{"description":"Use after free in Blink XSLT in Google Chrome prior to 91.0.4472.164 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page.","debianbug":990079,"scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"143.0.7499.169-1~deb12u1","bookworm-security":"145.0.7632.159-1~deb12u1"},"fixed_version":"93.0.4577.82-1","urgency":"not yet assigned"},"bullseye":{"status":"resolved","repositories":{"bullseye":"120.0.6099.224-1~deb11u1","bullseye-security":"120.0.6099.224-1~deb11u1"},"fixed_version":"93.0.4577.82-1","urgency":"not yet assigned"},"forky":{"status":"resolved","repositories":{"forky":"145.0.7632.159-1"},"fixed_version":"93.0.4577.82-1","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"146.0.7680.71-1"},"fixed_version":"93.0.4577.82-1","urgency":"not yet assigned"},"trixie":{"status":"resolved","repositories":{"trixie":"143.0.7499.169-1~deb13u1","trixie-security":"145.0.7632.159-1~deb13u1"},"fixed_version":"93.0.4577.82-1","urgency":"not yet assigned"}}},"CVE-2021-30561":{"description":"Type Confusion in V8 in Google Chrome prior to 91.0.4472.164 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page.","debianbug":990079,"scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"143.0.7499.169-1~deb12u1","bookworm-security":"145.0.7632.159-1~deb12u1"},"fixed_version":"93.0.4577.82-1","urgency":"not yet assigned"},"bullseye":{"status":"resolved","repositories":{"bullseye":"120.0.6099.224-1~deb11u1","bullseye-security":"120.0.6099.224-1~deb11u1"},"fixed_version":"93.0.4577.82-1","urgency":"not yet assigned"},"forky":{"status":"resolved","repositories":{"forky":"145.0.7632.159-1"},"fixed_version":"93.0.4577.82-1","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"146.0.7680.71-1"},"fixed_version":"93.0.4577.82-1","urgency":"not yet assigned"},"trixie":{"status":"resolved","repositories":{"trixie":"143.0.7499.169-1~deb13u1","trixie-security":"145.0.7632.159-1~deb13u1"},"fixed_version":"93.0.4577.82-1","urgency":"not yet assigned"}}},"CVE-2021-30562":{"description":"Use after free in WebSerial in Google Chrome prior to 91.0.4472.164 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page.","debianbug":990079,"scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"143.0.7499.169-1~deb12u1","bookworm-security":"145.0.7632.159-1~deb12u1"},"fixed_version":"93.0.4577.82-1","urgency":"not yet assigned"},"bullseye":{"status":"resolved","repositories":{"bullseye":"120.0.6099.224-1~deb11u1","bullseye-security":"120.0.6099.224-1~deb11u1"},"fixed_version":"93.0.4577.82-1","urgency":"not yet assigned"},"forky":{"status":"resolved","repositories":{"forky":"145.0.7632.159-1"},"fixed_version":"93.0.4577.82-1","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"146.0.7680.71-1"},"fixed_version":"93.0.4577.82-1","urgency":"not yet assigned"},"trixie":{"status":"resolved","repositories":{"trixie":"143.0.7499.169-1~deb13u1","trixie-security":"145.0.7632.159-1~deb13u1"},"fixed_version":"93.0.4577.82-1","urgency":"not yet assigned"}}},"CVE-2021-30563":{"description":"Type Confusion in V8 in Google Chrome prior to 91.0.4472.164 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page.","debianbug":990079,"scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"143.0.7499.169-1~deb12u1","bookworm-security":"145.0.7632.159-1~deb12u1"},"fixed_version":"93.0.4577.82-1","urgency":"not yet assigned"},"bullseye":{"status":"resolved","repositories":{"bullseye":"120.0.6099.224-1~deb11u1","bullseye-security":"120.0.6099.224-1~deb11u1"},"fixed_version":"93.0.4577.82-1","urgency":"not yet assigned"},"forky":{"status":"resolved","repositories":{"forky":"145.0.7632.159-1"},"fixed_version":"93.0.4577.82-1","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"146.0.7680.71-1"},"fixed_version":"93.0.4577.82-1","urgency":"not yet assigned"},"trixie":{"status":"resolved","repositories":{"trixie":"143.0.7499.169-1~deb13u1","trixie-security":"145.0.7632.159-1~deb13u1"},"fixed_version":"93.0.4577.82-1","urgency":"not yet assigned"}}},"CVE-2021-30564":{"description":"Heap buffer overflow in WebXR in Google Chrome prior to 91.0.4472.164 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page.","debianbug":990079,"scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"143.0.7499.169-1~deb12u1","bookworm-security":"145.0.7632.159-1~deb12u1"},"fixed_version":"93.0.4577.82-1","urgency":"not yet assigned"},"bullseye":{"status":"resolved","repositories":{"bullseye":"120.0.6099.224-1~deb11u1","bullseye-security":"120.0.6099.224-1~deb11u1"},"fixed_version":"93.0.4577.82-1","urgency":"not yet assigned"},"forky":{"status":"resolved","repositories":{"forky":"145.0.7632.159-1"},"fixed_version":"93.0.4577.82-1","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"146.0.7680.71-1"},"fixed_version":"93.0.4577.82-1","urgency":"not yet assigned"},"trixie":{"status":"resolved","repositories":{"trixie":"143.0.7499.169-1~deb13u1","trixie-security":"145.0.7632.159-1~deb13u1"},"fixed_version":"93.0.4577.82-1","urgency":"not yet assigned"}}},"CVE-2021-30565":{"description":"Out of bounds write in Tab Groups in Google Chrome on Linux and ChromeOS prior to 92.0.4515.107 allowed an attacker who convinced a user to install a malicious extension to perform an out of bounds memory write via a crafted HTML page.","debianbug":990079,"scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"143.0.7499.169-1~deb12u1","bookworm-security":"145.0.7632.159-1~deb12u1"},"fixed_version":"93.0.4577.82-1","urgency":"not yet assigned"},"bullseye":{"status":"resolved","repositories":{"bullseye":"120.0.6099.224-1~deb11u1","bullseye-security":"120.0.6099.224-1~deb11u1"},"fixed_version":"93.0.4577.82-1","urgency":"not yet assigned"},"forky":{"status":"resolved","repositories":{"forky":"145.0.7632.159-1"},"fixed_version":"93.0.4577.82-1","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"146.0.7680.71-1"},"fixed_version":"93.0.4577.82-1","urgency":"not yet assigned"},"trixie":{"status":"resolved","repositories":{"trixie":"143.0.7499.169-1~deb13u1","trixie-security":"145.0.7632.159-1~deb13u1"},"fixed_version":"93.0.4577.82-1","urgency":"not yet assigned"}}},"CVE-2021-30566":{"description":"Stack buffer overflow in Printing in Google Chrome prior to 92.0.4515.107 allowed a remote attacker who had compromised the renderer process to potentially exploit stack corruption via a crafted HTML page.","debianbug":990079,"scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"143.0.7499.169-1~deb12u1","bookworm-security":"145.0.7632.159-1~deb12u1"},"fixed_version":"93.0.4577.82-1","urgency":"not yet assigned"},"bullseye":{"status":"resolved","repositories":{"bullseye":"120.0.6099.224-1~deb11u1","bullseye-security":"120.0.6099.224-1~deb11u1"},"fixed_version":"93.0.4577.82-1","urgency":"not yet assigned"},"forky":{"status":"resolved","repositories":{"forky":"145.0.7632.159-1"},"fixed_version":"93.0.4577.82-1","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"146.0.7680.71-1"},"fixed_version":"93.0.4577.82-1","urgency":"not yet assigned"},"trixie":{"status":"resolved","repositories":{"trixie":"143.0.7499.169-1~deb13u1","trixie-security":"145.0.7632.159-1~deb13u1"},"fixed_version":"93.0.4577.82-1","urgency":"not yet assigned"}}},"CVE-2021-30567":{"description":"Use after free in DevTools in Google Chrome prior to 92.0.4515.107 allowed an attacker who convinced a user to open DevTools to potentially exploit heap corruption via specific user gesture.","debianbug":990079,"scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"143.0.7499.169-1~deb12u1","bookworm-security":"145.0.7632.159-1~deb12u1"},"fixed_version":"93.0.4577.82-1","urgency":"not yet assigned"},"bullseye":{"status":"resolved","repositories":{"bullseye":"120.0.6099.224-1~deb11u1","bullseye-security":"120.0.6099.224-1~deb11u1"},"fixed_version":"93.0.4577.82-1","urgency":"not yet assigned"},"forky":{"status":"resolved","repositories":{"forky":"145.0.7632.159-1"},"fixed_version":"93.0.4577.82-1","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"146.0.7680.71-1"},"fixed_version":"93.0.4577.82-1","urgency":"not yet assigned"},"trixie":{"status":"resolved","repositories":{"trixie":"143.0.7499.169-1~deb13u1","trixie-security":"145.0.7632.159-1~deb13u1"},"fixed_version":"93.0.4577.82-1","urgency":"not yet assigned"}}},"CVE-2021-30568":{"description":"Heap buffer overflow in WebGL in Google Chrome prior to 92.0.4515.107 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page.","debianbug":990079,"scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"143.0.7499.169-1~deb12u1","bookworm-security":"145.0.7632.159-1~deb12u1"},"fixed_version":"93.0.4577.82-1","urgency":"not yet assigned"},"bullseye":{"status":"resolved","repositories":{"bullseye":"120.0.6099.224-1~deb11u1","bullseye-security":"120.0.6099.224-1~deb11u1"},"fixed_version":"93.0.4577.82-1","urgency":"not yet assigned"},"forky":{"status":"resolved","repositories":{"forky":"145.0.7632.159-1"},"fixed_version":"93.0.4577.82-1","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"146.0.7680.71-1"},"fixed_version":"93.0.4577.82-1","urgency":"not yet assigned"},"trixie":{"status":"resolved","repositories":{"trixie":"143.0.7499.169-1~deb13u1","trixie-security":"145.0.7632.159-1~deb13u1"},"fixed_version":"93.0.4577.82-1","urgency":"not yet assigned"}}},"CVE-2021-30569":{"description":"Use after free in sqlite in Google Chrome prior to 92.0.4515.107 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page.","debianbug":990079,"scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"143.0.7499.169-1~deb12u1","bookworm-security":"145.0.7632.159-1~deb12u1"},"fixed_version":"93.0.4577.82-1","urgency":"not yet assigned"},"bullseye":{"status":"resolved","repositories":{"bullseye":"120.0.6099.224-1~deb11u1","bullseye-security":"120.0.6099.224-1~deb11u1"},"fixed_version":"93.0.4577.82-1","urgency":"not yet assigned"},"forky":{"status":"resolved","repositories":{"forky":"145.0.7632.159-1"},"fixed_version":"93.0.4577.82-1","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"146.0.7680.71-1"},"fixed_version":"93.0.4577.82-1","urgency":"not yet assigned"},"trixie":{"status":"resolved","repositories":{"trixie":"143.0.7499.169-1~deb13u1","trixie-security":"145.0.7632.159-1~deb13u1"},"fixed_version":"93.0.4577.82-1","urgency":"not yet assigned"}}},"CVE-2021-30571":{"description":"Insufficient policy enforcement in DevTools in Google Chrome prior to 92.0.4515.107 allowed an attacker who convinced a user to install a malicious extension to potentially perform a sandbox escape via a crafted HTML page.","debianbug":990079,"scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"143.0.7499.169-1~deb12u1","bookworm-security":"145.0.7632.159-1~deb12u1"},"fixed_version":"93.0.4577.82-1","urgency":"not yet assigned"},"bullseye":{"status":"resolved","repositories":{"bullseye":"120.0.6099.224-1~deb11u1","bullseye-security":"120.0.6099.224-1~deb11u1"},"fixed_version":"93.0.4577.82-1","urgency":"not yet assigned"},"forky":{"status":"resolved","repositories":{"forky":"145.0.7632.159-1"},"fixed_version":"93.0.4577.82-1","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"146.0.7680.71-1"},"fixed_version":"93.0.4577.82-1","urgency":"not yet assigned"},"trixie":{"status":"resolved","repositories":{"trixie":"143.0.7499.169-1~deb13u1","trixie-security":"145.0.7632.159-1~deb13u1"},"fixed_version":"93.0.4577.82-1","urgency":"not yet assigned"}}},"CVE-2021-30572":{"description":"Use after free in Autofill in Google Chrome prior to 92.0.4515.107 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page.","debianbug":990079,"scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"143.0.7499.169-1~deb12u1","bookworm-security":"145.0.7632.159-1~deb12u1"},"fixed_version":"93.0.4577.82-1","urgency":"not yet assigned"},"bullseye":{"status":"resolved","repositories":{"bullseye":"120.0.6099.224-1~deb11u1","bullseye-security":"120.0.6099.224-1~deb11u1"},"fixed_version":"93.0.4577.82-1","urgency":"not yet assigned"},"forky":{"status":"resolved","repositories":{"forky":"145.0.7632.159-1"},"fixed_version":"93.0.4577.82-1","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"146.0.7680.71-1"},"fixed_version":"93.0.4577.82-1","urgency":"not yet assigned"},"trixie":{"status":"resolved","repositories":{"trixie":"143.0.7499.169-1~deb13u1","trixie-security":"145.0.7632.159-1~deb13u1"},"fixed_version":"93.0.4577.82-1","urgency":"not yet assigned"}}},"CVE-2021-30573":{"description":"Use after free in GPU in Google Chrome prior to 92.0.4515.107 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page.","debianbug":990079,"scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"143.0.7499.169-1~deb12u1","bookworm-security":"145.0.7632.159-1~deb12u1"},"fixed_version":"93.0.4577.82-1","urgency":"not yet assigned"},"bullseye":{"status":"resolved","repositories":{"bullseye":"120.0.6099.224-1~deb11u1","bullseye-security":"120.0.6099.224-1~deb11u1"},"fixed_version":"93.0.4577.82-1","urgency":"not yet assigned"},"forky":{"status":"resolved","repositories":{"forky":"145.0.7632.159-1"},"fixed_version":"93.0.4577.82-1","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"146.0.7680.71-1"},"fixed_version":"93.0.4577.82-1","urgency":"not yet assigned"},"trixie":{"status":"resolved","repositories":{"trixie":"143.0.7499.169-1~deb13u1","trixie-security":"145.0.7632.159-1~deb13u1"},"fixed_version":"93.0.4577.82-1","urgency":"not yet assigned"}}},"CVE-2021-30574":{"description":"Use after free in protocol handling in Google Chrome prior to 92.0.4515.107 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page.","debianbug":990079,"scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"143.0.7499.169-1~deb12u1","bookworm-security":"145.0.7632.159-1~deb12u1"},"fixed_version":"93.0.4577.82-1","urgency":"not yet assigned"},"bullseye":{"status":"resolved","repositories":{"bullseye":"120.0.6099.224-1~deb11u1","bullseye-security":"120.0.6099.224-1~deb11u1"},"fixed_version":"93.0.4577.82-1","urgency":"not yet assigned"},"forky":{"status":"resolved","repositories":{"forky":"145.0.7632.159-1"},"fixed_version":"93.0.4577.82-1","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"146.0.7680.71-1"},"fixed_version":"93.0.4577.82-1","urgency":"not yet assigned"},"trixie":{"status":"resolved","repositories":{"trixie":"143.0.7499.169-1~deb13u1","trixie-security":"145.0.7632.159-1~deb13u1"},"fixed_version":"93.0.4577.82-1","urgency":"not yet assigned"}}},"CVE-2021-30575":{"description":"Out of bounds write in Autofill in Google Chrome prior to 92.0.4515.107 allowed a remote attacker who had compromised the renderer process to potentially exploit heap corruption via a crafted HTML page.","debianbug":990079,"scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"143.0.7499.169-1~deb12u1","bookworm-security":"145.0.7632.159-1~deb12u1"},"fixed_version":"93.0.4577.82-1","urgency":"not yet assigned"},"bullseye":{"status":"resolved","repositories":{"bullseye":"120.0.6099.224-1~deb11u1","bullseye-security":"120.0.6099.224-1~deb11u1"},"fixed_version":"93.0.4577.82-1","urgency":"not yet assigned"},"forky":{"status":"resolved","repositories":{"forky":"145.0.7632.159-1"},"fixed_version":"93.0.4577.82-1","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"146.0.7680.71-1"},"fixed_version":"93.0.4577.82-1","urgency":"not yet assigned"},"trixie":{"status":"resolved","repositories":{"trixie":"143.0.7499.169-1~deb13u1","trixie-security":"145.0.7632.159-1~deb13u1"},"fixed_version":"93.0.4577.82-1","urgency":"not yet assigned"}}},"CVE-2021-30576":{"description":"Use after free in DevTools in Google Chrome prior to 92.0.4515.107 allowed an attacker who convinced a user to install a malicious extension to potentially exploit heap corruption via a crafted HTML page.","debianbug":990079,"scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"143.0.7499.169-1~deb12u1","bookworm-security":"145.0.7632.159-1~deb12u1"},"fixed_version":"93.0.4577.82-1","urgency":"not yet assigned"},"bullseye":{"status":"resolved","repositories":{"bullseye":"120.0.6099.224-1~deb11u1","bullseye-security":"120.0.6099.224-1~deb11u1"},"fixed_version":"93.0.4577.82-1","urgency":"not yet assigned"},"forky":{"status":"resolved","repositories":{"forky":"145.0.7632.159-1"},"fixed_version":"93.0.4577.82-1","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"146.0.7680.71-1"},"fixed_version":"93.0.4577.82-1","urgency":"not yet assigned"},"trixie":{"status":"resolved","repositories":{"trixie":"143.0.7499.169-1~deb13u1","trixie-security":"145.0.7632.159-1~deb13u1"},"fixed_version":"93.0.4577.82-1","urgency":"not yet assigned"}}},"CVE-2021-30577":{"description":"Insufficient policy enforcement in Installer in Google Chrome prior to 92.0.4515.107 allowed a remote attacker to perform local privilege escalation via a crafted file.","debianbug":990079,"scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"143.0.7499.169-1~deb12u1","bookworm-security":"145.0.7632.159-1~deb12u1"},"fixed_version":"93.0.4577.82-1","urgency":"not yet assigned"},"bullseye":{"status":"resolved","repositories":{"bullseye":"120.0.6099.224-1~deb11u1","bullseye-security":"120.0.6099.224-1~deb11u1"},"fixed_version":"93.0.4577.82-1","urgency":"not yet assigned"},"forky":{"status":"resolved","repositories":{"forky":"145.0.7632.159-1"},"fixed_version":"93.0.4577.82-1","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"146.0.7680.71-1"},"fixed_version":"93.0.4577.82-1","urgency":"not yet assigned"},"trixie":{"status":"resolved","repositories":{"trixie":"143.0.7499.169-1~deb13u1","trixie-security":"145.0.7632.159-1~deb13u1"},"fixed_version":"93.0.4577.82-1","urgency":"not yet assigned"}}},"CVE-2021-30578":{"description":"Uninitialized use in Media in Google Chrome prior to 92.0.4515.107 allowed a remote attacker to perform out of bounds memory access via a crafted HTML page.","debianbug":990079,"scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"143.0.7499.169-1~deb12u1","bookworm-security":"145.0.7632.159-1~deb12u1"},"fixed_version":"93.0.4577.82-1","urgency":"not yet assigned"},"bullseye":{"status":"resolved","repositories":{"bullseye":"120.0.6099.224-1~deb11u1","bullseye-security":"120.0.6099.224-1~deb11u1"},"fixed_version":"93.0.4577.82-1","urgency":"not yet assigned"},"forky":{"status":"resolved","repositories":{"forky":"145.0.7632.159-1"},"fixed_version":"93.0.4577.82-1","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"146.0.7680.71-1"},"fixed_version":"93.0.4577.82-1","urgency":"not yet assigned"},"trixie":{"status":"resolved","repositories":{"trixie":"143.0.7499.169-1~deb13u1","trixie-security":"145.0.7632.159-1~deb13u1"},"fixed_version":"93.0.4577.82-1","urgency":"not yet assigned"}}},"CVE-2021-30579":{"description":"Use after free in UI framework in Google Chrome prior to 92.0.4515.107 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page.","debianbug":990079,"scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"143.0.7499.169-1~deb12u1","bookworm-security":"145.0.7632.159-1~deb12u1"},"fixed_version":"93.0.4577.82-1","urgency":"not yet assigned"},"bullseye":{"status":"resolved","repositories":{"bullseye":"120.0.6099.224-1~deb11u1","bullseye-security":"120.0.6099.224-1~deb11u1"},"fixed_version":"93.0.4577.82-1","urgency":"not yet assigned"},"forky":{"status":"resolved","repositories":{"forky":"145.0.7632.159-1"},"fixed_version":"93.0.4577.82-1","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"146.0.7680.71-1"},"fixed_version":"93.0.4577.82-1","urgency":"not yet assigned"},"trixie":{"status":"resolved","repositories":{"trixie":"143.0.7499.169-1~deb13u1","trixie-security":"145.0.7632.159-1~deb13u1"},"fixed_version":"93.0.4577.82-1","urgency":"not yet assigned"}}},"CVE-2021-30580":{"description":"Insufficient policy enforcement in Android intents in Google Chrome prior to 92.0.4515.107 allowed an attacker who convinced a user to install a malicious application to obtain potentially sensitive information via a crafted HTML page.","debianbug":990079,"scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"143.0.7499.169-1~deb12u1","bookworm-security":"145.0.7632.159-1~deb12u1"},"fixed_version":"93.0.4577.82-1","urgency":"not yet assigned"},"bullseye":{"status":"resolved","repositories":{"bullseye":"120.0.6099.224-1~deb11u1","bullseye-security":"120.0.6099.224-1~deb11u1"},"fixed_version":"93.0.4577.82-1","urgency":"not yet assigned"},"forky":{"status":"resolved","repositories":{"forky":"145.0.7632.159-1"},"fixed_version":"93.0.4577.82-1","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"146.0.7680.71-1"},"fixed_version":"93.0.4577.82-1","urgency":"not yet assigned"},"trixie":{"status":"resolved","repositories":{"trixie":"143.0.7499.169-1~deb13u1","trixie-security":"145.0.7632.159-1~deb13u1"},"fixed_version":"93.0.4577.82-1","urgency":"not yet assigned"}}},"CVE-2021-30581":{"description":"Use after free in DevTools in Google Chrome prior to 92.0.4515.107 allowed an attacker who convinced a user to install a malicious extension to potentially exploit heap corruption via a crafted HTML page.","debianbug":990079,"scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"143.0.7499.169-1~deb12u1","bookworm-security":"145.0.7632.159-1~deb12u1"},"fixed_version":"93.0.4577.82-1","urgency":"not yet assigned"},"bullseye":{"status":"resolved","repositories":{"bullseye":"120.0.6099.224-1~deb11u1","bullseye-security":"120.0.6099.224-1~deb11u1"},"fixed_version":"93.0.4577.82-1","urgency":"not yet assigned"},"forky":{"status":"resolved","repositories":{"forky":"145.0.7632.159-1"},"fixed_version":"93.0.4577.82-1","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"146.0.7680.71-1"},"fixed_version":"93.0.4577.82-1","urgency":"not yet assigned"},"trixie":{"status":"resolved","repositories":{"trixie":"143.0.7499.169-1~deb13u1","trixie-security":"145.0.7632.159-1~deb13u1"},"fixed_version":"93.0.4577.82-1","urgency":"not yet assigned"}}},"CVE-2021-30582":{"description":"Inappropriate implementation in Animation in Google Chrome prior to 92.0.4515.107 allowed a remote attacker to leak cross-origin data via a crafted HTML page.","debianbug":990079,"scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"143.0.7499.169-1~deb12u1","bookworm-security":"145.0.7632.159-1~deb12u1"},"fixed_version":"93.0.4577.82-1","urgency":"not yet assigned"},"bullseye":{"status":"resolved","repositories":{"bullseye":"120.0.6099.224-1~deb11u1","bullseye-security":"120.0.6099.224-1~deb11u1"},"fixed_version":"93.0.4577.82-1","urgency":"not yet assigned"},"forky":{"status":"resolved","repositories":{"forky":"145.0.7632.159-1"},"fixed_version":"93.0.4577.82-1","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"146.0.7680.71-1"},"fixed_version":"93.0.4577.82-1","urgency":"not yet assigned"},"trixie":{"status":"resolved","repositories":{"trixie":"143.0.7499.169-1~deb13u1","trixie-security":"145.0.7632.159-1~deb13u1"},"fixed_version":"93.0.4577.82-1","urgency":"not yet assigned"}}},"CVE-2021-30583":{"description":"Insufficient policy enforcement in image handling in iOS in Google Chrome on iOS prior to 92.0.4515.107 allowed a remote attacker to leak cross-origin data via a crafted HTML page.","debianbug":990079,"scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"143.0.7499.169-1~deb12u1","bookworm-security":"145.0.7632.159-1~deb12u1"},"fixed_version":"93.0.4577.82-1","urgency":"not yet assigned"},"bullseye":{"status":"resolved","repositories":{"bullseye":"120.0.6099.224-1~deb11u1","bullseye-security":"120.0.6099.224-1~deb11u1"},"fixed_version":"93.0.4577.82-1","urgency":"not yet assigned"},"forky":{"status":"resolved","repositories":{"forky":"145.0.7632.159-1"},"fixed_version":"93.0.4577.82-1","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"146.0.7680.71-1"},"fixed_version":"93.0.4577.82-1","urgency":"not yet assigned"},"trixie":{"status":"resolved","repositories":{"trixie":"143.0.7499.169-1~deb13u1","trixie-security":"145.0.7632.159-1~deb13u1"},"fixed_version":"93.0.4577.82-1","urgency":"not yet assigned"}}},"CVE-2021-30584":{"description":"Incorrect security UI in Downloads in Google Chrome on Android prior to 92.0.4515.107 allowed a remote attacker to perform domain spoofing via a crafted HTML page.","debianbug":990079,"scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"143.0.7499.169-1~deb12u1","bookworm-security":"145.0.7632.159-1~deb12u1"},"fixed_version":"93.0.4577.82-1","urgency":"not yet assigned"},"bullseye":{"status":"resolved","repositories":{"bullseye":"120.0.6099.224-1~deb11u1","bullseye-security":"120.0.6099.224-1~deb11u1"},"fixed_version":"93.0.4577.82-1","urgency":"not yet assigned"},"forky":{"status":"resolved","repositories":{"forky":"145.0.7632.159-1"},"fixed_version":"93.0.4577.82-1","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"146.0.7680.71-1"},"fixed_version":"93.0.4577.82-1","urgency":"not yet assigned"},"trixie":{"status":"resolved","repositories":{"trixie":"143.0.7499.169-1~deb13u1","trixie-security":"145.0.7632.159-1~deb13u1"},"fixed_version":"93.0.4577.82-1","urgency":"not yet assigned"}}},"CVE-2021-30585":{"description":"Use after free in sensor handling in Google Chrome on Windows prior to 92.0.4515.107 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page.","debianbug":990079,"scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"143.0.7499.169-1~deb12u1","bookworm-security":"145.0.7632.159-1~deb12u1"},"fixed_version":"93.0.4577.82-1","urgency":"not yet assigned"},"bullseye":{"status":"resolved","repositories":{"bullseye":"120.0.6099.224-1~deb11u1","bullseye-security":"120.0.6099.224-1~deb11u1"},"fixed_version":"93.0.4577.82-1","urgency":"not yet assigned"},"forky":{"status":"resolved","repositories":{"forky":"145.0.7632.159-1"},"fixed_version":"93.0.4577.82-1","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"146.0.7680.71-1"},"fixed_version":"93.0.4577.82-1","urgency":"not yet assigned"},"trixie":{"status":"resolved","repositories":{"trixie":"143.0.7499.169-1~deb13u1","trixie-security":"145.0.7632.159-1~deb13u1"},"fixed_version":"93.0.4577.82-1","urgency":"not yet assigned"}}},"CVE-2021-30586":{"description":"Use after free in dialog box handling in Windows in Google Chrome prior to 92.0.4515.107 allowed an attacker who convinced a user to install a malicious extension to potentially exploit heap corruption via a crafted HTML page.","debianbug":990079,"scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"143.0.7499.169-1~deb12u1","bookworm-security":"145.0.7632.159-1~deb12u1"},"fixed_version":"93.0.4577.82-1","urgency":"not yet assigned"},"bullseye":{"status":"resolved","repositories":{"bullseye":"120.0.6099.224-1~deb11u1","bullseye-security":"120.0.6099.224-1~deb11u1"},"fixed_version":"93.0.4577.82-1","urgency":"not yet assigned"},"forky":{"status":"resolved","repositories":{"forky":"145.0.7632.159-1"},"fixed_version":"93.0.4577.82-1","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"146.0.7680.71-1"},"fixed_version":"93.0.4577.82-1","urgency":"not yet assigned"},"trixie":{"status":"resolved","repositories":{"trixie":"143.0.7499.169-1~deb13u1","trixie-security":"145.0.7632.159-1~deb13u1"},"fixed_version":"93.0.4577.82-1","urgency":"not yet assigned"}}},"CVE-2021-30587":{"description":"Inappropriate implementation in Compositing in Google Chrome prior to 92.0.4515.107 allowed a remote attacker to potentially spoof the contents of the Omnibox (URL bar) via a crafted HTML page.","debianbug":990079,"scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"143.0.7499.169-1~deb12u1","bookworm-security":"145.0.7632.159-1~deb12u1"},"fixed_version":"93.0.4577.82-1","urgency":"not yet assigned"},"bullseye":{"status":"resolved","repositories":{"bullseye":"120.0.6099.224-1~deb11u1","bullseye-security":"120.0.6099.224-1~deb11u1"},"fixed_version":"93.0.4577.82-1","urgency":"not yet assigned"},"forky":{"status":"resolved","repositories":{"forky":"145.0.7632.159-1"},"fixed_version":"93.0.4577.82-1","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"146.0.7680.71-1"},"fixed_version":"93.0.4577.82-1","urgency":"not yet assigned"},"trixie":{"status":"resolved","repositories":{"trixie":"143.0.7499.169-1~deb13u1","trixie-security":"145.0.7632.159-1~deb13u1"},"fixed_version":"93.0.4577.82-1","urgency":"not yet assigned"}}},"CVE-2021-30588":{"description":"Type confusion in V8 in Google Chrome prior to 92.0.4515.107 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page.","debianbug":990079,"scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"143.0.7499.169-1~deb12u1","bookworm-security":"145.0.7632.159-1~deb12u1"},"fixed_version":"93.0.4577.82-1","urgency":"not yet assigned"},"bullseye":{"status":"resolved","repositories":{"bullseye":"120.0.6099.224-1~deb11u1","bullseye-security":"120.0.6099.224-1~deb11u1"},"fixed_version":"93.0.4577.82-1","urgency":"not yet assigned"},"forky":{"status":"resolved","repositories":{"forky":"145.0.7632.159-1"},"fixed_version":"93.0.4577.82-1","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"146.0.7680.71-1"},"fixed_version":"93.0.4577.82-1","urgency":"not yet assigned"},"trixie":{"status":"resolved","repositories":{"trixie":"143.0.7499.169-1~deb13u1","trixie-security":"145.0.7632.159-1~deb13u1"},"fixed_version":"93.0.4577.82-1","urgency":"not yet assigned"}}},"CVE-2021-30589":{"description":"Insufficient validation of untrusted input in Sharing in Google Chrome prior to 92.0.4515.107 allowed a remote attacker to bypass navigation restrictions via a crafted click-to-call link.","debianbug":990079,"scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"143.0.7499.169-1~deb12u1","bookworm-security":"145.0.7632.159-1~deb12u1"},"fixed_version":"93.0.4577.82-1","urgency":"not yet assigned"},"bullseye":{"status":"resolved","repositories":{"bullseye":"120.0.6099.224-1~deb11u1","bullseye-security":"120.0.6099.224-1~deb11u1"},"fixed_version":"93.0.4577.82-1","urgency":"not yet assigned"},"forky":{"status":"resolved","repositories":{"forky":"145.0.7632.159-1"},"fixed_version":"93.0.4577.82-1","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"146.0.7680.71-1"},"fixed_version":"93.0.4577.82-1","urgency":"not yet assigned"},"trixie":{"status":"resolved","repositories":{"trixie":"143.0.7499.169-1~deb13u1","trixie-security":"145.0.7632.159-1~deb13u1"},"fixed_version":"93.0.4577.82-1","urgency":"not yet assigned"}}},"CVE-2021-30590":{"description":"Heap buffer overflow in Bookmarks in Google Chrome prior to 92.0.4515.131 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page.","debianbug":990079,"scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"143.0.7499.169-1~deb12u1","bookworm-security":"145.0.7632.159-1~deb12u1"},"fixed_version":"93.0.4577.82-1","urgency":"not yet assigned"},"bullseye":{"status":"resolved","repositories":{"bullseye":"120.0.6099.224-1~deb11u1","bullseye-security":"120.0.6099.224-1~deb11u1"},"fixed_version":"93.0.4577.82-1","urgency":"not yet assigned"},"forky":{"status":"resolved","repositories":{"forky":"145.0.7632.159-1"},"fixed_version":"93.0.4577.82-1","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"146.0.7680.71-1"},"fixed_version":"93.0.4577.82-1","urgency":"not yet assigned"},"trixie":{"status":"resolved","repositories":{"trixie":"143.0.7499.169-1~deb13u1","trixie-security":"145.0.7632.159-1~deb13u1"},"fixed_version":"93.0.4577.82-1","urgency":"not yet assigned"}}},"CVE-2021-30591":{"description":"Use after free in File System API in Google Chrome prior to 92.0.4515.131 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page.","debianbug":990079,"scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"143.0.7499.169-1~deb12u1","bookworm-security":"145.0.7632.159-1~deb12u1"},"fixed_version":"93.0.4577.82-1","urgency":"not yet assigned"},"bullseye":{"status":"resolved","repositories":{"bullseye":"120.0.6099.224-1~deb11u1","bullseye-security":"120.0.6099.224-1~deb11u1"},"fixed_version":"93.0.4577.82-1","urgency":"not yet assigned"},"forky":{"status":"resolved","repositories":{"forky":"145.0.7632.159-1"},"fixed_version":"93.0.4577.82-1","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"146.0.7680.71-1"},"fixed_version":"93.0.4577.82-1","urgency":"not yet assigned"},"trixie":{"status":"resolved","repositories":{"trixie":"143.0.7499.169-1~deb13u1","trixie-security":"145.0.7632.159-1~deb13u1"},"fixed_version":"93.0.4577.82-1","urgency":"not yet assigned"}}},"CVE-2021-30592":{"description":"Out of bounds write in Tab Groups in Google Chrome prior to 92.0.4515.131 allowed an attacker who convinced a user to install a malicious extension to perform an out of bounds memory write via a crafted HTML page.","debianbug":990079,"scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"143.0.7499.169-1~deb12u1","bookworm-security":"145.0.7632.159-1~deb12u1"},"fixed_version":"93.0.4577.82-1","urgency":"not yet assigned"},"bullseye":{"status":"resolved","repositories":{"bullseye":"120.0.6099.224-1~deb11u1","bullseye-security":"120.0.6099.224-1~deb11u1"},"fixed_version":"93.0.4577.82-1","urgency":"not yet assigned"},"forky":{"status":"resolved","repositories":{"forky":"145.0.7632.159-1"},"fixed_version":"93.0.4577.82-1","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"146.0.7680.71-1"},"fixed_version":"93.0.4577.82-1","urgency":"not yet assigned"},"trixie":{"status":"resolved","repositories":{"trixie":"143.0.7499.169-1~deb13u1","trixie-security":"145.0.7632.159-1~deb13u1"},"fixed_version":"93.0.4577.82-1","urgency":"not yet assigned"}}},"CVE-2021-30593":{"description":"Out of bounds read in Tab Strip in Google Chrome prior to 92.0.4515.131 allowed an attacker who convinced a user to install a malicious extension to perform an out of bounds memory read via a crafted HTML page.","debianbug":990079,"scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"143.0.7499.169-1~deb12u1","bookworm-security":"145.0.7632.159-1~deb12u1"},"fixed_version":"93.0.4577.82-1","urgency":"not yet assigned"},"bullseye":{"status":"resolved","repositories":{"bullseye":"120.0.6099.224-1~deb11u1","bullseye-security":"120.0.6099.224-1~deb11u1"},"fixed_version":"93.0.4577.82-1","urgency":"not yet assigned"},"forky":{"status":"resolved","repositories":{"forky":"145.0.7632.159-1"},"fixed_version":"93.0.4577.82-1","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"146.0.7680.71-1"},"fixed_version":"93.0.4577.82-1","urgency":"not yet assigned"},"trixie":{"status":"resolved","repositories":{"trixie":"143.0.7499.169-1~deb13u1","trixie-security":"145.0.7632.159-1~deb13u1"},"fixed_version":"93.0.4577.82-1","urgency":"not yet assigned"}}},"CVE-2021-30594":{"description":"Use after free in Page Info UI in Google Chrome prior to 92.0.4515.131 allowed a remote attacker to potentially exploit heap corruption via physical access to the device.","debianbug":990079,"scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"143.0.7499.169-1~deb12u1","bookworm-security":"145.0.7632.159-1~deb12u1"},"fixed_version":"93.0.4577.82-1","urgency":"not yet assigned"},"bullseye":{"status":"resolved","repositories":{"bullseye":"120.0.6099.224-1~deb11u1","bullseye-security":"120.0.6099.224-1~deb11u1"},"fixed_version":"93.0.4577.82-1","urgency":"not yet assigned"},"forky":{"status":"resolved","repositories":{"forky":"145.0.7632.159-1"},"fixed_version":"93.0.4577.82-1","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"146.0.7680.71-1"},"fixed_version":"93.0.4577.82-1","urgency":"not yet assigned"},"trixie":{"status":"resolved","repositories":{"trixie":"143.0.7499.169-1~deb13u1","trixie-security":"145.0.7632.159-1~deb13u1"},"fixed_version":"93.0.4577.82-1","urgency":"not yet assigned"}}},"CVE-2021-30596":{"description":"Incorrect security UI in Navigation in Google Chrome on Android prior to 92.0.4515.131 allowed a remote attacker to spoof the contents of the Omnibox (URL bar) via a crafted HTML page.","debianbug":990079,"scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"143.0.7499.169-1~deb12u1","bookworm-security":"145.0.7632.159-1~deb12u1"},"fixed_version":"93.0.4577.82-1","urgency":"not yet assigned"},"bullseye":{"status":"resolved","repositories":{"bullseye":"120.0.6099.224-1~deb11u1","bullseye-security":"120.0.6099.224-1~deb11u1"},"fixed_version":"93.0.4577.82-1","urgency":"not yet assigned"},"forky":{"status":"resolved","repositories":{"forky":"145.0.7632.159-1"},"fixed_version":"93.0.4577.82-1","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"146.0.7680.71-1"},"fixed_version":"93.0.4577.82-1","urgency":"not yet assigned"},"trixie":{"status":"resolved","repositories":{"trixie":"143.0.7499.169-1~deb13u1","trixie-security":"145.0.7632.159-1~deb13u1"},"fixed_version":"93.0.4577.82-1","urgency":"not yet assigned"}}},"CVE-2021-30597":{"description":"Use after free in Browser UI in Google Chrome on Chrome prior to 92.0.4515.131 allowed a remote attacker to potentially exploit heap corruption via physical access to the device.","debianbug":990079,"scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"143.0.7499.169-1~deb12u1","bookworm-security":"145.0.7632.159-1~deb12u1"},"fixed_version":"93.0.4577.82-1","urgency":"not yet assigned"},"bullseye":{"status":"resolved","repositories":{"bullseye":"120.0.6099.224-1~deb11u1","bullseye-security":"120.0.6099.224-1~deb11u1"},"fixed_version":"93.0.4577.82-1","urgency":"not yet assigned"},"forky":{"status":"resolved","repositories":{"forky":"145.0.7632.159-1"},"fixed_version":"93.0.4577.82-1","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"146.0.7680.71-1"},"fixed_version":"93.0.4577.82-1","urgency":"not yet assigned"},"trixie":{"status":"resolved","repositories":{"trixie":"143.0.7499.169-1~deb13u1","trixie-security":"145.0.7632.159-1~deb13u1"},"fixed_version":"93.0.4577.82-1","urgency":"not yet assigned"}}},"CVE-2021-30598":{"description":"Type confusion in V8 in Google Chrome prior to 92.0.4515.159 allowed a remote attacker to execute arbitrary code inside a sandbox via a crafted HTML page.","debianbug":990079,"scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"143.0.7499.169-1~deb12u1","bookworm-security":"145.0.7632.159-1~deb12u1"},"fixed_version":"93.0.4577.82-1","urgency":"not yet assigned"},"bullseye":{"status":"resolved","repositories":{"bullseye":"120.0.6099.224-1~deb11u1","bullseye-security":"120.0.6099.224-1~deb11u1"},"fixed_version":"93.0.4577.82-1","urgency":"not yet assigned"},"forky":{"status":"resolved","repositories":{"forky":"145.0.7632.159-1"},"fixed_version":"93.0.4577.82-1","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"146.0.7680.71-1"},"fixed_version":"93.0.4577.82-1","urgency":"not yet assigned"},"trixie":{"status":"resolved","repositories":{"trixie":"143.0.7499.169-1~deb13u1","trixie-security":"145.0.7632.159-1~deb13u1"},"fixed_version":"93.0.4577.82-1","urgency":"not yet assigned"}}},"CVE-2021-30599":{"description":"Type confusion in V8 in Google Chrome prior to 92.0.4515.159 allowed a remote attacker to execute arbitrary code inside a sandbox via a crafted HTML page.","debianbug":990079,"scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"143.0.7499.169-1~deb12u1","bookworm-security":"145.0.7632.159-1~deb12u1"},"fixed_version":"93.0.4577.82-1","urgency":"not yet assigned"},"bullseye":{"status":"resolved","repositories":{"bullseye":"120.0.6099.224-1~deb11u1","bullseye-security":"120.0.6099.224-1~deb11u1"},"fixed_version":"93.0.4577.82-1","urgency":"not yet assigned"},"forky":{"status":"resolved","repositories":{"forky":"145.0.7632.159-1"},"fixed_version":"93.0.4577.82-1","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"146.0.7680.71-1"},"fixed_version":"93.0.4577.82-1","urgency":"not yet assigned"},"trixie":{"status":"resolved","repositories":{"trixie":"143.0.7499.169-1~deb13u1","trixie-security":"145.0.7632.159-1~deb13u1"},"fixed_version":"93.0.4577.82-1","urgency":"not yet assigned"}}},"CVE-2021-30600":{"description":"Use after free in Printing in Google Chrome prior to 92.0.4515.159 allowed a remote attacker who had compromised the renderer process to potentially exploit heap corruption via a crafted HTML page.","debianbug":990079,"scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"143.0.7499.169-1~deb12u1","bookworm-security":"145.0.7632.159-1~deb12u1"},"fixed_version":"93.0.4577.82-1","urgency":"not yet assigned"},"bullseye":{"status":"resolved","repositories":{"bullseye":"120.0.6099.224-1~deb11u1","bullseye-security":"120.0.6099.224-1~deb11u1"},"fixed_version":"93.0.4577.82-1","urgency":"not yet assigned"},"forky":{"status":"resolved","repositories":{"forky":"145.0.7632.159-1"},"fixed_version":"93.0.4577.82-1","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"146.0.7680.71-1"},"fixed_version":"93.0.4577.82-1","urgency":"not yet assigned"},"trixie":{"status":"resolved","repositories":{"trixie":"143.0.7499.169-1~deb13u1","trixie-security":"145.0.7632.159-1~deb13u1"},"fixed_version":"93.0.4577.82-1","urgency":"not yet assigned"}}},"CVE-2021-30601":{"description":"Use after free in Extensions API in Google Chrome prior to 92.0.4515.159 allowed an attacker who convinced a user to install a malicious extension to potentially exploit heap corruption via a crafted HTML page.","debianbug":990079,"scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"143.0.7499.169-1~deb12u1","bookworm-security":"145.0.7632.159-1~deb12u1"},"fixed_version":"93.0.4577.82-1","urgency":"not yet assigned"},"bullseye":{"status":"resolved","repositories":{"bullseye":"120.0.6099.224-1~deb11u1","bullseye-security":"120.0.6099.224-1~deb11u1"},"fixed_version":"93.0.4577.82-1","urgency":"not yet assigned"},"forky":{"status":"resolved","repositories":{"forky":"145.0.7632.159-1"},"fixed_version":"93.0.4577.82-1","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"146.0.7680.71-1"},"fixed_version":"93.0.4577.82-1","urgency":"not yet assigned"},"trixie":{"status":"resolved","repositories":{"trixie":"143.0.7499.169-1~deb13u1","trixie-security":"145.0.7632.159-1~deb13u1"},"fixed_version":"93.0.4577.82-1","urgency":"not yet assigned"}}},"CVE-2021-30602":{"description":"Use after free in WebRTC in Google Chrome prior to 92.0.4515.159 allowed an attacker who convinced a user to visit a malicious website to potentially exploit heap corruption via a crafted HTML page.","debianbug":990079,"scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"143.0.7499.169-1~deb12u1","bookworm-security":"145.0.7632.159-1~deb12u1"},"fixed_version":"93.0.4577.82-1","urgency":"not yet assigned"},"bullseye":{"status":"resolved","repositories":{"bullseye":"120.0.6099.224-1~deb11u1","bullseye-security":"120.0.6099.224-1~deb11u1"},"fixed_version":"93.0.4577.82-1","urgency":"not yet assigned"},"forky":{"status":"resolved","repositories":{"forky":"145.0.7632.159-1"},"fixed_version":"93.0.4577.82-1","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"146.0.7680.71-1"},"fixed_version":"93.0.4577.82-1","urgency":"not yet assigned"},"trixie":{"status":"resolved","repositories":{"trixie":"143.0.7499.169-1~deb13u1","trixie-security":"145.0.7632.159-1~deb13u1"},"fixed_version":"93.0.4577.82-1","urgency":"not yet assigned"}}},"CVE-2021-30603":{"description":"Data race in WebAudio in Google Chrome prior to 92.0.4515.159 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page.","debianbug":990079,"scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"143.0.7499.169-1~deb12u1","bookworm-security":"145.0.7632.159-1~deb12u1"},"fixed_version":"93.0.4577.82-1","urgency":"not yet assigned"},"bullseye":{"status":"resolved","repositories":{"bullseye":"120.0.6099.224-1~deb11u1","bullseye-security":"120.0.6099.224-1~deb11u1"},"fixed_version":"93.0.4577.82-1","urgency":"not yet assigned"},"forky":{"status":"resolved","repositories":{"forky":"145.0.7632.159-1"},"fixed_version":"93.0.4577.82-1","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"146.0.7680.71-1"},"fixed_version":"93.0.4577.82-1","urgency":"not yet assigned"},"trixie":{"status":"resolved","repositories":{"trixie":"143.0.7499.169-1~deb13u1","trixie-security":"145.0.7632.159-1~deb13u1"},"fixed_version":"93.0.4577.82-1","urgency":"not yet assigned"}}},"CVE-2021-30604":{"description":"Use after free in ANGLE in Google Chrome prior to 92.0.4515.159 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page.","debianbug":990079,"scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"143.0.7499.169-1~deb12u1","bookworm-security":"145.0.7632.159-1~deb12u1"},"fixed_version":"93.0.4577.82-1","urgency":"not yet assigned"},"bullseye":{"status":"resolved","repositories":{"bullseye":"120.0.6099.224-1~deb11u1","bullseye-security":"120.0.6099.224-1~deb11u1"},"fixed_version":"93.0.4577.82-1","urgency":"not yet assigned"},"forky":{"status":"resolved","repositories":{"forky":"145.0.7632.159-1"},"fixed_version":"93.0.4577.82-1","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"146.0.7680.71-1"},"fixed_version":"93.0.4577.82-1","urgency":"not yet assigned"},"trixie":{"status":"resolved","repositories":{"trixie":"143.0.7499.169-1~deb13u1","trixie-security":"145.0.7632.159-1~deb13u1"},"fixed_version":"93.0.4577.82-1","urgency":"not yet assigned"}}},"CVE-2021-30606":{"description":"Chromium: CVE-2021-30606 Use after free in Blink","scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"143.0.7499.169-1~deb12u1","bookworm-security":"145.0.7632.159-1~deb12u1"},"fixed_version":"93.0.4577.82-1","urgency":"not yet assigned"},"bullseye":{"status":"resolved","repositories":{"bullseye":"120.0.6099.224-1~deb11u1","bullseye-security":"120.0.6099.224-1~deb11u1"},"fixed_version":"93.0.4577.82-1","urgency":"not yet assigned"},"forky":{"status":"resolved","repositories":{"forky":"145.0.7632.159-1"},"fixed_version":"93.0.4577.82-1","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"146.0.7680.71-1"},"fixed_version":"93.0.4577.82-1","urgency":"not yet assigned"},"trixie":{"status":"resolved","repositories":{"trixie":"143.0.7499.169-1~deb13u1","trixie-security":"145.0.7632.159-1~deb13u1"},"fixed_version":"93.0.4577.82-1","urgency":"not yet assigned"}}},"CVE-2021-30607":{"description":"Chromium: CVE-2021-30607 Use after free in Permissions","scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"143.0.7499.169-1~deb12u1","bookworm-security":"145.0.7632.159-1~deb12u1"},"fixed_version":"93.0.4577.82-1","urgency":"not yet assigned"},"bullseye":{"status":"resolved","repositories":{"bullseye":"120.0.6099.224-1~deb11u1","bullseye-security":"120.0.6099.224-1~deb11u1"},"fixed_version":"93.0.4577.82-1","urgency":"not yet assigned"},"forky":{"status":"resolved","repositories":{"forky":"145.0.7632.159-1"},"fixed_version":"93.0.4577.82-1","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"146.0.7680.71-1"},"fixed_version":"93.0.4577.82-1","urgency":"not yet assigned"},"trixie":{"status":"resolved","repositories":{"trixie":"143.0.7499.169-1~deb13u1","trixie-security":"145.0.7632.159-1~deb13u1"},"fixed_version":"93.0.4577.82-1","urgency":"not yet assigned"}}},"CVE-2021-30608":{"description":"Chromium: CVE-2021-30608 Use after free in Web Share","scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"143.0.7499.169-1~deb12u1","bookworm-security":"145.0.7632.159-1~deb12u1"},"fixed_version":"93.0.4577.82-1","urgency":"not yet assigned"},"bullseye":{"status":"resolved","repositories":{"bullseye":"120.0.6099.224-1~deb11u1","bullseye-security":"120.0.6099.224-1~deb11u1"},"fixed_version":"93.0.4577.82-1","urgency":"not yet assigned"},"forky":{"status":"resolved","repositories":{"forky":"145.0.7632.159-1"},"fixed_version":"93.0.4577.82-1","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"146.0.7680.71-1"},"fixed_version":"93.0.4577.82-1","urgency":"not yet assigned"},"trixie":{"status":"resolved","repositories":{"trixie":"143.0.7499.169-1~deb13u1","trixie-security":"145.0.7632.159-1~deb13u1"},"fixed_version":"93.0.4577.82-1","urgency":"not yet assigned"}}},"CVE-2021-30609":{"description":"Chromium: CVE-2021-30609 Use after free in Sign-In","scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"143.0.7499.169-1~deb12u1","bookworm-security":"145.0.7632.159-1~deb12u1"},"fixed_version":"93.0.4577.82-1","urgency":"not yet assigned"},"bullseye":{"status":"resolved","repositories":{"bullseye":"120.0.6099.224-1~deb11u1","bullseye-security":"120.0.6099.224-1~deb11u1"},"fixed_version":"93.0.4577.82-1","urgency":"not yet assigned"},"forky":{"status":"resolved","repositories":{"forky":"145.0.7632.159-1"},"fixed_version":"93.0.4577.82-1","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"146.0.7680.71-1"},"fixed_version":"93.0.4577.82-1","urgency":"not yet assigned"},"trixie":{"status":"resolved","repositories":{"trixie":"143.0.7499.169-1~deb13u1","trixie-security":"145.0.7632.159-1~deb13u1"},"fixed_version":"93.0.4577.82-1","urgency":"not yet assigned"}}},"CVE-2021-30610":{"description":"Chromium: CVE-2021-30610 Use after free in Extensions API","scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"143.0.7499.169-1~deb12u1","bookworm-security":"145.0.7632.159-1~deb12u1"},"fixed_version":"93.0.4577.82-1","urgency":"not yet assigned"},"bullseye":{"status":"resolved","repositories":{"bullseye":"120.0.6099.224-1~deb11u1","bullseye-security":"120.0.6099.224-1~deb11u1"},"fixed_version":"93.0.4577.82-1","urgency":"not yet assigned"},"forky":{"status":"resolved","repositories":{"forky":"145.0.7632.159-1"},"fixed_version":"93.0.4577.82-1","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"146.0.7680.71-1"},"fixed_version":"93.0.4577.82-1","urgency":"not yet assigned"},"trixie":{"status":"resolved","repositories":{"trixie":"143.0.7499.169-1~deb13u1","trixie-security":"145.0.7632.159-1~deb13u1"},"fixed_version":"93.0.4577.82-1","urgency":"not yet assigned"}}},"CVE-2021-30611":{"description":"Chromium: CVE-2021-30611 Use after free in WebRTC","scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"143.0.7499.169-1~deb12u1","bookworm-security":"145.0.7632.159-1~deb12u1"},"fixed_version":"93.0.4577.82-1","urgency":"not yet assigned"},"bullseye":{"status":"resolved","repositories":{"bullseye":"120.0.6099.224-1~deb11u1","bullseye-security":"120.0.6099.224-1~deb11u1"},"fixed_version":"93.0.4577.82-1","urgency":"not yet assigned"},"forky":{"status":"resolved","repositories":{"forky":"145.0.7632.159-1"},"fixed_version":"93.0.4577.82-1","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"146.0.7680.71-1"},"fixed_version":"93.0.4577.82-1","urgency":"not yet assigned"},"trixie":{"status":"resolved","repositories":{"trixie":"143.0.7499.169-1~deb13u1","trixie-security":"145.0.7632.159-1~deb13u1"},"fixed_version":"93.0.4577.82-1","urgency":"not yet assigned"}}},"CVE-2021-30612":{"description":"Chromium: CVE-2021-30612 Use after free in WebRTC","scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"143.0.7499.169-1~deb12u1","bookworm-security":"145.0.7632.159-1~deb12u1"},"fixed_version":"93.0.4577.82-1","urgency":"not yet assigned"},"bullseye":{"status":"resolved","repositories":{"bullseye":"120.0.6099.224-1~deb11u1","bullseye-security":"120.0.6099.224-1~deb11u1"},"fixed_version":"93.0.4577.82-1","urgency":"not yet assigned"},"forky":{"status":"resolved","repositories":{"forky":"145.0.7632.159-1"},"fixed_version":"93.0.4577.82-1","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"146.0.7680.71-1"},"fixed_version":"93.0.4577.82-1","urgency":"not yet assigned"},"trixie":{"status":"resolved","repositories":{"trixie":"143.0.7499.169-1~deb13u1","trixie-security":"145.0.7632.159-1~deb13u1"},"fixed_version":"93.0.4577.82-1","urgency":"not yet assigned"}}},"CVE-2021-30613":{"description":"Chromium: CVE-2021-30613 Use after free in Base internals","scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"143.0.7499.169-1~deb12u1","bookworm-security":"145.0.7632.159-1~deb12u1"},"fixed_version":"93.0.4577.82-1","urgency":"not yet assigned"},"bullseye":{"status":"resolved","repositories":{"bullseye":"120.0.6099.224-1~deb11u1","bullseye-security":"120.0.6099.224-1~deb11u1"},"fixed_version":"93.0.4577.82-1","urgency":"not yet assigned"},"forky":{"status":"resolved","repositories":{"forky":"145.0.7632.159-1"},"fixed_version":"93.0.4577.82-1","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"146.0.7680.71-1"},"fixed_version":"93.0.4577.82-1","urgency":"not yet assigned"},"trixie":{"status":"resolved","repositories":{"trixie":"143.0.7499.169-1~deb13u1","trixie-security":"145.0.7632.159-1~deb13u1"},"fixed_version":"93.0.4577.82-1","urgency":"not yet assigned"}}},"CVE-2021-30614":{"description":"Chromium: CVE-2021-30614 Heap buffer overflow in TabStrip","scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"143.0.7499.169-1~deb12u1","bookworm-security":"145.0.7632.159-1~deb12u1"},"fixed_version":"93.0.4577.82-1","urgency":"not yet assigned"},"bullseye":{"status":"resolved","repositories":{"bullseye":"120.0.6099.224-1~deb11u1","bullseye-security":"120.0.6099.224-1~deb11u1"},"fixed_version":"93.0.4577.82-1","urgency":"not yet assigned"},"forky":{"status":"resolved","repositories":{"forky":"145.0.7632.159-1"},"fixed_version":"93.0.4577.82-1","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"146.0.7680.71-1"},"fixed_version":"93.0.4577.82-1","urgency":"not yet assigned"},"trixie":{"status":"resolved","repositories":{"trixie":"143.0.7499.169-1~deb13u1","trixie-security":"145.0.7632.159-1~deb13u1"},"fixed_version":"93.0.4577.82-1","urgency":"not yet assigned"}}},"CVE-2021-30615":{"description":"Chromium: CVE-2021-30615 Cross-origin data leak in Navigation","scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"143.0.7499.169-1~deb12u1","bookworm-security":"145.0.7632.159-1~deb12u1"},"fixed_version":"93.0.4577.82-1","urgency":"not yet assigned"},"bullseye":{"status":"resolved","repositories":{"bullseye":"120.0.6099.224-1~deb11u1","bullseye-security":"120.0.6099.224-1~deb11u1"},"fixed_version":"93.0.4577.82-1","urgency":"not yet assigned"},"forky":{"status":"resolved","repositories":{"forky":"145.0.7632.159-1"},"fixed_version":"93.0.4577.82-1","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"146.0.7680.71-1"},"fixed_version":"93.0.4577.82-1","urgency":"not yet assigned"},"trixie":{"status":"resolved","repositories":{"trixie":"143.0.7499.169-1~deb13u1","trixie-security":"145.0.7632.159-1~deb13u1"},"fixed_version":"93.0.4577.82-1","urgency":"not yet assigned"}}},"CVE-2021-30616":{"description":"Chromium: CVE-2021-30616 Use after free in Media","scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"143.0.7499.169-1~deb12u1","bookworm-security":"145.0.7632.159-1~deb12u1"},"fixed_version":"93.0.4577.82-1","urgency":"not yet assigned"},"bullseye":{"status":"resolved","repositories":{"bullseye":"120.0.6099.224-1~deb11u1","bullseye-security":"120.0.6099.224-1~deb11u1"},"fixed_version":"93.0.4577.82-1","urgency":"not yet assigned"},"forky":{"status":"resolved","repositories":{"forky":"145.0.7632.159-1"},"fixed_version":"93.0.4577.82-1","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"146.0.7680.71-1"},"fixed_version":"93.0.4577.82-1","urgency":"not yet assigned"},"trixie":{"status":"resolved","repositories":{"trixie":"143.0.7499.169-1~deb13u1","trixie-security":"145.0.7632.159-1~deb13u1"},"fixed_version":"93.0.4577.82-1","urgency":"not yet assigned"}}},"CVE-2021-30617":{"description":"Chromium: CVE-2021-30617 Policy bypass in Blink","scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"143.0.7499.169-1~deb12u1","bookworm-security":"145.0.7632.159-1~deb12u1"},"fixed_version":"93.0.4577.82-1","urgency":"not yet assigned"},"bullseye":{"status":"resolved","repositories":{"bullseye":"120.0.6099.224-1~deb11u1","bullseye-security":"120.0.6099.224-1~deb11u1"},"fixed_version":"93.0.4577.82-1","urgency":"not yet assigned"},"forky":{"status":"resolved","repositories":{"forky":"145.0.7632.159-1"},"fixed_version":"93.0.4577.82-1","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"146.0.7680.71-1"},"fixed_version":"93.0.4577.82-1","urgency":"not yet assigned"},"trixie":{"status":"resolved","repositories":{"trixie":"143.0.7499.169-1~deb13u1","trixie-security":"145.0.7632.159-1~deb13u1"},"fixed_version":"93.0.4577.82-1","urgency":"not yet assigned"}}},"CVE-2021-30618":{"description":"Chromium: CVE-2021-30618 Inappropriate implementation in DevTools","scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"143.0.7499.169-1~deb12u1","bookworm-security":"145.0.7632.159-1~deb12u1"},"fixed_version":"93.0.4577.82-1","urgency":"not yet assigned"},"bullseye":{"status":"resolved","repositories":{"bullseye":"120.0.6099.224-1~deb11u1","bullseye-security":"120.0.6099.224-1~deb11u1"},"fixed_version":"93.0.4577.82-1","urgency":"not yet assigned"},"forky":{"status":"resolved","repositories":{"forky":"145.0.7632.159-1"},"fixed_version":"93.0.4577.82-1","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"146.0.7680.71-1"},"fixed_version":"93.0.4577.82-1","urgency":"not yet assigned"},"trixie":{"status":"resolved","repositories":{"trixie":"143.0.7499.169-1~deb13u1","trixie-security":"145.0.7632.159-1~deb13u1"},"fixed_version":"93.0.4577.82-1","urgency":"not yet assigned"}}},"CVE-2021-30619":{"description":"Chromium: CVE-2021-30619 UI Spoofing in Autofill","scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"143.0.7499.169-1~deb12u1","bookworm-security":"145.0.7632.159-1~deb12u1"},"fixed_version":"93.0.4577.82-1","urgency":"not yet assigned"},"bullseye":{"status":"resolved","repositories":{"bullseye":"120.0.6099.224-1~deb11u1","bullseye-security":"120.0.6099.224-1~deb11u1"},"fixed_version":"93.0.4577.82-1","urgency":"not yet assigned"},"forky":{"status":"resolved","repositories":{"forky":"145.0.7632.159-1"},"fixed_version":"93.0.4577.82-1","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"146.0.7680.71-1"},"fixed_version":"93.0.4577.82-1","urgency":"not yet assigned"},"trixie":{"status":"resolved","repositories":{"trixie":"143.0.7499.169-1~deb13u1","trixie-security":"145.0.7632.159-1~deb13u1"},"fixed_version":"93.0.4577.82-1","urgency":"not yet assigned"}}},"CVE-2021-30620":{"description":"Chromium: CVE-2021-30620 Insufficient policy enforcement in Blink","scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"143.0.7499.169-1~deb12u1","bookworm-security":"145.0.7632.159-1~deb12u1"},"fixed_version":"93.0.4577.82-1","urgency":"not yet assigned"},"bullseye":{"status":"resolved","repositories":{"bullseye":"120.0.6099.224-1~deb11u1","bullseye-security":"120.0.6099.224-1~deb11u1"},"fixed_version":"93.0.4577.82-1","urgency":"not yet assigned"},"forky":{"status":"resolved","repositories":{"forky":"145.0.7632.159-1"},"fixed_version":"93.0.4577.82-1","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"146.0.7680.71-1"},"fixed_version":"93.0.4577.82-1","urgency":"not yet assigned"},"trixie":{"status":"resolved","repositories":{"trixie":"143.0.7499.169-1~deb13u1","trixie-security":"145.0.7632.159-1~deb13u1"},"fixed_version":"93.0.4577.82-1","urgency":"not yet assigned"}}},"CVE-2021-30621":{"description":"Chromium: CVE-2021-30621 UI Spoofing in Autofill","scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"143.0.7499.169-1~deb12u1","bookworm-security":"145.0.7632.159-1~deb12u1"},"fixed_version":"93.0.4577.82-1","urgency":"not yet assigned"},"bullseye":{"status":"resolved","repositories":{"bullseye":"120.0.6099.224-1~deb11u1","bullseye-security":"120.0.6099.224-1~deb11u1"},"fixed_version":"93.0.4577.82-1","urgency":"not yet assigned"},"forky":{"status":"resolved","repositories":{"forky":"145.0.7632.159-1"},"fixed_version":"93.0.4577.82-1","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"146.0.7680.71-1"},"fixed_version":"93.0.4577.82-1","urgency":"not yet assigned"},"trixie":{"status":"resolved","repositories":{"trixie":"143.0.7499.169-1~deb13u1","trixie-security":"145.0.7632.159-1~deb13u1"},"fixed_version":"93.0.4577.82-1","urgency":"not yet assigned"}}},"CVE-2021-30622":{"description":"Chromium: CVE-2021-30622 Use after free in WebApp Installs","scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"143.0.7499.169-1~deb12u1","bookworm-security":"145.0.7632.159-1~deb12u1"},"fixed_version":"93.0.4577.82-1","urgency":"not yet assigned"},"bullseye":{"status":"resolved","repositories":{"bullseye":"120.0.6099.224-1~deb11u1","bullseye-security":"120.0.6099.224-1~deb11u1"},"fixed_version":"93.0.4577.82-1","urgency":"not yet assigned"},"forky":{"status":"resolved","repositories":{"forky":"145.0.7632.159-1"},"fixed_version":"93.0.4577.82-1","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"146.0.7680.71-1"},"fixed_version":"93.0.4577.82-1","urgency":"not yet assigned"},"trixie":{"status":"resolved","repositories":{"trixie":"143.0.7499.169-1~deb13u1","trixie-security":"145.0.7632.159-1~deb13u1"},"fixed_version":"93.0.4577.82-1","urgency":"not yet assigned"}}},"CVE-2021-30623":{"description":"Chromium: CVE-2021-30623 Use after free in Bookmarks","scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"143.0.7499.169-1~deb12u1","bookworm-security":"145.0.7632.159-1~deb12u1"},"fixed_version":"93.0.4577.82-1","urgency":"not yet assigned"},"bullseye":{"status":"resolved","repositories":{"bullseye":"120.0.6099.224-1~deb11u1","bullseye-security":"120.0.6099.224-1~deb11u1"},"fixed_version":"93.0.4577.82-1","urgency":"not yet assigned"},"forky":{"status":"resolved","repositories":{"forky":"145.0.7632.159-1"},"fixed_version":"93.0.4577.82-1","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"146.0.7680.71-1"},"fixed_version":"93.0.4577.82-1","urgency":"not yet assigned"},"trixie":{"status":"resolved","repositories":{"trixie":"143.0.7499.169-1~deb13u1","trixie-security":"145.0.7632.159-1~deb13u1"},"fixed_version":"93.0.4577.82-1","urgency":"not yet assigned"}}},"CVE-2021-30624":{"description":"Chromium: CVE-2021-30624 Use after free in Autofill","scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"143.0.7499.169-1~deb12u1","bookworm-security":"145.0.7632.159-1~deb12u1"},"fixed_version":"93.0.4577.82-1","urgency":"not yet assigned"},"bullseye":{"status":"resolved","repositories":{"bullseye":"120.0.6099.224-1~deb11u1","bullseye-security":"120.0.6099.224-1~deb11u1"},"fixed_version":"93.0.4577.82-1","urgency":"not yet assigned"},"forky":{"status":"resolved","repositories":{"forky":"145.0.7632.159-1"},"fixed_version":"93.0.4577.82-1","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"146.0.7680.71-1"},"fixed_version":"93.0.4577.82-1","urgency":"not yet assigned"},"trixie":{"status":"resolved","repositories":{"trixie":"143.0.7499.169-1~deb13u1","trixie-security":"145.0.7632.159-1~deb13u1"},"fixed_version":"93.0.4577.82-1","urgency":"not yet assigned"}}},"CVE-2021-30625":{"description":"Use after free in Selection API in Google Chrome prior to 93.0.4577.82 allowed a remote attacker who convinced the user the visit a malicious website to potentially exploit heap corruption via a crafted HTML page.","scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"143.0.7499.169-1~deb12u1","bookworm-security":"145.0.7632.159-1~deb12u1"},"fixed_version":"93.0.4577.82-1","urgency":"not yet assigned"},"bullseye":{"status":"resolved","repositories":{"bullseye":"120.0.6099.224-1~deb11u1","bullseye-security":"120.0.6099.224-1~deb11u1"},"fixed_version":"93.0.4577.82-1","urgency":"not yet assigned"},"forky":{"status":"resolved","repositories":{"forky":"145.0.7632.159-1"},"fixed_version":"93.0.4577.82-1","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"146.0.7680.71-1"},"fixed_version":"93.0.4577.82-1","urgency":"not yet assigned"},"trixie":{"status":"resolved","repositories":{"trixie":"143.0.7499.169-1~deb13u1","trixie-security":"145.0.7632.159-1~deb13u1"},"fixed_version":"93.0.4577.82-1","urgency":"not yet assigned"}}},"CVE-2021-30626":{"description":"Out of bounds memory access in ANGLE in Google Chrome prior to 93.0.4577.82 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page.","scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"143.0.7499.169-1~deb12u1","bookworm-security":"145.0.7632.159-1~deb12u1"},"fixed_version":"93.0.4577.82-1","urgency":"not yet assigned"},"bullseye":{"status":"resolved","repositories":{"bullseye":"120.0.6099.224-1~deb11u1","bullseye-security":"120.0.6099.224-1~deb11u1"},"fixed_version":"93.0.4577.82-1","urgency":"not yet assigned"},"forky":{"status":"resolved","repositories":{"forky":"145.0.7632.159-1"},"fixed_version":"93.0.4577.82-1","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"146.0.7680.71-1"},"fixed_version":"93.0.4577.82-1","urgency":"not yet assigned"},"trixie":{"status":"resolved","repositories":{"trixie":"143.0.7499.169-1~deb13u1","trixie-security":"145.0.7632.159-1~deb13u1"},"fixed_version":"93.0.4577.82-1","urgency":"not yet assigned"}}},"CVE-2021-30627":{"description":"Type confusion in Blink layout in Google Chrome prior to 93.0.4577.82 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page.","scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"143.0.7499.169-1~deb12u1","bookworm-security":"145.0.7632.159-1~deb12u1"},"fixed_version":"93.0.4577.82-1","urgency":"not yet assigned"},"bullseye":{"status":"resolved","repositories":{"bullseye":"120.0.6099.224-1~deb11u1","bullseye-security":"120.0.6099.224-1~deb11u1"},"fixed_version":"93.0.4577.82-1","urgency":"not yet assigned"},"forky":{"status":"resolved","repositories":{"forky":"145.0.7632.159-1"},"fixed_version":"93.0.4577.82-1","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"146.0.7680.71-1"},"fixed_version":"93.0.4577.82-1","urgency":"not yet assigned"},"trixie":{"status":"resolved","repositories":{"trixie":"143.0.7499.169-1~deb13u1","trixie-security":"145.0.7632.159-1~deb13u1"},"fixed_version":"93.0.4577.82-1","urgency":"not yet assigned"}}},"CVE-2021-30628":{"description":"Stack buffer overflow in ANGLE in Google Chrome prior to 93.0.4577.82 allowed a remote attacker to potentially exploit stack corruption via a crafted HTML page.","scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"143.0.7499.169-1~deb12u1","bookworm-security":"145.0.7632.159-1~deb12u1"},"fixed_version":"93.0.4577.82-1","urgency":"not yet assigned"},"bullseye":{"status":"resolved","repositories":{"bullseye":"120.0.6099.224-1~deb11u1","bullseye-security":"120.0.6099.224-1~deb11u1"},"fixed_version":"93.0.4577.82-1","urgency":"not yet assigned"},"forky":{"status":"resolved","repositories":{"forky":"145.0.7632.159-1"},"fixed_version":"93.0.4577.82-1","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"146.0.7680.71-1"},"fixed_version":"93.0.4577.82-1","urgency":"not yet assigned"},"trixie":{"status":"resolved","repositories":{"trixie":"143.0.7499.169-1~deb13u1","trixie-security":"145.0.7632.159-1~deb13u1"},"fixed_version":"93.0.4577.82-1","urgency":"not yet assigned"}}},"CVE-2021-30629":{"description":"Use after free in Permissions in Google Chrome prior to 93.0.4577.82 allowed a remote attacker who had compromised the renderer process to potentially exploit heap corruption via a crafted HTML page.","scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"143.0.7499.169-1~deb12u1","bookworm-security":"145.0.7632.159-1~deb12u1"},"fixed_version":"93.0.4577.82-1","urgency":"not yet assigned"},"bullseye":{"status":"resolved","repositories":{"bullseye":"120.0.6099.224-1~deb11u1","bullseye-security":"120.0.6099.224-1~deb11u1"},"fixed_version":"93.0.4577.82-1","urgency":"not yet assigned"},"forky":{"status":"resolved","repositories":{"forky":"145.0.7632.159-1"},"fixed_version":"93.0.4577.82-1","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"146.0.7680.71-1"},"fixed_version":"93.0.4577.82-1","urgency":"not yet assigned"},"trixie":{"status":"resolved","repositories":{"trixie":"143.0.7499.169-1~deb13u1","trixie-security":"145.0.7632.159-1~deb13u1"},"fixed_version":"93.0.4577.82-1","urgency":"not yet assigned"}}},"CVE-2021-30630":{"description":"Inappropriate implementation in Blink in Google Chrome prior to 93.0.4577.82 allowed a remote attacker who had compromised the renderer process to leak cross-origin data via a crafted HTML page.","scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"143.0.7499.169-1~deb12u1","bookworm-security":"145.0.7632.159-1~deb12u1"},"fixed_version":"93.0.4577.82-1","urgency":"not yet assigned"},"bullseye":{"status":"resolved","repositories":{"bullseye":"120.0.6099.224-1~deb11u1","bullseye-security":"120.0.6099.224-1~deb11u1"},"fixed_version":"93.0.4577.82-1","urgency":"not yet assigned"},"forky":{"status":"resolved","repositories":{"forky":"145.0.7632.159-1"},"fixed_version":"93.0.4577.82-1","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"146.0.7680.71-1"},"fixed_version":"93.0.4577.82-1","urgency":"not yet assigned"},"trixie":{"status":"resolved","repositories":{"trixie":"143.0.7499.169-1~deb13u1","trixie-security":"145.0.7632.159-1~deb13u1"},"fixed_version":"93.0.4577.82-1","urgency":"not yet assigned"}}},"CVE-2021-30632":{"description":"Out of bounds write in V8 in Google Chrome prior to 93.0.4577.82 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page.","scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"143.0.7499.169-1~deb12u1","bookworm-security":"145.0.7632.159-1~deb12u1"},"fixed_version":"93.0.4577.82-1","urgency":"not yet assigned"},"bullseye":{"status":"resolved","repositories":{"bullseye":"120.0.6099.224-1~deb11u1","bullseye-security":"120.0.6099.224-1~deb11u1"},"fixed_version":"93.0.4577.82-1","urgency":"not yet assigned"},"forky":{"status":"resolved","repositories":{"forky":"145.0.7632.159-1"},"fixed_version":"93.0.4577.82-1","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"146.0.7680.71-1"},"fixed_version":"93.0.4577.82-1","urgency":"not yet assigned"},"trixie":{"status":"resolved","repositories":{"trixie":"143.0.7499.169-1~deb13u1","trixie-security":"145.0.7632.159-1~deb13u1"},"fixed_version":"93.0.4577.82-1","urgency":"not yet assigned"}}},"CVE-2021-30633":{"description":"Use after free in Indexed DB API in Google Chrome prior to 93.0.4577.82 allowed a remote attacker who had compromised the renderer process to potentially perform a sandbox escape via a crafted HTML page.","scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"143.0.7499.169-1~deb12u1","bookworm-security":"145.0.7632.159-1~deb12u1"},"fixed_version":"93.0.4577.82-1","urgency":"not yet assigned"},"bullseye":{"status":"resolved","repositories":{"bullseye":"120.0.6099.224-1~deb11u1","bullseye-security":"120.0.6099.224-1~deb11u1"},"fixed_version":"93.0.4577.82-1","urgency":"not yet assigned"},"forky":{"status":"resolved","repositories":{"forky":"145.0.7632.159-1"},"fixed_version":"93.0.4577.82-1","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"146.0.7680.71-1"},"fixed_version":"93.0.4577.82-1","urgency":"not yet assigned"},"trixie":{"status":"resolved","repositories":{"trixie":"143.0.7499.169-1~deb13u1","trixie-security":"145.0.7632.159-1~deb13u1"},"fixed_version":"93.0.4577.82-1","urgency":"not yet assigned"}}},"CVE-2021-37956":{"description":"Use after free in Offline use in Google Chrome on Android prior to 94.0.4606.54 allowed a remote attacker who had compromised the renderer process to potentially exploit heap corruption via a crafted HTML page.","scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"143.0.7499.169-1~deb12u1","bookworm-security":"145.0.7632.159-1~deb12u1"},"fixed_version":"97.0.4692.71-0.1","urgency":"not yet assigned"},"bullseye":{"status":"resolved","repositories":{"bullseye":"120.0.6099.224-1~deb11u1","bullseye-security":"120.0.6099.224-1~deb11u1"},"fixed_version":"97.0.4692.71-0.1~deb11u1","urgency":"not yet assigned"},"forky":{"status":"resolved","repositories":{"forky":"145.0.7632.159-1"},"fixed_version":"97.0.4692.71-0.1","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"146.0.7680.71-1"},"fixed_version":"97.0.4692.71-0.1","urgency":"not yet assigned"},"trixie":{"status":"resolved","repositories":{"trixie":"143.0.7499.169-1~deb13u1","trixie-security":"145.0.7632.159-1~deb13u1"},"fixed_version":"97.0.4692.71-0.1","urgency":"not yet assigned"}}},"CVE-2021-37957":{"description":"Use after free in WebGPU in Google Chrome prior to 94.0.4606.54 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page.","scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"143.0.7499.169-1~deb12u1","bookworm-security":"145.0.7632.159-1~deb12u1"},"fixed_version":"97.0.4692.71-0.1","urgency":"not yet assigned"},"bullseye":{"status":"resolved","repositories":{"bullseye":"120.0.6099.224-1~deb11u1","bullseye-security":"120.0.6099.224-1~deb11u1"},"fixed_version":"97.0.4692.71-0.1~deb11u1","urgency":"not yet assigned"},"forky":{"status":"resolved","repositories":{"forky":"145.0.7632.159-1"},"fixed_version":"97.0.4692.71-0.1","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"146.0.7680.71-1"},"fixed_version":"97.0.4692.71-0.1","urgency":"not yet assigned"},"trixie":{"status":"resolved","repositories":{"trixie":"143.0.7499.169-1~deb13u1","trixie-security":"145.0.7632.159-1~deb13u1"},"fixed_version":"97.0.4692.71-0.1","urgency":"not yet assigned"}}},"CVE-2021-37958":{"description":"Inappropriate implementation in Navigation in Google Chrome on Windows prior to 94.0.4606.54 allowed a remote attacker to inject scripts or HTML into a privileged page via a crafted HTML page.","scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"143.0.7499.169-1~deb12u1","bookworm-security":"145.0.7632.159-1~deb12u1"},"fixed_version":"97.0.4692.71-0.1","urgency":"not yet assigned"},"bullseye":{"status":"resolved","repositories":{"bullseye":"120.0.6099.224-1~deb11u1","bullseye-security":"120.0.6099.224-1~deb11u1"},"fixed_version":"97.0.4692.71-0.1~deb11u1","urgency":"not yet assigned"},"forky":{"status":"resolved","repositories":{"forky":"145.0.7632.159-1"},"fixed_version":"97.0.4692.71-0.1","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"146.0.7680.71-1"},"fixed_version":"97.0.4692.71-0.1","urgency":"not yet assigned"},"trixie":{"status":"resolved","repositories":{"trixie":"143.0.7499.169-1~deb13u1","trixie-security":"145.0.7632.159-1~deb13u1"},"fixed_version":"97.0.4692.71-0.1","urgency":"not yet assigned"}}},"CVE-2021-37959":{"description":"Use after free in Task Manager in Google Chrome prior to 94.0.4606.54 allowed an attacker who convinced a user to enage in a series of user gestures to potentially exploit heap corruption via a crafted HTML page.","scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"143.0.7499.169-1~deb12u1","bookworm-security":"145.0.7632.159-1~deb12u1"},"fixed_version":"97.0.4692.71-0.1","urgency":"not yet assigned"},"bullseye":{"status":"resolved","repositories":{"bullseye":"120.0.6099.224-1~deb11u1","bullseye-security":"120.0.6099.224-1~deb11u1"},"fixed_version":"97.0.4692.71-0.1~deb11u1","urgency":"not yet assigned"},"forky":{"status":"resolved","repositories":{"forky":"145.0.7632.159-1"},"fixed_version":"97.0.4692.71-0.1","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"146.0.7680.71-1"},"fixed_version":"97.0.4692.71-0.1","urgency":"not yet assigned"},"trixie":{"status":"resolved","repositories":{"trixie":"143.0.7499.169-1~deb13u1","trixie-security":"145.0.7632.159-1~deb13u1"},"fixed_version":"97.0.4692.71-0.1","urgency":"not yet assigned"}}},"CVE-2021-37961":{"description":"Use after free in Tab Strip in Google Chrome prior to 94.0.4606.54 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page.","scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"143.0.7499.169-1~deb12u1","bookworm-security":"145.0.7632.159-1~deb12u1"},"fixed_version":"97.0.4692.71-0.1","urgency":"not yet assigned"},"bullseye":{"status":"resolved","repositories":{"bullseye":"120.0.6099.224-1~deb11u1","bullseye-security":"120.0.6099.224-1~deb11u1"},"fixed_version":"97.0.4692.71-0.1~deb11u1","urgency":"not yet assigned"},"forky":{"status":"resolved","repositories":{"forky":"145.0.7632.159-1"},"fixed_version":"97.0.4692.71-0.1","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"146.0.7680.71-1"},"fixed_version":"97.0.4692.71-0.1","urgency":"not yet assigned"},"trixie":{"status":"resolved","repositories":{"trixie":"143.0.7499.169-1~deb13u1","trixie-security":"145.0.7632.159-1~deb13u1"},"fixed_version":"97.0.4692.71-0.1","urgency":"not yet assigned"}}},"CVE-2021-37962":{"description":"Use after free in Performance Manager in Google Chrome prior to 94.0.4606.54 allowed a remote attacker who had compromised the renderer process to potentially exploit heap corruption via a crafted HTML page.","scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"143.0.7499.169-1~deb12u1","bookworm-security":"145.0.7632.159-1~deb12u1"},"fixed_version":"97.0.4692.71-0.1","urgency":"not yet assigned"},"bullseye":{"status":"resolved","repositories":{"bullseye":"120.0.6099.224-1~deb11u1","bullseye-security":"120.0.6099.224-1~deb11u1"},"fixed_version":"97.0.4692.71-0.1~deb11u1","urgency":"not yet assigned"},"forky":{"status":"resolved","repositories":{"forky":"145.0.7632.159-1"},"fixed_version":"97.0.4692.71-0.1","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"146.0.7680.71-1"},"fixed_version":"97.0.4692.71-0.1","urgency":"not yet assigned"},"trixie":{"status":"resolved","repositories":{"trixie":"143.0.7499.169-1~deb13u1","trixie-security":"145.0.7632.159-1~deb13u1"},"fixed_version":"97.0.4692.71-0.1","urgency":"not yet assigned"}}},"CVE-2021-37963":{"description":"Side-channel information leakage in DevTools in Google Chrome prior to 94.0.4606.54 allowed a remote attacker to bypass site isolation via a crafted HTML page.","scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"143.0.7499.169-1~deb12u1","bookworm-security":"145.0.7632.159-1~deb12u1"},"fixed_version":"97.0.4692.71-0.1","urgency":"not yet assigned"},"bullseye":{"status":"resolved","repositories":{"bullseye":"120.0.6099.224-1~deb11u1","bullseye-security":"120.0.6099.224-1~deb11u1"},"fixed_version":"97.0.4692.71-0.1~deb11u1","urgency":"not yet assigned"},"forky":{"status":"resolved","repositories":{"forky":"145.0.7632.159-1"},"fixed_version":"97.0.4692.71-0.1","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"146.0.7680.71-1"},"fixed_version":"97.0.4692.71-0.1","urgency":"not yet assigned"},"trixie":{"status":"resolved","repositories":{"trixie":"143.0.7499.169-1~deb13u1","trixie-security":"145.0.7632.159-1~deb13u1"},"fixed_version":"97.0.4692.71-0.1","urgency":"not yet assigned"}}},"CVE-2021-37964":{"description":"Inappropriate implementation in ChromeOS Networking in Google Chrome on ChromeOS prior to 94.0.4606.54 allowed an attacker with a rogue wireless access point to to potentially carryout a wifi impersonation attack via a crafted ONC file.","scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"143.0.7499.169-1~deb12u1","bookworm-security":"145.0.7632.159-1~deb12u1"},"fixed_version":"97.0.4692.71-0.1","urgency":"not yet assigned"},"bullseye":{"status":"resolved","repositories":{"bullseye":"120.0.6099.224-1~deb11u1","bullseye-security":"120.0.6099.224-1~deb11u1"},"fixed_version":"97.0.4692.71-0.1~deb11u1","urgency":"not yet assigned"},"forky":{"status":"resolved","repositories":{"forky":"145.0.7632.159-1"},"fixed_version":"97.0.4692.71-0.1","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"146.0.7680.71-1"},"fixed_version":"97.0.4692.71-0.1","urgency":"not yet assigned"},"trixie":{"status":"resolved","repositories":{"trixie":"143.0.7499.169-1~deb13u1","trixie-security":"145.0.7632.159-1~deb13u1"},"fixed_version":"97.0.4692.71-0.1","urgency":"not yet assigned"}}},"CVE-2021-37965":{"description":"Inappropriate implementation in Background Fetch API in Google Chrome prior to 94.0.4606.54 allowed a remote attacker to leak cross-origin data via a crafted HTML page.","scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"143.0.7499.169-1~deb12u1","bookworm-security":"145.0.7632.159-1~deb12u1"},"fixed_version":"97.0.4692.71-0.1","urgency":"not yet assigned"},"bullseye":{"status":"resolved","repositories":{"bullseye":"120.0.6099.224-1~deb11u1","bullseye-security":"120.0.6099.224-1~deb11u1"},"fixed_version":"97.0.4692.71-0.1~deb11u1","urgency":"not yet assigned"},"forky":{"status":"resolved","repositories":{"forky":"145.0.7632.159-1"},"fixed_version":"97.0.4692.71-0.1","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"146.0.7680.71-1"},"fixed_version":"97.0.4692.71-0.1","urgency":"not yet assigned"},"trixie":{"status":"resolved","repositories":{"trixie":"143.0.7499.169-1~deb13u1","trixie-security":"145.0.7632.159-1~deb13u1"},"fixed_version":"97.0.4692.71-0.1","urgency":"not yet assigned"}}},"CVE-2021-37966":{"description":"Inappropriate implementation in Compositing in Google Chrome on Android prior to 94.0.4606.54 allowed a remote attacker to spoof the contents of the Omnibox (URL bar) via a crafted HTML page.","scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"143.0.7499.169-1~deb12u1","bookworm-security":"145.0.7632.159-1~deb12u1"},"fixed_version":"97.0.4692.71-0.1","urgency":"not yet assigned"},"bullseye":{"status":"resolved","repositories":{"bullseye":"120.0.6099.224-1~deb11u1","bullseye-security":"120.0.6099.224-1~deb11u1"},"fixed_version":"97.0.4692.71-0.1~deb11u1","urgency":"not yet assigned"},"forky":{"status":"resolved","repositories":{"forky":"145.0.7632.159-1"},"fixed_version":"97.0.4692.71-0.1","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"146.0.7680.71-1"},"fixed_version":"97.0.4692.71-0.1","urgency":"not yet assigned"},"trixie":{"status":"resolved","repositories":{"trixie":"143.0.7499.169-1~deb13u1","trixie-security":"145.0.7632.159-1~deb13u1"},"fixed_version":"97.0.4692.71-0.1","urgency":"not yet assigned"}}},"CVE-2021-37967":{"description":"Inappropriate implementation in Background Fetch API in Google Chrome prior to 94.0.4606.54 allowed a remote attacker who had compromised the renderer process to leak cross-origin data via a crafted HTML page.","scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"143.0.7499.169-1~deb12u1","bookworm-security":"145.0.7632.159-1~deb12u1"},"fixed_version":"97.0.4692.71-0.1","urgency":"not yet assigned"},"bullseye":{"status":"resolved","repositories":{"bullseye":"120.0.6099.224-1~deb11u1","bullseye-security":"120.0.6099.224-1~deb11u1"},"fixed_version":"97.0.4692.71-0.1~deb11u1","urgency":"not yet assigned"},"forky":{"status":"resolved","repositories":{"forky":"145.0.7632.159-1"},"fixed_version":"97.0.4692.71-0.1","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"146.0.7680.71-1"},"fixed_version":"97.0.4692.71-0.1","urgency":"not yet assigned"},"trixie":{"status":"resolved","repositories":{"trixie":"143.0.7499.169-1~deb13u1","trixie-security":"145.0.7632.159-1~deb13u1"},"fixed_version":"97.0.4692.71-0.1","urgency":"not yet assigned"}}},"CVE-2021-37968":{"description":"Inappropriate implementation in Background Fetch API in Google Chrome prior to 94.0.4606.54 allowed a remote attacker to leak cross-origin data via a crafted HTML page.","scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"143.0.7499.169-1~deb12u1","bookworm-security":"145.0.7632.159-1~deb12u1"},"fixed_version":"97.0.4692.71-0.1","urgency":"not yet assigned"},"bullseye":{"status":"resolved","repositories":{"bullseye":"120.0.6099.224-1~deb11u1","bullseye-security":"120.0.6099.224-1~deb11u1"},"fixed_version":"97.0.4692.71-0.1~deb11u1","urgency":"not yet assigned"},"forky":{"status":"resolved","repositories":{"forky":"145.0.7632.159-1"},"fixed_version":"97.0.4692.71-0.1","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"146.0.7680.71-1"},"fixed_version":"97.0.4692.71-0.1","urgency":"not yet assigned"},"trixie":{"status":"resolved","repositories":{"trixie":"143.0.7499.169-1~deb13u1","trixie-security":"145.0.7632.159-1~deb13u1"},"fixed_version":"97.0.4692.71-0.1","urgency":"not yet assigned"}}},"CVE-2021-37969":{"description":"Inappropriate implementation in Google Updater in Google Chrome on Windows prior to 94.0.4606.54 allowed a remote attacker to perform local privilege escalation via a crafted file.","scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"143.0.7499.169-1~deb12u1","bookworm-security":"145.0.7632.159-1~deb12u1"},"fixed_version":"97.0.4692.71-0.1","urgency":"not yet assigned"},"bullseye":{"status":"resolved","repositories":{"bullseye":"120.0.6099.224-1~deb11u1","bullseye-security":"120.0.6099.224-1~deb11u1"},"fixed_version":"97.0.4692.71-0.1~deb11u1","urgency":"not yet assigned"},"forky":{"status":"resolved","repositories":{"forky":"145.0.7632.159-1"},"fixed_version":"97.0.4692.71-0.1","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"146.0.7680.71-1"},"fixed_version":"97.0.4692.71-0.1","urgency":"not yet assigned"},"trixie":{"status":"resolved","repositories":{"trixie":"143.0.7499.169-1~deb13u1","trixie-security":"145.0.7632.159-1~deb13u1"},"fixed_version":"97.0.4692.71-0.1","urgency":"not yet assigned"}}},"CVE-2021-37970":{"description":"Use after free in File System API in Google Chrome prior to 94.0.4606.54 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page.","scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"143.0.7499.169-1~deb12u1","bookworm-security":"145.0.7632.159-1~deb12u1"},"fixed_version":"97.0.4692.71-0.1","urgency":"not yet assigned"},"bullseye":{"status":"resolved","repositories":{"bullseye":"120.0.6099.224-1~deb11u1","bullseye-security":"120.0.6099.224-1~deb11u1"},"fixed_version":"97.0.4692.71-0.1~deb11u1","urgency":"not yet assigned"},"forky":{"status":"resolved","repositories":{"forky":"145.0.7632.159-1"},"fixed_version":"97.0.4692.71-0.1","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"146.0.7680.71-1"},"fixed_version":"97.0.4692.71-0.1","urgency":"not yet assigned"},"trixie":{"status":"resolved","repositories":{"trixie":"143.0.7499.169-1~deb13u1","trixie-security":"145.0.7632.159-1~deb13u1"},"fixed_version":"97.0.4692.71-0.1","urgency":"not yet assigned"}}},"CVE-2021-37971":{"description":"Incorrect security UI in Web Browser UI in Google Chrome prior to 94.0.4606.54 allowed a remote attacker to spoof the contents of the Omnibox (URL bar) via a crafted HTML page.","scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"143.0.7499.169-1~deb12u1","bookworm-security":"145.0.7632.159-1~deb12u1"},"fixed_version":"97.0.4692.71-0.1","urgency":"not yet assigned"},"bullseye":{"status":"resolved","repositories":{"bullseye":"120.0.6099.224-1~deb11u1","bullseye-security":"120.0.6099.224-1~deb11u1"},"fixed_version":"97.0.4692.71-0.1~deb11u1","urgency":"not yet assigned"},"forky":{"status":"resolved","repositories":{"forky":"145.0.7632.159-1"},"fixed_version":"97.0.4692.71-0.1","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"146.0.7680.71-1"},"fixed_version":"97.0.4692.71-0.1","urgency":"not yet assigned"},"trixie":{"status":"resolved","repositories":{"trixie":"143.0.7499.169-1~deb13u1","trixie-security":"145.0.7632.159-1~deb13u1"},"fixed_version":"97.0.4692.71-0.1","urgency":"not yet assigned"}}},"CVE-2021-37972":{"description":"Out of bounds read in libjpeg-turbo in Google Chrome prior to 94.0.4606.54 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page.","scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"143.0.7499.169-1~deb12u1","bookworm-security":"145.0.7632.159-1~deb12u1"},"fixed_version":"97.0.4692.71-0.1","urgency":"not yet assigned"},"bullseye":{"status":"resolved","repositories":{"bullseye":"120.0.6099.224-1~deb11u1","bullseye-security":"120.0.6099.224-1~deb11u1"},"fixed_version":"97.0.4692.71-0.1~deb11u1","urgency":"not yet assigned"},"forky":{"status":"resolved","repositories":{"forky":"145.0.7632.159-1"},"fixed_version":"97.0.4692.71-0.1","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"146.0.7680.71-1"},"fixed_version":"97.0.4692.71-0.1","urgency":"not yet assigned"},"trixie":{"status":"resolved","repositories":{"trixie":"143.0.7499.169-1~deb13u1","trixie-security":"145.0.7632.159-1~deb13u1"},"fixed_version":"97.0.4692.71-0.1","urgency":"not yet assigned"}}},"CVE-2021-37973":{"description":"Use after free in Portals in Google Chrome prior to 94.0.4606.61 allowed a remote attacker who had compromised the renderer process to potentially perform a sandbox escape via a crafted HTML page.","scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"143.0.7499.169-1~deb12u1","bookworm-security":"145.0.7632.159-1~deb12u1"},"fixed_version":"97.0.4692.71-0.1","urgency":"not yet assigned"},"bullseye":{"status":"resolved","repositories":{"bullseye":"120.0.6099.224-1~deb11u1","bullseye-security":"120.0.6099.224-1~deb11u1"},"fixed_version":"97.0.4692.71-0.1~deb11u1","urgency":"not yet assigned"},"forky":{"status":"resolved","repositories":{"forky":"145.0.7632.159-1"},"fixed_version":"97.0.4692.71-0.1","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"146.0.7680.71-1"},"fixed_version":"97.0.4692.71-0.1","urgency":"not yet assigned"},"trixie":{"status":"resolved","repositories":{"trixie":"143.0.7499.169-1~deb13u1","trixie-security":"145.0.7632.159-1~deb13u1"},"fixed_version":"97.0.4692.71-0.1","urgency":"not yet assigned"}}},"CVE-2021-37974":{"description":"Use after free in Safebrowsing in Google Chrome prior to 94.0.4606.71 allowed a remote attacker who had compromised the renderer process to potentially exploit heap corruption via a crafted HTML page.","scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"143.0.7499.169-1~deb12u1","bookworm-security":"145.0.7632.159-1~deb12u1"},"fixed_version":"97.0.4692.71-0.1","urgency":"not yet assigned"},"bullseye":{"status":"resolved","repositories":{"bullseye":"120.0.6099.224-1~deb11u1","bullseye-security":"120.0.6099.224-1~deb11u1"},"fixed_version":"97.0.4692.71-0.1~deb11u1","urgency":"not yet assigned"},"forky":{"status":"resolved","repositories":{"forky":"145.0.7632.159-1"},"fixed_version":"97.0.4692.71-0.1","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"146.0.7680.71-1"},"fixed_version":"97.0.4692.71-0.1","urgency":"not yet assigned"},"trixie":{"status":"resolved","repositories":{"trixie":"143.0.7499.169-1~deb13u1","trixie-security":"145.0.7632.159-1~deb13u1"},"fixed_version":"97.0.4692.71-0.1","urgency":"not yet assigned"}}},"CVE-2021-37975":{"description":"Use after free in V8 in Google Chrome prior to 94.0.4606.71 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page.","scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"143.0.7499.169-1~deb12u1","bookworm-security":"145.0.7632.159-1~deb12u1"},"fixed_version":"97.0.4692.71-0.1","urgency":"not yet assigned"},"bullseye":{"status":"resolved","repositories":{"bullseye":"120.0.6099.224-1~deb11u1","bullseye-security":"120.0.6099.224-1~deb11u1"},"fixed_version":"97.0.4692.71-0.1~deb11u1","urgency":"not yet assigned"},"forky":{"status":"resolved","repositories":{"forky":"145.0.7632.159-1"},"fixed_version":"97.0.4692.71-0.1","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"146.0.7680.71-1"},"fixed_version":"97.0.4692.71-0.1","urgency":"not yet assigned"},"trixie":{"status":"resolved","repositories":{"trixie":"143.0.7499.169-1~deb13u1","trixie-security":"145.0.7632.159-1~deb13u1"},"fixed_version":"97.0.4692.71-0.1","urgency":"not yet assigned"}}},"CVE-2021-37976":{"description":"Inappropriate implementation in Memory in Google Chrome prior to 94.0.4606.71 allowed a remote attacker to obtain potentially sensitive information from process memory via a crafted HTML page.","scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"143.0.7499.169-1~deb12u1","bookworm-security":"145.0.7632.159-1~deb12u1"},"fixed_version":"97.0.4692.71-0.1","urgency":"not yet assigned"},"bullseye":{"status":"resolved","repositories":{"bullseye":"120.0.6099.224-1~deb11u1","bullseye-security":"120.0.6099.224-1~deb11u1"},"fixed_version":"97.0.4692.71-0.1~deb11u1","urgency":"not yet assigned"},"forky":{"status":"resolved","repositories":{"forky":"145.0.7632.159-1"},"fixed_version":"97.0.4692.71-0.1","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"146.0.7680.71-1"},"fixed_version":"97.0.4692.71-0.1","urgency":"not yet assigned"},"trixie":{"status":"resolved","repositories":{"trixie":"143.0.7499.169-1~deb13u1","trixie-security":"145.0.7632.159-1~deb13u1"},"fixed_version":"97.0.4692.71-0.1","urgency":"not yet assigned"}}},"CVE-2021-37977":{"description":"Use after free in Garbage Collection in Google Chrome prior to 94.0.4606.81 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page.","scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"143.0.7499.169-1~deb12u1","bookworm-security":"145.0.7632.159-1~deb12u1"},"fixed_version":"97.0.4692.71-0.1","urgency":"not yet assigned"},"bullseye":{"status":"resolved","repositories":{"bullseye":"120.0.6099.224-1~deb11u1","bullseye-security":"120.0.6099.224-1~deb11u1"},"fixed_version":"97.0.4692.71-0.1~deb11u1","urgency":"not yet assigned"},"forky":{"status":"resolved","repositories":{"forky":"145.0.7632.159-1"},"fixed_version":"97.0.4692.71-0.1","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"146.0.7680.71-1"},"fixed_version":"97.0.4692.71-0.1","urgency":"not yet assigned"},"trixie":{"status":"resolved","repositories":{"trixie":"143.0.7499.169-1~deb13u1","trixie-security":"145.0.7632.159-1~deb13u1"},"fixed_version":"97.0.4692.71-0.1","urgency":"not yet assigned"}}},"CVE-2021-37978":{"description":"Heap buffer overflow in Blink in Google Chrome prior to 94.0.4606.81 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page.","scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"143.0.7499.169-1~deb12u1","bookworm-security":"145.0.7632.159-1~deb12u1"},"fixed_version":"97.0.4692.71-0.1","urgency":"not yet assigned"},"bullseye":{"status":"resolved","repositories":{"bullseye":"120.0.6099.224-1~deb11u1","bullseye-security":"120.0.6099.224-1~deb11u1"},"fixed_version":"97.0.4692.71-0.1~deb11u1","urgency":"not yet assigned"},"forky":{"status":"resolved","repositories":{"forky":"145.0.7632.159-1"},"fixed_version":"97.0.4692.71-0.1","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"146.0.7680.71-1"},"fixed_version":"97.0.4692.71-0.1","urgency":"not yet assigned"},"trixie":{"status":"resolved","repositories":{"trixie":"143.0.7499.169-1~deb13u1","trixie-security":"145.0.7632.159-1~deb13u1"},"fixed_version":"97.0.4692.71-0.1","urgency":"not yet assigned"}}},"CVE-2021-37979":{"description":"heap buffer overflow in WebRTC in Google Chrome prior to 94.0.4606.81 allowed a remote attacker who convinced a user to browse to a malicious website to potentially exploit heap corruption via a crafted HTML page.","scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"143.0.7499.169-1~deb12u1","bookworm-security":"145.0.7632.159-1~deb12u1"},"fixed_version":"97.0.4692.71-0.1","urgency":"not yet assigned"},"bullseye":{"status":"resolved","repositories":{"bullseye":"120.0.6099.224-1~deb11u1","bullseye-security":"120.0.6099.224-1~deb11u1"},"fixed_version":"97.0.4692.71-0.1~deb11u1","urgency":"not yet assigned"},"forky":{"status":"resolved","repositories":{"forky":"145.0.7632.159-1"},"fixed_version":"97.0.4692.71-0.1","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"146.0.7680.71-1"},"fixed_version":"97.0.4692.71-0.1","urgency":"not yet assigned"},"trixie":{"status":"resolved","repositories":{"trixie":"143.0.7499.169-1~deb13u1","trixie-security":"145.0.7632.159-1~deb13u1"},"fixed_version":"97.0.4692.71-0.1","urgency":"not yet assigned"}}},"CVE-2021-37980":{"description":"Inappropriate implementation in Sandbox in Google Chrome prior to 94.0.4606.81 allowed a remote attacker to potentially bypass site isolation via Windows.","scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"143.0.7499.169-1~deb12u1","bookworm-security":"145.0.7632.159-1~deb12u1"},"fixed_version":"97.0.4692.71-0.1","urgency":"not yet assigned"},"bullseye":{"status":"resolved","repositories":{"bullseye":"120.0.6099.224-1~deb11u1","bullseye-security":"120.0.6099.224-1~deb11u1"},"fixed_version":"97.0.4692.71-0.1~deb11u1","urgency":"not yet assigned"},"forky":{"status":"resolved","repositories":{"forky":"145.0.7632.159-1"},"fixed_version":"97.0.4692.71-0.1","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"146.0.7680.71-1"},"fixed_version":"97.0.4692.71-0.1","urgency":"not yet assigned"},"trixie":{"status":"resolved","repositories":{"trixie":"143.0.7499.169-1~deb13u1","trixie-security":"145.0.7632.159-1~deb13u1"},"fixed_version":"97.0.4692.71-0.1","urgency":"not yet assigned"}}},"CVE-2021-37981":{"description":"Heap buffer overflow in Skia in Google Chrome prior to 95.0.4638.54 allowed a remote attacker who had compromised the renderer process to potentially perform a sandbox escape via a crafted HTML page.","scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"143.0.7499.169-1~deb12u1","bookworm-security":"145.0.7632.159-1~deb12u1"},"fixed_version":"97.0.4692.71-0.1","urgency":"not yet assigned"},"bullseye":{"status":"resolved","repositories":{"bullseye":"120.0.6099.224-1~deb11u1","bullseye-security":"120.0.6099.224-1~deb11u1"},"fixed_version":"97.0.4692.71-0.1~deb11u1","urgency":"not yet assigned"},"forky":{"status":"resolved","repositories":{"forky":"145.0.7632.159-1"},"fixed_version":"97.0.4692.71-0.1","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"146.0.7680.71-1"},"fixed_version":"97.0.4692.71-0.1","urgency":"not yet assigned"},"trixie":{"status":"resolved","repositories":{"trixie":"143.0.7499.169-1~deb13u1","trixie-security":"145.0.7632.159-1~deb13u1"},"fixed_version":"97.0.4692.71-0.1","urgency":"not yet assigned"}}},"CVE-2021-37982":{"description":"Use after free in Incognito in Google Chrome prior to 95.0.4638.54 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page.","scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"143.0.7499.169-1~deb12u1","bookworm-security":"145.0.7632.159-1~deb12u1"},"fixed_version":"97.0.4692.71-0.1","urgency":"not yet assigned"},"bullseye":{"status":"resolved","repositories":{"bullseye":"120.0.6099.224-1~deb11u1","bullseye-security":"120.0.6099.224-1~deb11u1"},"fixed_version":"97.0.4692.71-0.1~deb11u1","urgency":"not yet assigned"},"forky":{"status":"resolved","repositories":{"forky":"145.0.7632.159-1"},"fixed_version":"97.0.4692.71-0.1","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"146.0.7680.71-1"},"fixed_version":"97.0.4692.71-0.1","urgency":"not yet assigned"},"trixie":{"status":"resolved","repositories":{"trixie":"143.0.7499.169-1~deb13u1","trixie-security":"145.0.7632.159-1~deb13u1"},"fixed_version":"97.0.4692.71-0.1","urgency":"not yet assigned"}}},"CVE-2021-37983":{"description":"Use after free in Dev Tools in Google Chrome prior to 95.0.4638.54 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page.","scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"143.0.7499.169-1~deb12u1","bookworm-security":"145.0.7632.159-1~deb12u1"},"fixed_version":"97.0.4692.71-0.1","urgency":"not yet assigned"},"bullseye":{"status":"resolved","repositories":{"bullseye":"120.0.6099.224-1~deb11u1","bullseye-security":"120.0.6099.224-1~deb11u1"},"fixed_version":"97.0.4692.71-0.1~deb11u1","urgency":"not yet assigned"},"forky":{"status":"resolved","repositories":{"forky":"145.0.7632.159-1"},"fixed_version":"97.0.4692.71-0.1","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"146.0.7680.71-1"},"fixed_version":"97.0.4692.71-0.1","urgency":"not yet assigned"},"trixie":{"status":"resolved","repositories":{"trixie":"143.0.7499.169-1~deb13u1","trixie-security":"145.0.7632.159-1~deb13u1"},"fixed_version":"97.0.4692.71-0.1","urgency":"not yet assigned"}}},"CVE-2021-37984":{"description":"Heap buffer overflow in PDFium in Google Chrome prior to 95.0.4638.54 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page.","scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"143.0.7499.169-1~deb12u1","bookworm-security":"145.0.7632.159-1~deb12u1"},"fixed_version":"97.0.4692.71-0.1","urgency":"not yet assigned"},"bullseye":{"status":"resolved","repositories":{"bullseye":"120.0.6099.224-1~deb11u1","bullseye-security":"120.0.6099.224-1~deb11u1"},"fixed_version":"97.0.4692.71-0.1~deb11u1","urgency":"not yet assigned"},"forky":{"status":"resolved","repositories":{"forky":"145.0.7632.159-1"},"fixed_version":"97.0.4692.71-0.1","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"146.0.7680.71-1"},"fixed_version":"97.0.4692.71-0.1","urgency":"not yet assigned"},"trixie":{"status":"resolved","repositories":{"trixie":"143.0.7499.169-1~deb13u1","trixie-security":"145.0.7632.159-1~deb13u1"},"fixed_version":"97.0.4692.71-0.1","urgency":"not yet assigned"}}},"CVE-2021-37985":{"description":"Use after free in V8 in Google Chrome prior to 95.0.4638.54 allowed a remote attacker who had convinced a user to allow for connection to debugger to potentially exploit heap corruption via a crafted HTML page.","scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"143.0.7499.169-1~deb12u1","bookworm-security":"145.0.7632.159-1~deb12u1"},"fixed_version":"97.0.4692.71-0.1","urgency":"not yet assigned"},"bullseye":{"status":"resolved","repositories":{"bullseye":"120.0.6099.224-1~deb11u1","bullseye-security":"120.0.6099.224-1~deb11u1"},"fixed_version":"97.0.4692.71-0.1~deb11u1","urgency":"not yet assigned"},"forky":{"status":"resolved","repositories":{"forky":"145.0.7632.159-1"},"fixed_version":"97.0.4692.71-0.1","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"146.0.7680.71-1"},"fixed_version":"97.0.4692.71-0.1","urgency":"not yet assigned"},"trixie":{"status":"resolved","repositories":{"trixie":"143.0.7499.169-1~deb13u1","trixie-security":"145.0.7632.159-1~deb13u1"},"fixed_version":"97.0.4692.71-0.1","urgency":"not yet assigned"}}},"CVE-2021-37986":{"description":"Heap buffer overflow in Settings in Google Chrome prior to 95.0.4638.54 allowed a remote attacker to engage with Dev Tools to potentially exploit heap corruption via a crafted HTML page.","scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"143.0.7499.169-1~deb12u1","bookworm-security":"145.0.7632.159-1~deb12u1"},"fixed_version":"97.0.4692.71-0.1","urgency":"not yet assigned"},"bullseye":{"status":"resolved","repositories":{"bullseye":"120.0.6099.224-1~deb11u1","bullseye-security":"120.0.6099.224-1~deb11u1"},"fixed_version":"97.0.4692.71-0.1~deb11u1","urgency":"not yet assigned"},"forky":{"status":"resolved","repositories":{"forky":"145.0.7632.159-1"},"fixed_version":"97.0.4692.71-0.1","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"146.0.7680.71-1"},"fixed_version":"97.0.4692.71-0.1","urgency":"not yet assigned"},"trixie":{"status":"resolved","repositories":{"trixie":"143.0.7499.169-1~deb13u1","trixie-security":"145.0.7632.159-1~deb13u1"},"fixed_version":"97.0.4692.71-0.1","urgency":"not yet assigned"}}},"CVE-2021-37987":{"description":"Use after free in Network APIs in Google Chrome prior to 95.0.4638.54 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page.","scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"143.0.7499.169-1~deb12u1","bookworm-security":"145.0.7632.159-1~deb12u1"},"fixed_version":"97.0.4692.71-0.1","urgency":"not yet assigned"},"bullseye":{"status":"resolved","repositories":{"bullseye":"120.0.6099.224-1~deb11u1","bullseye-security":"120.0.6099.224-1~deb11u1"},"fixed_version":"97.0.4692.71-0.1~deb11u1","urgency":"not yet assigned"},"forky":{"status":"resolved","repositories":{"forky":"145.0.7632.159-1"},"fixed_version":"97.0.4692.71-0.1","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"146.0.7680.71-1"},"fixed_version":"97.0.4692.71-0.1","urgency":"not yet assigned"},"trixie":{"status":"resolved","repositories":{"trixie":"143.0.7499.169-1~deb13u1","trixie-security":"145.0.7632.159-1~deb13u1"},"fixed_version":"97.0.4692.71-0.1","urgency":"not yet assigned"}}},"CVE-2021-37988":{"description":"Use after free in Profiles in Google Chrome prior to 95.0.4638.54 allowed a remote attacker who convinced a user to engage in specific gestures to potentially exploit heap corruption via a crafted HTML page.","scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"143.0.7499.169-1~deb12u1","bookworm-security":"145.0.7632.159-1~deb12u1"},"fixed_version":"97.0.4692.71-0.1","urgency":"not yet assigned"},"bullseye":{"status":"resolved","repositories":{"bullseye":"120.0.6099.224-1~deb11u1","bullseye-security":"120.0.6099.224-1~deb11u1"},"fixed_version":"97.0.4692.71-0.1~deb11u1","urgency":"not yet assigned"},"forky":{"status":"resolved","repositories":{"forky":"145.0.7632.159-1"},"fixed_version":"97.0.4692.71-0.1","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"146.0.7680.71-1"},"fixed_version":"97.0.4692.71-0.1","urgency":"not yet assigned"},"trixie":{"status":"resolved","repositories":{"trixie":"143.0.7499.169-1~deb13u1","trixie-security":"145.0.7632.159-1~deb13u1"},"fixed_version":"97.0.4692.71-0.1","urgency":"not yet assigned"}}},"CVE-2021-37989":{"description":"Inappropriate implementation in Blink in Google Chrome prior to 95.0.4638.54 allowed a remote attacker to abuse content security policy via a crafted HTML page.","scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"143.0.7499.169-1~deb12u1","bookworm-security":"145.0.7632.159-1~deb12u1"},"fixed_version":"97.0.4692.71-0.1","urgency":"not yet assigned"},"bullseye":{"status":"resolved","repositories":{"bullseye":"120.0.6099.224-1~deb11u1","bullseye-security":"120.0.6099.224-1~deb11u1"},"fixed_version":"97.0.4692.71-0.1~deb11u1","urgency":"not yet assigned"},"forky":{"status":"resolved","repositories":{"forky":"145.0.7632.159-1"},"fixed_version":"97.0.4692.71-0.1","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"146.0.7680.71-1"},"fixed_version":"97.0.4692.71-0.1","urgency":"not yet assigned"},"trixie":{"status":"resolved","repositories":{"trixie":"143.0.7499.169-1~deb13u1","trixie-security":"145.0.7632.159-1~deb13u1"},"fixed_version":"97.0.4692.71-0.1","urgency":"not yet assigned"}}},"CVE-2021-37990":{"description":"Inappropriate implementation in WebView in Google Chrome on Android prior to 95.0.4638.54 allowed a remote attacker to leak cross-origin data via a crafted app.","scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"143.0.7499.169-1~deb12u1","bookworm-security":"145.0.7632.159-1~deb12u1"},"fixed_version":"97.0.4692.71-0.1","urgency":"not yet assigned"},"bullseye":{"status":"resolved","repositories":{"bullseye":"120.0.6099.224-1~deb11u1","bullseye-security":"120.0.6099.224-1~deb11u1"},"fixed_version":"97.0.4692.71-0.1~deb11u1","urgency":"not yet assigned"},"forky":{"status":"resolved","repositories":{"forky":"145.0.7632.159-1"},"fixed_version":"97.0.4692.71-0.1","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"146.0.7680.71-1"},"fixed_version":"97.0.4692.71-0.1","urgency":"not yet assigned"},"trixie":{"status":"resolved","repositories":{"trixie":"143.0.7499.169-1~deb13u1","trixie-security":"145.0.7632.159-1~deb13u1"},"fixed_version":"97.0.4692.71-0.1","urgency":"not yet assigned"}}},"CVE-2021-37991":{"description":"Race in V8 in Google Chrome prior to 95.0.4638.54 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page.","scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"143.0.7499.169-1~deb12u1","bookworm-security":"145.0.7632.159-1~deb12u1"},"fixed_version":"97.0.4692.71-0.1","urgency":"not yet assigned"},"bullseye":{"status":"resolved","repositories":{"bullseye":"120.0.6099.224-1~deb11u1","bullseye-security":"120.0.6099.224-1~deb11u1"},"fixed_version":"97.0.4692.71-0.1~deb11u1","urgency":"not yet assigned"},"forky":{"status":"resolved","repositories":{"forky":"145.0.7632.159-1"},"fixed_version":"97.0.4692.71-0.1","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"146.0.7680.71-1"},"fixed_version":"97.0.4692.71-0.1","urgency":"not yet assigned"},"trixie":{"status":"resolved","repositories":{"trixie":"143.0.7499.169-1~deb13u1","trixie-security":"145.0.7632.159-1~deb13u1"},"fixed_version":"97.0.4692.71-0.1","urgency":"not yet assigned"}}},"CVE-2021-37992":{"description":"Out of bounds read in WebAudio in Google Chrome prior to 95.0.4638.54 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page.","scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"143.0.7499.169-1~deb12u1","bookworm-security":"145.0.7632.159-1~deb12u1"},"fixed_version":"97.0.4692.71-0.1","urgency":"not yet assigned"},"bullseye":{"status":"resolved","repositories":{"bullseye":"120.0.6099.224-1~deb11u1","bullseye-security":"120.0.6099.224-1~deb11u1"},"fixed_version":"97.0.4692.71-0.1~deb11u1","urgency":"not yet assigned"},"forky":{"status":"resolved","repositories":{"forky":"145.0.7632.159-1"},"fixed_version":"97.0.4692.71-0.1","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"146.0.7680.71-1"},"fixed_version":"97.0.4692.71-0.1","urgency":"not yet assigned"},"trixie":{"status":"resolved","repositories":{"trixie":"143.0.7499.169-1~deb13u1","trixie-security":"145.0.7632.159-1~deb13u1"},"fixed_version":"97.0.4692.71-0.1","urgency":"not yet assigned"}}},"CVE-2021-37993":{"description":"Use after free in PDF Accessibility in Google Chrome prior to 95.0.4638.54 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page.","scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"143.0.7499.169-1~deb12u1","bookworm-security":"145.0.7632.159-1~deb12u1"},"fixed_version":"97.0.4692.71-0.1","urgency":"not yet assigned"},"bullseye":{"status":"resolved","repositories":{"bullseye":"120.0.6099.224-1~deb11u1","bullseye-security":"120.0.6099.224-1~deb11u1"},"fixed_version":"97.0.4692.71-0.1~deb11u1","urgency":"not yet assigned"},"forky":{"status":"resolved","repositories":{"forky":"145.0.7632.159-1"},"fixed_version":"97.0.4692.71-0.1","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"146.0.7680.71-1"},"fixed_version":"97.0.4692.71-0.1","urgency":"not yet assigned"},"trixie":{"status":"resolved","repositories":{"trixie":"143.0.7499.169-1~deb13u1","trixie-security":"145.0.7632.159-1~deb13u1"},"fixed_version":"97.0.4692.71-0.1","urgency":"not yet assigned"}}},"CVE-2021-37994":{"description":"Inappropriate implementation in iFrame Sandbox in Google Chrome prior to 95.0.4638.54 allowed a remote attacker to bypass navigation restrictions via a crafted HTML page.","scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"143.0.7499.169-1~deb12u1","bookworm-security":"145.0.7632.159-1~deb12u1"},"fixed_version":"97.0.4692.71-0.1","urgency":"not yet assigned"},"bullseye":{"status":"resolved","repositories":{"bullseye":"120.0.6099.224-1~deb11u1","bullseye-security":"120.0.6099.224-1~deb11u1"},"fixed_version":"97.0.4692.71-0.1~deb11u1","urgency":"not yet assigned"},"forky":{"status":"resolved","repositories":{"forky":"145.0.7632.159-1"},"fixed_version":"97.0.4692.71-0.1","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"146.0.7680.71-1"},"fixed_version":"97.0.4692.71-0.1","urgency":"not yet assigned"},"trixie":{"status":"resolved","repositories":{"trixie":"143.0.7499.169-1~deb13u1","trixie-security":"145.0.7632.159-1~deb13u1"},"fixed_version":"97.0.4692.71-0.1","urgency":"not yet assigned"}}},"CVE-2021-37995":{"description":"Inappropriate implementation in WebApp Installer in Google Chrome prior to 95.0.4638.54 allowed a remote attacker to potentially overlay and spoof the contents of the Omnibox (URL bar) via a crafted HTML page.","scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"143.0.7499.169-1~deb12u1","bookworm-security":"145.0.7632.159-1~deb12u1"},"fixed_version":"97.0.4692.71-0.1","urgency":"not yet assigned"},"bullseye":{"status":"resolved","repositories":{"bullseye":"120.0.6099.224-1~deb11u1","bullseye-security":"120.0.6099.224-1~deb11u1"},"fixed_version":"97.0.4692.71-0.1~deb11u1","urgency":"not yet assigned"},"forky":{"status":"resolved","repositories":{"forky":"145.0.7632.159-1"},"fixed_version":"97.0.4692.71-0.1","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"146.0.7680.71-1"},"fixed_version":"97.0.4692.71-0.1","urgency":"not yet assigned"},"trixie":{"status":"resolved","repositories":{"trixie":"143.0.7499.169-1~deb13u1","trixie-security":"145.0.7632.159-1~deb13u1"},"fixed_version":"97.0.4692.71-0.1","urgency":"not yet assigned"}}},"CVE-2021-37996":{"description":"Insufficient validation of untrusted input Downloads in Google Chrome prior to 95.0.4638.54 allowed a remote attacker to bypass navigation restrictions via a malicious file.","scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"143.0.7499.169-1~deb12u1","bookworm-security":"145.0.7632.159-1~deb12u1"},"fixed_version":"97.0.4692.71-0.1","urgency":"not yet assigned"},"bullseye":{"status":"resolved","repositories":{"bullseye":"120.0.6099.224-1~deb11u1","bullseye-security":"120.0.6099.224-1~deb11u1"},"fixed_version":"97.0.4692.71-0.1~deb11u1","urgency":"not yet assigned"},"forky":{"status":"resolved","repositories":{"forky":"145.0.7632.159-1"},"fixed_version":"97.0.4692.71-0.1","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"146.0.7680.71-1"},"fixed_version":"97.0.4692.71-0.1","urgency":"not yet assigned"},"trixie":{"status":"resolved","repositories":{"trixie":"143.0.7499.169-1~deb13u1","trixie-security":"145.0.7632.159-1~deb13u1"},"fixed_version":"97.0.4692.71-0.1","urgency":"not yet assigned"}}},"CVE-2021-37997":{"description":"Use after free in Sign-In in Google Chrome prior to 95.0.4638.69 allowed a remote attacker who convinced a user to sign into Chrome to potentially exploit heap corruption via a crafted HTML page.","scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"143.0.7499.169-1~deb12u1","bookworm-security":"145.0.7632.159-1~deb12u1"},"fixed_version":"97.0.4692.71-0.1","urgency":"not yet assigned"},"bullseye":{"status":"resolved","repositories":{"bullseye":"120.0.6099.224-1~deb11u1","bullseye-security":"120.0.6099.224-1~deb11u1"},"fixed_version":"97.0.4692.71-0.1~deb11u1","urgency":"not yet assigned"},"forky":{"status":"resolved","repositories":{"forky":"145.0.7632.159-1"},"fixed_version":"97.0.4692.71-0.1","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"146.0.7680.71-1"},"fixed_version":"97.0.4692.71-0.1","urgency":"not yet assigned"},"trixie":{"status":"resolved","repositories":{"trixie":"143.0.7499.169-1~deb13u1","trixie-security":"145.0.7632.159-1~deb13u1"},"fixed_version":"97.0.4692.71-0.1","urgency":"not yet assigned"}}},"CVE-2021-37998":{"description":"Use after free in Garbage Collection in Google Chrome prior to 95.0.4638.69 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page.","scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"143.0.7499.169-1~deb12u1","bookworm-security":"145.0.7632.159-1~deb12u1"},"fixed_version":"97.0.4692.71-0.1","urgency":"not yet assigned"},"bullseye":{"status":"resolved","repositories":{"bullseye":"120.0.6099.224-1~deb11u1","bullseye-security":"120.0.6099.224-1~deb11u1"},"fixed_version":"97.0.4692.71-0.1~deb11u1","urgency":"not yet assigned"},"forky":{"status":"resolved","repositories":{"forky":"145.0.7632.159-1"},"fixed_version":"97.0.4692.71-0.1","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"146.0.7680.71-1"},"fixed_version":"97.0.4692.71-0.1","urgency":"not yet assigned"},"trixie":{"status":"resolved","repositories":{"trixie":"143.0.7499.169-1~deb13u1","trixie-security":"145.0.7632.159-1~deb13u1"},"fixed_version":"97.0.4692.71-0.1","urgency":"not yet assigned"}}},"CVE-2021-37999":{"description":"Insufficient data validation in New Tab Page in Google Chrome prior to 95.0.4638.69 allowed a remote attacker to inject arbitrary scripts or HTML in a new browser tab via a crafted HTML page.","scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"143.0.7499.169-1~deb12u1","bookworm-security":"145.0.7632.159-1~deb12u1"},"fixed_version":"97.0.4692.71-0.1","urgency":"not yet assigned"},"bullseye":{"status":"resolved","repositories":{"bullseye":"120.0.6099.224-1~deb11u1","bullseye-security":"120.0.6099.224-1~deb11u1"},"fixed_version":"97.0.4692.71-0.1~deb11u1","urgency":"not yet assigned"},"forky":{"status":"resolved","repositories":{"forky":"145.0.7632.159-1"},"fixed_version":"97.0.4692.71-0.1","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"146.0.7680.71-1"},"fixed_version":"97.0.4692.71-0.1","urgency":"not yet assigned"},"trixie":{"status":"resolved","repositories":{"trixie":"143.0.7499.169-1~deb13u1","trixie-security":"145.0.7632.159-1~deb13u1"},"fixed_version":"97.0.4692.71-0.1","urgency":"not yet assigned"}}},"CVE-2021-38000":{"description":"Insufficient validation of untrusted input in Intents in Google Chrome on Android prior to 95.0.4638.69 allowed a remote attacker to arbitrarily browser to a malicious URL via a crafted HTML page.","scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"143.0.7499.169-1~deb12u1","bookworm-security":"145.0.7632.159-1~deb12u1"},"fixed_version":"97.0.4692.71-0.1","urgency":"not yet assigned"},"bullseye":{"status":"resolved","repositories":{"bullseye":"120.0.6099.224-1~deb11u1","bullseye-security":"120.0.6099.224-1~deb11u1"},"fixed_version":"97.0.4692.71-0.1~deb11u1","urgency":"not yet assigned"},"forky":{"status":"resolved","repositories":{"forky":"145.0.7632.159-1"},"fixed_version":"97.0.4692.71-0.1","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"146.0.7680.71-1"},"fixed_version":"97.0.4692.71-0.1","urgency":"not yet assigned"},"trixie":{"status":"resolved","repositories":{"trixie":"143.0.7499.169-1~deb13u1","trixie-security":"145.0.7632.159-1~deb13u1"},"fixed_version":"97.0.4692.71-0.1","urgency":"not yet assigned"}}},"CVE-2021-38001":{"description":"Type confusion in V8 in Google Chrome prior to 95.0.4638.69 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page.","scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"143.0.7499.169-1~deb12u1","bookworm-security":"145.0.7632.159-1~deb12u1"},"fixed_version":"97.0.4692.71-0.1","urgency":"not yet assigned"},"bullseye":{"status":"resolved","repositories":{"bullseye":"120.0.6099.224-1~deb11u1","bullseye-security":"120.0.6099.224-1~deb11u1"},"fixed_version":"97.0.4692.71-0.1~deb11u1","urgency":"not yet assigned"},"forky":{"status":"resolved","repositories":{"forky":"145.0.7632.159-1"},"fixed_version":"97.0.4692.71-0.1","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"146.0.7680.71-1"},"fixed_version":"97.0.4692.71-0.1","urgency":"not yet assigned"},"trixie":{"status":"resolved","repositories":{"trixie":"143.0.7499.169-1~deb13u1","trixie-security":"145.0.7632.159-1~deb13u1"},"fixed_version":"97.0.4692.71-0.1","urgency":"not yet assigned"}}},"CVE-2021-38002":{"description":"Use after free in Web Transport in Google Chrome prior to 95.0.4638.69 allowed a remote attacker to potentially perform a sandbox escape via a crafted HTML page.","scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"143.0.7499.169-1~deb12u1","bookworm-security":"145.0.7632.159-1~deb12u1"},"fixed_version":"97.0.4692.71-0.1","urgency":"not yet assigned"},"bullseye":{"status":"resolved","repositories":{"bullseye":"120.0.6099.224-1~deb11u1","bullseye-security":"120.0.6099.224-1~deb11u1"},"fixed_version":"97.0.4692.71-0.1~deb11u1","urgency":"not yet assigned"},"forky":{"status":"resolved","repositories":{"forky":"145.0.7632.159-1"},"fixed_version":"97.0.4692.71-0.1","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"146.0.7680.71-1"},"fixed_version":"97.0.4692.71-0.1","urgency":"not yet assigned"},"trixie":{"status":"resolved","repositories":{"trixie":"143.0.7499.169-1~deb13u1","trixie-security":"145.0.7632.159-1~deb13u1"},"fixed_version":"97.0.4692.71-0.1","urgency":"not yet assigned"}}},"CVE-2021-38003":{"description":"Inappropriate implementation in V8 in Google Chrome prior to 95.0.4638.69 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page.","scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"143.0.7499.169-1~deb12u1","bookworm-security":"145.0.7632.159-1~deb12u1"},"fixed_version":"97.0.4692.71-0.1","urgency":"not yet assigned"},"bullseye":{"status":"resolved","repositories":{"bullseye":"120.0.6099.224-1~deb11u1","bullseye-security":"120.0.6099.224-1~deb11u1"},"fixed_version":"97.0.4692.71-0.1~deb11u1","urgency":"not yet assigned"},"forky":{"status":"resolved","repositories":{"forky":"145.0.7632.159-1"},"fixed_version":"97.0.4692.71-0.1","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"146.0.7680.71-1"},"fixed_version":"97.0.4692.71-0.1","urgency":"not yet assigned"},"trixie":{"status":"resolved","repositories":{"trixie":"143.0.7499.169-1~deb13u1","trixie-security":"145.0.7632.159-1~deb13u1"},"fixed_version":"97.0.4692.71-0.1","urgency":"not yet assigned"}}},"CVE-2021-38004":{"description":"Insufficient policy enforcement in Autofill in Google Chrome prior to 95.0.4638.69 allowed a remote attacker to leak cross-origin data via a crafted HTML page.","scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"143.0.7499.169-1~deb12u1","bookworm-security":"145.0.7632.159-1~deb12u1"},"fixed_version":"97.0.4692.71-0.1","urgency":"not yet assigned"},"bullseye":{"status":"resolved","repositories":{"bullseye":"120.0.6099.224-1~deb11u1","bullseye-security":"120.0.6099.224-1~deb11u1"},"fixed_version":"97.0.4692.71-0.1~deb11u1","urgency":"not yet assigned"},"forky":{"status":"resolved","repositories":{"forky":"145.0.7632.159-1"},"fixed_version":"97.0.4692.71-0.1","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"146.0.7680.71-1"},"fixed_version":"97.0.4692.71-0.1","urgency":"not yet assigned"},"trixie":{"status":"resolved","repositories":{"trixie":"143.0.7499.169-1~deb13u1","trixie-security":"145.0.7632.159-1~deb13u1"},"fixed_version":"97.0.4692.71-0.1","urgency":"not yet assigned"}}},"CVE-2021-38005":{"description":"Use after free in loader in Google Chrome prior to 96.0.4664.45 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page.","scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"143.0.7499.169-1~deb12u1","bookworm-security":"145.0.7632.159-1~deb12u1"},"fixed_version":"97.0.4692.71-0.1","urgency":"not yet assigned"},"bullseye":{"status":"resolved","repositories":{"bullseye":"120.0.6099.224-1~deb11u1","bullseye-security":"120.0.6099.224-1~deb11u1"},"fixed_version":"97.0.4692.71-0.1~deb11u1","urgency":"not yet assigned"},"forky":{"status":"resolved","repositories":{"forky":"145.0.7632.159-1"},"fixed_version":"97.0.4692.71-0.1","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"146.0.7680.71-1"},"fixed_version":"97.0.4692.71-0.1","urgency":"not yet assigned"},"trixie":{"status":"resolved","repositories":{"trixie":"143.0.7499.169-1~deb13u1","trixie-security":"145.0.7632.159-1~deb13u1"},"fixed_version":"97.0.4692.71-0.1","urgency":"not yet assigned"}}},"CVE-2021-38006":{"description":"Use after free in storage foundation in Google Chrome prior to 96.0.4664.45 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page.","scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"143.0.7499.169-1~deb12u1","bookworm-security":"145.0.7632.159-1~deb12u1"},"fixed_version":"97.0.4692.71-0.1","urgency":"not yet assigned"},"bullseye":{"status":"resolved","repositories":{"bullseye":"120.0.6099.224-1~deb11u1","bullseye-security":"120.0.6099.224-1~deb11u1"},"fixed_version":"97.0.4692.71-0.1~deb11u1","urgency":"not yet assigned"},"forky":{"status":"resolved","repositories":{"forky":"145.0.7632.159-1"},"fixed_version":"97.0.4692.71-0.1","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"146.0.7680.71-1"},"fixed_version":"97.0.4692.71-0.1","urgency":"not yet assigned"},"trixie":{"status":"resolved","repositories":{"trixie":"143.0.7499.169-1~deb13u1","trixie-security":"145.0.7632.159-1~deb13u1"},"fixed_version":"97.0.4692.71-0.1","urgency":"not yet assigned"}}},"CVE-2021-38007":{"description":"Type confusion in V8 in Google Chrome prior to 96.0.4664.45 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page.","scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"143.0.7499.169-1~deb12u1","bookworm-security":"145.0.7632.159-1~deb12u1"},"fixed_version":"97.0.4692.71-0.1","urgency":"not yet assigned"},"bullseye":{"status":"resolved","repositories":{"bullseye":"120.0.6099.224-1~deb11u1","bullseye-security":"120.0.6099.224-1~deb11u1"},"fixed_version":"97.0.4692.71-0.1~deb11u1","urgency":"not yet assigned"},"forky":{"status":"resolved","repositories":{"forky":"145.0.7632.159-1"},"fixed_version":"97.0.4692.71-0.1","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"146.0.7680.71-1"},"fixed_version":"97.0.4692.71-0.1","urgency":"not yet assigned"},"trixie":{"status":"resolved","repositories":{"trixie":"143.0.7499.169-1~deb13u1","trixie-security":"145.0.7632.159-1~deb13u1"},"fixed_version":"97.0.4692.71-0.1","urgency":"not yet assigned"}}},"CVE-2021-38008":{"description":"Use after free in media in Google Chrome prior to 96.0.4664.45 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page.","scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"143.0.7499.169-1~deb12u1","bookworm-security":"145.0.7632.159-1~deb12u1"},"fixed_version":"97.0.4692.71-0.1","urgency":"not yet assigned"},"bullseye":{"status":"resolved","repositories":{"bullseye":"120.0.6099.224-1~deb11u1","bullseye-security":"120.0.6099.224-1~deb11u1"},"fixed_version":"97.0.4692.71-0.1~deb11u1","urgency":"not yet assigned"},"forky":{"status":"resolved","repositories":{"forky":"145.0.7632.159-1"},"fixed_version":"97.0.4692.71-0.1","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"146.0.7680.71-1"},"fixed_version":"97.0.4692.71-0.1","urgency":"not yet assigned"},"trixie":{"status":"resolved","repositories":{"trixie":"143.0.7499.169-1~deb13u1","trixie-security":"145.0.7632.159-1~deb13u1"},"fixed_version":"97.0.4692.71-0.1","urgency":"not yet assigned"}}},"CVE-2021-38009":{"description":"Inappropriate implementation in cache in Google Chrome prior to 96.0.4664.45 allowed a remote attacker to leak cross-origin data via a crafted HTML page.","scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"143.0.7499.169-1~deb12u1","bookworm-security":"145.0.7632.159-1~deb12u1"},"fixed_version":"97.0.4692.71-0.1","urgency":"not yet assigned"},"bullseye":{"status":"resolved","repositories":{"bullseye":"120.0.6099.224-1~deb11u1","bullseye-security":"120.0.6099.224-1~deb11u1"},"fixed_version":"97.0.4692.71-0.1~deb11u1","urgency":"not yet assigned"},"forky":{"status":"resolved","repositories":{"forky":"145.0.7632.159-1"},"fixed_version":"97.0.4692.71-0.1","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"146.0.7680.71-1"},"fixed_version":"97.0.4692.71-0.1","urgency":"not yet assigned"},"trixie":{"status":"resolved","repositories":{"trixie":"143.0.7499.169-1~deb13u1","trixie-security":"145.0.7632.159-1~deb13u1"},"fixed_version":"97.0.4692.71-0.1","urgency":"not yet assigned"}}},"CVE-2021-38010":{"description":"Inappropriate implementation in service workers in Google Chrome prior to 96.0.4664.45 allowed a remote attacker who had compromised the renderer process to bypass site isolation via a crafted HTML page.","scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"143.0.7499.169-1~deb12u1","bookworm-security":"145.0.7632.159-1~deb12u1"},"fixed_version":"97.0.4692.71-0.1","urgency":"not yet assigned"},"bullseye":{"status":"resolved","repositories":{"bullseye":"120.0.6099.224-1~deb11u1","bullseye-security":"120.0.6099.224-1~deb11u1"},"fixed_version":"97.0.4692.71-0.1~deb11u1","urgency":"not yet assigned"},"forky":{"status":"resolved","repositories":{"forky":"145.0.7632.159-1"},"fixed_version":"97.0.4692.71-0.1","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"146.0.7680.71-1"},"fixed_version":"97.0.4692.71-0.1","urgency":"not yet assigned"},"trixie":{"status":"resolved","repositories":{"trixie":"143.0.7499.169-1~deb13u1","trixie-security":"145.0.7632.159-1~deb13u1"},"fixed_version":"97.0.4692.71-0.1","urgency":"not yet assigned"}}},"CVE-2021-38011":{"description":"Use after free in storage foundation in Google Chrome prior to 96.0.4664.45 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page.","scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"143.0.7499.169-1~deb12u1","bookworm-security":"145.0.7632.159-1~deb12u1"},"fixed_version":"97.0.4692.71-0.1","urgency":"not yet assigned"},"bullseye":{"status":"resolved","repositories":{"bullseye":"120.0.6099.224-1~deb11u1","bullseye-security":"120.0.6099.224-1~deb11u1"},"fixed_version":"97.0.4692.71-0.1~deb11u1","urgency":"not yet assigned"},"forky":{"status":"resolved","repositories":{"forky":"145.0.7632.159-1"},"fixed_version":"97.0.4692.71-0.1","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"146.0.7680.71-1"},"fixed_version":"97.0.4692.71-0.1","urgency":"not yet assigned"},"trixie":{"status":"resolved","repositories":{"trixie":"143.0.7499.169-1~deb13u1","trixie-security":"145.0.7632.159-1~deb13u1"},"fixed_version":"97.0.4692.71-0.1","urgency":"not yet assigned"}}},"CVE-2021-38012":{"description":"Type confusion in V8 in Google Chrome prior to 96.0.4664.45 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page.","scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"143.0.7499.169-1~deb12u1","bookworm-security":"145.0.7632.159-1~deb12u1"},"fixed_version":"97.0.4692.71-0.1","urgency":"not yet assigned"},"bullseye":{"status":"resolved","repositories":{"bullseye":"120.0.6099.224-1~deb11u1","bullseye-security":"120.0.6099.224-1~deb11u1"},"fixed_version":"97.0.4692.71-0.1~deb11u1","urgency":"not yet assigned"},"forky":{"status":"resolved","repositories":{"forky":"145.0.7632.159-1"},"fixed_version":"97.0.4692.71-0.1","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"146.0.7680.71-1"},"fixed_version":"97.0.4692.71-0.1","urgency":"not yet assigned"},"trixie":{"status":"resolved","repositories":{"trixie":"143.0.7499.169-1~deb13u1","trixie-security":"145.0.7632.159-1~deb13u1"},"fixed_version":"97.0.4692.71-0.1","urgency":"not yet assigned"}}},"CVE-2021-38013":{"description":"Heap buffer overflow in fingerprint recognition in Google Chrome on ChromeOS prior to 96.0.4664.45 allowed a remote attacker who had compromised a WebUI renderer process to potentially perform a sandbox escape via a crafted HTML page.","scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"143.0.7499.169-1~deb12u1","bookworm-security":"145.0.7632.159-1~deb12u1"},"fixed_version":"97.0.4692.71-0.1","urgency":"not yet assigned"},"bullseye":{"status":"resolved","repositories":{"bullseye":"120.0.6099.224-1~deb11u1","bullseye-security":"120.0.6099.224-1~deb11u1"},"fixed_version":"97.0.4692.71-0.1~deb11u1","urgency":"not yet assigned"},"forky":{"status":"resolved","repositories":{"forky":"145.0.7632.159-1"},"fixed_version":"97.0.4692.71-0.1","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"146.0.7680.71-1"},"fixed_version":"97.0.4692.71-0.1","urgency":"not yet assigned"},"trixie":{"status":"resolved","repositories":{"trixie":"143.0.7499.169-1~deb13u1","trixie-security":"145.0.7632.159-1~deb13u1"},"fixed_version":"97.0.4692.71-0.1","urgency":"not yet assigned"}}},"CVE-2021-38014":{"description":"Out of bounds write in Swiftshader in Google Chrome prior to 96.0.4664.45 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page.","scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"143.0.7499.169-1~deb12u1","bookworm-security":"145.0.7632.159-1~deb12u1"},"fixed_version":"97.0.4692.71-0.1","urgency":"not yet assigned"},"bullseye":{"status":"resolved","repositories":{"bullseye":"120.0.6099.224-1~deb11u1","bullseye-security":"120.0.6099.224-1~deb11u1"},"fixed_version":"97.0.4692.71-0.1~deb11u1","urgency":"not yet assigned"},"forky":{"status":"resolved","repositories":{"forky":"145.0.7632.159-1"},"fixed_version":"97.0.4692.71-0.1","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"146.0.7680.71-1"},"fixed_version":"97.0.4692.71-0.1","urgency":"not yet assigned"},"trixie":{"status":"resolved","repositories":{"trixie":"143.0.7499.169-1~deb13u1","trixie-security":"145.0.7632.159-1~deb13u1"},"fixed_version":"97.0.4692.71-0.1","urgency":"not yet assigned"}}},"CVE-2021-38015":{"description":"Inappropriate implementation in input in Google Chrome prior to 96.0.4664.45 allowed an attacker who convinced a user to install a malicious extension to bypass navigation restrictions via a crafted Chrome Extension.","scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"143.0.7499.169-1~deb12u1","bookworm-security":"145.0.7632.159-1~deb12u1"},"fixed_version":"97.0.4692.71-0.1","urgency":"not yet assigned"},"bullseye":{"status":"resolved","repositories":{"bullseye":"120.0.6099.224-1~deb11u1","bullseye-security":"120.0.6099.224-1~deb11u1"},"fixed_version":"97.0.4692.71-0.1~deb11u1","urgency":"not yet assigned"},"forky":{"status":"resolved","repositories":{"forky":"145.0.7632.159-1"},"fixed_version":"97.0.4692.71-0.1","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"146.0.7680.71-1"},"fixed_version":"97.0.4692.71-0.1","urgency":"not yet assigned"},"trixie":{"status":"resolved","repositories":{"trixie":"143.0.7499.169-1~deb13u1","trixie-security":"145.0.7632.159-1~deb13u1"},"fixed_version":"97.0.4692.71-0.1","urgency":"not yet assigned"}}},"CVE-2021-38016":{"description":"Insufficient policy enforcement in background fetch in Google Chrome prior to 96.0.4664.45 allowed a remote attacker to bypass same origin policy via a crafted HTML page.","scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"143.0.7499.169-1~deb12u1","bookworm-security":"145.0.7632.159-1~deb12u1"},"fixed_version":"97.0.4692.71-0.1","urgency":"not yet assigned"},"bullseye":{"status":"resolved","repositories":{"bullseye":"120.0.6099.224-1~deb11u1","bullseye-security":"120.0.6099.224-1~deb11u1"},"fixed_version":"97.0.4692.71-0.1~deb11u1","urgency":"not yet assigned"},"forky":{"status":"resolved","repositories":{"forky":"145.0.7632.159-1"},"fixed_version":"97.0.4692.71-0.1","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"146.0.7680.71-1"},"fixed_version":"97.0.4692.71-0.1","urgency":"not yet assigned"},"trixie":{"status":"resolved","repositories":{"trixie":"143.0.7499.169-1~deb13u1","trixie-security":"145.0.7632.159-1~deb13u1"},"fixed_version":"97.0.4692.71-0.1","urgency":"not yet assigned"}}},"CVE-2021-38017":{"description":"Insufficient policy enforcement in iframe sandbox in Google Chrome prior to 96.0.4664.45 allowed a remote attacker to bypass navigation restrictions via a crafted HTML page.","scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"143.0.7499.169-1~deb12u1","bookworm-security":"145.0.7632.159-1~deb12u1"},"fixed_version":"97.0.4692.71-0.1","urgency":"not yet assigned"},"bullseye":{"status":"resolved","repositories":{"bullseye":"120.0.6099.224-1~deb11u1","bullseye-security":"120.0.6099.224-1~deb11u1"},"fixed_version":"97.0.4692.71-0.1~deb11u1","urgency":"not yet assigned"},"forky":{"status":"resolved","repositories":{"forky":"145.0.7632.159-1"},"fixed_version":"97.0.4692.71-0.1","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"146.0.7680.71-1"},"fixed_version":"97.0.4692.71-0.1","urgency":"not yet assigned"},"trixie":{"status":"resolved","repositories":{"trixie":"143.0.7499.169-1~deb13u1","trixie-security":"145.0.7632.159-1~deb13u1"},"fixed_version":"97.0.4692.71-0.1","urgency":"not yet assigned"}}},"CVE-2021-38018":{"description":"Inappropriate implementation in navigation in Google Chrome prior to 96.0.4664.45 allowed a remote attacker to perform domain spoofing via a crafted HTML page.","scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"143.0.7499.169-1~deb12u1","bookworm-security":"145.0.7632.159-1~deb12u1"},"fixed_version":"97.0.4692.71-0.1","urgency":"not yet assigned"},"bullseye":{"status":"resolved","repositories":{"bullseye":"120.0.6099.224-1~deb11u1","bullseye-security":"120.0.6099.224-1~deb11u1"},"fixed_version":"97.0.4692.71-0.1~deb11u1","urgency":"not yet assigned"},"forky":{"status":"resolved","repositories":{"forky":"145.0.7632.159-1"},"fixed_version":"97.0.4692.71-0.1","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"146.0.7680.71-1"},"fixed_version":"97.0.4692.71-0.1","urgency":"not yet assigned"},"trixie":{"status":"resolved","repositories":{"trixie":"143.0.7499.169-1~deb13u1","trixie-security":"145.0.7632.159-1~deb13u1"},"fixed_version":"97.0.4692.71-0.1","urgency":"not yet assigned"}}},"CVE-2021-38019":{"description":"Insufficient policy enforcement in CORS in Google Chrome prior to 96.0.4664.45 allowed a remote attacker to leak cross-origin data via a crafted HTML page.","scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"143.0.7499.169-1~deb12u1","bookworm-security":"145.0.7632.159-1~deb12u1"},"fixed_version":"97.0.4692.71-0.1","urgency":"not yet assigned"},"bullseye":{"status":"resolved","repositories":{"bullseye":"120.0.6099.224-1~deb11u1","bullseye-security":"120.0.6099.224-1~deb11u1"},"fixed_version":"97.0.4692.71-0.1~deb11u1","urgency":"not yet assigned"},"forky":{"status":"resolved","repositories":{"forky":"145.0.7632.159-1"},"fixed_version":"97.0.4692.71-0.1","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"146.0.7680.71-1"},"fixed_version":"97.0.4692.71-0.1","urgency":"not yet assigned"},"trixie":{"status":"resolved","repositories":{"trixie":"143.0.7499.169-1~deb13u1","trixie-security":"145.0.7632.159-1~deb13u1"},"fixed_version":"97.0.4692.71-0.1","urgency":"not yet assigned"}}},"CVE-2021-38020":{"description":"Insufficient policy enforcement in contacts picker in Google Chrome on Android prior to 96.0.4664.45 allowed a remote attacker to spoof the contents of the Omnibox (URL bar) via a crafted HTML page.","scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"143.0.7499.169-1~deb12u1","bookworm-security":"145.0.7632.159-1~deb12u1"},"fixed_version":"97.0.4692.71-0.1","urgency":"not yet assigned"},"bullseye":{"status":"resolved","repositories":{"bullseye":"120.0.6099.224-1~deb11u1","bullseye-security":"120.0.6099.224-1~deb11u1"},"fixed_version":"97.0.4692.71-0.1~deb11u1","urgency":"not yet assigned"},"forky":{"status":"resolved","repositories":{"forky":"145.0.7632.159-1"},"fixed_version":"97.0.4692.71-0.1","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"146.0.7680.71-1"},"fixed_version":"97.0.4692.71-0.1","urgency":"not yet assigned"},"trixie":{"status":"resolved","repositories":{"trixie":"143.0.7499.169-1~deb13u1","trixie-security":"145.0.7632.159-1~deb13u1"},"fixed_version":"97.0.4692.71-0.1","urgency":"not yet assigned"}}},"CVE-2021-38021":{"description":"Inappropriate implementation in referrer in Google Chrome prior to 96.0.4664.45 allowed a remote attacker to bypass navigation restrictions via a crafted HTML page.","scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"143.0.7499.169-1~deb12u1","bookworm-security":"145.0.7632.159-1~deb12u1"},"fixed_version":"97.0.4692.71-0.1","urgency":"not yet assigned"},"bullseye":{"status":"resolved","repositories":{"bullseye":"120.0.6099.224-1~deb11u1","bullseye-security":"120.0.6099.224-1~deb11u1"},"fixed_version":"97.0.4692.71-0.1~deb11u1","urgency":"not yet assigned"},"forky":{"status":"resolved","repositories":{"forky":"145.0.7632.159-1"},"fixed_version":"97.0.4692.71-0.1","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"146.0.7680.71-1"},"fixed_version":"97.0.4692.71-0.1","urgency":"not yet assigned"},"trixie":{"status":"resolved","repositories":{"trixie":"143.0.7499.169-1~deb13u1","trixie-security":"145.0.7632.159-1~deb13u1"},"fixed_version":"97.0.4692.71-0.1","urgency":"not yet assigned"}}},"CVE-2021-38022":{"description":"Inappropriate implementation in WebAuthentication in Google Chrome prior to 96.0.4664.45 allowed a remote attacker to leak cross-origin data via a crafted HTML page.","scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"143.0.7499.169-1~deb12u1","bookworm-security":"145.0.7632.159-1~deb12u1"},"fixed_version":"97.0.4692.71-0.1","urgency":"not yet assigned"},"bullseye":{"status":"resolved","repositories":{"bullseye":"120.0.6099.224-1~deb11u1","bullseye-security":"120.0.6099.224-1~deb11u1"},"fixed_version":"97.0.4692.71-0.1~deb11u1","urgency":"not yet assigned"},"forky":{"status":"resolved","repositories":{"forky":"145.0.7632.159-1"},"fixed_version":"97.0.4692.71-0.1","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"146.0.7680.71-1"},"fixed_version":"97.0.4692.71-0.1","urgency":"not yet assigned"},"trixie":{"status":"resolved","repositories":{"trixie":"143.0.7499.169-1~deb13u1","trixie-security":"145.0.7632.159-1~deb13u1"},"fixed_version":"97.0.4692.71-0.1","urgency":"not yet assigned"}}},"CVE-2021-38023":{"description":"Use after free in Extensions in Google Chrome prior to 92.0.4515.107 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. (Chromium security severity: High)","scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"143.0.7499.169-1~deb12u1","bookworm-security":"145.0.7632.159-1~deb12u1"},"fixed_version":"93.0.4577.82-1","urgency":"not yet assigned"},"bullseye":{"status":"resolved","repositories":{"bullseye":"120.0.6099.224-1~deb11u1","bullseye-security":"120.0.6099.224-1~deb11u1"},"fixed_version":"93.0.4577.82-1","urgency":"not yet assigned"},"forky":{"status":"resolved","repositories":{"forky":"145.0.7632.159-1"},"fixed_version":"93.0.4577.82-1","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"146.0.7680.71-1"},"fixed_version":"93.0.4577.82-1","urgency":"not yet assigned"},"trixie":{"status":"resolved","repositories":{"trixie":"143.0.7499.169-1~deb13u1","trixie-security":"145.0.7632.159-1~deb13u1"},"fixed_version":"93.0.4577.82-1","urgency":"not yet assigned"}}},"CVE-2021-4052":{"description":"Use after free in web apps in Google Chrome prior to 96.0.4664.93 allowed an attacker who convinced a user to install a malicious extension to potentially exploit heap corruption via a crafted Chrome Extension.","scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"143.0.7499.169-1~deb12u1","bookworm-security":"145.0.7632.159-1~deb12u1"},"fixed_version":"97.0.4692.71-0.1","urgency":"not yet assigned"},"bullseye":{"status":"resolved","repositories":{"bullseye":"120.0.6099.224-1~deb11u1","bullseye-security":"120.0.6099.224-1~deb11u1"},"fixed_version":"97.0.4692.71-0.1~deb11u1","urgency":"not yet assigned"},"forky":{"status":"resolved","repositories":{"forky":"145.0.7632.159-1"},"fixed_version":"97.0.4692.71-0.1","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"146.0.7680.71-1"},"fixed_version":"97.0.4692.71-0.1","urgency":"not yet assigned"},"trixie":{"status":"resolved","repositories":{"trixie":"143.0.7499.169-1~deb13u1","trixie-security":"145.0.7632.159-1~deb13u1"},"fixed_version":"97.0.4692.71-0.1","urgency":"not yet assigned"}}},"CVE-2021-4053":{"description":"Use after free in UI in Google Chrome on Linux prior to 96.0.4664.93 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page.","scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"143.0.7499.169-1~deb12u1","bookworm-security":"145.0.7632.159-1~deb12u1"},"fixed_version":"97.0.4692.71-0.1","urgency":"not yet assigned"},"bullseye":{"status":"resolved","repositories":{"bullseye":"120.0.6099.224-1~deb11u1","bullseye-security":"120.0.6099.224-1~deb11u1"},"fixed_version":"97.0.4692.71-0.1~deb11u1","urgency":"not yet assigned"},"forky":{"status":"resolved","repositories":{"forky":"145.0.7632.159-1"},"fixed_version":"97.0.4692.71-0.1","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"146.0.7680.71-1"},"fixed_version":"97.0.4692.71-0.1","urgency":"not yet assigned"},"trixie":{"status":"resolved","repositories":{"trixie":"143.0.7499.169-1~deb13u1","trixie-security":"145.0.7632.159-1~deb13u1"},"fixed_version":"97.0.4692.71-0.1","urgency":"not yet assigned"}}},"CVE-2021-4054":{"description":"Incorrect security UI in autofill in Google Chrome prior to 96.0.4664.93 allowed a remote attacker to perform domain spoofing via a crafted HTML page.","scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"143.0.7499.169-1~deb12u1","bookworm-security":"145.0.7632.159-1~deb12u1"},"fixed_version":"97.0.4692.71-0.1","urgency":"not yet assigned"},"bullseye":{"status":"resolved","repositories":{"bullseye":"120.0.6099.224-1~deb11u1","bullseye-security":"120.0.6099.224-1~deb11u1"},"fixed_version":"97.0.4692.71-0.1~deb11u1","urgency":"not yet assigned"},"forky":{"status":"resolved","repositories":{"forky":"145.0.7632.159-1"},"fixed_version":"97.0.4692.71-0.1","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"146.0.7680.71-1"},"fixed_version":"97.0.4692.71-0.1","urgency":"not yet assigned"},"trixie":{"status":"resolved","repositories":{"trixie":"143.0.7499.169-1~deb13u1","trixie-security":"145.0.7632.159-1~deb13u1"},"fixed_version":"97.0.4692.71-0.1","urgency":"not yet assigned"}}},"CVE-2021-4055":{"description":"Heap buffer overflow in extensions in Google Chrome prior to 96.0.4664.93 allowed an attacker who convinced a user to install a malicious extension to potentially exploit heap corruption via a crafted Chrome Extension.","scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"143.0.7499.169-1~deb12u1","bookworm-security":"145.0.7632.159-1~deb12u1"},"fixed_version":"97.0.4692.71-0.1","urgency":"not yet assigned"},"bullseye":{"status":"resolved","repositories":{"bullseye":"120.0.6099.224-1~deb11u1","bullseye-security":"120.0.6099.224-1~deb11u1"},"fixed_version":"97.0.4692.71-0.1~deb11u1","urgency":"not yet assigned"},"forky":{"status":"resolved","repositories":{"forky":"145.0.7632.159-1"},"fixed_version":"97.0.4692.71-0.1","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"146.0.7680.71-1"},"fixed_version":"97.0.4692.71-0.1","urgency":"not yet assigned"},"trixie":{"status":"resolved","repositories":{"trixie":"143.0.7499.169-1~deb13u1","trixie-security":"145.0.7632.159-1~deb13u1"},"fixed_version":"97.0.4692.71-0.1","urgency":"not yet assigned"}}},"CVE-2021-4056":{"description":"Type confusion in loader in Google Chrome prior to 96.0.4664.93 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page.","scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"143.0.7499.169-1~deb12u1","bookworm-security":"145.0.7632.159-1~deb12u1"},"fixed_version":"97.0.4692.71-0.1","urgency":"not yet assigned"},"bullseye":{"status":"resolved","repositories":{"bullseye":"120.0.6099.224-1~deb11u1","bullseye-security":"120.0.6099.224-1~deb11u1"},"fixed_version":"97.0.4692.71-0.1~deb11u1","urgency":"not yet assigned"},"forky":{"status":"resolved","repositories":{"forky":"145.0.7632.159-1"},"fixed_version":"97.0.4692.71-0.1","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"146.0.7680.71-1"},"fixed_version":"97.0.4692.71-0.1","urgency":"not yet assigned"},"trixie":{"status":"resolved","repositories":{"trixie":"143.0.7499.169-1~deb13u1","trixie-security":"145.0.7632.159-1~deb13u1"},"fixed_version":"97.0.4692.71-0.1","urgency":"not yet assigned"}}},"CVE-2021-4057":{"description":"Use after free in file API in Google Chrome prior to 96.0.4664.93 allowed a remote attacker who had compromised the renderer process to potentially exploit heap corruption via a crafted HTML page.","scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"143.0.7499.169-1~deb12u1","bookworm-security":"145.0.7632.159-1~deb12u1"},"fixed_version":"97.0.4692.71-0.1","urgency":"not yet assigned"},"bullseye":{"status":"resolved","repositories":{"bullseye":"120.0.6099.224-1~deb11u1","bullseye-security":"120.0.6099.224-1~deb11u1"},"fixed_version":"97.0.4692.71-0.1~deb11u1","urgency":"not yet assigned"},"forky":{"status":"resolved","repositories":{"forky":"145.0.7632.159-1"},"fixed_version":"97.0.4692.71-0.1","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"146.0.7680.71-1"},"fixed_version":"97.0.4692.71-0.1","urgency":"not yet assigned"},"trixie":{"status":"resolved","repositories":{"trixie":"143.0.7499.169-1~deb13u1","trixie-security":"145.0.7632.159-1~deb13u1"},"fixed_version":"97.0.4692.71-0.1","urgency":"not yet assigned"}}},"CVE-2021-4058":{"description":"Heap buffer overflow in ANGLE in Google Chrome prior to 96.0.4664.93 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page.","scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"143.0.7499.169-1~deb12u1","bookworm-security":"145.0.7632.159-1~deb12u1"},"fixed_version":"97.0.4692.71-0.1","urgency":"not yet assigned"},"bullseye":{"status":"resolved","repositories":{"bullseye":"120.0.6099.224-1~deb11u1","bullseye-security":"120.0.6099.224-1~deb11u1"},"fixed_version":"97.0.4692.71-0.1~deb11u1","urgency":"not yet assigned"},"forky":{"status":"resolved","repositories":{"forky":"145.0.7632.159-1"},"fixed_version":"97.0.4692.71-0.1","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"146.0.7680.71-1"},"fixed_version":"97.0.4692.71-0.1","urgency":"not yet assigned"},"trixie":{"status":"resolved","repositories":{"trixie":"143.0.7499.169-1~deb13u1","trixie-security":"145.0.7632.159-1~deb13u1"},"fixed_version":"97.0.4692.71-0.1","urgency":"not yet assigned"}}},"CVE-2021-4059":{"description":"Insufficient data validation in loader in Google Chrome prior to 96.0.4664.93 allowed a remote attacker to leak cross-origin data via a crafted HTML page.","scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"143.0.7499.169-1~deb12u1","bookworm-security":"145.0.7632.159-1~deb12u1"},"fixed_version":"97.0.4692.71-0.1","urgency":"not yet assigned"},"bullseye":{"status":"resolved","repositories":{"bullseye":"120.0.6099.224-1~deb11u1","bullseye-security":"120.0.6099.224-1~deb11u1"},"fixed_version":"97.0.4692.71-0.1~deb11u1","urgency":"not yet assigned"},"forky":{"status":"resolved","repositories":{"forky":"145.0.7632.159-1"},"fixed_version":"97.0.4692.71-0.1","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"146.0.7680.71-1"},"fixed_version":"97.0.4692.71-0.1","urgency":"not yet assigned"},"trixie":{"status":"resolved","repositories":{"trixie":"143.0.7499.169-1~deb13u1","trixie-security":"145.0.7632.159-1~deb13u1"},"fixed_version":"97.0.4692.71-0.1","urgency":"not yet assigned"}}},"CVE-2021-4061":{"description":"Type confusion in V8 in Google Chrome prior to 96.0.4664.93 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page.","scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"143.0.7499.169-1~deb12u1","bookworm-security":"145.0.7632.159-1~deb12u1"},"fixed_version":"97.0.4692.71-0.1","urgency":"not yet assigned"},"bullseye":{"status":"resolved","repositories":{"bullseye":"120.0.6099.224-1~deb11u1","bullseye-security":"120.0.6099.224-1~deb11u1"},"fixed_version":"97.0.4692.71-0.1~deb11u1","urgency":"not yet assigned"},"forky":{"status":"resolved","repositories":{"forky":"145.0.7632.159-1"},"fixed_version":"97.0.4692.71-0.1","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"146.0.7680.71-1"},"fixed_version":"97.0.4692.71-0.1","urgency":"not yet assigned"},"trixie":{"status":"resolved","repositories":{"trixie":"143.0.7499.169-1~deb13u1","trixie-security":"145.0.7632.159-1~deb13u1"},"fixed_version":"97.0.4692.71-0.1","urgency":"not yet assigned"}}},"CVE-2021-4062":{"description":"Heap buffer overflow in BFCache in Google Chrome prior to 96.0.4664.93 allowed a remote attacker who had compromised the renderer process to potentially exploit heap corruption via a crafted HTML page.","scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"143.0.7499.169-1~deb12u1","bookworm-security":"145.0.7632.159-1~deb12u1"},"fixed_version":"97.0.4692.71-0.1","urgency":"not yet assigned"},"bullseye":{"status":"resolved","repositories":{"bullseye":"120.0.6099.224-1~deb11u1","bullseye-security":"120.0.6099.224-1~deb11u1"},"fixed_version":"97.0.4692.71-0.1~deb11u1","urgency":"not yet assigned"},"forky":{"status":"resolved","repositories":{"forky":"145.0.7632.159-1"},"fixed_version":"97.0.4692.71-0.1","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"146.0.7680.71-1"},"fixed_version":"97.0.4692.71-0.1","urgency":"not yet assigned"},"trixie":{"status":"resolved","repositories":{"trixie":"143.0.7499.169-1~deb13u1","trixie-security":"145.0.7632.159-1~deb13u1"},"fixed_version":"97.0.4692.71-0.1","urgency":"not yet assigned"}}},"CVE-2021-4063":{"description":"Use after free in developer tools in Google Chrome prior to 96.0.4664.93 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page.","scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"143.0.7499.169-1~deb12u1","bookworm-security":"145.0.7632.159-1~deb12u1"},"fixed_version":"97.0.4692.71-0.1","urgency":"not yet assigned"},"bullseye":{"status":"resolved","repositories":{"bullseye":"120.0.6099.224-1~deb11u1","bullseye-security":"120.0.6099.224-1~deb11u1"},"fixed_version":"97.0.4692.71-0.1~deb11u1","urgency":"not yet assigned"},"forky":{"status":"resolved","repositories":{"forky":"145.0.7632.159-1"},"fixed_version":"97.0.4692.71-0.1","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"146.0.7680.71-1"},"fixed_version":"97.0.4692.71-0.1","urgency":"not yet assigned"},"trixie":{"status":"resolved","repositories":{"trixie":"143.0.7499.169-1~deb13u1","trixie-security":"145.0.7632.159-1~deb13u1"},"fixed_version":"97.0.4692.71-0.1","urgency":"not yet assigned"}}},"CVE-2021-4064":{"description":"Use after free in screen capture in Google Chrome on ChromeOS prior to 96.0.4664.93 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page.","scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"143.0.7499.169-1~deb12u1","bookworm-security":"145.0.7632.159-1~deb12u1"},"fixed_version":"97.0.4692.71-0.1","urgency":"not yet assigned"},"bullseye":{"status":"resolved","repositories":{"bullseye":"120.0.6099.224-1~deb11u1","bullseye-security":"120.0.6099.224-1~deb11u1"},"fixed_version":"97.0.4692.71-0.1~deb11u1","urgency":"not yet assigned"},"forky":{"status":"resolved","repositories":{"forky":"145.0.7632.159-1"},"fixed_version":"97.0.4692.71-0.1","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"146.0.7680.71-1"},"fixed_version":"97.0.4692.71-0.1","urgency":"not yet assigned"},"trixie":{"status":"resolved","repositories":{"trixie":"143.0.7499.169-1~deb13u1","trixie-security":"145.0.7632.159-1~deb13u1"},"fixed_version":"97.0.4692.71-0.1","urgency":"not yet assigned"}}},"CVE-2021-4065":{"description":"Use after free in autofill in Google Chrome prior to 96.0.4664.93 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page.","scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"143.0.7499.169-1~deb12u1","bookworm-security":"145.0.7632.159-1~deb12u1"},"fixed_version":"97.0.4692.71-0.1","urgency":"not yet assigned"},"bullseye":{"status":"resolved","repositories":{"bullseye":"120.0.6099.224-1~deb11u1","bullseye-security":"120.0.6099.224-1~deb11u1"},"fixed_version":"97.0.4692.71-0.1~deb11u1","urgency":"not yet assigned"},"forky":{"status":"resolved","repositories":{"forky":"145.0.7632.159-1"},"fixed_version":"97.0.4692.71-0.1","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"146.0.7680.71-1"},"fixed_version":"97.0.4692.71-0.1","urgency":"not yet assigned"},"trixie":{"status":"resolved","repositories":{"trixie":"143.0.7499.169-1~deb13u1","trixie-security":"145.0.7632.159-1~deb13u1"},"fixed_version":"97.0.4692.71-0.1","urgency":"not yet assigned"}}},"CVE-2021-4066":{"description":"Integer underflow in ANGLE in Google Chrome prior to 96.0.4664.93 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page.","scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"143.0.7499.169-1~deb12u1","bookworm-security":"145.0.7632.159-1~deb12u1"},"fixed_version":"97.0.4692.71-0.1","urgency":"not yet assigned"},"bullseye":{"status":"resolved","repositories":{"bullseye":"120.0.6099.224-1~deb11u1","bullseye-security":"120.0.6099.224-1~deb11u1"},"fixed_version":"97.0.4692.71-0.1~deb11u1","urgency":"not yet assigned"},"forky":{"status":"resolved","repositories":{"forky":"145.0.7632.159-1"},"fixed_version":"97.0.4692.71-0.1","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"146.0.7680.71-1"},"fixed_version":"97.0.4692.71-0.1","urgency":"not yet assigned"},"trixie":{"status":"resolved","repositories":{"trixie":"143.0.7499.169-1~deb13u1","trixie-security":"145.0.7632.159-1~deb13u1"},"fixed_version":"97.0.4692.71-0.1","urgency":"not yet assigned"}}},"CVE-2021-4067":{"description":"Use after free in window manager in Google Chrome on ChromeOS prior to 96.0.4664.93 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page.","scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"143.0.7499.169-1~deb12u1","bookworm-security":"145.0.7632.159-1~deb12u1"},"fixed_version":"97.0.4692.71-0.1","urgency":"not yet assigned"},"bullseye":{"status":"resolved","repositories":{"bullseye":"120.0.6099.224-1~deb11u1","bullseye-security":"120.0.6099.224-1~deb11u1"},"fixed_version":"97.0.4692.71-0.1~deb11u1","urgency":"not yet assigned"},"forky":{"status":"resolved","repositories":{"forky":"145.0.7632.159-1"},"fixed_version":"97.0.4692.71-0.1","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"146.0.7680.71-1"},"fixed_version":"97.0.4692.71-0.1","urgency":"not yet assigned"},"trixie":{"status":"resolved","repositories":{"trixie":"143.0.7499.169-1~deb13u1","trixie-security":"145.0.7632.159-1~deb13u1"},"fixed_version":"97.0.4692.71-0.1","urgency":"not yet assigned"}}},"CVE-2021-4068":{"description":"Insufficient data validation in new tab page in Google Chrome prior to 96.0.4664.93 allowed a remote attacker to leak cross-origin data via a crafted HTML page.","scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"143.0.7499.169-1~deb12u1","bookworm-security":"145.0.7632.159-1~deb12u1"},"fixed_version":"97.0.4692.71-0.1","urgency":"not yet assigned"},"bullseye":{"status":"resolved","repositories":{"bullseye":"120.0.6099.224-1~deb11u1","bullseye-security":"120.0.6099.224-1~deb11u1"},"fixed_version":"97.0.4692.71-0.1~deb11u1","urgency":"not yet assigned"},"forky":{"status":"resolved","repositories":{"forky":"145.0.7632.159-1"},"fixed_version":"97.0.4692.71-0.1","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"146.0.7680.71-1"},"fixed_version":"97.0.4692.71-0.1","urgency":"not yet assigned"},"trixie":{"status":"resolved","repositories":{"trixie":"143.0.7499.169-1~deb13u1","trixie-security":"145.0.7632.159-1~deb13u1"},"fixed_version":"97.0.4692.71-0.1","urgency":"not yet assigned"}}},"CVE-2021-4078":{"description":"Type confusion in V8 in Google Chrome prior to 96.0.4664.93 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page.","scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"143.0.7499.169-1~deb12u1","bookworm-security":"145.0.7632.159-1~deb12u1"},"fixed_version":"97.0.4692.71-0.1","urgency":"not yet assigned"},"bullseye":{"status":"resolved","repositories":{"bullseye":"120.0.6099.224-1~deb11u1","bullseye-security":"120.0.6099.224-1~deb11u1"},"fixed_version":"97.0.4692.71-0.1~deb11u1","urgency":"not yet assigned"},"forky":{"status":"resolved","repositories":{"forky":"145.0.7632.159-1"},"fixed_version":"97.0.4692.71-0.1","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"146.0.7680.71-1"},"fixed_version":"97.0.4692.71-0.1","urgency":"not yet assigned"},"trixie":{"status":"resolved","repositories":{"trixie":"143.0.7499.169-1~deb13u1","trixie-security":"145.0.7632.159-1~deb13u1"},"fixed_version":"97.0.4692.71-0.1","urgency":"not yet assigned"}}},"CVE-2021-4079":{"description":"Out of bounds write in WebRTC in Google Chrome prior to 96.0.4664.93 allowed a remote attacker to potentially exploit heap corruption via crafted WebRTC packets.","scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"143.0.7499.169-1~deb12u1","bookworm-security":"145.0.7632.159-1~deb12u1"},"fixed_version":"97.0.4692.71-0.1","urgency":"not yet assigned"},"bullseye":{"status":"resolved","repositories":{"bullseye":"120.0.6099.224-1~deb11u1","bullseye-security":"120.0.6099.224-1~deb11u1"},"fixed_version":"97.0.4692.71-0.1~deb11u1","urgency":"not yet assigned"},"forky":{"status":"resolved","repositories":{"forky":"145.0.7632.159-1"},"fixed_version":"97.0.4692.71-0.1","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"146.0.7680.71-1"},"fixed_version":"97.0.4692.71-0.1","urgency":"not yet assigned"},"trixie":{"status":"resolved","repositories":{"trixie":"143.0.7499.169-1~deb13u1","trixie-security":"145.0.7632.159-1~deb13u1"},"fixed_version":"97.0.4692.71-0.1","urgency":"not yet assigned"}}},"CVE-2021-4098":{"description":"Insufficient data validation in Mojo in Google Chrome prior to 96.0.4664.110 allowed a remote attacker who had compromised the renderer process to potentially perform a sandbox escape via a crafted HTML page.","scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"143.0.7499.169-1~deb12u1","bookworm-security":"145.0.7632.159-1~deb12u1"},"fixed_version":"97.0.4692.71-0.1","urgency":"not yet assigned"},"bullseye":{"status":"resolved","repositories":{"bullseye":"120.0.6099.224-1~deb11u1","bullseye-security":"120.0.6099.224-1~deb11u1"},"fixed_version":"97.0.4692.71-0.1~deb11u1","urgency":"not yet assigned"},"forky":{"status":"resolved","repositories":{"forky":"145.0.7632.159-1"},"fixed_version":"97.0.4692.71-0.1","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"146.0.7680.71-1"},"fixed_version":"97.0.4692.71-0.1","urgency":"not yet assigned"},"trixie":{"status":"resolved","repositories":{"trixie":"143.0.7499.169-1~deb13u1","trixie-security":"145.0.7632.159-1~deb13u1"},"fixed_version":"97.0.4692.71-0.1","urgency":"not yet assigned"}}},"CVE-2021-4099":{"description":"Use after free in Swiftshader in Google Chrome prior to 96.0.4664.110 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page.","scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"143.0.7499.169-1~deb12u1","bookworm-security":"145.0.7632.159-1~deb12u1"},"fixed_version":"97.0.4692.71-0.1","urgency":"not yet assigned"},"bullseye":{"status":"resolved","repositories":{"bullseye":"120.0.6099.224-1~deb11u1","bullseye-security":"120.0.6099.224-1~deb11u1"},"fixed_version":"97.0.4692.71-0.1~deb11u1","urgency":"not yet assigned"},"forky":{"status":"resolved","repositories":{"forky":"145.0.7632.159-1"},"fixed_version":"97.0.4692.71-0.1","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"146.0.7680.71-1"},"fixed_version":"97.0.4692.71-0.1","urgency":"not yet assigned"},"trixie":{"status":"resolved","repositories":{"trixie":"143.0.7499.169-1~deb13u1","trixie-security":"145.0.7632.159-1~deb13u1"},"fixed_version":"97.0.4692.71-0.1","urgency":"not yet assigned"}}},"CVE-2021-4100":{"description":"Object lifecycle issue in ANGLE in Google Chrome prior to 96.0.4664.110 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page.","scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"143.0.7499.169-1~deb12u1","bookworm-security":"145.0.7632.159-1~deb12u1"},"fixed_version":"97.0.4692.71-0.1","urgency":"not yet assigned"},"bullseye":{"status":"resolved","repositories":{"bullseye":"120.0.6099.224-1~deb11u1","bullseye-security":"120.0.6099.224-1~deb11u1"},"fixed_version":"97.0.4692.71-0.1~deb11u1","urgency":"not yet assigned"},"forky":{"status":"resolved","repositories":{"forky":"145.0.7632.159-1"},"fixed_version":"97.0.4692.71-0.1","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"146.0.7680.71-1"},"fixed_version":"97.0.4692.71-0.1","urgency":"not yet assigned"},"trixie":{"status":"resolved","repositories":{"trixie":"143.0.7499.169-1~deb13u1","trixie-security":"145.0.7632.159-1~deb13u1"},"fixed_version":"97.0.4692.71-0.1","urgency":"not yet assigned"}}},"CVE-2021-4101":{"description":"Heap buffer overflow in Swiftshader in Google Chrome prior to 96.0.4664.110 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page.","scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"143.0.7499.169-1~deb12u1","bookworm-security":"145.0.7632.159-1~deb12u1"},"fixed_version":"97.0.4692.71-0.1","urgency":"not yet assigned"},"bullseye":{"status":"resolved","repositories":{"bullseye":"120.0.6099.224-1~deb11u1","bullseye-security":"120.0.6099.224-1~deb11u1"},"fixed_version":"97.0.4692.71-0.1~deb11u1","urgency":"not yet assigned"},"forky":{"status":"resolved","repositories":{"forky":"145.0.7632.159-1"},"fixed_version":"97.0.4692.71-0.1","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"146.0.7680.71-1"},"fixed_version":"97.0.4692.71-0.1","urgency":"not yet assigned"},"trixie":{"status":"resolved","repositories":{"trixie":"143.0.7499.169-1~deb13u1","trixie-security":"145.0.7632.159-1~deb13u1"},"fixed_version":"97.0.4692.71-0.1","urgency":"not yet assigned"}}},"CVE-2021-4102":{"description":"Use after free in V8 in Google Chrome prior to 96.0.4664.110 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page.","scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"143.0.7499.169-1~deb12u1","bookworm-security":"145.0.7632.159-1~deb12u1"},"fixed_version":"97.0.4692.71-0.1","urgency":"not yet assigned"},"bullseye":{"status":"resolved","repositories":{"bullseye":"120.0.6099.224-1~deb11u1","bullseye-security":"120.0.6099.224-1~deb11u1"},"fixed_version":"97.0.4692.71-0.1~deb11u1","urgency":"not yet assigned"},"forky":{"status":"resolved","repositories":{"forky":"145.0.7632.159-1"},"fixed_version":"97.0.4692.71-0.1","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"146.0.7680.71-1"},"fixed_version":"97.0.4692.71-0.1","urgency":"not yet assigned"},"trixie":{"status":"resolved","repositories":{"trixie":"143.0.7499.169-1~deb13u1","trixie-security":"145.0.7632.159-1~deb13u1"},"fixed_version":"97.0.4692.71-0.1","urgency":"not yet assigned"}}},"CVE-2021-4316":{"description":"Inappropriate implementation in Cast UI in Google Chrome prior to 96.0.4664.45 allowed a remote attacker to spoof browser UI via a crafted HTML page. (Chromium security severity: Low)","scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"143.0.7499.169-1~deb12u1","bookworm-security":"145.0.7632.159-1~deb12u1"},"fixed_version":"97.0.4692.71-0.1","urgency":"not yet assigned"},"bullseye":{"status":"resolved","repositories":{"bullseye":"120.0.6099.224-1~deb11u1","bullseye-security":"120.0.6099.224-1~deb11u1"},"fixed_version":"97.0.4692.71-0.1~deb11u1","urgency":"not yet assigned"},"forky":{"status":"resolved","repositories":{"forky":"145.0.7632.159-1"},"fixed_version":"97.0.4692.71-0.1","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"146.0.7680.71-1"},"fixed_version":"97.0.4692.71-0.1","urgency":"not yet assigned"},"trixie":{"status":"resolved","repositories":{"trixie":"143.0.7499.169-1~deb13u1","trixie-security":"145.0.7632.159-1~deb13u1"},"fixed_version":"97.0.4692.71-0.1","urgency":"not yet assigned"}}},"CVE-2021-4317":{"description":"Use after free in ANGLE in Google Chrome prior to 96.0.4664.93 allowed a remote attacker to perform arbitrary read/write via a crafted HTML page. (Chromium security severity: High)","scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"143.0.7499.169-1~deb12u1","bookworm-security":"145.0.7632.159-1~deb12u1"},"fixed_version":"97.0.4692.71-0.1","urgency":"not yet assigned"},"bullseye":{"status":"resolved","repositories":{"bullseye":"120.0.6099.224-1~deb11u1","bullseye-security":"120.0.6099.224-1~deb11u1"},"fixed_version":"97.0.4692.71-0.1~deb11u1","urgency":"not yet assigned"},"forky":{"status":"resolved","repositories":{"forky":"145.0.7632.159-1"},"fixed_version":"97.0.4692.71-0.1","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"146.0.7680.71-1"},"fixed_version":"97.0.4692.71-0.1","urgency":"not yet assigned"},"trixie":{"status":"resolved","repositories":{"trixie":"143.0.7499.169-1~deb13u1","trixie-security":"145.0.7632.159-1~deb13u1"},"fixed_version":"97.0.4692.71-0.1","urgency":"not yet assigned"}}},"CVE-2021-4318":{"description":"Object corruption in Blink in Google Chrome prior to 94.0.4606.54 allowed a remote attacker to potentially exploit object corruption via a crafted HTML page. (Chromium security severity: High)","scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"143.0.7499.169-1~deb12u1","bookworm-security":"145.0.7632.159-1~deb12u1"},"fixed_version":"97.0.4692.71-0.1","urgency":"not yet assigned"},"bullseye":{"status":"resolved","repositories":{"bullseye":"120.0.6099.224-1~deb11u1","bullseye-security":"120.0.6099.224-1~deb11u1"},"fixed_version":"97.0.4692.71-0.1~deb11u1","urgency":"not yet assigned"},"forky":{"status":"resolved","repositories":{"forky":"145.0.7632.159-1"},"fixed_version":"97.0.4692.71-0.1","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"146.0.7680.71-1"},"fixed_version":"97.0.4692.71-0.1","urgency":"not yet assigned"},"trixie":{"status":"resolved","repositories":{"trixie":"143.0.7499.169-1~deb13u1","trixie-security":"145.0.7632.159-1~deb13u1"},"fixed_version":"97.0.4692.71-0.1","urgency":"not yet assigned"}}},"CVE-2021-4319":{"description":"Use after free in Blink in Google Chrome prior to 93.0.4577.82 allowed a remote attacker to perform arbitrary read/write via a crafted HTML page. (Chromium security severity: High)","scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"143.0.7499.169-1~deb12u1","bookworm-security":"145.0.7632.159-1~deb12u1"},"fixed_version":"97.0.4692.71-0.1","urgency":"not yet assigned"},"bullseye":{"status":"resolved","repositories":{"bullseye":"120.0.6099.224-1~deb11u1","bullseye-security":"120.0.6099.224-1~deb11u1"},"fixed_version":"97.0.4692.71-0.1~deb11u1","urgency":"not yet assigned"},"forky":{"status":"resolved","repositories":{"forky":"145.0.7632.159-1"},"fixed_version":"97.0.4692.71-0.1","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"146.0.7680.71-1"},"fixed_version":"97.0.4692.71-0.1","urgency":"not yet assigned"},"trixie":{"status":"resolved","repositories":{"trixie":"143.0.7499.169-1~deb13u1","trixie-security":"145.0.7632.159-1~deb13u1"},"fixed_version":"97.0.4692.71-0.1","urgency":"not yet assigned"}}},"CVE-2021-4320":{"description":"Use after free in Blink in Google Chrome prior to 92.0.4515.107 allowed a remote attacker who had compromised the renderer process to perform arbitrary read/write via a crafted HTML page. (Chromium security severity: High)","scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"143.0.7499.169-1~deb12u1","bookworm-security":"145.0.7632.159-1~deb12u1"},"fixed_version":"97.0.4692.71-0.1","urgency":"not yet assigned"},"bullseye":{"status":"resolved","repositories":{"bullseye":"120.0.6099.224-1~deb11u1","bullseye-security":"120.0.6099.224-1~deb11u1"},"fixed_version":"97.0.4692.71-0.1~deb11u1","urgency":"not yet assigned"},"forky":{"status":"resolved","repositories":{"forky":"145.0.7632.159-1"},"fixed_version":"97.0.4692.71-0.1","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"146.0.7680.71-1"},"fixed_version":"97.0.4692.71-0.1","urgency":"not yet assigned"},"trixie":{"status":"resolved","repositories":{"trixie":"143.0.7499.169-1~deb13u1","trixie-security":"145.0.7632.159-1~deb13u1"},"fixed_version":"97.0.4692.71-0.1","urgency":"not yet assigned"}}},"CVE-2021-4321":{"description":"Policy bypass in Blink in Google Chrome prior to 91.0.4472.77 allowed a remote attacker to bypass content security policy via a crafted HTML page. (Chromium security severity: Low)","scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"143.0.7499.169-1~deb12u1","bookworm-security":"145.0.7632.159-1~deb12u1"},"fixed_version":"97.0.4692.71-0.1","urgency":"not yet assigned"},"bullseye":{"status":"resolved","repositories":{"bullseye":"120.0.6099.224-1~deb11u1","bullseye-security":"120.0.6099.224-1~deb11u1"},"fixed_version":"97.0.4692.71-0.1~deb11u1","urgency":"not yet assigned"},"forky":{"status":"resolved","repositories":{"forky":"145.0.7632.159-1"},"fixed_version":"97.0.4692.71-0.1","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"146.0.7680.71-1"},"fixed_version":"97.0.4692.71-0.1","urgency":"not yet assigned"},"trixie":{"status":"resolved","repositories":{"trixie":"143.0.7499.169-1~deb13u1","trixie-security":"145.0.7632.159-1~deb13u1"},"fixed_version":"97.0.4692.71-0.1","urgency":"not yet assigned"}}},"CVE-2021-4322":{"description":"Use after free in DevTools in Google Chrome prior to 91.0.4472.77 allowed an attacker who convinced a user to install a malicious extension to execute arbitrary code via a crafted Chrome Extension. (Chromium security severity: Medium)","scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"143.0.7499.169-1~deb12u1","bookworm-security":"145.0.7632.159-1~deb12u1"},"fixed_version":"97.0.4692.71-0.1","urgency":"not yet assigned"},"bullseye":{"status":"resolved","repositories":{"bullseye":"120.0.6099.224-1~deb11u1","bullseye-security":"120.0.6099.224-1~deb11u1"},"fixed_version":"97.0.4692.71-0.1~deb11u1","urgency":"not yet assigned"},"forky":{"status":"resolved","repositories":{"forky":"145.0.7632.159-1"},"fixed_version":"97.0.4692.71-0.1","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"146.0.7680.71-1"},"fixed_version":"97.0.4692.71-0.1","urgency":"not yet assigned"},"trixie":{"status":"resolved","repositories":{"trixie":"143.0.7499.169-1~deb13u1","trixie-security":"145.0.7632.159-1~deb13u1"},"fixed_version":"97.0.4692.71-0.1","urgency":"not yet assigned"}}},"CVE-2021-4323":{"description":"Insufficient validation of untrusted input in Extensions in Google Chrome prior to 90.0.4430.72 allowed an attacker who convinced a user to install a malicious extension to access local files via a crafted Chrome Extension. (Chromium security severity: Medium)","debianbug":987053,"scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"143.0.7499.169-1~deb12u1","bookworm-security":"145.0.7632.159-1~deb12u1"},"fixed_version":"90.0.4430.72-1","urgency":"not yet assigned"},"bullseye":{"status":"resolved","repositories":{"bullseye":"120.0.6099.224-1~deb11u1","bullseye-security":"120.0.6099.224-1~deb11u1"},"fixed_version":"90.0.4430.72-1","urgency":"not yet assigned"},"forky":{"status":"resolved","repositories":{"forky":"145.0.7632.159-1"},"fixed_version":"90.0.4430.72-1","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"146.0.7680.71-1"},"fixed_version":"90.0.4430.72-1","urgency":"not yet assigned"},"trixie":{"status":"resolved","repositories":{"trixie":"143.0.7499.169-1~deb13u1","trixie-security":"145.0.7632.159-1~deb13u1"},"fixed_version":"90.0.4430.72-1","urgency":"not yet assigned"}}},"CVE-2021-4324":{"description":"Insufficient policy enforcement in Google Update in Google Chrome prior to 90.0.4430.93 allowed a remote attacker to read arbitrary files via a malicious file. (Chromium security severity: Medium)","scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"143.0.7499.169-1~deb12u1","bookworm-security":"145.0.7632.159-1~deb12u1"},"fixed_version":"0","urgency":"unimportant"},"bullseye":{"status":"resolved","repositories":{"bullseye":"120.0.6099.224-1~deb11u1","bullseye-security":"120.0.6099.224-1~deb11u1"},"fixed_version":"0","urgency":"unimportant"},"forky":{"status":"resolved","repositories":{"forky":"145.0.7632.159-1"},"fixed_version":"0","urgency":"unimportant"},"sid":{"status":"resolved","repositories":{"sid":"146.0.7680.71-1"},"fixed_version":"0","urgency":"unimportant"},"trixie":{"status":"resolved","repositories":{"trixie":"143.0.7499.169-1~deb13u1","trixie-security":"145.0.7632.159-1~deb13u1"},"fixed_version":"0","urgency":"unimportant"}}},"CVE-2022-0096":{"description":"Use after free in Storage in Google Chrome prior to 97.0.4692.71 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page.","scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"143.0.7499.169-1~deb12u1","bookworm-security":"145.0.7632.159-1~deb12u1"},"fixed_version":"97.0.4692.71-0.1","urgency":"not yet assigned"},"bullseye":{"status":"resolved","repositories":{"bullseye":"120.0.6099.224-1~deb11u1","bullseye-security":"120.0.6099.224-1~deb11u1"},"fixed_version":"97.0.4692.71-0.1~deb11u1","urgency":"not yet assigned"},"forky":{"status":"resolved","repositories":{"forky":"145.0.7632.159-1"},"fixed_version":"97.0.4692.71-0.1","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"146.0.7680.71-1"},"fixed_version":"97.0.4692.71-0.1","urgency":"not yet assigned"},"trixie":{"status":"resolved","repositories":{"trixie":"143.0.7499.169-1~deb13u1","trixie-security":"145.0.7632.159-1~deb13u1"},"fixed_version":"97.0.4692.71-0.1","urgency":"not yet assigned"}}},"CVE-2022-0097":{"description":"Inappropriate implementation in DevTools in Google Chrome prior to 97.0.4692.71 allowed an attacker who convinced a user to install a malicious extension to to potentially allow extension to escape the sandbox via a crafted HTML page.","scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"143.0.7499.169-1~deb12u1","bookworm-security":"145.0.7632.159-1~deb12u1"},"fixed_version":"97.0.4692.71-0.1","urgency":"not yet assigned"},"bullseye":{"status":"resolved","repositories":{"bullseye":"120.0.6099.224-1~deb11u1","bullseye-security":"120.0.6099.224-1~deb11u1"},"fixed_version":"97.0.4692.71-0.1~deb11u1","urgency":"not yet assigned"},"forky":{"status":"resolved","repositories":{"forky":"145.0.7632.159-1"},"fixed_version":"97.0.4692.71-0.1","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"146.0.7680.71-1"},"fixed_version":"97.0.4692.71-0.1","urgency":"not yet assigned"},"trixie":{"status":"resolved","repositories":{"trixie":"143.0.7499.169-1~deb13u1","trixie-security":"145.0.7632.159-1~deb13u1"},"fixed_version":"97.0.4692.71-0.1","urgency":"not yet assigned"}}},"CVE-2022-0098":{"description":"Use after free in Screen Capture in Google Chrome on Chrome OS prior to 97.0.4692.71 allowed an attacker who convinced a user to perform specific user gestures to potentially exploit heap corruption via specific user gestures.","scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"143.0.7499.169-1~deb12u1","bookworm-security":"145.0.7632.159-1~deb12u1"},"fixed_version":"97.0.4692.71-0.1","urgency":"not yet assigned"},"bullseye":{"status":"resolved","repositories":{"bullseye":"120.0.6099.224-1~deb11u1","bullseye-security":"120.0.6099.224-1~deb11u1"},"fixed_version":"97.0.4692.71-0.1~deb11u1","urgency":"not yet assigned"},"forky":{"status":"resolved","repositories":{"forky":"145.0.7632.159-1"},"fixed_version":"97.0.4692.71-0.1","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"146.0.7680.71-1"},"fixed_version":"97.0.4692.71-0.1","urgency":"not yet assigned"},"trixie":{"status":"resolved","repositories":{"trixie":"143.0.7499.169-1~deb13u1","trixie-security":"145.0.7632.159-1~deb13u1"},"fixed_version":"97.0.4692.71-0.1","urgency":"not yet assigned"}}},"CVE-2022-0099":{"description":"Use after free in Sign-in in Google Chrome prior to 97.0.4692.71 allowed a remote attacker who convinced a user to perform specific user gestures to potentially exploit heap corruption via specific user gesture.","scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"143.0.7499.169-1~deb12u1","bookworm-security":"145.0.7632.159-1~deb12u1"},"fixed_version":"97.0.4692.71-0.1","urgency":"not yet assigned"},"bullseye":{"status":"resolved","repositories":{"bullseye":"120.0.6099.224-1~deb11u1","bullseye-security":"120.0.6099.224-1~deb11u1"},"fixed_version":"97.0.4692.71-0.1~deb11u1","urgency":"not yet assigned"},"forky":{"status":"resolved","repositories":{"forky":"145.0.7632.159-1"},"fixed_version":"97.0.4692.71-0.1","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"146.0.7680.71-1"},"fixed_version":"97.0.4692.71-0.1","urgency":"not yet assigned"},"trixie":{"status":"resolved","repositories":{"trixie":"143.0.7499.169-1~deb13u1","trixie-security":"145.0.7632.159-1~deb13u1"},"fixed_version":"97.0.4692.71-0.1","urgency":"not yet assigned"}}},"CVE-2022-0100":{"description":"Heap buffer overflow in Media streams API in Google Chrome prior to 97.0.4692.71 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page.","scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"143.0.7499.169-1~deb12u1","bookworm-security":"145.0.7632.159-1~deb12u1"},"fixed_version":"97.0.4692.71-0.1","urgency":"not yet assigned"},"bullseye":{"status":"resolved","repositories":{"bullseye":"120.0.6099.224-1~deb11u1","bullseye-security":"120.0.6099.224-1~deb11u1"},"fixed_version":"97.0.4692.71-0.1~deb11u1","urgency":"not yet assigned"},"forky":{"status":"resolved","repositories":{"forky":"145.0.7632.159-1"},"fixed_version":"97.0.4692.71-0.1","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"146.0.7680.71-1"},"fixed_version":"97.0.4692.71-0.1","urgency":"not yet assigned"},"trixie":{"status":"resolved","repositories":{"trixie":"143.0.7499.169-1~deb13u1","trixie-security":"145.0.7632.159-1~deb13u1"},"fixed_version":"97.0.4692.71-0.1","urgency":"not yet assigned"}}},"CVE-2022-0101":{"description":"Heap buffer overflow in Bookmarks in Google Chrome prior to 97.0.4692.71 allowed a remote attacker who convinced a user to perform specific user gesture to potentially exploit heap corruption via specific user gesture.","scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"143.0.7499.169-1~deb12u1","bookworm-security":"145.0.7632.159-1~deb12u1"},"fixed_version":"97.0.4692.71-0.1","urgency":"not yet assigned"},"bullseye":{"status":"resolved","repositories":{"bullseye":"120.0.6099.224-1~deb11u1","bullseye-security":"120.0.6099.224-1~deb11u1"},"fixed_version":"97.0.4692.71-0.1~deb11u1","urgency":"not yet assigned"},"forky":{"status":"resolved","repositories":{"forky":"145.0.7632.159-1"},"fixed_version":"97.0.4692.71-0.1","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"146.0.7680.71-1"},"fixed_version":"97.0.4692.71-0.1","urgency":"not yet assigned"},"trixie":{"status":"resolved","repositories":{"trixie":"143.0.7499.169-1~deb13u1","trixie-security":"145.0.7632.159-1~deb13u1"},"fixed_version":"97.0.4692.71-0.1","urgency":"not yet assigned"}}},"CVE-2022-0102":{"description":"Type confusion in V8 in Google Chrome prior to 97.0.4692.71 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page.","scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"143.0.7499.169-1~deb12u1","bookworm-security":"145.0.7632.159-1~deb12u1"},"fixed_version":"97.0.4692.71-0.1","urgency":"not yet assigned"},"bullseye":{"status":"resolved","repositories":{"bullseye":"120.0.6099.224-1~deb11u1","bullseye-security":"120.0.6099.224-1~deb11u1"},"fixed_version":"97.0.4692.71-0.1~deb11u1","urgency":"not yet assigned"},"forky":{"status":"resolved","repositories":{"forky":"145.0.7632.159-1"},"fixed_version":"97.0.4692.71-0.1","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"146.0.7680.71-1"},"fixed_version":"97.0.4692.71-0.1","urgency":"not yet assigned"},"trixie":{"status":"resolved","repositories":{"trixie":"143.0.7499.169-1~deb13u1","trixie-security":"145.0.7632.159-1~deb13u1"},"fixed_version":"97.0.4692.71-0.1","urgency":"not yet assigned"}}},"CVE-2022-0103":{"description":"Use after free in SwiftShader in Google Chrome prior to 97.0.4692.71 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page.","scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"143.0.7499.169-1~deb12u1","bookworm-security":"145.0.7632.159-1~deb12u1"},"fixed_version":"97.0.4692.71-0.1","urgency":"not yet assigned"},"bullseye":{"status":"resolved","repositories":{"bullseye":"120.0.6099.224-1~deb11u1","bullseye-security":"120.0.6099.224-1~deb11u1"},"fixed_version":"97.0.4692.71-0.1~deb11u1","urgency":"not yet assigned"},"forky":{"status":"resolved","repositories":{"forky":"145.0.7632.159-1"},"fixed_version":"97.0.4692.71-0.1","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"146.0.7680.71-1"},"fixed_version":"97.0.4692.71-0.1","urgency":"not yet assigned"},"trixie":{"status":"resolved","repositories":{"trixie":"143.0.7499.169-1~deb13u1","trixie-security":"145.0.7632.159-1~deb13u1"},"fixed_version":"97.0.4692.71-0.1","urgency":"not yet assigned"}}},"CVE-2022-0104":{"description":"Heap buffer overflow in ANGLE in Google Chrome prior to 97.0.4692.71 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page.","scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"143.0.7499.169-1~deb12u1","bookworm-security":"145.0.7632.159-1~deb12u1"},"fixed_version":"97.0.4692.71-0.1","urgency":"not yet assigned"},"bullseye":{"status":"resolved","repositories":{"bullseye":"120.0.6099.224-1~deb11u1","bullseye-security":"120.0.6099.224-1~deb11u1"},"fixed_version":"97.0.4692.71-0.1~deb11u1","urgency":"not yet assigned"},"forky":{"status":"resolved","repositories":{"forky":"145.0.7632.159-1"},"fixed_version":"97.0.4692.71-0.1","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"146.0.7680.71-1"},"fixed_version":"97.0.4692.71-0.1","urgency":"not yet assigned"},"trixie":{"status":"resolved","repositories":{"trixie":"143.0.7499.169-1~deb13u1","trixie-security":"145.0.7632.159-1~deb13u1"},"fixed_version":"97.0.4692.71-0.1","urgency":"not yet assigned"}}},"CVE-2022-0105":{"description":"Use after free in PDF Accessibility in Google Chrome prior to 97.0.4692.71 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page.","scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"143.0.7499.169-1~deb12u1","bookworm-security":"145.0.7632.159-1~deb12u1"},"fixed_version":"97.0.4692.71-0.1","urgency":"not yet assigned"},"bullseye":{"status":"resolved","repositories":{"bullseye":"120.0.6099.224-1~deb11u1","bullseye-security":"120.0.6099.224-1~deb11u1"},"fixed_version":"97.0.4692.71-0.1~deb11u1","urgency":"not yet assigned"},"forky":{"status":"resolved","repositories":{"forky":"145.0.7632.159-1"},"fixed_version":"97.0.4692.71-0.1","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"146.0.7680.71-1"},"fixed_version":"97.0.4692.71-0.1","urgency":"not yet assigned"},"trixie":{"status":"resolved","repositories":{"trixie":"143.0.7499.169-1~deb13u1","trixie-security":"145.0.7632.159-1~deb13u1"},"fixed_version":"97.0.4692.71-0.1","urgency":"not yet assigned"}}},"CVE-2022-0106":{"description":"Use after free in Autofill in Google Chrome prior to 97.0.4692.71 allowed a remote attacker who convinced a user to perform specific user gesture to potentially exploit heap corruption via a crafted HTML page.","scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"143.0.7499.169-1~deb12u1","bookworm-security":"145.0.7632.159-1~deb12u1"},"fixed_version":"97.0.4692.71-0.1","urgency":"not yet assigned"},"bullseye":{"status":"resolved","repositories":{"bullseye":"120.0.6099.224-1~deb11u1","bullseye-security":"120.0.6099.224-1~deb11u1"},"fixed_version":"97.0.4692.71-0.1~deb11u1","urgency":"not yet assigned"},"forky":{"status":"resolved","repositories":{"forky":"145.0.7632.159-1"},"fixed_version":"97.0.4692.71-0.1","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"146.0.7680.71-1"},"fixed_version":"97.0.4692.71-0.1","urgency":"not yet assigned"},"trixie":{"status":"resolved","repositories":{"trixie":"143.0.7499.169-1~deb13u1","trixie-security":"145.0.7632.159-1~deb13u1"},"fixed_version":"97.0.4692.71-0.1","urgency":"not yet assigned"}}},"CVE-2022-0107":{"description":"Use after free in File Manager API in Google Chrome on Chrome OS prior to 97.0.4692.71 allowed an attacker who convinced a user to install a malicious extension to potentially exploit heap corruption via a crafted HTML page.","scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"143.0.7499.169-1~deb12u1","bookworm-security":"145.0.7632.159-1~deb12u1"},"fixed_version":"97.0.4692.71-0.1","urgency":"not yet assigned"},"bullseye":{"status":"resolved","repositories":{"bullseye":"120.0.6099.224-1~deb11u1","bullseye-security":"120.0.6099.224-1~deb11u1"},"fixed_version":"97.0.4692.71-0.1~deb11u1","urgency":"not yet assigned"},"forky":{"status":"resolved","repositories":{"forky":"145.0.7632.159-1"},"fixed_version":"97.0.4692.71-0.1","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"146.0.7680.71-1"},"fixed_version":"97.0.4692.71-0.1","urgency":"not yet assigned"},"trixie":{"status":"resolved","repositories":{"trixie":"143.0.7499.169-1~deb13u1","trixie-security":"145.0.7632.159-1~deb13u1"},"fixed_version":"97.0.4692.71-0.1","urgency":"not yet assigned"}}},"CVE-2022-0108":{"description":"Inappropriate implementation in Navigation in Google Chrome prior to 97.0.4692.71 allowed a remote attacker to leak cross-origin data via a crafted HTML page.","scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"143.0.7499.169-1~deb12u1","bookworm-security":"145.0.7632.159-1~deb12u1"},"fixed_version":"97.0.4692.71-0.1","urgency":"not yet assigned"},"bullseye":{"status":"resolved","repositories":{"bullseye":"120.0.6099.224-1~deb11u1","bullseye-security":"120.0.6099.224-1~deb11u1"},"fixed_version":"97.0.4692.71-0.1~deb11u1","urgency":"not yet assigned"},"forky":{"status":"resolved","repositories":{"forky":"145.0.7632.159-1"},"fixed_version":"97.0.4692.71-0.1","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"146.0.7680.71-1"},"fixed_version":"97.0.4692.71-0.1","urgency":"not yet assigned"},"trixie":{"status":"resolved","repositories":{"trixie":"143.0.7499.169-1~deb13u1","trixie-security":"145.0.7632.159-1~deb13u1"},"fixed_version":"97.0.4692.71-0.1","urgency":"not yet assigned"}}},"CVE-2022-0109":{"description":"Inappropriate implementation in Autofill in Google Chrome prior to 97.0.4692.71 allowed a remote attacker to obtain potentially sensitive information via a crafted HTML page.","scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"143.0.7499.169-1~deb12u1","bookworm-security":"145.0.7632.159-1~deb12u1"},"fixed_version":"97.0.4692.71-0.1","urgency":"not yet assigned"},"bullseye":{"status":"resolved","repositories":{"bullseye":"120.0.6099.224-1~deb11u1","bullseye-security":"120.0.6099.224-1~deb11u1"},"fixed_version":"97.0.4692.71-0.1~deb11u1","urgency":"not yet assigned"},"forky":{"status":"resolved","repositories":{"forky":"145.0.7632.159-1"},"fixed_version":"97.0.4692.71-0.1","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"146.0.7680.71-1"},"fixed_version":"97.0.4692.71-0.1","urgency":"not yet assigned"},"trixie":{"status":"resolved","repositories":{"trixie":"143.0.7499.169-1~deb13u1","trixie-security":"145.0.7632.159-1~deb13u1"},"fixed_version":"97.0.4692.71-0.1","urgency":"not yet assigned"}}},"CVE-2022-0110":{"description":"Incorrect security UI in Autofill in Google Chrome prior to 97.0.4692.71 allowed a remote attacker to spoof the contents of the Omnibox (URL bar) via a crafted HTML page.","scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"143.0.7499.169-1~deb12u1","bookworm-security":"145.0.7632.159-1~deb12u1"},"fixed_version":"97.0.4692.71-0.1","urgency":"not yet assigned"},"bullseye":{"status":"resolved","repositories":{"bullseye":"120.0.6099.224-1~deb11u1","bullseye-security":"120.0.6099.224-1~deb11u1"},"fixed_version":"97.0.4692.71-0.1~deb11u1","urgency":"not yet assigned"},"forky":{"status":"resolved","repositories":{"forky":"145.0.7632.159-1"},"fixed_version":"97.0.4692.71-0.1","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"146.0.7680.71-1"},"fixed_version":"97.0.4692.71-0.1","urgency":"not yet assigned"},"trixie":{"status":"resolved","repositories":{"trixie":"143.0.7499.169-1~deb13u1","trixie-security":"145.0.7632.159-1~deb13u1"},"fixed_version":"97.0.4692.71-0.1","urgency":"not yet assigned"}}},"CVE-2022-0111":{"description":"Inappropriate implementation in Navigation in Google Chrome prior to 97.0.4692.71 allowed a remote attacker to incorrectly set origin via a crafted HTML page.","scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"143.0.7499.169-1~deb12u1","bookworm-security":"145.0.7632.159-1~deb12u1"},"fixed_version":"97.0.4692.71-0.1","urgency":"not yet assigned"},"bullseye":{"status":"resolved","repositories":{"bullseye":"120.0.6099.224-1~deb11u1","bullseye-security":"120.0.6099.224-1~deb11u1"},"fixed_version":"97.0.4692.71-0.1~deb11u1","urgency":"not yet assigned"},"forky":{"status":"resolved","repositories":{"forky":"145.0.7632.159-1"},"fixed_version":"97.0.4692.71-0.1","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"146.0.7680.71-1"},"fixed_version":"97.0.4692.71-0.1","urgency":"not yet assigned"},"trixie":{"status":"resolved","repositories":{"trixie":"143.0.7499.169-1~deb13u1","trixie-security":"145.0.7632.159-1~deb13u1"},"fixed_version":"97.0.4692.71-0.1","urgency":"not yet assigned"}}},"CVE-2022-0112":{"description":"Incorrect security UI in Browser UI in Google Chrome prior to 97.0.4692.71 allowed a remote attacker to display missing URL or incorrect URL via a crafted URL.","scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"143.0.7499.169-1~deb12u1","bookworm-security":"145.0.7632.159-1~deb12u1"},"fixed_version":"97.0.4692.71-0.1","urgency":"not yet assigned"},"bullseye":{"status":"resolved","repositories":{"bullseye":"120.0.6099.224-1~deb11u1","bullseye-security":"120.0.6099.224-1~deb11u1"},"fixed_version":"97.0.4692.71-0.1~deb11u1","urgency":"not yet assigned"},"forky":{"status":"resolved","repositories":{"forky":"145.0.7632.159-1"},"fixed_version":"97.0.4692.71-0.1","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"146.0.7680.71-1"},"fixed_version":"97.0.4692.71-0.1","urgency":"not yet assigned"},"trixie":{"status":"resolved","repositories":{"trixie":"143.0.7499.169-1~deb13u1","trixie-security":"145.0.7632.159-1~deb13u1"},"fixed_version":"97.0.4692.71-0.1","urgency":"not yet assigned"}}},"CVE-2022-0113":{"description":"Inappropriate implementation in Blink in Google Chrome prior to 97.0.4692.71 allowed a remote attacker to leak cross-origin data via a crafted HTML page.","scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"143.0.7499.169-1~deb12u1","bookworm-security":"145.0.7632.159-1~deb12u1"},"fixed_version":"97.0.4692.71-0.1","urgency":"not yet assigned"},"bullseye":{"status":"resolved","repositories":{"bullseye":"120.0.6099.224-1~deb11u1","bullseye-security":"120.0.6099.224-1~deb11u1"},"fixed_version":"97.0.4692.71-0.1~deb11u1","urgency":"not yet assigned"},"forky":{"status":"resolved","repositories":{"forky":"145.0.7632.159-1"},"fixed_version":"97.0.4692.71-0.1","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"146.0.7680.71-1"},"fixed_version":"97.0.4692.71-0.1","urgency":"not yet assigned"},"trixie":{"status":"resolved","repositories":{"trixie":"143.0.7499.169-1~deb13u1","trixie-security":"145.0.7632.159-1~deb13u1"},"fixed_version":"97.0.4692.71-0.1","urgency":"not yet assigned"}}},"CVE-2022-0114":{"description":"Out of bounds memory access in Blink Serial API in Google Chrome prior to 97.0.4692.71 allowed a remote attacker to perform an out of bounds memory read via a crafted HTML page and virtual serial port driver.","scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"143.0.7499.169-1~deb12u1","bookworm-security":"145.0.7632.159-1~deb12u1"},"fixed_version":"97.0.4692.71-0.1","urgency":"not yet assigned"},"bullseye":{"status":"resolved","repositories":{"bullseye":"120.0.6099.224-1~deb11u1","bullseye-security":"120.0.6099.224-1~deb11u1"},"fixed_version":"97.0.4692.71-0.1~deb11u1","urgency":"not yet assigned"},"forky":{"status":"resolved","repositories":{"forky":"145.0.7632.159-1"},"fixed_version":"97.0.4692.71-0.1","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"146.0.7680.71-1"},"fixed_version":"97.0.4692.71-0.1","urgency":"not yet assigned"},"trixie":{"status":"resolved","repositories":{"trixie":"143.0.7499.169-1~deb13u1","trixie-security":"145.0.7632.159-1~deb13u1"},"fixed_version":"97.0.4692.71-0.1","urgency":"not yet assigned"}}},"CVE-2022-0115":{"description":"Uninitialized use in File API in Google Chrome prior to 97.0.4692.71 allowed a remote attacker to potentially perform out of bounds memory access via a crafted HTML page.","scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"143.0.7499.169-1~deb12u1","bookworm-security":"145.0.7632.159-1~deb12u1"},"fixed_version":"97.0.4692.71-0.1","urgency":"not yet assigned"},"bullseye":{"status":"resolved","repositories":{"bullseye":"120.0.6099.224-1~deb11u1","bullseye-security":"120.0.6099.224-1~deb11u1"},"fixed_version":"97.0.4692.71-0.1~deb11u1","urgency":"not yet assigned"},"forky":{"status":"resolved","repositories":{"forky":"145.0.7632.159-1"},"fixed_version":"97.0.4692.71-0.1","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"146.0.7680.71-1"},"fixed_version":"97.0.4692.71-0.1","urgency":"not yet assigned"},"trixie":{"status":"resolved","repositories":{"trixie":"143.0.7499.169-1~deb13u1","trixie-security":"145.0.7632.159-1~deb13u1"},"fixed_version":"97.0.4692.71-0.1","urgency":"not yet assigned"}}},"CVE-2022-0116":{"description":"Inappropriate implementation in Compositing in Google Chrome prior to 97.0.4692.71 allowed a remote attacker to spoof the contents of the Omnibox (URL bar) via a crafted HTML page.","scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"143.0.7499.169-1~deb12u1","bookworm-security":"145.0.7632.159-1~deb12u1"},"fixed_version":"97.0.4692.71-0.1","urgency":"not yet assigned"},"bullseye":{"status":"resolved","repositories":{"bullseye":"120.0.6099.224-1~deb11u1","bullseye-security":"120.0.6099.224-1~deb11u1"},"fixed_version":"97.0.4692.71-0.1~deb11u1","urgency":"not yet assigned"},"forky":{"status":"resolved","repositories":{"forky":"145.0.7632.159-1"},"fixed_version":"97.0.4692.71-0.1","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"146.0.7680.71-1"},"fixed_version":"97.0.4692.71-0.1","urgency":"not yet assigned"},"trixie":{"status":"resolved","repositories":{"trixie":"143.0.7499.169-1~deb13u1","trixie-security":"145.0.7632.159-1~deb13u1"},"fixed_version":"97.0.4692.71-0.1","urgency":"not yet assigned"}}},"CVE-2022-0117":{"description":"Policy bypass in Blink in Google Chrome prior to 97.0.4692.71 allowed a remote attacker to leak cross-origin data via a crafted HTML page.","scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"143.0.7499.169-1~deb12u1","bookworm-security":"145.0.7632.159-1~deb12u1"},"fixed_version":"97.0.4692.71-0.1","urgency":"not yet assigned"},"bullseye":{"status":"resolved","repositories":{"bullseye":"120.0.6099.224-1~deb11u1","bullseye-security":"120.0.6099.224-1~deb11u1"},"fixed_version":"97.0.4692.71-0.1~deb11u1","urgency":"not yet assigned"},"forky":{"status":"resolved","repositories":{"forky":"145.0.7632.159-1"},"fixed_version":"97.0.4692.71-0.1","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"146.0.7680.71-1"},"fixed_version":"97.0.4692.71-0.1","urgency":"not yet assigned"},"trixie":{"status":"resolved","repositories":{"trixie":"143.0.7499.169-1~deb13u1","trixie-security":"145.0.7632.159-1~deb13u1"},"fixed_version":"97.0.4692.71-0.1","urgency":"not yet assigned"}}},"CVE-2022-0118":{"description":"Inappropriate implementation in WebShare in Google Chrome prior to 97.0.4692.71 allowed a remote attacker to potentially hide the contents of the Omnibox (URL bar) via a crafted HTML page.","scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"143.0.7499.169-1~deb12u1","bookworm-security":"145.0.7632.159-1~deb12u1"},"fixed_version":"97.0.4692.71-0.1","urgency":"not yet assigned"},"bullseye":{"status":"resolved","repositories":{"bullseye":"120.0.6099.224-1~deb11u1","bullseye-security":"120.0.6099.224-1~deb11u1"},"fixed_version":"97.0.4692.71-0.1~deb11u1","urgency":"not yet assigned"},"forky":{"status":"resolved","repositories":{"forky":"145.0.7632.159-1"},"fixed_version":"97.0.4692.71-0.1","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"146.0.7680.71-1"},"fixed_version":"97.0.4692.71-0.1","urgency":"not yet assigned"},"trixie":{"status":"resolved","repositories":{"trixie":"143.0.7499.169-1~deb13u1","trixie-security":"145.0.7632.159-1~deb13u1"},"fixed_version":"97.0.4692.71-0.1","urgency":"not yet assigned"}}},"CVE-2022-0120":{"description":"Inappropriate implementation in Passwords in Google Chrome prior to 97.0.4692.71 allowed a remote attacker to potentially leak cross-origin data via a malicious website.","scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"143.0.7499.169-1~deb12u1","bookworm-security":"145.0.7632.159-1~deb12u1"},"fixed_version":"97.0.4692.71-0.1","urgency":"not yet assigned"},"bullseye":{"status":"resolved","repositories":{"bullseye":"120.0.6099.224-1~deb11u1","bullseye-security":"120.0.6099.224-1~deb11u1"},"fixed_version":"97.0.4692.71-0.1~deb11u1","urgency":"not yet assigned"},"forky":{"status":"resolved","repositories":{"forky":"145.0.7632.159-1"},"fixed_version":"97.0.4692.71-0.1","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"146.0.7680.71-1"},"fixed_version":"97.0.4692.71-0.1","urgency":"not yet assigned"},"trixie":{"status":"resolved","repositories":{"trixie":"143.0.7499.169-1~deb13u1","trixie-security":"145.0.7632.159-1~deb13u1"},"fixed_version":"97.0.4692.71-0.1","urgency":"not yet assigned"}}},"CVE-2022-0289":{"description":"Use after free in Safe browsing in Google Chrome prior to 97.0.4692.99 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page.","scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"143.0.7499.169-1~deb12u1","bookworm-security":"145.0.7632.159-1~deb12u1"},"fixed_version":"97.0.4692.99-1","urgency":"not yet assigned"},"bullseye":{"status":"resolved","repositories":{"bullseye":"120.0.6099.224-1~deb11u1","bullseye-security":"120.0.6099.224-1~deb11u1"},"fixed_version":"97.0.4692.99-1~deb11u2","urgency":"not yet assigned"},"forky":{"status":"resolved","repositories":{"forky":"145.0.7632.159-1"},"fixed_version":"97.0.4692.99-1","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"146.0.7680.71-1"},"fixed_version":"97.0.4692.99-1","urgency":"not yet assigned"},"trixie":{"status":"resolved","repositories":{"trixie":"143.0.7499.169-1~deb13u1","trixie-security":"145.0.7632.159-1~deb13u1"},"fixed_version":"97.0.4692.99-1","urgency":"not yet assigned"}}},"CVE-2022-0290":{"description":"Use after free in Site isolation in Google Chrome prior to 97.0.4692.99 allowed a remote attacker to potentially perform a sandbox escape via a crafted HTML page.","scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"143.0.7499.169-1~deb12u1","bookworm-security":"145.0.7632.159-1~deb12u1"},"fixed_version":"97.0.4692.99-1","urgency":"not yet assigned"},"bullseye":{"status":"resolved","repositories":{"bullseye":"120.0.6099.224-1~deb11u1","bullseye-security":"120.0.6099.224-1~deb11u1"},"fixed_version":"97.0.4692.99-1~deb11u2","urgency":"not yet assigned"},"forky":{"status":"resolved","repositories":{"forky":"145.0.7632.159-1"},"fixed_version":"97.0.4692.99-1","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"146.0.7680.71-1"},"fixed_version":"97.0.4692.99-1","urgency":"not yet assigned"},"trixie":{"status":"resolved","repositories":{"trixie":"143.0.7499.169-1~deb13u1","trixie-security":"145.0.7632.159-1~deb13u1"},"fixed_version":"97.0.4692.99-1","urgency":"not yet assigned"}}},"CVE-2022-0291":{"description":"Inappropriate implementation in Storage in Google Chrome prior to 97.0.4692.99 allowed a remote attacker who had compromised the renderer process to bypass site isolation via a crafted HTML page.","scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"143.0.7499.169-1~deb12u1","bookworm-security":"145.0.7632.159-1~deb12u1"},"fixed_version":"97.0.4692.99-1","urgency":"not yet assigned"},"bullseye":{"status":"resolved","repositories":{"bullseye":"120.0.6099.224-1~deb11u1","bullseye-security":"120.0.6099.224-1~deb11u1"},"fixed_version":"97.0.4692.99-1~deb11u2","urgency":"not yet assigned"},"forky":{"status":"resolved","repositories":{"forky":"145.0.7632.159-1"},"fixed_version":"97.0.4692.99-1","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"146.0.7680.71-1"},"fixed_version":"97.0.4692.99-1","urgency":"not yet assigned"},"trixie":{"status":"resolved","repositories":{"trixie":"143.0.7499.169-1~deb13u1","trixie-security":"145.0.7632.159-1~deb13u1"},"fixed_version":"97.0.4692.99-1","urgency":"not yet assigned"}}},"CVE-2022-0292":{"description":"Inappropriate implementation in Fenced Frames in Google Chrome prior to 97.0.4692.99 allowed a remote attacker who had compromised the renderer process to bypass navigation restrictions via a crafted HTML page.","scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"143.0.7499.169-1~deb12u1","bookworm-security":"145.0.7632.159-1~deb12u1"},"fixed_version":"97.0.4692.99-1","urgency":"not yet assigned"},"bullseye":{"status":"resolved","repositories":{"bullseye":"120.0.6099.224-1~deb11u1","bullseye-security":"120.0.6099.224-1~deb11u1"},"fixed_version":"97.0.4692.99-1~deb11u2","urgency":"not yet assigned"},"forky":{"status":"resolved","repositories":{"forky":"145.0.7632.159-1"},"fixed_version":"97.0.4692.99-1","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"146.0.7680.71-1"},"fixed_version":"97.0.4692.99-1","urgency":"not yet assigned"},"trixie":{"status":"resolved","repositories":{"trixie":"143.0.7499.169-1~deb13u1","trixie-security":"145.0.7632.159-1~deb13u1"},"fixed_version":"97.0.4692.99-1","urgency":"not yet assigned"}}},"CVE-2022-0293":{"description":"Use after free in Web packaging in Google Chrome prior to 97.0.4692.99 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page.","scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"143.0.7499.169-1~deb12u1","bookworm-security":"145.0.7632.159-1~deb12u1"},"fixed_version":"97.0.4692.99-1","urgency":"not yet assigned"},"bullseye":{"status":"resolved","repositories":{"bullseye":"120.0.6099.224-1~deb11u1","bullseye-security":"120.0.6099.224-1~deb11u1"},"fixed_version":"97.0.4692.99-1~deb11u2","urgency":"not yet assigned"},"forky":{"status":"resolved","repositories":{"forky":"145.0.7632.159-1"},"fixed_version":"97.0.4692.99-1","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"146.0.7680.71-1"},"fixed_version":"97.0.4692.99-1","urgency":"not yet assigned"},"trixie":{"status":"resolved","repositories":{"trixie":"143.0.7499.169-1~deb13u1","trixie-security":"145.0.7632.159-1~deb13u1"},"fixed_version":"97.0.4692.99-1","urgency":"not yet assigned"}}},"CVE-2022-0294":{"description":"Inappropriate implementation in Push messaging in Google Chrome prior to 97.0.4692.99 allowed a remote attacker who had compromised the renderer process to bypass site isolation via a crafted HTML page.","scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"143.0.7499.169-1~deb12u1","bookworm-security":"145.0.7632.159-1~deb12u1"},"fixed_version":"97.0.4692.99-1","urgency":"not yet assigned"},"bullseye":{"status":"resolved","repositories":{"bullseye":"120.0.6099.224-1~deb11u1","bullseye-security":"120.0.6099.224-1~deb11u1"},"fixed_version":"97.0.4692.99-1~deb11u2","urgency":"not yet assigned"},"forky":{"status":"resolved","repositories":{"forky":"145.0.7632.159-1"},"fixed_version":"97.0.4692.99-1","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"146.0.7680.71-1"},"fixed_version":"97.0.4692.99-1","urgency":"not yet assigned"},"trixie":{"status":"resolved","repositories":{"trixie":"143.0.7499.169-1~deb13u1","trixie-security":"145.0.7632.159-1~deb13u1"},"fixed_version":"97.0.4692.99-1","urgency":"not yet assigned"}}},"CVE-2022-0295":{"description":"Use after free in Omnibox in Google Chrome prior to 97.0.4692.99 allowed a remote attacker who convinced the user to engage is specific user interactions to potentially exploit heap corruption via a crafted HTML page.","scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"143.0.7499.169-1~deb12u1","bookworm-security":"145.0.7632.159-1~deb12u1"},"fixed_version":"97.0.4692.99-1","urgency":"not yet assigned"},"bullseye":{"status":"resolved","repositories":{"bullseye":"120.0.6099.224-1~deb11u1","bullseye-security":"120.0.6099.224-1~deb11u1"},"fixed_version":"97.0.4692.99-1~deb11u2","urgency":"not yet assigned"},"forky":{"status":"resolved","repositories":{"forky":"145.0.7632.159-1"},"fixed_version":"97.0.4692.99-1","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"146.0.7680.71-1"},"fixed_version":"97.0.4692.99-1","urgency":"not yet assigned"},"trixie":{"status":"resolved","repositories":{"trixie":"143.0.7499.169-1~deb13u1","trixie-security":"145.0.7632.159-1~deb13u1"},"fixed_version":"97.0.4692.99-1","urgency":"not yet assigned"}}},"CVE-2022-0296":{"description":"Use after free in Printing in Google Chrome prior to 97.0.4692.99 allowed a remote attacker who convinced the user to engage is specific user interactions to potentially exploit heap corruption via a crafted HTML page.","scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"143.0.7499.169-1~deb12u1","bookworm-security":"145.0.7632.159-1~deb12u1"},"fixed_version":"97.0.4692.99-1","urgency":"not yet assigned"},"bullseye":{"status":"resolved","repositories":{"bullseye":"120.0.6099.224-1~deb11u1","bullseye-security":"120.0.6099.224-1~deb11u1"},"fixed_version":"97.0.4692.99-1~deb11u2","urgency":"not yet assigned"},"forky":{"status":"resolved","repositories":{"forky":"145.0.7632.159-1"},"fixed_version":"97.0.4692.99-1","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"146.0.7680.71-1"},"fixed_version":"97.0.4692.99-1","urgency":"not yet assigned"},"trixie":{"status":"resolved","repositories":{"trixie":"143.0.7499.169-1~deb13u1","trixie-security":"145.0.7632.159-1~deb13u1"},"fixed_version":"97.0.4692.99-1","urgency":"not yet assigned"}}},"CVE-2022-0297":{"description":"Use after free in Vulkan in Google Chrome prior to 97.0.4692.99 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page.","scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"143.0.7499.169-1~deb12u1","bookworm-security":"145.0.7632.159-1~deb12u1"},"fixed_version":"97.0.4692.99-1","urgency":"not yet assigned"},"bullseye":{"status":"resolved","repositories":{"bullseye":"120.0.6099.224-1~deb11u1","bullseye-security":"120.0.6099.224-1~deb11u1"},"fixed_version":"97.0.4692.99-1~deb11u2","urgency":"not yet assigned"},"forky":{"status":"resolved","repositories":{"forky":"145.0.7632.159-1"},"fixed_version":"97.0.4692.99-1","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"146.0.7680.71-1"},"fixed_version":"97.0.4692.99-1","urgency":"not yet assigned"},"trixie":{"status":"resolved","repositories":{"trixie":"143.0.7499.169-1~deb13u1","trixie-security":"145.0.7632.159-1~deb13u1"},"fixed_version":"97.0.4692.99-1","urgency":"not yet assigned"}}},"CVE-2022-0298":{"description":"Use after free in Scheduling in Google Chrome prior to 97.0.4692.99 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page.","scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"143.0.7499.169-1~deb12u1","bookworm-security":"145.0.7632.159-1~deb12u1"},"fixed_version":"97.0.4692.99-1","urgency":"not yet assigned"},"bullseye":{"status":"resolved","repositories":{"bullseye":"120.0.6099.224-1~deb11u1","bullseye-security":"120.0.6099.224-1~deb11u1"},"fixed_version":"97.0.4692.99-1~deb11u2","urgency":"not yet assigned"},"forky":{"status":"resolved","repositories":{"forky":"145.0.7632.159-1"},"fixed_version":"97.0.4692.99-1","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"146.0.7680.71-1"},"fixed_version":"97.0.4692.99-1","urgency":"not yet assigned"},"trixie":{"status":"resolved","repositories":{"trixie":"143.0.7499.169-1~deb13u1","trixie-security":"145.0.7632.159-1~deb13u1"},"fixed_version":"97.0.4692.99-1","urgency":"not yet assigned"}}},"CVE-2022-0300":{"description":"Use after free in Text Input Method Editor in Google Chrome on Android prior to 97.0.4692.99 allowed a remote attacker who convinced a user to engage in specific user interactions to potentially exploit heap corruption via a crafted HTML page.","scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"143.0.7499.169-1~deb12u1","bookworm-security":"145.0.7632.159-1~deb12u1"},"fixed_version":"97.0.4692.99-1","urgency":"not yet assigned"},"bullseye":{"status":"resolved","repositories":{"bullseye":"120.0.6099.224-1~deb11u1","bullseye-security":"120.0.6099.224-1~deb11u1"},"fixed_version":"97.0.4692.99-1~deb11u2","urgency":"not yet assigned"},"forky":{"status":"resolved","repositories":{"forky":"145.0.7632.159-1"},"fixed_version":"97.0.4692.99-1","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"146.0.7680.71-1"},"fixed_version":"97.0.4692.99-1","urgency":"not yet assigned"},"trixie":{"status":"resolved","repositories":{"trixie":"143.0.7499.169-1~deb13u1","trixie-security":"145.0.7632.159-1~deb13u1"},"fixed_version":"97.0.4692.99-1","urgency":"not yet assigned"}}},"CVE-2022-0301":{"description":"Heap buffer overflow in DevTools in Google Chrome prior to 97.0.4692.99 allowed an attacker who convinced a user to install a malicious extension to potentially exploit heap corruption via a crafted HTML page.","scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"143.0.7499.169-1~deb12u1","bookworm-security":"145.0.7632.159-1~deb12u1"},"fixed_version":"97.0.4692.99-1","urgency":"not yet assigned"},"bullseye":{"status":"resolved","repositories":{"bullseye":"120.0.6099.224-1~deb11u1","bullseye-security":"120.0.6099.224-1~deb11u1"},"fixed_version":"97.0.4692.99-1~deb11u2","urgency":"not yet assigned"},"forky":{"status":"resolved","repositories":{"forky":"145.0.7632.159-1"},"fixed_version":"97.0.4692.99-1","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"146.0.7680.71-1"},"fixed_version":"97.0.4692.99-1","urgency":"not yet assigned"},"trixie":{"status":"resolved","repositories":{"trixie":"143.0.7499.169-1~deb13u1","trixie-security":"145.0.7632.159-1~deb13u1"},"fixed_version":"97.0.4692.99-1","urgency":"not yet assigned"}}},"CVE-2022-0302":{"description":"Use after free in Omnibox in Google Chrome prior to 97.0.4692.99 allowed an attacker who convinced a user to engage in specific user interactions to potentially exploit heap corruption via a crafted HTML page.","scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"143.0.7499.169-1~deb12u1","bookworm-security":"145.0.7632.159-1~deb12u1"},"fixed_version":"97.0.4692.99-1","urgency":"not yet assigned"},"bullseye":{"status":"resolved","repositories":{"bullseye":"120.0.6099.224-1~deb11u1","bullseye-security":"120.0.6099.224-1~deb11u1"},"fixed_version":"97.0.4692.99-1~deb11u2","urgency":"not yet assigned"},"forky":{"status":"resolved","repositories":{"forky":"145.0.7632.159-1"},"fixed_version":"97.0.4692.99-1","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"146.0.7680.71-1"},"fixed_version":"97.0.4692.99-1","urgency":"not yet assigned"},"trixie":{"status":"resolved","repositories":{"trixie":"143.0.7499.169-1~deb13u1","trixie-security":"145.0.7632.159-1~deb13u1"},"fixed_version":"97.0.4692.99-1","urgency":"not yet assigned"}}},"CVE-2022-0304":{"description":"Use after free in Bookmarks in Google Chrome prior to 97.0.4692.99 allowed a remote attacker who convinced a user to engage in specific user interactions to potentially exploit heap corruption via a crafted HTML page.","scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"143.0.7499.169-1~deb12u1","bookworm-security":"145.0.7632.159-1~deb12u1"},"fixed_version":"97.0.4692.99-1","urgency":"not yet assigned"},"bullseye":{"status":"resolved","repositories":{"bullseye":"120.0.6099.224-1~deb11u1","bullseye-security":"120.0.6099.224-1~deb11u1"},"fixed_version":"97.0.4692.99-1~deb11u2","urgency":"not yet assigned"},"forky":{"status":"resolved","repositories":{"forky":"145.0.7632.159-1"},"fixed_version":"97.0.4692.99-1","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"146.0.7680.71-1"},"fixed_version":"97.0.4692.99-1","urgency":"not yet assigned"},"trixie":{"status":"resolved","repositories":{"trixie":"143.0.7499.169-1~deb13u1","trixie-security":"145.0.7632.159-1~deb13u1"},"fixed_version":"97.0.4692.99-1","urgency":"not yet assigned"}}},"CVE-2022-0305":{"description":"Inappropriate implementation in Service Worker API in Google Chrome prior to 97.0.4692.99 allowed a remote attacker who had compromised the renderer process to bypass site isolation via a crafted HTML page.","scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"143.0.7499.169-1~deb12u1","bookworm-security":"145.0.7632.159-1~deb12u1"},"fixed_version":"97.0.4692.99-1","urgency":"not yet assigned"},"bullseye":{"status":"resolved","repositories":{"bullseye":"120.0.6099.224-1~deb11u1","bullseye-security":"120.0.6099.224-1~deb11u1"},"fixed_version":"97.0.4692.99-1~deb11u2","urgency":"not yet assigned"},"forky":{"status":"resolved","repositories":{"forky":"145.0.7632.159-1"},"fixed_version":"97.0.4692.99-1","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"146.0.7680.71-1"},"fixed_version":"97.0.4692.99-1","urgency":"not yet assigned"},"trixie":{"status":"resolved","repositories":{"trixie":"143.0.7499.169-1~deb13u1","trixie-security":"145.0.7632.159-1~deb13u1"},"fixed_version":"97.0.4692.99-1","urgency":"not yet assigned"}}},"CVE-2022-0306":{"description":"Heap buffer overflow in PDFium in Google Chrome prior to 97.0.4692.99 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page.","scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"143.0.7499.169-1~deb12u1","bookworm-security":"145.0.7632.159-1~deb12u1"},"fixed_version":"97.0.4692.99-1","urgency":"not yet assigned"},"bullseye":{"status":"resolved","repositories":{"bullseye":"120.0.6099.224-1~deb11u1","bullseye-security":"120.0.6099.224-1~deb11u1"},"fixed_version":"97.0.4692.99-1~deb11u2","urgency":"not yet assigned"},"forky":{"status":"resolved","repositories":{"forky":"145.0.7632.159-1"},"fixed_version":"97.0.4692.99-1","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"146.0.7680.71-1"},"fixed_version":"97.0.4692.99-1","urgency":"not yet assigned"},"trixie":{"status":"resolved","repositories":{"trixie":"143.0.7499.169-1~deb13u1","trixie-security":"145.0.7632.159-1~deb13u1"},"fixed_version":"97.0.4692.99-1","urgency":"not yet assigned"}}},"CVE-2022-0307":{"description":"Use after free in Optimization Guide in Google Chrome prior to 97.0.4692.99 allowed a remote attacker who convinced a user to engage in specific user interaction to potentially exploit heap corruption via a crafted HTML page.","scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"143.0.7499.169-1~deb12u1","bookworm-security":"145.0.7632.159-1~deb12u1"},"fixed_version":"97.0.4692.99-1","urgency":"not yet assigned"},"bullseye":{"status":"resolved","repositories":{"bullseye":"120.0.6099.224-1~deb11u1","bullseye-security":"120.0.6099.224-1~deb11u1"},"fixed_version":"97.0.4692.99-1~deb11u2","urgency":"not yet assigned"},"forky":{"status":"resolved","repositories":{"forky":"145.0.7632.159-1"},"fixed_version":"97.0.4692.99-1","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"146.0.7680.71-1"},"fixed_version":"97.0.4692.99-1","urgency":"not yet assigned"},"trixie":{"status":"resolved","repositories":{"trixie":"143.0.7499.169-1~deb13u1","trixie-security":"145.0.7632.159-1~deb13u1"},"fixed_version":"97.0.4692.99-1","urgency":"not yet assigned"}}},"CVE-2022-0308":{"description":"Use after free in Data Transfer in Google Chrome on Chrome OS prior to 97.0.4692.99 allowed a remote attacker who convinced a user to engage in specific user interaction to potentially exploit heap corruption via a crafted HTML page.","scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"143.0.7499.169-1~deb12u1","bookworm-security":"145.0.7632.159-1~deb12u1"},"fixed_version":"97.0.4692.99-1","urgency":"not yet assigned"},"bullseye":{"status":"resolved","repositories":{"bullseye":"120.0.6099.224-1~deb11u1","bullseye-security":"120.0.6099.224-1~deb11u1"},"fixed_version":"97.0.4692.99-1~deb11u2","urgency":"not yet assigned"},"forky":{"status":"resolved","repositories":{"forky":"145.0.7632.159-1"},"fixed_version":"97.0.4692.99-1","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"146.0.7680.71-1"},"fixed_version":"97.0.4692.99-1","urgency":"not yet assigned"},"trixie":{"status":"resolved","repositories":{"trixie":"143.0.7499.169-1~deb13u1","trixie-security":"145.0.7632.159-1~deb13u1"},"fixed_version":"97.0.4692.99-1","urgency":"not yet assigned"}}},"CVE-2022-0309":{"description":"Inappropriate implementation in Autofill in Google Chrome prior to 97.0.4692.99 allowed a remote attacker to bypass navigation restrictions via a crafted HTML page.","scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"143.0.7499.169-1~deb12u1","bookworm-security":"145.0.7632.159-1~deb12u1"},"fixed_version":"97.0.4692.99-1","urgency":"not yet assigned"},"bullseye":{"status":"resolved","repositories":{"bullseye":"120.0.6099.224-1~deb11u1","bullseye-security":"120.0.6099.224-1~deb11u1"},"fixed_version":"97.0.4692.99-1~deb11u2","urgency":"not yet assigned"},"forky":{"status":"resolved","repositories":{"forky":"145.0.7632.159-1"},"fixed_version":"97.0.4692.99-1","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"146.0.7680.71-1"},"fixed_version":"97.0.4692.99-1","urgency":"not yet assigned"},"trixie":{"status":"resolved","repositories":{"trixie":"143.0.7499.169-1~deb13u1","trixie-security":"145.0.7632.159-1~deb13u1"},"fixed_version":"97.0.4692.99-1","urgency":"not yet assigned"}}},"CVE-2022-0310":{"description":"Heap buffer overflow in Task Manager in Google Chrome prior to 97.0.4692.99 allowed a remote attacker to potentially exploit heap corruption via specific user interactions.","scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"143.0.7499.169-1~deb12u1","bookworm-security":"145.0.7632.159-1~deb12u1"},"fixed_version":"97.0.4692.99-1","urgency":"not yet assigned"},"bullseye":{"status":"resolved","repositories":{"bullseye":"120.0.6099.224-1~deb11u1","bullseye-security":"120.0.6099.224-1~deb11u1"},"fixed_version":"97.0.4692.99-1~deb11u2","urgency":"not yet assigned"},"forky":{"status":"resolved","repositories":{"forky":"145.0.7632.159-1"},"fixed_version":"97.0.4692.99-1","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"146.0.7680.71-1"},"fixed_version":"97.0.4692.99-1","urgency":"not yet assigned"},"trixie":{"status":"resolved","repositories":{"trixie":"143.0.7499.169-1~deb13u1","trixie-security":"145.0.7632.159-1~deb13u1"},"fixed_version":"97.0.4692.99-1","urgency":"not yet assigned"}}},"CVE-2022-0311":{"description":"Heap buffer overflow in Task Manager in Google Chrome prior to 97.0.4692.99 allowed a remote attacker who convinced a user to engage in specific user interaction to potentially exploit heap corruption via a crafted HTML page.","scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"143.0.7499.169-1~deb12u1","bookworm-security":"145.0.7632.159-1~deb12u1"},"fixed_version":"97.0.4692.99-1","urgency":"not yet assigned"},"bullseye":{"status":"resolved","repositories":{"bullseye":"120.0.6099.224-1~deb11u1","bullseye-security":"120.0.6099.224-1~deb11u1"},"fixed_version":"97.0.4692.99-1~deb11u2","urgency":"not yet assigned"},"forky":{"status":"resolved","repositories":{"forky":"145.0.7632.159-1"},"fixed_version":"97.0.4692.99-1","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"146.0.7680.71-1"},"fixed_version":"97.0.4692.99-1","urgency":"not yet assigned"},"trixie":{"status":"resolved","repositories":{"trixie":"143.0.7499.169-1~deb13u1","trixie-security":"145.0.7632.159-1~deb13u1"},"fixed_version":"97.0.4692.99-1","urgency":"not yet assigned"}}},"CVE-2022-0337":{"description":"Inappropriate implementation in File System API in Google Chrome on Windows prior to 97.0.4692.71 allowed a remote attacker to obtain potentially sensitive information via a crafted HTML page. (Chrome security severity: High)","scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"143.0.7499.169-1~deb12u1","bookworm-security":"145.0.7632.159-1~deb12u1"},"fixed_version":"0","urgency":"unimportant"},"bullseye":{"status":"resolved","repositories":{"bullseye":"120.0.6099.224-1~deb11u1","bullseye-security":"120.0.6099.224-1~deb11u1"},"fixed_version":"0","urgency":"unimportant"},"forky":{"status":"resolved","repositories":{"forky":"145.0.7632.159-1"},"fixed_version":"0","urgency":"unimportant"},"sid":{"status":"resolved","repositories":{"sid":"146.0.7680.71-1"},"fixed_version":"0","urgency":"unimportant"},"trixie":{"status":"resolved","repositories":{"trixie":"143.0.7499.169-1~deb13u1","trixie-security":"145.0.7632.159-1~deb13u1"},"fixed_version":"0","urgency":"unimportant"}}},"CVE-2022-0452":{"description":"Use after free in Safe Browsing in Google Chrome prior to 98.0.4758.80 allowed a remote attacker to potentially perform a sandbox escape via a crafted HTML page.","scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"143.0.7499.169-1~deb12u1","bookworm-security":"145.0.7632.159-1~deb12u1"},"fixed_version":"98.0.4758.80-1","urgency":"not yet assigned"},"bullseye":{"status":"resolved","repositories":{"bullseye":"120.0.6099.224-1~deb11u1","bullseye-security":"120.0.6099.224-1~deb11u1"},"fixed_version":"98.0.4758.80-1~deb11u1","urgency":"not yet assigned"},"forky":{"status":"resolved","repositories":{"forky":"145.0.7632.159-1"},"fixed_version":"98.0.4758.80-1","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"146.0.7680.71-1"},"fixed_version":"98.0.4758.80-1","urgency":"not yet assigned"},"trixie":{"status":"resolved","repositories":{"trixie":"143.0.7499.169-1~deb13u1","trixie-security":"145.0.7632.159-1~deb13u1"},"fixed_version":"98.0.4758.80-1","urgency":"not yet assigned"}}},"CVE-2022-0453":{"description":"Use after free in Reader Mode in Google Chrome prior to 98.0.4758.80 allowed a remote attacker who had compromised the renderer process to potentially exploit heap corruption via a crafted HTML page.","scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"143.0.7499.169-1~deb12u1","bookworm-security":"145.0.7632.159-1~deb12u1"},"fixed_version":"98.0.4758.80-1","urgency":"not yet assigned"},"bullseye":{"status":"resolved","repositories":{"bullseye":"120.0.6099.224-1~deb11u1","bullseye-security":"120.0.6099.224-1~deb11u1"},"fixed_version":"98.0.4758.80-1~deb11u1","urgency":"not yet assigned"},"forky":{"status":"resolved","repositories":{"forky":"145.0.7632.159-1"},"fixed_version":"98.0.4758.80-1","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"146.0.7680.71-1"},"fixed_version":"98.0.4758.80-1","urgency":"not yet assigned"},"trixie":{"status":"resolved","repositories":{"trixie":"143.0.7499.169-1~deb13u1","trixie-security":"145.0.7632.159-1~deb13u1"},"fixed_version":"98.0.4758.80-1","urgency":"not yet assigned"}}},"CVE-2022-0454":{"description":"Heap buffer overflow in ANGLE in Google Chrome prior to 98.0.4758.80 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page.","scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"143.0.7499.169-1~deb12u1","bookworm-security":"145.0.7632.159-1~deb12u1"},"fixed_version":"98.0.4758.80-1","urgency":"not yet assigned"},"bullseye":{"status":"resolved","repositories":{"bullseye":"120.0.6099.224-1~deb11u1","bullseye-security":"120.0.6099.224-1~deb11u1"},"fixed_version":"98.0.4758.80-1~deb11u1","urgency":"not yet assigned"},"forky":{"status":"resolved","repositories":{"forky":"145.0.7632.159-1"},"fixed_version":"98.0.4758.80-1","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"146.0.7680.71-1"},"fixed_version":"98.0.4758.80-1","urgency":"not yet assigned"},"trixie":{"status":"resolved","repositories":{"trixie":"143.0.7499.169-1~deb13u1","trixie-security":"145.0.7632.159-1~deb13u1"},"fixed_version":"98.0.4758.80-1","urgency":"not yet assigned"}}},"CVE-2022-0455":{"description":"Inappropriate implementation in Full Screen Mode in Google Chrome on Android prior to 98.0.4758.80 allowed a remote attacker to spoof the contents of the Omnibox (URL bar) via a crafted HTML page.","scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"143.0.7499.169-1~deb12u1","bookworm-security":"145.0.7632.159-1~deb12u1"},"fixed_version":"98.0.4758.80-1","urgency":"not yet assigned"},"bullseye":{"status":"resolved","repositories":{"bullseye":"120.0.6099.224-1~deb11u1","bullseye-security":"120.0.6099.224-1~deb11u1"},"fixed_version":"98.0.4758.80-1~deb11u1","urgency":"not yet assigned"},"forky":{"status":"resolved","repositories":{"forky":"145.0.7632.159-1"},"fixed_version":"98.0.4758.80-1","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"146.0.7680.71-1"},"fixed_version":"98.0.4758.80-1","urgency":"not yet assigned"},"trixie":{"status":"resolved","repositories":{"trixie":"143.0.7499.169-1~deb13u1","trixie-security":"145.0.7632.159-1~deb13u1"},"fixed_version":"98.0.4758.80-1","urgency":"not yet assigned"}}},"CVE-2022-0456":{"description":"Use after free in Web Search in Google Chrome prior to 98.0.4758.80 allowed a remote attacker to potentially exploit heap corruption via profile destruction.","scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"143.0.7499.169-1~deb12u1","bookworm-security":"145.0.7632.159-1~deb12u1"},"fixed_version":"98.0.4758.80-1","urgency":"not yet assigned"},"bullseye":{"status":"resolved","repositories":{"bullseye":"120.0.6099.224-1~deb11u1","bullseye-security":"120.0.6099.224-1~deb11u1"},"fixed_version":"98.0.4758.80-1~deb11u1","urgency":"not yet assigned"},"forky":{"status":"resolved","repositories":{"forky":"145.0.7632.159-1"},"fixed_version":"98.0.4758.80-1","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"146.0.7680.71-1"},"fixed_version":"98.0.4758.80-1","urgency":"not yet assigned"},"trixie":{"status":"resolved","repositories":{"trixie":"143.0.7499.169-1~deb13u1","trixie-security":"145.0.7632.159-1~deb13u1"},"fixed_version":"98.0.4758.80-1","urgency":"not yet assigned"}}},"CVE-2022-0457":{"description":"Type confusion in V8 in Google Chrome prior to 98.0.4758.80 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page.","scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"143.0.7499.169-1~deb12u1","bookworm-security":"145.0.7632.159-1~deb12u1"},"fixed_version":"98.0.4758.80-1","urgency":"not yet assigned"},"bullseye":{"status":"resolved","repositories":{"bullseye":"120.0.6099.224-1~deb11u1","bullseye-security":"120.0.6099.224-1~deb11u1"},"fixed_version":"98.0.4758.80-1~deb11u1","urgency":"not yet assigned"},"forky":{"status":"resolved","repositories":{"forky":"145.0.7632.159-1"},"fixed_version":"98.0.4758.80-1","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"146.0.7680.71-1"},"fixed_version":"98.0.4758.80-1","urgency":"not yet assigned"},"trixie":{"status":"resolved","repositories":{"trixie":"143.0.7499.169-1~deb13u1","trixie-security":"145.0.7632.159-1~deb13u1"},"fixed_version":"98.0.4758.80-1","urgency":"not yet assigned"}}},"CVE-2022-0458":{"description":"Use after free in Thumbnail Tab Strip in Google Chrome prior to 98.0.4758.80 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page.","scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"143.0.7499.169-1~deb12u1","bookworm-security":"145.0.7632.159-1~deb12u1"},"fixed_version":"98.0.4758.80-1","urgency":"not yet assigned"},"bullseye":{"status":"resolved","repositories":{"bullseye":"120.0.6099.224-1~deb11u1","bullseye-security":"120.0.6099.224-1~deb11u1"},"fixed_version":"98.0.4758.80-1~deb11u1","urgency":"not yet assigned"},"forky":{"status":"resolved","repositories":{"forky":"145.0.7632.159-1"},"fixed_version":"98.0.4758.80-1","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"146.0.7680.71-1"},"fixed_version":"98.0.4758.80-1","urgency":"not yet assigned"},"trixie":{"status":"resolved","repositories":{"trixie":"143.0.7499.169-1~deb13u1","trixie-security":"145.0.7632.159-1~deb13u1"},"fixed_version":"98.0.4758.80-1","urgency":"not yet assigned"}}},"CVE-2022-0459":{"description":"Use after free in Screen Capture in Google Chrome prior to 98.0.4758.80 allowed a remote attacker who had compromised the renderer process and convinced a user to engage in specific user interaction to potentially exploit heap corruption via a crafted HTML page.","scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"143.0.7499.169-1~deb12u1","bookworm-security":"145.0.7632.159-1~deb12u1"},"fixed_version":"98.0.4758.80-1","urgency":"not yet assigned"},"bullseye":{"status":"resolved","repositories":{"bullseye":"120.0.6099.224-1~deb11u1","bullseye-security":"120.0.6099.224-1~deb11u1"},"fixed_version":"98.0.4758.80-1~deb11u1","urgency":"not yet assigned"},"forky":{"status":"resolved","repositories":{"forky":"145.0.7632.159-1"},"fixed_version":"98.0.4758.80-1","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"146.0.7680.71-1"},"fixed_version":"98.0.4758.80-1","urgency":"not yet assigned"},"trixie":{"status":"resolved","repositories":{"trixie":"143.0.7499.169-1~deb13u1","trixie-security":"145.0.7632.159-1~deb13u1"},"fixed_version":"98.0.4758.80-1","urgency":"not yet assigned"}}},"CVE-2022-0460":{"description":"Use after free in Window Dialogue in Google Chrome prior to 98.0.4758.80 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page.","scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"143.0.7499.169-1~deb12u1","bookworm-security":"145.0.7632.159-1~deb12u1"},"fixed_version":"98.0.4758.80-1","urgency":"not yet assigned"},"bullseye":{"status":"resolved","repositories":{"bullseye":"120.0.6099.224-1~deb11u1","bullseye-security":"120.0.6099.224-1~deb11u1"},"fixed_version":"98.0.4758.80-1~deb11u1","urgency":"not yet assigned"},"forky":{"status":"resolved","repositories":{"forky":"145.0.7632.159-1"},"fixed_version":"98.0.4758.80-1","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"146.0.7680.71-1"},"fixed_version":"98.0.4758.80-1","urgency":"not yet assigned"},"trixie":{"status":"resolved","repositories":{"trixie":"143.0.7499.169-1~deb13u1","trixie-security":"145.0.7632.159-1~deb13u1"},"fixed_version":"98.0.4758.80-1","urgency":"not yet assigned"}}},"CVE-2022-0461":{"description":"Policy bypass in COOP in Google Chrome prior to 98.0.4758.80 allowed a remote attacker to bypass iframe sandbox via a crafted HTML page.","scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"143.0.7499.169-1~deb12u1","bookworm-security":"145.0.7632.159-1~deb12u1"},"fixed_version":"98.0.4758.80-1","urgency":"not yet assigned"},"bullseye":{"status":"resolved","repositories":{"bullseye":"120.0.6099.224-1~deb11u1","bullseye-security":"120.0.6099.224-1~deb11u1"},"fixed_version":"98.0.4758.80-1~deb11u1","urgency":"not yet assigned"},"forky":{"status":"resolved","repositories":{"forky":"145.0.7632.159-1"},"fixed_version":"98.0.4758.80-1","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"146.0.7680.71-1"},"fixed_version":"98.0.4758.80-1","urgency":"not yet assigned"},"trixie":{"status":"resolved","repositories":{"trixie":"143.0.7499.169-1~deb13u1","trixie-security":"145.0.7632.159-1~deb13u1"},"fixed_version":"98.0.4758.80-1","urgency":"not yet assigned"}}},"CVE-2022-0462":{"description":"Inappropriate implementation in Scroll in Google Chrome prior to 98.0.4758.80 allowed a remote attacker to leak cross-origin data via a crafted HTML page.","scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"143.0.7499.169-1~deb12u1","bookworm-security":"145.0.7632.159-1~deb12u1"},"fixed_version":"98.0.4758.80-1","urgency":"not yet assigned"},"bullseye":{"status":"resolved","repositories":{"bullseye":"120.0.6099.224-1~deb11u1","bullseye-security":"120.0.6099.224-1~deb11u1"},"fixed_version":"98.0.4758.80-1~deb11u1","urgency":"not yet assigned"},"forky":{"status":"resolved","repositories":{"forky":"145.0.7632.159-1"},"fixed_version":"98.0.4758.80-1","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"146.0.7680.71-1"},"fixed_version":"98.0.4758.80-1","urgency":"not yet assigned"},"trixie":{"status":"resolved","repositories":{"trixie":"143.0.7499.169-1~deb13u1","trixie-security":"145.0.7632.159-1~deb13u1"},"fixed_version":"98.0.4758.80-1","urgency":"not yet assigned"}}},"CVE-2022-0463":{"description":"Use after free in Accessibility in Google Chrome prior to 98.0.4758.80 allowed a remote attacker who convinced a user to engage in specific user interaction to potentially exploit heap corruption via user interaction.","scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"143.0.7499.169-1~deb12u1","bookworm-security":"145.0.7632.159-1~deb12u1"},"fixed_version":"98.0.4758.80-1","urgency":"not yet assigned"},"bullseye":{"status":"resolved","repositories":{"bullseye":"120.0.6099.224-1~deb11u1","bullseye-security":"120.0.6099.224-1~deb11u1"},"fixed_version":"98.0.4758.80-1~deb11u1","urgency":"not yet assigned"},"forky":{"status":"resolved","repositories":{"forky":"145.0.7632.159-1"},"fixed_version":"98.0.4758.80-1","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"146.0.7680.71-1"},"fixed_version":"98.0.4758.80-1","urgency":"not yet assigned"},"trixie":{"status":"resolved","repositories":{"trixie":"143.0.7499.169-1~deb13u1","trixie-security":"145.0.7632.159-1~deb13u1"},"fixed_version":"98.0.4758.80-1","urgency":"not yet assigned"}}},"CVE-2022-0464":{"description":"Use after free in Accessibility in Google Chrome prior to 98.0.4758.80 allowed a remote attacker who convinced a user to engage in specific user interaction to potentially exploit heap corruption via user interaction.","scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"143.0.7499.169-1~deb12u1","bookworm-security":"145.0.7632.159-1~deb12u1"},"fixed_version":"98.0.4758.80-1","urgency":"not yet assigned"},"bullseye":{"status":"resolved","repositories":{"bullseye":"120.0.6099.224-1~deb11u1","bullseye-security":"120.0.6099.224-1~deb11u1"},"fixed_version":"98.0.4758.80-1~deb11u1","urgency":"not yet assigned"},"forky":{"status":"resolved","repositories":{"forky":"145.0.7632.159-1"},"fixed_version":"98.0.4758.80-1","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"146.0.7680.71-1"},"fixed_version":"98.0.4758.80-1","urgency":"not yet assigned"},"trixie":{"status":"resolved","repositories":{"trixie":"143.0.7499.169-1~deb13u1","trixie-security":"145.0.7632.159-1~deb13u1"},"fixed_version":"98.0.4758.80-1","urgency":"not yet assigned"}}},"CVE-2022-0465":{"description":"Use after free in Extensions in Google Chrome prior to 98.0.4758.80 allowed a remote attacker to potentially exploit heap corruption via user interaction.","scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"143.0.7499.169-1~deb12u1","bookworm-security":"145.0.7632.159-1~deb12u1"},"fixed_version":"98.0.4758.80-1","urgency":"not yet assigned"},"bullseye":{"status":"resolved","repositories":{"bullseye":"120.0.6099.224-1~deb11u1","bullseye-security":"120.0.6099.224-1~deb11u1"},"fixed_version":"98.0.4758.80-1~deb11u1","urgency":"not yet assigned"},"forky":{"status":"resolved","repositories":{"forky":"145.0.7632.159-1"},"fixed_version":"98.0.4758.80-1","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"146.0.7680.71-1"},"fixed_version":"98.0.4758.80-1","urgency":"not yet assigned"},"trixie":{"status":"resolved","repositories":{"trixie":"143.0.7499.169-1~deb13u1","trixie-security":"145.0.7632.159-1~deb13u1"},"fixed_version":"98.0.4758.80-1","urgency":"not yet assigned"}}},"CVE-2022-0466":{"description":"Inappropriate implementation in Extensions Platform in Google Chrome prior to 98.0.4758.80 allowed an attacker who convinced a user to install a malicious extension to potentially perform a sandbox escape via a crafted HTML page.","scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"143.0.7499.169-1~deb12u1","bookworm-security":"145.0.7632.159-1~deb12u1"},"fixed_version":"98.0.4758.80-1","urgency":"not yet assigned"},"bullseye":{"status":"resolved","repositories":{"bullseye":"120.0.6099.224-1~deb11u1","bullseye-security":"120.0.6099.224-1~deb11u1"},"fixed_version":"98.0.4758.80-1~deb11u1","urgency":"not yet assigned"},"forky":{"status":"resolved","repositories":{"forky":"145.0.7632.159-1"},"fixed_version":"98.0.4758.80-1","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"146.0.7680.71-1"},"fixed_version":"98.0.4758.80-1","urgency":"not yet assigned"},"trixie":{"status":"resolved","repositories":{"trixie":"143.0.7499.169-1~deb13u1","trixie-security":"145.0.7632.159-1~deb13u1"},"fixed_version":"98.0.4758.80-1","urgency":"not yet assigned"}}},"CVE-2022-0467":{"description":"Inappropriate implementation in Pointer Lock in Google Chrome on Windows prior to 98.0.4758.80 allowed a remote attacker to bypass navigation restrictions via a crafted HTML page.","scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"143.0.7499.169-1~deb12u1","bookworm-security":"145.0.7632.159-1~deb12u1"},"fixed_version":"98.0.4758.80-1","urgency":"not yet assigned"},"bullseye":{"status":"resolved","repositories":{"bullseye":"120.0.6099.224-1~deb11u1","bullseye-security":"120.0.6099.224-1~deb11u1"},"fixed_version":"98.0.4758.80-1~deb11u1","urgency":"not yet assigned"},"forky":{"status":"resolved","repositories":{"forky":"145.0.7632.159-1"},"fixed_version":"98.0.4758.80-1","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"146.0.7680.71-1"},"fixed_version":"98.0.4758.80-1","urgency":"not yet assigned"},"trixie":{"status":"resolved","repositories":{"trixie":"143.0.7499.169-1~deb13u1","trixie-security":"145.0.7632.159-1~deb13u1"},"fixed_version":"98.0.4758.80-1","urgency":"not yet assigned"}}},"CVE-2022-0468":{"description":"Use after free in Payments in Google Chrome prior to 98.0.4758.80 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page.","scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"143.0.7499.169-1~deb12u1","bookworm-security":"145.0.7632.159-1~deb12u1"},"fixed_version":"98.0.4758.80-1","urgency":"not yet assigned"},"bullseye":{"status":"resolved","repositories":{"bullseye":"120.0.6099.224-1~deb11u1","bullseye-security":"120.0.6099.224-1~deb11u1"},"fixed_version":"98.0.4758.80-1~deb11u1","urgency":"not yet assigned"},"forky":{"status":"resolved","repositories":{"forky":"145.0.7632.159-1"},"fixed_version":"98.0.4758.80-1","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"146.0.7680.71-1"},"fixed_version":"98.0.4758.80-1","urgency":"not yet assigned"},"trixie":{"status":"resolved","repositories":{"trixie":"143.0.7499.169-1~deb13u1","trixie-security":"145.0.7632.159-1~deb13u1"},"fixed_version":"98.0.4758.80-1","urgency":"not yet assigned"}}},"CVE-2022-0469":{"description":"Use after free in Cast in Google Chrome prior to 98.0.4758.80 allowed a remote attacker who convinced a user to engage in specific interactions to potentially exploit heap corruption via a crafted HTML page.","scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"143.0.7499.169-1~deb12u1","bookworm-security":"145.0.7632.159-1~deb12u1"},"fixed_version":"98.0.4758.80-1","urgency":"not yet assigned"},"bullseye":{"status":"resolved","repositories":{"bullseye":"120.0.6099.224-1~deb11u1","bullseye-security":"120.0.6099.224-1~deb11u1"},"fixed_version":"98.0.4758.80-1~deb11u1","urgency":"not yet assigned"},"forky":{"status":"resolved","repositories":{"forky":"145.0.7632.159-1"},"fixed_version":"98.0.4758.80-1","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"146.0.7680.71-1"},"fixed_version":"98.0.4758.80-1","urgency":"not yet assigned"},"trixie":{"status":"resolved","repositories":{"trixie":"143.0.7499.169-1~deb13u1","trixie-security":"145.0.7632.159-1~deb13u1"},"fixed_version":"98.0.4758.80-1","urgency":"not yet assigned"}}},"CVE-2022-0470":{"description":"Out of bounds memory access in V8 in Google Chrome prior to 98.0.4758.80 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page.","scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"143.0.7499.169-1~deb12u1","bookworm-security":"145.0.7632.159-1~deb12u1"},"fixed_version":"98.0.4758.80-1","urgency":"not yet assigned"},"bullseye":{"status":"resolved","repositories":{"bullseye":"120.0.6099.224-1~deb11u1","bullseye-security":"120.0.6099.224-1~deb11u1"},"fixed_version":"98.0.4758.80-1~deb11u1","urgency":"not yet assigned"},"forky":{"status":"resolved","repositories":{"forky":"145.0.7632.159-1"},"fixed_version":"98.0.4758.80-1","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"146.0.7680.71-1"},"fixed_version":"98.0.4758.80-1","urgency":"not yet assigned"},"trixie":{"status":"resolved","repositories":{"trixie":"143.0.7499.169-1~deb13u1","trixie-security":"145.0.7632.159-1~deb13u1"},"fixed_version":"98.0.4758.80-1","urgency":"not yet assigned"}}},"CVE-2022-0603":{"description":"Use after free in File Manager in Google Chrome on Chrome OS prior to 98.0.4758.102 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page.","scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"143.0.7499.169-1~deb12u1","bookworm-security":"145.0.7632.159-1~deb12u1"},"fixed_version":"98.0.4758.102-1","urgency":"not yet assigned"},"bullseye":{"status":"resolved","repositories":{"bullseye":"120.0.6099.224-1~deb11u1","bullseye-security":"120.0.6099.224-1~deb11u1"},"fixed_version":"98.0.4758.102-1~deb11u1","urgency":"not yet assigned"},"forky":{"status":"resolved","repositories":{"forky":"145.0.7632.159-1"},"fixed_version":"98.0.4758.102-1","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"146.0.7680.71-1"},"fixed_version":"98.0.4758.102-1","urgency":"not yet assigned"},"trixie":{"status":"resolved","repositories":{"trixie":"143.0.7499.169-1~deb13u1","trixie-security":"145.0.7632.159-1~deb13u1"},"fixed_version":"98.0.4758.102-1","urgency":"not yet assigned"}}},"CVE-2022-0604":{"description":"Heap buffer overflow in Tab Groups in Google Chrome prior to 98.0.4758.102 allowed an attacker who convinced a user to install a malicious extension and engage in specific user interaction to potentially exploit heap corruption via a crafted HTML page.","scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"143.0.7499.169-1~deb12u1","bookworm-security":"145.0.7632.159-1~deb12u1"},"fixed_version":"98.0.4758.102-1","urgency":"not yet assigned"},"bullseye":{"status":"resolved","repositories":{"bullseye":"120.0.6099.224-1~deb11u1","bullseye-security":"120.0.6099.224-1~deb11u1"},"fixed_version":"98.0.4758.102-1~deb11u1","urgency":"not yet assigned"},"forky":{"status":"resolved","repositories":{"forky":"145.0.7632.159-1"},"fixed_version":"98.0.4758.102-1","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"146.0.7680.71-1"},"fixed_version":"98.0.4758.102-1","urgency":"not yet assigned"},"trixie":{"status":"resolved","repositories":{"trixie":"143.0.7499.169-1~deb13u1","trixie-security":"145.0.7632.159-1~deb13u1"},"fixed_version":"98.0.4758.102-1","urgency":"not yet assigned"}}},"CVE-2022-0605":{"description":"Use after free in Webstore API in Google Chrome prior to 98.0.4758.102 allowed an attacker who convinced a user to install a malicious extension and convinced a user to enage in specific user interaction to potentially exploit heap corruption via a crafted HTML page.","scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"143.0.7499.169-1~deb12u1","bookworm-security":"145.0.7632.159-1~deb12u1"},"fixed_version":"98.0.4758.102-1","urgency":"not yet assigned"},"bullseye":{"status":"resolved","repositories":{"bullseye":"120.0.6099.224-1~deb11u1","bullseye-security":"120.0.6099.224-1~deb11u1"},"fixed_version":"98.0.4758.102-1~deb11u1","urgency":"not yet assigned"},"forky":{"status":"resolved","repositories":{"forky":"145.0.7632.159-1"},"fixed_version":"98.0.4758.102-1","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"146.0.7680.71-1"},"fixed_version":"98.0.4758.102-1","urgency":"not yet assigned"},"trixie":{"status":"resolved","repositories":{"trixie":"143.0.7499.169-1~deb13u1","trixie-security":"145.0.7632.159-1~deb13u1"},"fixed_version":"98.0.4758.102-1","urgency":"not yet assigned"}}},"CVE-2022-0606":{"description":"Use after free in ANGLE in Google Chrome prior to 98.0.4758.102 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page.","scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"143.0.7499.169-1~deb12u1","bookworm-security":"145.0.7632.159-1~deb12u1"},"fixed_version":"98.0.4758.102-1","urgency":"not yet assigned"},"bullseye":{"status":"resolved","repositories":{"bullseye":"120.0.6099.224-1~deb11u1","bullseye-security":"120.0.6099.224-1~deb11u1"},"fixed_version":"98.0.4758.102-1~deb11u1","urgency":"not yet assigned"},"forky":{"status":"resolved","repositories":{"forky":"145.0.7632.159-1"},"fixed_version":"98.0.4758.102-1","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"146.0.7680.71-1"},"fixed_version":"98.0.4758.102-1","urgency":"not yet assigned"},"trixie":{"status":"resolved","repositories":{"trixie":"143.0.7499.169-1~deb13u1","trixie-security":"145.0.7632.159-1~deb13u1"},"fixed_version":"98.0.4758.102-1","urgency":"not yet assigned"}}},"CVE-2022-0607":{"description":"Use after free in GPU in Google Chrome prior to 98.0.4758.102 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page.","scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"143.0.7499.169-1~deb12u1","bookworm-security":"145.0.7632.159-1~deb12u1"},"fixed_version":"98.0.4758.102-1","urgency":"not yet assigned"},"bullseye":{"status":"resolved","repositories":{"bullseye":"120.0.6099.224-1~deb11u1","bullseye-security":"120.0.6099.224-1~deb11u1"},"fixed_version":"98.0.4758.102-1~deb11u1","urgency":"not yet assigned"},"forky":{"status":"resolved","repositories":{"forky":"145.0.7632.159-1"},"fixed_version":"98.0.4758.102-1","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"146.0.7680.71-1"},"fixed_version":"98.0.4758.102-1","urgency":"not yet assigned"},"trixie":{"status":"resolved","repositories":{"trixie":"143.0.7499.169-1~deb13u1","trixie-security":"145.0.7632.159-1~deb13u1"},"fixed_version":"98.0.4758.102-1","urgency":"not yet assigned"}}},"CVE-2022-0608":{"description":"Integer overflow in Mojo in Google Chrome prior to 98.0.4758.102 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page.","scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"143.0.7499.169-1~deb12u1","bookworm-security":"145.0.7632.159-1~deb12u1"},"fixed_version":"98.0.4758.102-1","urgency":"not yet assigned"},"bullseye":{"status":"resolved","repositories":{"bullseye":"120.0.6099.224-1~deb11u1","bullseye-security":"120.0.6099.224-1~deb11u1"},"fixed_version":"98.0.4758.102-1~deb11u1","urgency":"not yet assigned"},"forky":{"status":"resolved","repositories":{"forky":"145.0.7632.159-1"},"fixed_version":"98.0.4758.102-1","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"146.0.7680.71-1"},"fixed_version":"98.0.4758.102-1","urgency":"not yet assigned"},"trixie":{"status":"resolved","repositories":{"trixie":"143.0.7499.169-1~deb13u1","trixie-security":"145.0.7632.159-1~deb13u1"},"fixed_version":"98.0.4758.102-1","urgency":"not yet assigned"}}},"CVE-2022-0609":{"description":"Use after free in Animation in Google Chrome prior to 98.0.4758.102 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page.","scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"143.0.7499.169-1~deb12u1","bookworm-security":"145.0.7632.159-1~deb12u1"},"fixed_version":"98.0.4758.102-1","urgency":"not yet assigned"},"bullseye":{"status":"resolved","repositories":{"bullseye":"120.0.6099.224-1~deb11u1","bullseye-security":"120.0.6099.224-1~deb11u1"},"fixed_version":"98.0.4758.102-1~deb11u1","urgency":"not yet assigned"},"forky":{"status":"resolved","repositories":{"forky":"145.0.7632.159-1"},"fixed_version":"98.0.4758.102-1","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"146.0.7680.71-1"},"fixed_version":"98.0.4758.102-1","urgency":"not yet assigned"},"trixie":{"status":"resolved","repositories":{"trixie":"143.0.7499.169-1~deb13u1","trixie-security":"145.0.7632.159-1~deb13u1"},"fixed_version":"98.0.4758.102-1","urgency":"not yet assigned"}}},"CVE-2022-0610":{"description":"Inappropriate implementation in Gamepad API in Google Chrome prior to 98.0.4758.102 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page.","scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"143.0.7499.169-1~deb12u1","bookworm-security":"145.0.7632.159-1~deb12u1"},"fixed_version":"98.0.4758.102-1","urgency":"not yet assigned"},"bullseye":{"status":"resolved","repositories":{"bullseye":"120.0.6099.224-1~deb11u1","bullseye-security":"120.0.6099.224-1~deb11u1"},"fixed_version":"98.0.4758.102-1~deb11u1","urgency":"not yet assigned"},"forky":{"status":"resolved","repositories":{"forky":"145.0.7632.159-1"},"fixed_version":"98.0.4758.102-1","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"146.0.7680.71-1"},"fixed_version":"98.0.4758.102-1","urgency":"not yet assigned"},"trixie":{"status":"resolved","repositories":{"trixie":"143.0.7499.169-1~deb13u1","trixie-security":"145.0.7632.159-1~deb13u1"},"fixed_version":"98.0.4758.102-1","urgency":"not yet assigned"}}},"CVE-2022-0789":{"description":"Heap buffer overflow in ANGLE in Google Chrome prior to 99.0.4844.51 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page.","scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"143.0.7499.169-1~deb12u1","bookworm-security":"145.0.7632.159-1~deb12u1"},"fixed_version":"99.0.4844.51-1","urgency":"not yet assigned"},"bullseye":{"status":"resolved","repositories":{"bullseye":"120.0.6099.224-1~deb11u1","bullseye-security":"120.0.6099.224-1~deb11u1"},"fixed_version":"99.0.4844.51-1~deb11u1","urgency":"not yet assigned"},"forky":{"status":"resolved","repositories":{"forky":"145.0.7632.159-1"},"fixed_version":"99.0.4844.51-1","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"146.0.7680.71-1"},"fixed_version":"99.0.4844.51-1","urgency":"not yet assigned"},"trixie":{"status":"resolved","repositories":{"trixie":"143.0.7499.169-1~deb13u1","trixie-security":"145.0.7632.159-1~deb13u1"},"fixed_version":"99.0.4844.51-1","urgency":"not yet assigned"}}},"CVE-2022-0790":{"description":"Use after free in Cast UI in Google Chrome prior to 99.0.4844.51 allowed a remote attacker who convinced a user to engage in specific user interaction to potentially perform a sandbox escape via a crafted HTML page.","scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"143.0.7499.169-1~deb12u1","bookworm-security":"145.0.7632.159-1~deb12u1"},"fixed_version":"99.0.4844.51-1","urgency":"not yet assigned"},"bullseye":{"status":"resolved","repositories":{"bullseye":"120.0.6099.224-1~deb11u1","bullseye-security":"120.0.6099.224-1~deb11u1"},"fixed_version":"99.0.4844.51-1~deb11u1","urgency":"not yet assigned"},"forky":{"status":"resolved","repositories":{"forky":"145.0.7632.159-1"},"fixed_version":"99.0.4844.51-1","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"146.0.7680.71-1"},"fixed_version":"99.0.4844.51-1","urgency":"not yet assigned"},"trixie":{"status":"resolved","repositories":{"trixie":"143.0.7499.169-1~deb13u1","trixie-security":"145.0.7632.159-1~deb13u1"},"fixed_version":"99.0.4844.51-1","urgency":"not yet assigned"}}},"CVE-2022-0791":{"description":"Use after free in Omnibox in Google Chrome prior to 99.0.4844.51 allowed a remote attacker who convinced a user to engage in specific user interactions to potentially exploit heap corruption via user interactions.","scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"143.0.7499.169-1~deb12u1","bookworm-security":"145.0.7632.159-1~deb12u1"},"fixed_version":"99.0.4844.51-1","urgency":"not yet assigned"},"bullseye":{"status":"resolved","repositories":{"bullseye":"120.0.6099.224-1~deb11u1","bullseye-security":"120.0.6099.224-1~deb11u1"},"fixed_version":"99.0.4844.51-1~deb11u1","urgency":"not yet assigned"},"forky":{"status":"resolved","repositories":{"forky":"145.0.7632.159-1"},"fixed_version":"99.0.4844.51-1","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"146.0.7680.71-1"},"fixed_version":"99.0.4844.51-1","urgency":"not yet assigned"},"trixie":{"status":"resolved","repositories":{"trixie":"143.0.7499.169-1~deb13u1","trixie-security":"145.0.7632.159-1~deb13u1"},"fixed_version":"99.0.4844.51-1","urgency":"not yet assigned"}}},"CVE-2022-0792":{"description":"Out of bounds read in ANGLE in Google Chrome prior to 99.0.4844.51 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page.","scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"143.0.7499.169-1~deb12u1","bookworm-security":"145.0.7632.159-1~deb12u1"},"fixed_version":"99.0.4844.51-1","urgency":"not yet assigned"},"bullseye":{"status":"resolved","repositories":{"bullseye":"120.0.6099.224-1~deb11u1","bullseye-security":"120.0.6099.224-1~deb11u1"},"fixed_version":"99.0.4844.51-1~deb11u1","urgency":"not yet assigned"},"forky":{"status":"resolved","repositories":{"forky":"145.0.7632.159-1"},"fixed_version":"99.0.4844.51-1","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"146.0.7680.71-1"},"fixed_version":"99.0.4844.51-1","urgency":"not yet assigned"},"trixie":{"status":"resolved","repositories":{"trixie":"143.0.7499.169-1~deb13u1","trixie-security":"145.0.7632.159-1~deb13u1"},"fixed_version":"99.0.4844.51-1","urgency":"not yet assigned"}}},"CVE-2022-0793":{"description":"Use after free in Cast in Google Chrome prior to 99.0.4844.51 allowed an attacker who convinced a user to install a malicious extension and engage in specific user interaction to potentially exploit heap corruption via a crafted Chrome Extension.","scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"143.0.7499.169-1~deb12u1","bookworm-security":"145.0.7632.159-1~deb12u1"},"fixed_version":"99.0.4844.51-1","urgency":"not yet assigned"},"bullseye":{"status":"resolved","repositories":{"bullseye":"120.0.6099.224-1~deb11u1","bullseye-security":"120.0.6099.224-1~deb11u1"},"fixed_version":"99.0.4844.51-1~deb11u1","urgency":"not yet assigned"},"forky":{"status":"resolved","repositories":{"forky":"145.0.7632.159-1"},"fixed_version":"99.0.4844.51-1","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"146.0.7680.71-1"},"fixed_version":"99.0.4844.51-1","urgency":"not yet assigned"},"trixie":{"status":"resolved","repositories":{"trixie":"143.0.7499.169-1~deb13u1","trixie-security":"145.0.7632.159-1~deb13u1"},"fixed_version":"99.0.4844.51-1","urgency":"not yet assigned"}}},"CVE-2022-0794":{"description":"Use after free in WebShare in Google Chrome prior to 99.0.4844.51 allowed a remote attacker who convinced a user to engage in specific user interaction to potentially exploit heap corruption via a crafted HTML page.","scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"143.0.7499.169-1~deb12u1","bookworm-security":"145.0.7632.159-1~deb12u1"},"fixed_version":"99.0.4844.51-1","urgency":"not yet assigned"},"bullseye":{"status":"resolved","repositories":{"bullseye":"120.0.6099.224-1~deb11u1","bullseye-security":"120.0.6099.224-1~deb11u1"},"fixed_version":"99.0.4844.51-1~deb11u1","urgency":"not yet assigned"},"forky":{"status":"resolved","repositories":{"forky":"145.0.7632.159-1"},"fixed_version":"99.0.4844.51-1","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"146.0.7680.71-1"},"fixed_version":"99.0.4844.51-1","urgency":"not yet assigned"},"trixie":{"status":"resolved","repositories":{"trixie":"143.0.7499.169-1~deb13u1","trixie-security":"145.0.7632.159-1~deb13u1"},"fixed_version":"99.0.4844.51-1","urgency":"not yet assigned"}}},"CVE-2022-0795":{"description":"Type confusion in Blink Layout in Google Chrome prior to 99.0.4844.51 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page.","scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"143.0.7499.169-1~deb12u1","bookworm-security":"145.0.7632.159-1~deb12u1"},"fixed_version":"99.0.4844.51-1","urgency":"not yet assigned"},"bullseye":{"status":"resolved","repositories":{"bullseye":"120.0.6099.224-1~deb11u1","bullseye-security":"120.0.6099.224-1~deb11u1"},"fixed_version":"99.0.4844.51-1~deb11u1","urgency":"not yet assigned"},"forky":{"status":"resolved","repositories":{"forky":"145.0.7632.159-1"},"fixed_version":"99.0.4844.51-1","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"146.0.7680.71-1"},"fixed_version":"99.0.4844.51-1","urgency":"not yet assigned"},"trixie":{"status":"resolved","repositories":{"trixie":"143.0.7499.169-1~deb13u1","trixie-security":"145.0.7632.159-1~deb13u1"},"fixed_version":"99.0.4844.51-1","urgency":"not yet assigned"}}},"CVE-2022-0796":{"description":"Use after free in Media in Google Chrome prior to 99.0.4844.51 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page.","scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"143.0.7499.169-1~deb12u1","bookworm-security":"145.0.7632.159-1~deb12u1"},"fixed_version":"99.0.4844.51-1","urgency":"not yet assigned"},"bullseye":{"status":"resolved","repositories":{"bullseye":"120.0.6099.224-1~deb11u1","bullseye-security":"120.0.6099.224-1~deb11u1"},"fixed_version":"99.0.4844.51-1~deb11u1","urgency":"not yet assigned"},"forky":{"status":"resolved","repositories":{"forky":"145.0.7632.159-1"},"fixed_version":"99.0.4844.51-1","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"146.0.7680.71-1"},"fixed_version":"99.0.4844.51-1","urgency":"not yet assigned"},"trixie":{"status":"resolved","repositories":{"trixie":"143.0.7499.169-1~deb13u1","trixie-security":"145.0.7632.159-1~deb13u1"},"fixed_version":"99.0.4844.51-1","urgency":"not yet assigned"}}},"CVE-2022-0797":{"description":"Out of bounds memory access in Mojo in Google Chrome prior to 99.0.4844.51 allowed a remote attacker to perform an out of bounds memory write via a crafted HTML page.","scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"143.0.7499.169-1~deb12u1","bookworm-security":"145.0.7632.159-1~deb12u1"},"fixed_version":"99.0.4844.51-1","urgency":"not yet assigned"},"bullseye":{"status":"resolved","repositories":{"bullseye":"120.0.6099.224-1~deb11u1","bullseye-security":"120.0.6099.224-1~deb11u1"},"fixed_version":"99.0.4844.51-1~deb11u1","urgency":"not yet assigned"},"forky":{"status":"resolved","repositories":{"forky":"145.0.7632.159-1"},"fixed_version":"99.0.4844.51-1","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"146.0.7680.71-1"},"fixed_version":"99.0.4844.51-1","urgency":"not yet assigned"},"trixie":{"status":"resolved","repositories":{"trixie":"143.0.7499.169-1~deb13u1","trixie-security":"145.0.7632.159-1~deb13u1"},"fixed_version":"99.0.4844.51-1","urgency":"not yet assigned"}}},"CVE-2022-0798":{"description":"Use after free in MediaStream in Google Chrome prior to 99.0.4844.51 allowed an attacker who convinced a user to install a malicious extension to potentially exploit heap corruption via a crafted Chrome Extension.","scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"143.0.7499.169-1~deb12u1","bookworm-security":"145.0.7632.159-1~deb12u1"},"fixed_version":"99.0.4844.51-1","urgency":"not yet assigned"},"bullseye":{"status":"resolved","repositories":{"bullseye":"120.0.6099.224-1~deb11u1","bullseye-security":"120.0.6099.224-1~deb11u1"},"fixed_version":"99.0.4844.51-1~deb11u1","urgency":"not yet assigned"},"forky":{"status":"resolved","repositories":{"forky":"145.0.7632.159-1"},"fixed_version":"99.0.4844.51-1","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"146.0.7680.71-1"},"fixed_version":"99.0.4844.51-1","urgency":"not yet assigned"},"trixie":{"status":"resolved","repositories":{"trixie":"143.0.7499.169-1~deb13u1","trixie-security":"145.0.7632.159-1~deb13u1"},"fixed_version":"99.0.4844.51-1","urgency":"not yet assigned"}}},"CVE-2022-0799":{"description":"Insufficient policy enforcement in Installer in Google Chrome on Windows prior to 99.0.4844.51 allowed a remote attacker to perform local privilege escalation via a crafted offline installer file.","scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"143.0.7499.169-1~deb12u1","bookworm-security":"145.0.7632.159-1~deb12u1"},"fixed_version":"99.0.4844.51-1","urgency":"not yet assigned"},"bullseye":{"status":"resolved","repositories":{"bullseye":"120.0.6099.224-1~deb11u1","bullseye-security":"120.0.6099.224-1~deb11u1"},"fixed_version":"99.0.4844.51-1~deb11u1","urgency":"not yet assigned"},"forky":{"status":"resolved","repositories":{"forky":"145.0.7632.159-1"},"fixed_version":"99.0.4844.51-1","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"146.0.7680.71-1"},"fixed_version":"99.0.4844.51-1","urgency":"not yet assigned"},"trixie":{"status":"resolved","repositories":{"trixie":"143.0.7499.169-1~deb13u1","trixie-security":"145.0.7632.159-1~deb13u1"},"fixed_version":"99.0.4844.51-1","urgency":"not yet assigned"}}},"CVE-2022-0800":{"description":"Heap buffer overflow in Cast UI in Google Chrome prior to 99.0.4844.51 allowed a remote attacker who convinced a user to engage in specific user interaction to potentially exploit heap corruption via a crafted HTML page.","scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"143.0.7499.169-1~deb12u1","bookworm-security":"145.0.7632.159-1~deb12u1"},"fixed_version":"99.0.4844.51-1","urgency":"not yet assigned"},"bullseye":{"status":"resolved","repositories":{"bullseye":"120.0.6099.224-1~deb11u1","bullseye-security":"120.0.6099.224-1~deb11u1"},"fixed_version":"99.0.4844.51-1~deb11u1","urgency":"not yet assigned"},"forky":{"status":"resolved","repositories":{"forky":"145.0.7632.159-1"},"fixed_version":"99.0.4844.51-1","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"146.0.7680.71-1"},"fixed_version":"99.0.4844.51-1","urgency":"not yet assigned"},"trixie":{"status":"resolved","repositories":{"trixie":"143.0.7499.169-1~deb13u1","trixie-security":"145.0.7632.159-1~deb13u1"},"fixed_version":"99.0.4844.51-1","urgency":"not yet assigned"}}},"CVE-2022-0801":{"description":"Inappropriate implementation in HTML parser in Google Chrome prior to 99.0.4844.51 allowed a remote attacker to bypass XSS preventions via a crafted HTML page. (Chrome security severity: Medium)","scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"143.0.7499.169-1~deb12u1","bookworm-security":"145.0.7632.159-1~deb12u1"},"fixed_version":"99.0.4844.51-1","urgency":"not yet assigned"},"bullseye":{"status":"resolved","repositories":{"bullseye":"120.0.6099.224-1~deb11u1","bullseye-security":"120.0.6099.224-1~deb11u1"},"fixed_version":"99.0.4844.51-1~deb11u1","urgency":"not yet assigned"},"forky":{"status":"resolved","repositories":{"forky":"145.0.7632.159-1"},"fixed_version":"99.0.4844.51-1","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"146.0.7680.71-1"},"fixed_version":"99.0.4844.51-1","urgency":"not yet assigned"},"trixie":{"status":"resolved","repositories":{"trixie":"143.0.7499.169-1~deb13u1","trixie-security":"145.0.7632.159-1~deb13u1"},"fixed_version":"99.0.4844.51-1","urgency":"not yet assigned"}}},"CVE-2022-0802":{"description":"Inappropriate implementation in Full screen mode in Google Chrome on Android prior to 99.0.4844.51 allowed a remote attacker to hide the contents of the Omnibox (URL bar) via a crafted HTML page.","scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"143.0.7499.169-1~deb12u1","bookworm-security":"145.0.7632.159-1~deb12u1"},"fixed_version":"99.0.4844.51-1","urgency":"not yet assigned"},"bullseye":{"status":"resolved","repositories":{"bullseye":"120.0.6099.224-1~deb11u1","bullseye-security":"120.0.6099.224-1~deb11u1"},"fixed_version":"99.0.4844.51-1~deb11u1","urgency":"not yet assigned"},"forky":{"status":"resolved","repositories":{"forky":"145.0.7632.159-1"},"fixed_version":"99.0.4844.51-1","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"146.0.7680.71-1"},"fixed_version":"99.0.4844.51-1","urgency":"not yet assigned"},"trixie":{"status":"resolved","repositories":{"trixie":"143.0.7499.169-1~deb13u1","trixie-security":"145.0.7632.159-1~deb13u1"},"fixed_version":"99.0.4844.51-1","urgency":"not yet assigned"}}},"CVE-2022-0803":{"description":"Inappropriate implementation in Permissions in Google Chrome prior to 99.0.4844.51 allowed a remote attacker to tamper with the contents of the Omnibox (URL bar) via a crafted HTML page.","scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"143.0.7499.169-1~deb12u1","bookworm-security":"145.0.7632.159-1~deb12u1"},"fixed_version":"99.0.4844.51-1","urgency":"not yet assigned"},"bullseye":{"status":"resolved","repositories":{"bullseye":"120.0.6099.224-1~deb11u1","bullseye-security":"120.0.6099.224-1~deb11u1"},"fixed_version":"99.0.4844.51-1~deb11u1","urgency":"not yet assigned"},"forky":{"status":"resolved","repositories":{"forky":"145.0.7632.159-1"},"fixed_version":"99.0.4844.51-1","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"146.0.7680.71-1"},"fixed_version":"99.0.4844.51-1","urgency":"not yet assigned"},"trixie":{"status":"resolved","repositories":{"trixie":"143.0.7499.169-1~deb13u1","trixie-security":"145.0.7632.159-1~deb13u1"},"fixed_version":"99.0.4844.51-1","urgency":"not yet assigned"}}},"CVE-2022-0804":{"description":"Inappropriate implementation in Full screen mode in Google Chrome on Android prior to 99.0.4844.51 allowed a remote attacker to hide the contents of the Omnibox (URL bar) via a crafted HTML page.","scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"143.0.7499.169-1~deb12u1","bookworm-security":"145.0.7632.159-1~deb12u1"},"fixed_version":"99.0.4844.51-1","urgency":"not yet assigned"},"bullseye":{"status":"resolved","repositories":{"bullseye":"120.0.6099.224-1~deb11u1","bullseye-security":"120.0.6099.224-1~deb11u1"},"fixed_version":"99.0.4844.51-1~deb11u1","urgency":"not yet assigned"},"forky":{"status":"resolved","repositories":{"forky":"145.0.7632.159-1"},"fixed_version":"99.0.4844.51-1","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"146.0.7680.71-1"},"fixed_version":"99.0.4844.51-1","urgency":"not yet assigned"},"trixie":{"status":"resolved","repositories":{"trixie":"143.0.7499.169-1~deb13u1","trixie-security":"145.0.7632.159-1~deb13u1"},"fixed_version":"99.0.4844.51-1","urgency":"not yet assigned"}}},"CVE-2022-0805":{"description":"Use after free in Browser Switcher in Google Chrome prior to 99.0.4844.51 allowed a remote attacker who convinced a user to engage in specific user interaction to potentially exploit heap corruption via user interaction.","scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"143.0.7499.169-1~deb12u1","bookworm-security":"145.0.7632.159-1~deb12u1"},"fixed_version":"99.0.4844.51-1","urgency":"not yet assigned"},"bullseye":{"status":"resolved","repositories":{"bullseye":"120.0.6099.224-1~deb11u1","bullseye-security":"120.0.6099.224-1~deb11u1"},"fixed_version":"99.0.4844.51-1~deb11u1","urgency":"not yet assigned"},"forky":{"status":"resolved","repositories":{"forky":"145.0.7632.159-1"},"fixed_version":"99.0.4844.51-1","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"146.0.7680.71-1"},"fixed_version":"99.0.4844.51-1","urgency":"not yet assigned"},"trixie":{"status":"resolved","repositories":{"trixie":"143.0.7499.169-1~deb13u1","trixie-security":"145.0.7632.159-1~deb13u1"},"fixed_version":"99.0.4844.51-1","urgency":"not yet assigned"}}},"CVE-2022-0806":{"description":"Data leak in Canvas in Google Chrome prior to 99.0.4844.51 allowed a remote attacker who convinced a user to engage in screen sharing to potentially leak cross-origin data via a crafted HTML page.","scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"143.0.7499.169-1~deb12u1","bookworm-security":"145.0.7632.159-1~deb12u1"},"fixed_version":"99.0.4844.51-1","urgency":"not yet assigned"},"bullseye":{"status":"resolved","repositories":{"bullseye":"120.0.6099.224-1~deb11u1","bullseye-security":"120.0.6099.224-1~deb11u1"},"fixed_version":"99.0.4844.51-1~deb11u1","urgency":"not yet assigned"},"forky":{"status":"resolved","repositories":{"forky":"145.0.7632.159-1"},"fixed_version":"99.0.4844.51-1","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"146.0.7680.71-1"},"fixed_version":"99.0.4844.51-1","urgency":"not yet assigned"},"trixie":{"status":"resolved","repositories":{"trixie":"143.0.7499.169-1~deb13u1","trixie-security":"145.0.7632.159-1~deb13u1"},"fixed_version":"99.0.4844.51-1","urgency":"not yet assigned"}}},"CVE-2022-0807":{"description":"Inappropriate implementation in Autofill in Google Chrome prior to 99.0.4844.51 allowed a remote attacker to bypass navigation restrictions via a crafted HTML page.","scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"143.0.7499.169-1~deb12u1","bookworm-security":"145.0.7632.159-1~deb12u1"},"fixed_version":"99.0.4844.51-1","urgency":"not yet assigned"},"bullseye":{"status":"resolved","repositories":{"bullseye":"120.0.6099.224-1~deb11u1","bullseye-security":"120.0.6099.224-1~deb11u1"},"fixed_version":"99.0.4844.51-1~deb11u1","urgency":"not yet assigned"},"forky":{"status":"resolved","repositories":{"forky":"145.0.7632.159-1"},"fixed_version":"99.0.4844.51-1","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"146.0.7680.71-1"},"fixed_version":"99.0.4844.51-1","urgency":"not yet assigned"},"trixie":{"status":"resolved","repositories":{"trixie":"143.0.7499.169-1~deb13u1","trixie-security":"145.0.7632.159-1~deb13u1"},"fixed_version":"99.0.4844.51-1","urgency":"not yet assigned"}}},"CVE-2022-0808":{"description":"Use after free in Chrome OS Shell in Google Chrome on Chrome OS prior to 99.0.4844.51 allowed a remote attacker who convinced a user to engage in a series of user interaction to potentially exploit heap corruption via user interactions.","scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"143.0.7499.169-1~deb12u1","bookworm-security":"145.0.7632.159-1~deb12u1"},"fixed_version":"99.0.4844.51-1","urgency":"not yet assigned"},"bullseye":{"status":"resolved","repositories":{"bullseye":"120.0.6099.224-1~deb11u1","bullseye-security":"120.0.6099.224-1~deb11u1"},"fixed_version":"99.0.4844.51-1~deb11u1","urgency":"not yet assigned"},"forky":{"status":"resolved","repositories":{"forky":"145.0.7632.159-1"},"fixed_version":"99.0.4844.51-1","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"146.0.7680.71-1"},"fixed_version":"99.0.4844.51-1","urgency":"not yet assigned"},"trixie":{"status":"resolved","repositories":{"trixie":"143.0.7499.169-1~deb13u1","trixie-security":"145.0.7632.159-1~deb13u1"},"fixed_version":"99.0.4844.51-1","urgency":"not yet assigned"}}},"CVE-2022-0809":{"description":"Out of bounds memory access in WebXR in Google Chrome prior to 99.0.4844.51 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page.","scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"143.0.7499.169-1~deb12u1","bookworm-security":"145.0.7632.159-1~deb12u1"},"fixed_version":"99.0.4844.51-1","urgency":"not yet assigned"},"bullseye":{"status":"resolved","repositories":{"bullseye":"120.0.6099.224-1~deb11u1","bullseye-security":"120.0.6099.224-1~deb11u1"},"fixed_version":"99.0.4844.51-1~deb11u1","urgency":"not yet assigned"},"forky":{"status":"resolved","repositories":{"forky":"145.0.7632.159-1"},"fixed_version":"99.0.4844.51-1","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"146.0.7680.71-1"},"fixed_version":"99.0.4844.51-1","urgency":"not yet assigned"},"trixie":{"status":"resolved","repositories":{"trixie":"143.0.7499.169-1~deb13u1","trixie-security":"145.0.7632.159-1~deb13u1"},"fixed_version":"99.0.4844.51-1","urgency":"not yet assigned"}}},"CVE-2022-0971":{"description":"Use after free in Blink Layout in Google Chrome on Android prior to 99.0.4844.74 allowed a remote attacker who had compromised the renderer process to potentially exploit heap corruption via a crafted HTML page.","scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"143.0.7499.169-1~deb12u1","bookworm-security":"145.0.7632.159-1~deb12u1"},"fixed_version":"99.0.4844.74-1","urgency":"not yet assigned"},"bullseye":{"status":"resolved","repositories":{"bullseye":"120.0.6099.224-1~deb11u1","bullseye-security":"120.0.6099.224-1~deb11u1"},"fixed_version":"99.0.4844.74-1~deb11u1","urgency":"not yet assigned"},"forky":{"status":"resolved","repositories":{"forky":"145.0.7632.159-1"},"fixed_version":"99.0.4844.74-1","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"146.0.7680.71-1"},"fixed_version":"99.0.4844.74-1","urgency":"not yet assigned"},"trixie":{"status":"resolved","repositories":{"trixie":"143.0.7499.169-1~deb13u1","trixie-security":"145.0.7632.159-1~deb13u1"},"fixed_version":"99.0.4844.74-1","urgency":"not yet assigned"}}},"CVE-2022-0972":{"description":"Use after free in Extensions in Google Chrome prior to 99.0.4844.74 allowed an attacker who convinced a user to install a malicious extension to potentially exploit heap corruption via a crafted HTML page.","scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"143.0.7499.169-1~deb12u1","bookworm-security":"145.0.7632.159-1~deb12u1"},"fixed_version":"99.0.4844.74-1","urgency":"not yet assigned"},"bullseye":{"status":"resolved","repositories":{"bullseye":"120.0.6099.224-1~deb11u1","bullseye-security":"120.0.6099.224-1~deb11u1"},"fixed_version":"99.0.4844.74-1~deb11u1","urgency":"not yet assigned"},"forky":{"status":"resolved","repositories":{"forky":"145.0.7632.159-1"},"fixed_version":"99.0.4844.74-1","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"146.0.7680.71-1"},"fixed_version":"99.0.4844.74-1","urgency":"not yet assigned"},"trixie":{"status":"resolved","repositories":{"trixie":"143.0.7499.169-1~deb13u1","trixie-security":"145.0.7632.159-1~deb13u1"},"fixed_version":"99.0.4844.74-1","urgency":"not yet assigned"}}},"CVE-2022-0973":{"description":"Use after free in Safe Browsing in Google Chrome prior to 99.0.4844.74 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page.","scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"143.0.7499.169-1~deb12u1","bookworm-security":"145.0.7632.159-1~deb12u1"},"fixed_version":"99.0.4844.74-1","urgency":"not yet assigned"},"bullseye":{"status":"resolved","repositories":{"bullseye":"120.0.6099.224-1~deb11u1","bullseye-security":"120.0.6099.224-1~deb11u1"},"fixed_version":"99.0.4844.74-1~deb11u1","urgency":"not yet assigned"},"forky":{"status":"resolved","repositories":{"forky":"145.0.7632.159-1"},"fixed_version":"99.0.4844.74-1","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"146.0.7680.71-1"},"fixed_version":"99.0.4844.74-1","urgency":"not yet assigned"},"trixie":{"status":"resolved","repositories":{"trixie":"143.0.7499.169-1~deb13u1","trixie-security":"145.0.7632.159-1~deb13u1"},"fixed_version":"99.0.4844.74-1","urgency":"not yet assigned"}}},"CVE-2022-0974":{"description":"Use after free in Splitscreen in Google Chrome on Chrome OS prior to 99.0.4844.74 allowed a remote attacker who convinced a user to engage in specific user interaction to potentially exploit heap corruption via a crafted HTML page.","scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"143.0.7499.169-1~deb12u1","bookworm-security":"145.0.7632.159-1~deb12u1"},"fixed_version":"99.0.4844.74-1","urgency":"not yet assigned"},"bullseye":{"status":"resolved","repositories":{"bullseye":"120.0.6099.224-1~deb11u1","bullseye-security":"120.0.6099.224-1~deb11u1"},"fixed_version":"99.0.4844.74-1~deb11u1","urgency":"not yet assigned"},"forky":{"status":"resolved","repositories":{"forky":"145.0.7632.159-1"},"fixed_version":"99.0.4844.74-1","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"146.0.7680.71-1"},"fixed_version":"99.0.4844.74-1","urgency":"not yet assigned"},"trixie":{"status":"resolved","repositories":{"trixie":"143.0.7499.169-1~deb13u1","trixie-security":"145.0.7632.159-1~deb13u1"},"fixed_version":"99.0.4844.74-1","urgency":"not yet assigned"}}},"CVE-2022-0975":{"description":"Use after free in ANGLE in Google Chrome prior to 99.0.4844.74 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page.","scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"143.0.7499.169-1~deb12u1","bookworm-security":"145.0.7632.159-1~deb12u1"},"fixed_version":"99.0.4844.74-1","urgency":"not yet assigned"},"bullseye":{"status":"resolved","repositories":{"bullseye":"120.0.6099.224-1~deb11u1","bullseye-security":"120.0.6099.224-1~deb11u1"},"fixed_version":"99.0.4844.74-1~deb11u1","urgency":"not yet assigned"},"forky":{"status":"resolved","repositories":{"forky":"145.0.7632.159-1"},"fixed_version":"99.0.4844.74-1","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"146.0.7680.71-1"},"fixed_version":"99.0.4844.74-1","urgency":"not yet assigned"},"trixie":{"status":"resolved","repositories":{"trixie":"143.0.7499.169-1~deb13u1","trixie-security":"145.0.7632.159-1~deb13u1"},"fixed_version":"99.0.4844.74-1","urgency":"not yet assigned"}}},"CVE-2022-0976":{"description":"Heap buffer overflow in GPU in Google Chrome prior to 99.0.4844.74 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page.","scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"143.0.7499.169-1~deb12u1","bookworm-security":"145.0.7632.159-1~deb12u1"},"fixed_version":"99.0.4844.74-1","urgency":"not yet assigned"},"bullseye":{"status":"resolved","repositories":{"bullseye":"120.0.6099.224-1~deb11u1","bullseye-security":"120.0.6099.224-1~deb11u1"},"fixed_version":"99.0.4844.74-1~deb11u1","urgency":"not yet assigned"},"forky":{"status":"resolved","repositories":{"forky":"145.0.7632.159-1"},"fixed_version":"99.0.4844.74-1","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"146.0.7680.71-1"},"fixed_version":"99.0.4844.74-1","urgency":"not yet assigned"},"trixie":{"status":"resolved","repositories":{"trixie":"143.0.7499.169-1~deb13u1","trixie-security":"145.0.7632.159-1~deb13u1"},"fixed_version":"99.0.4844.74-1","urgency":"not yet assigned"}}},"CVE-2022-0977":{"description":"Use after free in Browser UI in Google Chrome on Chrome OS prior to 99.0.4844.74 allowed a remote attacker who convinced a user to engage in specific user interaction to potentially exploit heap corruption via a crafted HTML page.","scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"143.0.7499.169-1~deb12u1","bookworm-security":"145.0.7632.159-1~deb12u1"},"fixed_version":"99.0.4844.74-1","urgency":"not yet assigned"},"bullseye":{"status":"resolved","repositories":{"bullseye":"120.0.6099.224-1~deb11u1","bullseye-security":"120.0.6099.224-1~deb11u1"},"fixed_version":"99.0.4844.74-1~deb11u1","urgency":"not yet assigned"},"forky":{"status":"resolved","repositories":{"forky":"145.0.7632.159-1"},"fixed_version":"99.0.4844.74-1","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"146.0.7680.71-1"},"fixed_version":"99.0.4844.74-1","urgency":"not yet assigned"},"trixie":{"status":"resolved","repositories":{"trixie":"143.0.7499.169-1~deb13u1","trixie-security":"145.0.7632.159-1~deb13u1"},"fixed_version":"99.0.4844.74-1","urgency":"not yet assigned"}}},"CVE-2022-0978":{"description":"Use after free in ANGLE in Google Chrome prior to 99.0.4844.74 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page.","scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"143.0.7499.169-1~deb12u1","bookworm-security":"145.0.7632.159-1~deb12u1"},"fixed_version":"99.0.4844.74-1","urgency":"not yet assigned"},"bullseye":{"status":"resolved","repositories":{"bullseye":"120.0.6099.224-1~deb11u1","bullseye-security":"120.0.6099.224-1~deb11u1"},"fixed_version":"99.0.4844.74-1~deb11u1","urgency":"not yet assigned"},"forky":{"status":"resolved","repositories":{"forky":"145.0.7632.159-1"},"fixed_version":"99.0.4844.74-1","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"146.0.7680.71-1"},"fixed_version":"99.0.4844.74-1","urgency":"not yet assigned"},"trixie":{"status":"resolved","repositories":{"trixie":"143.0.7499.169-1~deb13u1","trixie-security":"145.0.7632.159-1~deb13u1"},"fixed_version":"99.0.4844.74-1","urgency":"not yet assigned"}}},"CVE-2022-0979":{"description":"Use after free in Safe Browsing in Google Chrome on Android prior to 99.0.4844.74 allowed a remote attacker who convinced a user to engage in specific user interaction to potentially exploit heap corruption via a crafted HTML page.","scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"143.0.7499.169-1~deb12u1","bookworm-security":"145.0.7632.159-1~deb12u1"},"fixed_version":"99.0.4844.74-1","urgency":"not yet assigned"},"bullseye":{"status":"resolved","repositories":{"bullseye":"120.0.6099.224-1~deb11u1","bullseye-security":"120.0.6099.224-1~deb11u1"},"fixed_version":"99.0.4844.74-1~deb11u1","urgency":"not yet assigned"},"forky":{"status":"resolved","repositories":{"forky":"145.0.7632.159-1"},"fixed_version":"99.0.4844.74-1","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"146.0.7680.71-1"},"fixed_version":"99.0.4844.74-1","urgency":"not yet assigned"},"trixie":{"status":"resolved","repositories":{"trixie":"143.0.7499.169-1~deb13u1","trixie-security":"145.0.7632.159-1~deb13u1"},"fixed_version":"99.0.4844.74-1","urgency":"not yet assigned"}}},"CVE-2022-0980":{"description":"Use after free in New Tab Page in Google Chrome prior to 99.0.4844.74 allowed an attacker who convinced a user to install a malicious extension to potentially exploit heap corruption via specific user interactions.","scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"143.0.7499.169-1~deb12u1","bookworm-security":"145.0.7632.159-1~deb12u1"},"fixed_version":"99.0.4844.74-1","urgency":"not yet assigned"},"bullseye":{"status":"resolved","repositories":{"bullseye":"120.0.6099.224-1~deb11u1","bullseye-security":"120.0.6099.224-1~deb11u1"},"fixed_version":"99.0.4844.74-1~deb11u1","urgency":"not yet assigned"},"forky":{"status":"resolved","repositories":{"forky":"145.0.7632.159-1"},"fixed_version":"99.0.4844.74-1","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"146.0.7680.71-1"},"fixed_version":"99.0.4844.74-1","urgency":"not yet assigned"},"trixie":{"status":"resolved","repositories":{"trixie":"143.0.7499.169-1~deb13u1","trixie-security":"145.0.7632.159-1~deb13u1"},"fixed_version":"99.0.4844.74-1","urgency":"not yet assigned"}}},"CVE-2022-1096":{"description":"Type confusion in V8 in Google Chrome prior to 99.0.4844.84 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page.","scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"143.0.7499.169-1~deb12u1","bookworm-security":"145.0.7632.159-1~deb12u1"},"fixed_version":"99.0.4844.84-1","urgency":"not yet assigned"},"bullseye":{"status":"resolved","repositories":{"bullseye":"120.0.6099.224-1~deb11u1","bullseye-security":"120.0.6099.224-1~deb11u1"},"fixed_version":"99.0.4844.84-1~deb11u1","urgency":"not yet assigned"},"forky":{"status":"resolved","repositories":{"forky":"145.0.7632.159-1"},"fixed_version":"99.0.4844.84-1","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"146.0.7680.71-1"},"fixed_version":"99.0.4844.84-1","urgency":"not yet assigned"},"trixie":{"status":"resolved","repositories":{"trixie":"143.0.7499.169-1~deb13u1","trixie-security":"145.0.7632.159-1~deb13u1"},"fixed_version":"99.0.4844.84-1","urgency":"not yet assigned"}}},"CVE-2022-1125":{"description":"Use after free in Portals in Google Chrome prior to 100.0.4896.60 allowed a remote attacker who convinced a user to engage in specific user interaction to potentially exploit heap corruption via user interaction.","scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"143.0.7499.169-1~deb12u1","bookworm-security":"145.0.7632.159-1~deb12u1"},"fixed_version":"100.0.4896.60-1","urgency":"not yet assigned"},"bullseye":{"status":"resolved","repositories":{"bullseye":"120.0.6099.224-1~deb11u1","bullseye-security":"120.0.6099.224-1~deb11u1"},"fixed_version":"100.0.4896.60-1~deb11u1","urgency":"not yet assigned"},"forky":{"status":"resolved","repositories":{"forky":"145.0.7632.159-1"},"fixed_version":"100.0.4896.60-1","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"146.0.7680.71-1"},"fixed_version":"100.0.4896.60-1","urgency":"not yet assigned"},"trixie":{"status":"resolved","repositories":{"trixie":"143.0.7499.169-1~deb13u1","trixie-security":"145.0.7632.159-1~deb13u1"},"fixed_version":"100.0.4896.60-1","urgency":"not yet assigned"}}},"CVE-2022-1127":{"description":"Use after free in QR Code Generator in Google Chrome prior to 100.0.4896.60 allowed a remote attacker who convinced a user to engage in specific user interaction to potentially exploit heap corruption via user interaction.","scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"143.0.7499.169-1~deb12u1","bookworm-security":"145.0.7632.159-1~deb12u1"},"fixed_version":"100.0.4896.60-1","urgency":"not yet assigned"},"bullseye":{"status":"resolved","repositories":{"bullseye":"120.0.6099.224-1~deb11u1","bullseye-security":"120.0.6099.224-1~deb11u1"},"fixed_version":"100.0.4896.60-1~deb11u1","urgency":"not yet assigned"},"forky":{"status":"resolved","repositories":{"forky":"145.0.7632.159-1"},"fixed_version":"100.0.4896.60-1","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"146.0.7680.71-1"},"fixed_version":"100.0.4896.60-1","urgency":"not yet assigned"},"trixie":{"status":"resolved","repositories":{"trixie":"143.0.7499.169-1~deb13u1","trixie-security":"145.0.7632.159-1~deb13u1"},"fixed_version":"100.0.4896.60-1","urgency":"not yet assigned"}}},"CVE-2022-1128":{"description":"Inappropriate implementation in Web Share API in Google Chrome on Windows prior to 100.0.4896.60 allowed an attacker on the local network segment to leak cross-origin data via a crafted HTML page.","scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"143.0.7499.169-1~deb12u1","bookworm-security":"145.0.7632.159-1~deb12u1"},"fixed_version":"100.0.4896.60-1","urgency":"not yet assigned"},"bullseye":{"status":"resolved","repositories":{"bullseye":"120.0.6099.224-1~deb11u1","bullseye-security":"120.0.6099.224-1~deb11u1"},"fixed_version":"100.0.4896.60-1~deb11u1","urgency":"not yet assigned"},"forky":{"status":"resolved","repositories":{"forky":"145.0.7632.159-1"},"fixed_version":"100.0.4896.60-1","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"146.0.7680.71-1"},"fixed_version":"100.0.4896.60-1","urgency":"not yet assigned"},"trixie":{"status":"resolved","repositories":{"trixie":"143.0.7499.169-1~deb13u1","trixie-security":"145.0.7632.159-1~deb13u1"},"fixed_version":"100.0.4896.60-1","urgency":"not yet assigned"}}},"CVE-2022-1129":{"description":"Inappropriate implementation in Full Screen Mode in Google Chrome on Android prior to 100.0.4896.60 allowed a remote attacker to spoof the contents of the Omnibox (URL bar) via a crafted HTML page.","scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"143.0.7499.169-1~deb12u1","bookworm-security":"145.0.7632.159-1~deb12u1"},"fixed_version":"100.0.4896.60-1","urgency":"not yet assigned"},"bullseye":{"status":"resolved","repositories":{"bullseye":"120.0.6099.224-1~deb11u1","bullseye-security":"120.0.6099.224-1~deb11u1"},"fixed_version":"100.0.4896.60-1~deb11u1","urgency":"not yet assigned"},"forky":{"status":"resolved","repositories":{"forky":"145.0.7632.159-1"},"fixed_version":"100.0.4896.60-1","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"146.0.7680.71-1"},"fixed_version":"100.0.4896.60-1","urgency":"not yet assigned"},"trixie":{"status":"resolved","repositories":{"trixie":"143.0.7499.169-1~deb13u1","trixie-security":"145.0.7632.159-1~deb13u1"},"fixed_version":"100.0.4896.60-1","urgency":"not yet assigned"}}},"CVE-2022-1130":{"description":"Insufficient validation of trust input in WebOTP in Google Chrome on Android prior to 100.0.4896.60 allowed a remote attacker to send arbitrary intents from any app via a malicious app.","scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"143.0.7499.169-1~deb12u1","bookworm-security":"145.0.7632.159-1~deb12u1"},"fixed_version":"100.0.4896.60-1","urgency":"not yet assigned"},"bullseye":{"status":"resolved","repositories":{"bullseye":"120.0.6099.224-1~deb11u1","bullseye-security":"120.0.6099.224-1~deb11u1"},"fixed_version":"100.0.4896.60-1~deb11u1","urgency":"not yet assigned"},"forky":{"status":"resolved","repositories":{"forky":"145.0.7632.159-1"},"fixed_version":"100.0.4896.60-1","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"146.0.7680.71-1"},"fixed_version":"100.0.4896.60-1","urgency":"not yet assigned"},"trixie":{"status":"resolved","repositories":{"trixie":"143.0.7499.169-1~deb13u1","trixie-security":"145.0.7632.159-1~deb13u1"},"fixed_version":"100.0.4896.60-1","urgency":"not yet assigned"}}},"CVE-2022-1131":{"description":"Use after free in Cast UI in Google Chrome prior to 100.0.4896.60 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page.","scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"143.0.7499.169-1~deb12u1","bookworm-security":"145.0.7632.159-1~deb12u1"},"fixed_version":"100.0.4896.60-1","urgency":"not yet assigned"},"bullseye":{"status":"resolved","repositories":{"bullseye":"120.0.6099.224-1~deb11u1","bullseye-security":"120.0.6099.224-1~deb11u1"},"fixed_version":"100.0.4896.60-1~deb11u1","urgency":"not yet assigned"},"forky":{"status":"resolved","repositories":{"forky":"145.0.7632.159-1"},"fixed_version":"100.0.4896.60-1","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"146.0.7680.71-1"},"fixed_version":"100.0.4896.60-1","urgency":"not yet assigned"},"trixie":{"status":"resolved","repositories":{"trixie":"143.0.7499.169-1~deb13u1","trixie-security":"145.0.7632.159-1~deb13u1"},"fixed_version":"100.0.4896.60-1","urgency":"not yet assigned"}}},"CVE-2022-1132":{"description":"Inappropriate implementation in Virtual Keyboard in Google Chrome on Chrome OS prior to 100.0.4896.60 allowed a local attacker to bypass navigation restrictions via physical access to the device.","scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"143.0.7499.169-1~deb12u1","bookworm-security":"145.0.7632.159-1~deb12u1"},"fixed_version":"100.0.4896.60-1","urgency":"not yet assigned"},"bullseye":{"status":"resolved","repositories":{"bullseye":"120.0.6099.224-1~deb11u1","bullseye-security":"120.0.6099.224-1~deb11u1"},"fixed_version":"100.0.4896.60-1~deb11u1","urgency":"not yet assigned"},"forky":{"status":"resolved","repositories":{"forky":"145.0.7632.159-1"},"fixed_version":"100.0.4896.60-1","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"146.0.7680.71-1"},"fixed_version":"100.0.4896.60-1","urgency":"not yet assigned"},"trixie":{"status":"resolved","repositories":{"trixie":"143.0.7499.169-1~deb13u1","trixie-security":"145.0.7632.159-1~deb13u1"},"fixed_version":"100.0.4896.60-1","urgency":"not yet assigned"}}},"CVE-2022-1133":{"description":"Use after free in WebRTC Perf in Google Chrome prior to 100.0.4896.60 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page.","scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"143.0.7499.169-1~deb12u1","bookworm-security":"145.0.7632.159-1~deb12u1"},"fixed_version":"100.0.4896.60-1","urgency":"not yet assigned"},"bullseye":{"status":"resolved","repositories":{"bullseye":"120.0.6099.224-1~deb11u1","bullseye-security":"120.0.6099.224-1~deb11u1"},"fixed_version":"100.0.4896.60-1~deb11u1","urgency":"not yet assigned"},"forky":{"status":"resolved","repositories":{"forky":"145.0.7632.159-1"},"fixed_version":"100.0.4896.60-1","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"146.0.7680.71-1"},"fixed_version":"100.0.4896.60-1","urgency":"not yet assigned"},"trixie":{"status":"resolved","repositories":{"trixie":"143.0.7499.169-1~deb13u1","trixie-security":"145.0.7632.159-1~deb13u1"},"fixed_version":"100.0.4896.60-1","urgency":"not yet assigned"}}},"CVE-2022-1134":{"description":"Type confusion in V8 in Google Chrome prior to 100.0.4896.60 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page.","scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"143.0.7499.169-1~deb12u1","bookworm-security":"145.0.7632.159-1~deb12u1"},"fixed_version":"100.0.4896.60-1","urgency":"not yet assigned"},"bullseye":{"status":"resolved","repositories":{"bullseye":"120.0.6099.224-1~deb11u1","bullseye-security":"120.0.6099.224-1~deb11u1"},"fixed_version":"100.0.4896.60-1~deb11u1","urgency":"not yet assigned"},"forky":{"status":"resolved","repositories":{"forky":"145.0.7632.159-1"},"fixed_version":"100.0.4896.60-1","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"146.0.7680.71-1"},"fixed_version":"100.0.4896.60-1","urgency":"not yet assigned"},"trixie":{"status":"resolved","repositories":{"trixie":"143.0.7499.169-1~deb13u1","trixie-security":"145.0.7632.159-1~deb13u1"},"fixed_version":"100.0.4896.60-1","urgency":"not yet assigned"}}},"CVE-2022-1135":{"description":"Use after free in Shopping Cart in Google Chrome prior to 100.0.4896.60 allowed a remote attacker to potentially exploit heap corruption via standard feature user interaction.","scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"143.0.7499.169-1~deb12u1","bookworm-security":"145.0.7632.159-1~deb12u1"},"fixed_version":"100.0.4896.60-1","urgency":"not yet assigned"},"bullseye":{"status":"resolved","repositories":{"bullseye":"120.0.6099.224-1~deb11u1","bullseye-security":"120.0.6099.224-1~deb11u1"},"fixed_version":"100.0.4896.60-1~deb11u1","urgency":"not yet assigned"},"forky":{"status":"resolved","repositories":{"forky":"145.0.7632.159-1"},"fixed_version":"100.0.4896.60-1","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"146.0.7680.71-1"},"fixed_version":"100.0.4896.60-1","urgency":"not yet assigned"},"trixie":{"status":"resolved","repositories":{"trixie":"143.0.7499.169-1~deb13u1","trixie-security":"145.0.7632.159-1~deb13u1"},"fixed_version":"100.0.4896.60-1","urgency":"not yet assigned"}}},"CVE-2022-1136":{"description":"Use after free in Tab Strip in Google Chrome prior to 100.0.4896.60 allowed an attacker who convinced a user to install a malicious extension to potentially exploit heap corruption via specific set of user gestures.","scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"143.0.7499.169-1~deb12u1","bookworm-security":"145.0.7632.159-1~deb12u1"},"fixed_version":"100.0.4896.60-1","urgency":"not yet assigned"},"bullseye":{"status":"resolved","repositories":{"bullseye":"120.0.6099.224-1~deb11u1","bullseye-security":"120.0.6099.224-1~deb11u1"},"fixed_version":"100.0.4896.60-1~deb11u1","urgency":"not yet assigned"},"forky":{"status":"resolved","repositories":{"forky":"145.0.7632.159-1"},"fixed_version":"100.0.4896.60-1","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"146.0.7680.71-1"},"fixed_version":"100.0.4896.60-1","urgency":"not yet assigned"},"trixie":{"status":"resolved","repositories":{"trixie":"143.0.7499.169-1~deb13u1","trixie-security":"145.0.7632.159-1~deb13u1"},"fixed_version":"100.0.4896.60-1","urgency":"not yet assigned"}}},"CVE-2022-1137":{"description":"Inappropriate implementation in Extensions in Google Chrome prior to 100.0.4896.60 allowed an attacker who convinced a user to install a malicious extension to leak potentially sensitive information via a crafted HTML page.","scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"143.0.7499.169-1~deb12u1","bookworm-security":"145.0.7632.159-1~deb12u1"},"fixed_version":"100.0.4896.60-1","urgency":"not yet assigned"},"bullseye":{"status":"resolved","repositories":{"bullseye":"120.0.6099.224-1~deb11u1","bullseye-security":"120.0.6099.224-1~deb11u1"},"fixed_version":"100.0.4896.60-1~deb11u1","urgency":"not yet assigned"},"forky":{"status":"resolved","repositories":{"forky":"145.0.7632.159-1"},"fixed_version":"100.0.4896.60-1","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"146.0.7680.71-1"},"fixed_version":"100.0.4896.60-1","urgency":"not yet assigned"},"trixie":{"status":"resolved","repositories":{"trixie":"143.0.7499.169-1~deb13u1","trixie-security":"145.0.7632.159-1~deb13u1"},"fixed_version":"100.0.4896.60-1","urgency":"not yet assigned"}}},"CVE-2022-1138":{"description":"Inappropriate implementation in Web Cursor in Google Chrome prior to 100.0.4896.60 allowed a remote attacker who had compromised the renderer process to obscure the contents of the Omnibox (URL bar) via a crafted HTML page.","scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"143.0.7499.169-1~deb12u1","bookworm-security":"145.0.7632.159-1~deb12u1"},"fixed_version":"100.0.4896.60-1","urgency":"not yet assigned"},"bullseye":{"status":"resolved","repositories":{"bullseye":"120.0.6099.224-1~deb11u1","bullseye-security":"120.0.6099.224-1~deb11u1"},"fixed_version":"100.0.4896.60-1~deb11u1","urgency":"not yet assigned"},"forky":{"status":"resolved","repositories":{"forky":"145.0.7632.159-1"},"fixed_version":"100.0.4896.60-1","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"146.0.7680.71-1"},"fixed_version":"100.0.4896.60-1","urgency":"not yet assigned"},"trixie":{"status":"resolved","repositories":{"trixie":"143.0.7499.169-1~deb13u1","trixie-security":"145.0.7632.159-1~deb13u1"},"fixed_version":"100.0.4896.60-1","urgency":"not yet assigned"}}},"CVE-2022-1139":{"description":"Inappropriate implementation in Background Fetch API in Google Chrome prior to 100.0.4896.60 allowed a remote attacker to leak cross-origin data via a crafted HTML page.","scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"143.0.7499.169-1~deb12u1","bookworm-security":"145.0.7632.159-1~deb12u1"},"fixed_version":"100.0.4896.60-1","urgency":"not yet assigned"},"bullseye":{"status":"resolved","repositories":{"bullseye":"120.0.6099.224-1~deb11u1","bullseye-security":"120.0.6099.224-1~deb11u1"},"fixed_version":"100.0.4896.60-1~deb11u1","urgency":"not yet assigned"},"forky":{"status":"resolved","repositories":{"forky":"145.0.7632.159-1"},"fixed_version":"100.0.4896.60-1","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"146.0.7680.71-1"},"fixed_version":"100.0.4896.60-1","urgency":"not yet assigned"},"trixie":{"status":"resolved","repositories":{"trixie":"143.0.7499.169-1~deb13u1","trixie-security":"145.0.7632.159-1~deb13u1"},"fixed_version":"100.0.4896.60-1","urgency":"not yet assigned"}}},"CVE-2022-1141":{"description":"Use after free in File Manager in Google Chrome prior to 100.0.4896.60 allowed a remote attacker who convinced a user to engage in specific user interaction to potentially exploit heap corruption via specific user gesture.","scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"143.0.7499.169-1~deb12u1","bookworm-security":"145.0.7632.159-1~deb12u1"},"fixed_version":"100.0.4896.60-1","urgency":"not yet assigned"},"bullseye":{"status":"resolved","repositories":{"bullseye":"120.0.6099.224-1~deb11u1","bullseye-security":"120.0.6099.224-1~deb11u1"},"fixed_version":"100.0.4896.60-1~deb11u1","urgency":"not yet assigned"},"forky":{"status":"resolved","repositories":{"forky":"145.0.7632.159-1"},"fixed_version":"100.0.4896.60-1","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"146.0.7680.71-1"},"fixed_version":"100.0.4896.60-1","urgency":"not yet assigned"},"trixie":{"status":"resolved","repositories":{"trixie":"143.0.7499.169-1~deb13u1","trixie-security":"145.0.7632.159-1~deb13u1"},"fixed_version":"100.0.4896.60-1","urgency":"not yet assigned"}}},"CVE-2022-1142":{"description":"Heap buffer overflow in WebUI in Google Chrome prior to 100.0.4896.60 allowed a remote attacker who convinced a user to engage in specific user interaction to potentially exploit heap corruption via specific input into DevTools.","scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"143.0.7499.169-1~deb12u1","bookworm-security":"145.0.7632.159-1~deb12u1"},"fixed_version":"100.0.4896.60-1","urgency":"not yet assigned"},"bullseye":{"status":"resolved","repositories":{"bullseye":"120.0.6099.224-1~deb11u1","bullseye-security":"120.0.6099.224-1~deb11u1"},"fixed_version":"100.0.4896.60-1~deb11u1","urgency":"not yet assigned"},"forky":{"status":"resolved","repositories":{"forky":"145.0.7632.159-1"},"fixed_version":"100.0.4896.60-1","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"146.0.7680.71-1"},"fixed_version":"100.0.4896.60-1","urgency":"not yet assigned"},"trixie":{"status":"resolved","repositories":{"trixie":"143.0.7499.169-1~deb13u1","trixie-security":"145.0.7632.159-1~deb13u1"},"fixed_version":"100.0.4896.60-1","urgency":"not yet assigned"}}},"CVE-2022-1143":{"description":"Heap buffer overflow in WebUI in Google Chrome prior to 100.0.4896.60 allowed a remote attacker who convinced a user to engage in specific user interaction to potentially exploit heap corruption via specific input into DevTools.","scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"143.0.7499.169-1~deb12u1","bookworm-security":"145.0.7632.159-1~deb12u1"},"fixed_version":"100.0.4896.60-1","urgency":"not yet assigned"},"bullseye":{"status":"resolved","repositories":{"bullseye":"120.0.6099.224-1~deb11u1","bullseye-security":"120.0.6099.224-1~deb11u1"},"fixed_version":"100.0.4896.60-1~deb11u1","urgency":"not yet assigned"},"forky":{"status":"resolved","repositories":{"forky":"145.0.7632.159-1"},"fixed_version":"100.0.4896.60-1","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"146.0.7680.71-1"},"fixed_version":"100.0.4896.60-1","urgency":"not yet assigned"},"trixie":{"status":"resolved","repositories":{"trixie":"143.0.7499.169-1~deb13u1","trixie-security":"145.0.7632.159-1~deb13u1"},"fixed_version":"100.0.4896.60-1","urgency":"not yet assigned"}}},"CVE-2022-1144":{"description":"Use after free in WebUI in Google Chrome prior to 100.0.4896.60 allowed a remote attacker who convinced a user to engage in specific user interaction to potentially exploit heap corruption via specific input into DevTools.","scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"143.0.7499.169-1~deb12u1","bookworm-security":"145.0.7632.159-1~deb12u1"},"fixed_version":"100.0.4896.60-1","urgency":"not yet assigned"},"bullseye":{"status":"resolved","repositories":{"bullseye":"120.0.6099.224-1~deb11u1","bullseye-security":"120.0.6099.224-1~deb11u1"},"fixed_version":"100.0.4896.60-1~deb11u1","urgency":"not yet assigned"},"forky":{"status":"resolved","repositories":{"forky":"145.0.7632.159-1"},"fixed_version":"100.0.4896.60-1","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"146.0.7680.71-1"},"fixed_version":"100.0.4896.60-1","urgency":"not yet assigned"},"trixie":{"status":"resolved","repositories":{"trixie":"143.0.7499.169-1~deb13u1","trixie-security":"145.0.7632.159-1~deb13u1"},"fixed_version":"100.0.4896.60-1","urgency":"not yet assigned"}}},"CVE-2022-1145":{"description":"Use after free in Extensions in Google Chrome prior to 100.0.4896.60 allowed an attacker who convinced a user to install a malicious extension to potentially exploit heap corruption via specific user interaction and profile destruction.","scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"143.0.7499.169-1~deb12u1","bookworm-security":"145.0.7632.159-1~deb12u1"},"fixed_version":"100.0.4896.60-1","urgency":"not yet assigned"},"bullseye":{"status":"resolved","repositories":{"bullseye":"120.0.6099.224-1~deb11u1","bullseye-security":"120.0.6099.224-1~deb11u1"},"fixed_version":"100.0.4896.60-1~deb11u1","urgency":"not yet assigned"},"forky":{"status":"resolved","repositories":{"forky":"145.0.7632.159-1"},"fixed_version":"100.0.4896.60-1","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"146.0.7680.71-1"},"fixed_version":"100.0.4896.60-1","urgency":"not yet assigned"},"trixie":{"status":"resolved","repositories":{"trixie":"143.0.7499.169-1~deb13u1","trixie-security":"145.0.7632.159-1~deb13u1"},"fixed_version":"100.0.4896.60-1","urgency":"not yet assigned"}}},"CVE-2022-1146":{"description":"Inappropriate implementation in Resource Timing in Google Chrome prior to 100.0.4896.60 allowed a remote attacker to leak cross-origin data via a crafted HTML page.","scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"143.0.7499.169-1~deb12u1","bookworm-security":"145.0.7632.159-1~deb12u1"},"fixed_version":"100.0.4896.60-1","urgency":"not yet assigned"},"bullseye":{"status":"resolved","repositories":{"bullseye":"120.0.6099.224-1~deb11u1","bullseye-security":"120.0.6099.224-1~deb11u1"},"fixed_version":"100.0.4896.60-1~deb11u1","urgency":"not yet assigned"},"forky":{"status":"resolved","repositories":{"forky":"145.0.7632.159-1"},"fixed_version":"100.0.4896.60-1","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"146.0.7680.71-1"},"fixed_version":"100.0.4896.60-1","urgency":"not yet assigned"},"trixie":{"status":"resolved","repositories":{"trixie":"143.0.7499.169-1~deb13u1","trixie-security":"145.0.7632.159-1~deb13u1"},"fixed_version":"100.0.4896.60-1","urgency":"not yet assigned"}}},"CVE-2022-1232":{"description":"Type confusion in V8 in Google Chrome prior to 100.0.4896.75 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page.","scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"143.0.7499.169-1~deb12u1","bookworm-security":"145.0.7632.159-1~deb12u1"},"fixed_version":"100.0.4896.75-1","urgency":"not yet assigned"},"bullseye":{"status":"resolved","repositories":{"bullseye":"120.0.6099.224-1~deb11u1","bullseye-security":"120.0.6099.224-1~deb11u1"},"fixed_version":"100.0.4896.75-1~deb11u1","urgency":"not yet assigned"},"forky":{"status":"resolved","repositories":{"forky":"145.0.7632.159-1"},"fixed_version":"100.0.4896.75-1","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"146.0.7680.71-1"},"fixed_version":"100.0.4896.75-1","urgency":"not yet assigned"},"trixie":{"status":"resolved","repositories":{"trixie":"143.0.7499.169-1~deb13u1","trixie-security":"145.0.7632.159-1~deb13u1"},"fixed_version":"100.0.4896.75-1","urgency":"not yet assigned"}}},"CVE-2022-1305":{"description":"Use after free in storage in Google Chrome prior to 100.0.4896.88 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page.","scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"143.0.7499.169-1~deb12u1","bookworm-security":"145.0.7632.159-1~deb12u1"},"fixed_version":"100.0.4896.88-1","urgency":"not yet assigned"},"bullseye":{"status":"resolved","repositories":{"bullseye":"120.0.6099.224-1~deb11u1","bullseye-security":"120.0.6099.224-1~deb11u1"},"fixed_version":"100.0.4896.88-1~deb11u1","urgency":"not yet assigned"},"forky":{"status":"resolved","repositories":{"forky":"145.0.7632.159-1"},"fixed_version":"100.0.4896.88-1","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"146.0.7680.71-1"},"fixed_version":"100.0.4896.88-1","urgency":"not yet assigned"},"trixie":{"status":"resolved","repositories":{"trixie":"143.0.7499.169-1~deb13u1","trixie-security":"145.0.7632.159-1~deb13u1"},"fixed_version":"100.0.4896.88-1","urgency":"not yet assigned"}}},"CVE-2022-1306":{"description":"Inappropriate implementation in compositing in Google Chrome prior to 100.0.4896.88 allowed a remote attacker to spoof the contents of the Omnibox (URL bar) via a crafted HTML page.","scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"143.0.7499.169-1~deb12u1","bookworm-security":"145.0.7632.159-1~deb12u1"},"fixed_version":"100.0.4896.88-1","urgency":"not yet assigned"},"bullseye":{"status":"resolved","repositories":{"bullseye":"120.0.6099.224-1~deb11u1","bullseye-security":"120.0.6099.224-1~deb11u1"},"fixed_version":"100.0.4896.88-1~deb11u1","urgency":"not yet assigned"},"forky":{"status":"resolved","repositories":{"forky":"145.0.7632.159-1"},"fixed_version":"100.0.4896.88-1","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"146.0.7680.71-1"},"fixed_version":"100.0.4896.88-1","urgency":"not yet assigned"},"trixie":{"status":"resolved","repositories":{"trixie":"143.0.7499.169-1~deb13u1","trixie-security":"145.0.7632.159-1~deb13u1"},"fixed_version":"100.0.4896.88-1","urgency":"not yet assigned"}}},"CVE-2022-1307":{"description":"Inappropriate implementation in full screen in Google Chrome on Android prior to 100.0.4896.88 allowed a remote attacker to spoof the contents of the Omnibox (URL bar) via a crafted HTML page.","scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"143.0.7499.169-1~deb12u1","bookworm-security":"145.0.7632.159-1~deb12u1"},"fixed_version":"100.0.4896.88-1","urgency":"not yet assigned"},"bullseye":{"status":"resolved","repositories":{"bullseye":"120.0.6099.224-1~deb11u1","bullseye-security":"120.0.6099.224-1~deb11u1"},"fixed_version":"100.0.4896.88-1~deb11u1","urgency":"not yet assigned"},"forky":{"status":"resolved","repositories":{"forky":"145.0.7632.159-1"},"fixed_version":"100.0.4896.88-1","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"146.0.7680.71-1"},"fixed_version":"100.0.4896.88-1","urgency":"not yet assigned"},"trixie":{"status":"resolved","repositories":{"trixie":"143.0.7499.169-1~deb13u1","trixie-security":"145.0.7632.159-1~deb13u1"},"fixed_version":"100.0.4896.88-1","urgency":"not yet assigned"}}},"CVE-2022-1308":{"description":"Use after free in BFCache in Google Chrome prior to 100.0.4896.88 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page.","scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"143.0.7499.169-1~deb12u1","bookworm-security":"145.0.7632.159-1~deb12u1"},"fixed_version":"100.0.4896.88-1","urgency":"not yet assigned"},"bullseye":{"status":"resolved","repositories":{"bullseye":"120.0.6099.224-1~deb11u1","bullseye-security":"120.0.6099.224-1~deb11u1"},"fixed_version":"100.0.4896.88-1~deb11u1","urgency":"not yet assigned"},"forky":{"status":"resolved","repositories":{"forky":"145.0.7632.159-1"},"fixed_version":"100.0.4896.88-1","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"146.0.7680.71-1"},"fixed_version":"100.0.4896.88-1","urgency":"not yet assigned"},"trixie":{"status":"resolved","repositories":{"trixie":"143.0.7499.169-1~deb13u1","trixie-security":"145.0.7632.159-1~deb13u1"},"fixed_version":"100.0.4896.88-1","urgency":"not yet assigned"}}},"CVE-2022-1309":{"description":"Insufficient policy enforcement in developer tools in Google Chrome prior to 100.0.4896.88 allowed a remote attacker to potentially perform a sandbox escape via a crafted HTML page.","scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"143.0.7499.169-1~deb12u1","bookworm-security":"145.0.7632.159-1~deb12u1"},"fixed_version":"100.0.4896.88-1","urgency":"not yet assigned"},"bullseye":{"status":"resolved","repositories":{"bullseye":"120.0.6099.224-1~deb11u1","bullseye-security":"120.0.6099.224-1~deb11u1"},"fixed_version":"100.0.4896.88-1~deb11u1","urgency":"not yet assigned"},"forky":{"status":"resolved","repositories":{"forky":"145.0.7632.159-1"},"fixed_version":"100.0.4896.88-1","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"146.0.7680.71-1"},"fixed_version":"100.0.4896.88-1","urgency":"not yet assigned"},"trixie":{"status":"resolved","repositories":{"trixie":"143.0.7499.169-1~deb13u1","trixie-security":"145.0.7632.159-1~deb13u1"},"fixed_version":"100.0.4896.88-1","urgency":"not yet assigned"}}},"CVE-2022-1310":{"description":"Use after free in regular expressions in Google Chrome prior to 100.0.4896.88 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page.","scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"143.0.7499.169-1~deb12u1","bookworm-security":"145.0.7632.159-1~deb12u1"},"fixed_version":"100.0.4896.88-1","urgency":"not yet assigned"},"bullseye":{"status":"resolved","repositories":{"bullseye":"120.0.6099.224-1~deb11u1","bullseye-security":"120.0.6099.224-1~deb11u1"},"fixed_version":"100.0.4896.88-1~deb11u1","urgency":"not yet assigned"},"forky":{"status":"resolved","repositories":{"forky":"145.0.7632.159-1"},"fixed_version":"100.0.4896.88-1","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"146.0.7680.71-1"},"fixed_version":"100.0.4896.88-1","urgency":"not yet assigned"},"trixie":{"status":"resolved","repositories":{"trixie":"143.0.7499.169-1~deb13u1","trixie-security":"145.0.7632.159-1~deb13u1"},"fixed_version":"100.0.4896.88-1","urgency":"not yet assigned"}}},"CVE-2022-1311":{"description":"Use after free in shell in Google Chrome on ChromeOS prior to 100.0.4896.88 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page.","scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"143.0.7499.169-1~deb12u1","bookworm-security":"145.0.7632.159-1~deb12u1"},"fixed_version":"100.0.4896.88-1","urgency":"not yet assigned"},"bullseye":{"status":"resolved","repositories":{"bullseye":"120.0.6099.224-1~deb11u1","bullseye-security":"120.0.6099.224-1~deb11u1"},"fixed_version":"100.0.4896.88-1~deb11u1","urgency":"not yet assigned"},"forky":{"status":"resolved","repositories":{"forky":"145.0.7632.159-1"},"fixed_version":"100.0.4896.88-1","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"146.0.7680.71-1"},"fixed_version":"100.0.4896.88-1","urgency":"not yet assigned"},"trixie":{"status":"resolved","repositories":{"trixie":"143.0.7499.169-1~deb13u1","trixie-security":"145.0.7632.159-1~deb13u1"},"fixed_version":"100.0.4896.88-1","urgency":"not yet assigned"}}},"CVE-2022-1312":{"description":"Use after free in storage in Google Chrome prior to 100.0.4896.88 allowed an attacker who convinced a user to install a malicious extension to potentially perform a sandbox escape via a crafted Chrome Extension.","scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"143.0.7499.169-1~deb12u1","bookworm-security":"145.0.7632.159-1~deb12u1"},"fixed_version":"100.0.4896.88-1","urgency":"not yet assigned"},"bullseye":{"status":"resolved","repositories":{"bullseye":"120.0.6099.224-1~deb11u1","bullseye-security":"120.0.6099.224-1~deb11u1"},"fixed_version":"100.0.4896.88-1~deb11u1","urgency":"not yet assigned"},"forky":{"status":"resolved","repositories":{"forky":"145.0.7632.159-1"},"fixed_version":"100.0.4896.88-1","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"146.0.7680.71-1"},"fixed_version":"100.0.4896.88-1","urgency":"not yet assigned"},"trixie":{"status":"resolved","repositories":{"trixie":"143.0.7499.169-1~deb13u1","trixie-security":"145.0.7632.159-1~deb13u1"},"fixed_version":"100.0.4896.88-1","urgency":"not yet assigned"}}},"CVE-2022-1313":{"description":"Use after free in tab groups in Google Chrome prior to 100.0.4896.88 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page.","scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"143.0.7499.169-1~deb12u1","bookworm-security":"145.0.7632.159-1~deb12u1"},"fixed_version":"100.0.4896.88-1","urgency":"not yet assigned"},"bullseye":{"status":"resolved","repositories":{"bullseye":"120.0.6099.224-1~deb11u1","bullseye-security":"120.0.6099.224-1~deb11u1"},"fixed_version":"100.0.4896.88-1~deb11u1","urgency":"not yet assigned"},"forky":{"status":"resolved","repositories":{"forky":"145.0.7632.159-1"},"fixed_version":"100.0.4896.88-1","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"146.0.7680.71-1"},"fixed_version":"100.0.4896.88-1","urgency":"not yet assigned"},"trixie":{"status":"resolved","repositories":{"trixie":"143.0.7499.169-1~deb13u1","trixie-security":"145.0.7632.159-1~deb13u1"},"fixed_version":"100.0.4896.88-1","urgency":"not yet assigned"}}},"CVE-2022-1314":{"description":"Type confusion in V8 in Google Chrome prior to 100.0.4896.88 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page.","scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"143.0.7499.169-1~deb12u1","bookworm-security":"145.0.7632.159-1~deb12u1"},"fixed_version":"100.0.4896.88-1","urgency":"not yet assigned"},"bullseye":{"status":"resolved","repositories":{"bullseye":"120.0.6099.224-1~deb11u1","bullseye-security":"120.0.6099.224-1~deb11u1"},"fixed_version":"100.0.4896.88-1~deb11u1","urgency":"not yet assigned"},"forky":{"status":"resolved","repositories":{"forky":"145.0.7632.159-1"},"fixed_version":"100.0.4896.88-1","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"146.0.7680.71-1"},"fixed_version":"100.0.4896.88-1","urgency":"not yet assigned"},"trixie":{"status":"resolved","repositories":{"trixie":"143.0.7499.169-1~deb13u1","trixie-security":"145.0.7632.159-1~deb13u1"},"fixed_version":"100.0.4896.88-1","urgency":"not yet assigned"}}},"CVE-2022-1364":{"description":"Type confusion in V8 Turbofan in Google Chrome prior to 100.0.4896.127 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page.","scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"143.0.7499.169-1~deb12u1","bookworm-security":"145.0.7632.159-1~deb12u1"},"fixed_version":"100.0.4896.127-1","urgency":"not yet assigned"},"bullseye":{"status":"resolved","repositories":{"bullseye":"120.0.6099.224-1~deb11u1","bullseye-security":"120.0.6099.224-1~deb11u1"},"fixed_version":"100.0.4896.127-1~deb11u1","urgency":"not yet assigned"},"forky":{"status":"resolved","repositories":{"forky":"145.0.7632.159-1"},"fixed_version":"100.0.4896.127-1","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"146.0.7680.71-1"},"fixed_version":"100.0.4896.127-1","urgency":"not yet assigned"},"trixie":{"status":"resolved","repositories":{"trixie":"143.0.7499.169-1~deb13u1","trixie-security":"145.0.7632.159-1~deb13u1"},"fixed_version":"100.0.4896.127-1","urgency":"not yet assigned"}}},"CVE-2022-1477":{"description":"Use after free in Vulkan in Google Chrome prior to 101.0.4951.41 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page.","scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"143.0.7499.169-1~deb12u1","bookworm-security":"145.0.7632.159-1~deb12u1"},"fixed_version":"101.0.4951.41-1","urgency":"not yet assigned"},"bullseye":{"status":"resolved","repositories":{"bullseye":"120.0.6099.224-1~deb11u1","bullseye-security":"120.0.6099.224-1~deb11u1"},"fixed_version":"101.0.4951.41-1~deb11u1","urgency":"not yet assigned"},"forky":{"status":"resolved","repositories":{"forky":"145.0.7632.159-1"},"fixed_version":"101.0.4951.41-1","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"146.0.7680.71-1"},"fixed_version":"101.0.4951.41-1","urgency":"not yet assigned"},"trixie":{"status":"resolved","repositories":{"trixie":"143.0.7499.169-1~deb13u1","trixie-security":"145.0.7632.159-1~deb13u1"},"fixed_version":"101.0.4951.41-1","urgency":"not yet assigned"}}},"CVE-2022-1478":{"description":"Use after free in SwiftShader in Google Chrome prior to 101.0.4951.41 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page.","scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"143.0.7499.169-1~deb12u1","bookworm-security":"145.0.7632.159-1~deb12u1"},"fixed_version":"101.0.4951.41-1","urgency":"not yet assigned"},"bullseye":{"status":"resolved","repositories":{"bullseye":"120.0.6099.224-1~deb11u1","bullseye-security":"120.0.6099.224-1~deb11u1"},"fixed_version":"101.0.4951.41-1~deb11u1","urgency":"not yet assigned"},"forky":{"status":"resolved","repositories":{"forky":"145.0.7632.159-1"},"fixed_version":"101.0.4951.41-1","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"146.0.7680.71-1"},"fixed_version":"101.0.4951.41-1","urgency":"not yet assigned"},"trixie":{"status":"resolved","repositories":{"trixie":"143.0.7499.169-1~deb13u1","trixie-security":"145.0.7632.159-1~deb13u1"},"fixed_version":"101.0.4951.41-1","urgency":"not yet assigned"}}},"CVE-2022-1479":{"description":"Use after free in ANGLE in Google Chrome prior to 101.0.4951.41 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page.","scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"143.0.7499.169-1~deb12u1","bookworm-security":"145.0.7632.159-1~deb12u1"},"fixed_version":"101.0.4951.41-1","urgency":"not yet assigned"},"bullseye":{"status":"resolved","repositories":{"bullseye":"120.0.6099.224-1~deb11u1","bullseye-security":"120.0.6099.224-1~deb11u1"},"fixed_version":"101.0.4951.41-1~deb11u1","urgency":"not yet assigned"},"forky":{"status":"resolved","repositories":{"forky":"145.0.7632.159-1"},"fixed_version":"101.0.4951.41-1","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"146.0.7680.71-1"},"fixed_version":"101.0.4951.41-1","urgency":"not yet assigned"},"trixie":{"status":"resolved","repositories":{"trixie":"143.0.7499.169-1~deb13u1","trixie-security":"145.0.7632.159-1~deb13u1"},"fixed_version":"101.0.4951.41-1","urgency":"not yet assigned"}}},"CVE-2022-1481":{"description":"Use after free in Sharing in Google Chrome on Mac prior to 101.0.4951.41 allowed a remote attacker who convinced a user to engage in specific user interaction to potentially exploit heap corruption via a crafted HTML page.","scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"143.0.7499.169-1~deb12u1","bookworm-security":"145.0.7632.159-1~deb12u1"},"fixed_version":"101.0.4951.41-1","urgency":"not yet assigned"},"bullseye":{"status":"resolved","repositories":{"bullseye":"120.0.6099.224-1~deb11u1","bullseye-security":"120.0.6099.224-1~deb11u1"},"fixed_version":"101.0.4951.41-1~deb11u1","urgency":"not yet assigned"},"forky":{"status":"resolved","repositories":{"forky":"145.0.7632.159-1"},"fixed_version":"101.0.4951.41-1","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"146.0.7680.71-1"},"fixed_version":"101.0.4951.41-1","urgency":"not yet assigned"},"trixie":{"status":"resolved","repositories":{"trixie":"143.0.7499.169-1~deb13u1","trixie-security":"145.0.7632.159-1~deb13u1"},"fixed_version":"101.0.4951.41-1","urgency":"not yet assigned"}}},"CVE-2022-1482":{"description":"Inappropriate implementation in WebGL in Google Chrome prior to 101.0.4951.41 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page.","scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"143.0.7499.169-1~deb12u1","bookworm-security":"145.0.7632.159-1~deb12u1"},"fixed_version":"101.0.4951.41-1","urgency":"not yet assigned"},"bullseye":{"status":"resolved","repositories":{"bullseye":"120.0.6099.224-1~deb11u1","bullseye-security":"120.0.6099.224-1~deb11u1"},"fixed_version":"101.0.4951.41-1~deb11u1","urgency":"not yet assigned"},"forky":{"status":"resolved","repositories":{"forky":"145.0.7632.159-1"},"fixed_version":"101.0.4951.41-1","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"146.0.7680.71-1"},"fixed_version":"101.0.4951.41-1","urgency":"not yet assigned"},"trixie":{"status":"resolved","repositories":{"trixie":"143.0.7499.169-1~deb13u1","trixie-security":"145.0.7632.159-1~deb13u1"},"fixed_version":"101.0.4951.41-1","urgency":"not yet assigned"}}},"CVE-2022-1483":{"description":"Heap buffer overflow in WebGPU in Google Chrome prior to 101.0.4951.41 allowed a remote attacker who had compromised the renderer process to potentially exploit heap corruption via a crafted HTML page.","scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"143.0.7499.169-1~deb12u1","bookworm-security":"145.0.7632.159-1~deb12u1"},"fixed_version":"101.0.4951.41-1","urgency":"not yet assigned"},"bullseye":{"status":"resolved","repositories":{"bullseye":"120.0.6099.224-1~deb11u1","bullseye-security":"120.0.6099.224-1~deb11u1"},"fixed_version":"101.0.4951.41-1~deb11u1","urgency":"not yet assigned"},"forky":{"status":"resolved","repositories":{"forky":"145.0.7632.159-1"},"fixed_version":"101.0.4951.41-1","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"146.0.7680.71-1"},"fixed_version":"101.0.4951.41-1","urgency":"not yet assigned"},"trixie":{"status":"resolved","repositories":{"trixie":"143.0.7499.169-1~deb13u1","trixie-security":"145.0.7632.159-1~deb13u1"},"fixed_version":"101.0.4951.41-1","urgency":"not yet assigned"}}},"CVE-2022-1484":{"description":"Heap buffer overflow in Web UI Settings in Google Chrome prior to 101.0.4951.41 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page.","scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"143.0.7499.169-1~deb12u1","bookworm-security":"145.0.7632.159-1~deb12u1"},"fixed_version":"101.0.4951.41-1","urgency":"not yet assigned"},"bullseye":{"status":"resolved","repositories":{"bullseye":"120.0.6099.224-1~deb11u1","bullseye-security":"120.0.6099.224-1~deb11u1"},"fixed_version":"101.0.4951.41-1~deb11u1","urgency":"not yet assigned"},"forky":{"status":"resolved","repositories":{"forky":"145.0.7632.159-1"},"fixed_version":"101.0.4951.41-1","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"146.0.7680.71-1"},"fixed_version":"101.0.4951.41-1","urgency":"not yet assigned"},"trixie":{"status":"resolved","repositories":{"trixie":"143.0.7499.169-1~deb13u1","trixie-security":"145.0.7632.159-1~deb13u1"},"fixed_version":"101.0.4951.41-1","urgency":"not yet assigned"}}},"CVE-2022-1485":{"description":"Use after free in File System API in Google Chrome prior to 101.0.4951.41 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page.","scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"143.0.7499.169-1~deb12u1","bookworm-security":"145.0.7632.159-1~deb12u1"},"fixed_version":"101.0.4951.41-1","urgency":"not yet assigned"},"bullseye":{"status":"resolved","repositories":{"bullseye":"120.0.6099.224-1~deb11u1","bullseye-security":"120.0.6099.224-1~deb11u1"},"fixed_version":"101.0.4951.41-1~deb11u1","urgency":"not yet assigned"},"forky":{"status":"resolved","repositories":{"forky":"145.0.7632.159-1"},"fixed_version":"101.0.4951.41-1","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"146.0.7680.71-1"},"fixed_version":"101.0.4951.41-1","urgency":"not yet assigned"},"trixie":{"status":"resolved","repositories":{"trixie":"143.0.7499.169-1~deb13u1","trixie-security":"145.0.7632.159-1~deb13u1"},"fixed_version":"101.0.4951.41-1","urgency":"not yet assigned"}}},"CVE-2022-1486":{"description":"Type confusion in V8 in Google Chrome prior to 101.0.4951.41 allowed a remote attacker to obtain potentially sensitive information from process memory via a crafted HTML page.","scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"143.0.7499.169-1~deb12u1","bookworm-security":"145.0.7632.159-1~deb12u1"},"fixed_version":"101.0.4951.41-1","urgency":"not yet assigned"},"bullseye":{"status":"resolved","repositories":{"bullseye":"120.0.6099.224-1~deb11u1","bullseye-security":"120.0.6099.224-1~deb11u1"},"fixed_version":"101.0.4951.41-1~deb11u1","urgency":"not yet assigned"},"forky":{"status":"resolved","repositories":{"forky":"145.0.7632.159-1"},"fixed_version":"101.0.4951.41-1","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"146.0.7680.71-1"},"fixed_version":"101.0.4951.41-1","urgency":"not yet assigned"},"trixie":{"status":"resolved","repositories":{"trixie":"143.0.7499.169-1~deb13u1","trixie-security":"145.0.7632.159-1~deb13u1"},"fixed_version":"101.0.4951.41-1","urgency":"not yet assigned"}}},"CVE-2022-1487":{"description":"Use after free in Ozone in Google Chrome prior to 101.0.4951.41 allowed a remote attacker to potentially exploit heap corruption via running a Wayland test.","scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"143.0.7499.169-1~deb12u1","bookworm-security":"145.0.7632.159-1~deb12u1"},"fixed_version":"101.0.4951.41-1","urgency":"not yet assigned"},"bullseye":{"status":"resolved","repositories":{"bullseye":"120.0.6099.224-1~deb11u1","bullseye-security":"120.0.6099.224-1~deb11u1"},"fixed_version":"101.0.4951.41-1~deb11u1","urgency":"not yet assigned"},"forky":{"status":"resolved","repositories":{"forky":"145.0.7632.159-1"},"fixed_version":"101.0.4951.41-1","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"146.0.7680.71-1"},"fixed_version":"101.0.4951.41-1","urgency":"not yet assigned"},"trixie":{"status":"resolved","repositories":{"trixie":"143.0.7499.169-1~deb13u1","trixie-security":"145.0.7632.159-1~deb13u1"},"fixed_version":"101.0.4951.41-1","urgency":"not yet assigned"}}},"CVE-2022-1488":{"description":"Inappropriate implementation in Extensions API in Google Chrome prior to 101.0.4951.41 allowed an attacker who convinced a user to install a malicious extension to leak cross-origin data via a crafted Chrome Extension.","scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"143.0.7499.169-1~deb12u1","bookworm-security":"145.0.7632.159-1~deb12u1"},"fixed_version":"101.0.4951.41-1","urgency":"not yet assigned"},"bullseye":{"status":"resolved","repositories":{"bullseye":"120.0.6099.224-1~deb11u1","bullseye-security":"120.0.6099.224-1~deb11u1"},"fixed_version":"101.0.4951.41-1~deb11u1","urgency":"not yet assigned"},"forky":{"status":"resolved","repositories":{"forky":"145.0.7632.159-1"},"fixed_version":"101.0.4951.41-1","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"146.0.7680.71-1"},"fixed_version":"101.0.4951.41-1","urgency":"not yet assigned"},"trixie":{"status":"resolved","repositories":{"trixie":"143.0.7499.169-1~deb13u1","trixie-security":"145.0.7632.159-1~deb13u1"},"fixed_version":"101.0.4951.41-1","urgency":"not yet assigned"}}},"CVE-2022-1489":{"description":"Out of bounds memory access in UI Shelf in Google Chrome on Chrome OS, Lacros prior to 101.0.4951.41 allowed a remote attacker to potentially exploit heap corruption via specific user interactions.","scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"143.0.7499.169-1~deb12u1","bookworm-security":"145.0.7632.159-1~deb12u1"},"fixed_version":"101.0.4951.41-1","urgency":"not yet assigned"},"bullseye":{"status":"resolved","repositories":{"bullseye":"120.0.6099.224-1~deb11u1","bullseye-security":"120.0.6099.224-1~deb11u1"},"fixed_version":"101.0.4951.41-1~deb11u1","urgency":"not yet assigned"},"forky":{"status":"resolved","repositories":{"forky":"145.0.7632.159-1"},"fixed_version":"101.0.4951.41-1","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"146.0.7680.71-1"},"fixed_version":"101.0.4951.41-1","urgency":"not yet assigned"},"trixie":{"status":"resolved","repositories":{"trixie":"143.0.7499.169-1~deb13u1","trixie-security":"145.0.7632.159-1~deb13u1"},"fixed_version":"101.0.4951.41-1","urgency":"not yet assigned"}}},"CVE-2022-1490":{"description":"Use after free in Browser Switcher in Google Chrome prior to 101.0.4951.41 allowed a remote attacker who convinced a user to engage in specific user interaction to potentially exploit heap corruption via a crafted HTML page.","scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"143.0.7499.169-1~deb12u1","bookworm-security":"145.0.7632.159-1~deb12u1"},"fixed_version":"101.0.4951.41-1","urgency":"not yet assigned"},"bullseye":{"status":"resolved","repositories":{"bullseye":"120.0.6099.224-1~deb11u1","bullseye-security":"120.0.6099.224-1~deb11u1"},"fixed_version":"101.0.4951.41-1~deb11u1","urgency":"not yet assigned"},"forky":{"status":"resolved","repositories":{"forky":"145.0.7632.159-1"},"fixed_version":"101.0.4951.41-1","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"146.0.7680.71-1"},"fixed_version":"101.0.4951.41-1","urgency":"not yet assigned"},"trixie":{"status":"resolved","repositories":{"trixie":"143.0.7499.169-1~deb13u1","trixie-security":"145.0.7632.159-1~deb13u1"},"fixed_version":"101.0.4951.41-1","urgency":"not yet assigned"}}},"CVE-2022-1491":{"description":"Use after free in Bookmarks in Google Chrome prior to 101.0.4951.41 allowed a remote attacker to potentially exploit heap corruption via specific and direct user interaction.","scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"143.0.7499.169-1~deb12u1","bookworm-security":"145.0.7632.159-1~deb12u1"},"fixed_version":"101.0.4951.41-1","urgency":"not yet assigned"},"bullseye":{"status":"resolved","repositories":{"bullseye":"120.0.6099.224-1~deb11u1","bullseye-security":"120.0.6099.224-1~deb11u1"},"fixed_version":"101.0.4951.41-1~deb11u1","urgency":"not yet assigned"},"forky":{"status":"resolved","repositories":{"forky":"145.0.7632.159-1"},"fixed_version":"101.0.4951.41-1","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"146.0.7680.71-1"},"fixed_version":"101.0.4951.41-1","urgency":"not yet assigned"},"trixie":{"status":"resolved","repositories":{"trixie":"143.0.7499.169-1~deb13u1","trixie-security":"145.0.7632.159-1~deb13u1"},"fixed_version":"101.0.4951.41-1","urgency":"not yet assigned"}}},"CVE-2022-1492":{"description":"Insufficient data validation in Blink Editing in Google Chrome prior to 101.0.4951.41 allowed a remote attacker to inject arbitrary scripts or HTML via a crafted HTML page.","scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"143.0.7499.169-1~deb12u1","bookworm-security":"145.0.7632.159-1~deb12u1"},"fixed_version":"101.0.4951.41-1","urgency":"not yet assigned"},"bullseye":{"status":"resolved","repositories":{"bullseye":"120.0.6099.224-1~deb11u1","bullseye-security":"120.0.6099.224-1~deb11u1"},"fixed_version":"101.0.4951.41-1~deb11u1","urgency":"not yet assigned"},"forky":{"status":"resolved","repositories":{"forky":"145.0.7632.159-1"},"fixed_version":"101.0.4951.41-1","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"146.0.7680.71-1"},"fixed_version":"101.0.4951.41-1","urgency":"not yet assigned"},"trixie":{"status":"resolved","repositories":{"trixie":"143.0.7499.169-1~deb13u1","trixie-security":"145.0.7632.159-1~deb13u1"},"fixed_version":"101.0.4951.41-1","urgency":"not yet assigned"}}},"CVE-2022-1493":{"description":"Use after free in Dev Tools in Google Chrome prior to 101.0.4951.41 allowed a remote attacker to potentially exploit heap corruption via specific and direct user interaction.","scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"143.0.7499.169-1~deb12u1","bookworm-security":"145.0.7632.159-1~deb12u1"},"fixed_version":"101.0.4951.41-1","urgency":"not yet assigned"},"bullseye":{"status":"resolved","repositories":{"bullseye":"120.0.6099.224-1~deb11u1","bullseye-security":"120.0.6099.224-1~deb11u1"},"fixed_version":"101.0.4951.41-1~deb11u1","urgency":"not yet assigned"},"forky":{"status":"resolved","repositories":{"forky":"145.0.7632.159-1"},"fixed_version":"101.0.4951.41-1","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"146.0.7680.71-1"},"fixed_version":"101.0.4951.41-1","urgency":"not yet assigned"},"trixie":{"status":"resolved","repositories":{"trixie":"143.0.7499.169-1~deb13u1","trixie-security":"145.0.7632.159-1~deb13u1"},"fixed_version":"101.0.4951.41-1","urgency":"not yet assigned"}}},"CVE-2022-1494":{"description":"Insufficient data validation in Trusted Types in Google Chrome prior to 101.0.4951.41 allowed a remote attacker to bypass trusted types policy via a crafted HTML page.","scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"143.0.7499.169-1~deb12u1","bookworm-security":"145.0.7632.159-1~deb12u1"},"fixed_version":"101.0.4951.41-1","urgency":"not yet assigned"},"bullseye":{"status":"resolved","repositories":{"bullseye":"120.0.6099.224-1~deb11u1","bullseye-security":"120.0.6099.224-1~deb11u1"},"fixed_version":"101.0.4951.41-1~deb11u1","urgency":"not yet assigned"},"forky":{"status":"resolved","repositories":{"forky":"145.0.7632.159-1"},"fixed_version":"101.0.4951.41-1","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"146.0.7680.71-1"},"fixed_version":"101.0.4951.41-1","urgency":"not yet assigned"},"trixie":{"status":"resolved","repositories":{"trixie":"143.0.7499.169-1~deb13u1","trixie-security":"145.0.7632.159-1~deb13u1"},"fixed_version":"101.0.4951.41-1","urgency":"not yet assigned"}}},"CVE-2022-1495":{"description":"Incorrect security UI in Downloads in Google Chrome on Android prior to 101.0.4951.41 allowed a remote attacker to spoof the APK downloads dialog via a crafted HTML page.","scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"143.0.7499.169-1~deb12u1","bookworm-security":"145.0.7632.159-1~deb12u1"},"fixed_version":"101.0.4951.41-1","urgency":"not yet assigned"},"bullseye":{"status":"resolved","repositories":{"bullseye":"120.0.6099.224-1~deb11u1","bullseye-security":"120.0.6099.224-1~deb11u1"},"fixed_version":"101.0.4951.41-1~deb11u1","urgency":"not yet assigned"},"forky":{"status":"resolved","repositories":{"forky":"145.0.7632.159-1"},"fixed_version":"101.0.4951.41-1","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"146.0.7680.71-1"},"fixed_version":"101.0.4951.41-1","urgency":"not yet assigned"},"trixie":{"status":"resolved","repositories":{"trixie":"143.0.7499.169-1~deb13u1","trixie-security":"145.0.7632.159-1~deb13u1"},"fixed_version":"101.0.4951.41-1","urgency":"not yet assigned"}}},"CVE-2022-1496":{"description":"Use after free in File Manager in Google Chrome prior to 101.0.4951.41 allowed a remote attacker to potentially exploit heap corruption via specific and direct user interaction.","scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"143.0.7499.169-1~deb12u1","bookworm-security":"145.0.7632.159-1~deb12u1"},"fixed_version":"101.0.4951.41-1","urgency":"not yet assigned"},"bullseye":{"status":"resolved","repositories":{"bullseye":"120.0.6099.224-1~deb11u1","bullseye-security":"120.0.6099.224-1~deb11u1"},"fixed_version":"101.0.4951.41-1~deb11u1","urgency":"not yet assigned"},"forky":{"status":"resolved","repositories":{"forky":"145.0.7632.159-1"},"fixed_version":"101.0.4951.41-1","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"146.0.7680.71-1"},"fixed_version":"101.0.4951.41-1","urgency":"not yet assigned"},"trixie":{"status":"resolved","repositories":{"trixie":"143.0.7499.169-1~deb13u1","trixie-security":"145.0.7632.159-1~deb13u1"},"fixed_version":"101.0.4951.41-1","urgency":"not yet assigned"}}},"CVE-2022-1497":{"description":"Inappropriate implementation in Input in Google Chrome prior to 101.0.4951.41 allowed a remote attacker to spoof the contents of cross-origin websites via a crafted HTML page.","scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"143.0.7499.169-1~deb12u1","bookworm-security":"145.0.7632.159-1~deb12u1"},"fixed_version":"101.0.4951.41-1","urgency":"not yet assigned"},"bullseye":{"status":"resolved","repositories":{"bullseye":"120.0.6099.224-1~deb11u1","bullseye-security":"120.0.6099.224-1~deb11u1"},"fixed_version":"101.0.4951.41-1~deb11u1","urgency":"not yet assigned"},"forky":{"status":"resolved","repositories":{"forky":"145.0.7632.159-1"},"fixed_version":"101.0.4951.41-1","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"146.0.7680.71-1"},"fixed_version":"101.0.4951.41-1","urgency":"not yet assigned"},"trixie":{"status":"resolved","repositories":{"trixie":"143.0.7499.169-1~deb13u1","trixie-security":"145.0.7632.159-1~deb13u1"},"fixed_version":"101.0.4951.41-1","urgency":"not yet assigned"}}},"CVE-2022-1498":{"description":"Inappropriate implementation in HTML Parser in Google Chrome prior to 101.0.4951.41 allowed a remote attacker to leak cross-origin data via a crafted HTML page.","scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"143.0.7499.169-1~deb12u1","bookworm-security":"145.0.7632.159-1~deb12u1"},"fixed_version":"101.0.4951.41-1","urgency":"not yet assigned"},"bullseye":{"status":"resolved","repositories":{"bullseye":"120.0.6099.224-1~deb11u1","bullseye-security":"120.0.6099.224-1~deb11u1"},"fixed_version":"101.0.4951.41-1~deb11u1","urgency":"not yet assigned"},"forky":{"status":"resolved","repositories":{"forky":"145.0.7632.159-1"},"fixed_version":"101.0.4951.41-1","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"146.0.7680.71-1"},"fixed_version":"101.0.4951.41-1","urgency":"not yet assigned"},"trixie":{"status":"resolved","repositories":{"trixie":"143.0.7499.169-1~deb13u1","trixie-security":"145.0.7632.159-1~deb13u1"},"fixed_version":"101.0.4951.41-1","urgency":"not yet assigned"}}},"CVE-2022-1499":{"description":"Inappropriate implementation in WebAuthentication in Google Chrome prior to 101.0.4951.41 allowed a remote attacker to bypass same origin policy via a crafted HTML page.","scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"143.0.7499.169-1~deb12u1","bookworm-security":"145.0.7632.159-1~deb12u1"},"fixed_version":"101.0.4951.41-1","urgency":"not yet assigned"},"bullseye":{"status":"resolved","repositories":{"bullseye":"120.0.6099.224-1~deb11u1","bullseye-security":"120.0.6099.224-1~deb11u1"},"fixed_version":"101.0.4951.41-1~deb11u1","urgency":"not yet assigned"},"forky":{"status":"resolved","repositories":{"forky":"145.0.7632.159-1"},"fixed_version":"101.0.4951.41-1","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"146.0.7680.71-1"},"fixed_version":"101.0.4951.41-1","urgency":"not yet assigned"},"trixie":{"status":"resolved","repositories":{"trixie":"143.0.7499.169-1~deb13u1","trixie-security":"145.0.7632.159-1~deb13u1"},"fixed_version":"101.0.4951.41-1","urgency":"not yet assigned"}}},"CVE-2022-1500":{"description":"Insufficient data validation in Dev Tools in Google Chrome prior to 101.0.4951.41 allowed a remote attacker to bypass content security policy via a crafted HTML page.","scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"143.0.7499.169-1~deb12u1","bookworm-security":"145.0.7632.159-1~deb12u1"},"fixed_version":"101.0.4951.41-1","urgency":"not yet assigned"},"bullseye":{"status":"resolved","repositories":{"bullseye":"120.0.6099.224-1~deb11u1","bullseye-security":"120.0.6099.224-1~deb11u1"},"fixed_version":"101.0.4951.41-1~deb11u1","urgency":"not yet assigned"},"forky":{"status":"resolved","repositories":{"forky":"145.0.7632.159-1"},"fixed_version":"101.0.4951.41-1","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"146.0.7680.71-1"},"fixed_version":"101.0.4951.41-1","urgency":"not yet assigned"},"trixie":{"status":"resolved","repositories":{"trixie":"143.0.7499.169-1~deb13u1","trixie-security":"145.0.7632.159-1~deb13u1"},"fixed_version":"101.0.4951.41-1","urgency":"not yet assigned"}}},"CVE-2022-1501":{"description":"Inappropriate implementation in iframe in Google Chrome prior to 101.0.4951.41 allowed a remote attacker to leak cross-origin data via a crafted HTML page.","scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"143.0.7499.169-1~deb12u1","bookworm-security":"145.0.7632.159-1~deb12u1"},"fixed_version":"101.0.4951.41-1","urgency":"not yet assigned"},"bullseye":{"status":"resolved","repositories":{"bullseye":"120.0.6099.224-1~deb11u1","bullseye-security":"120.0.6099.224-1~deb11u1"},"fixed_version":"101.0.4951.41-1~deb11u1","urgency":"not yet assigned"},"forky":{"status":"resolved","repositories":{"forky":"145.0.7632.159-1"},"fixed_version":"101.0.4951.41-1","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"146.0.7680.71-1"},"fixed_version":"101.0.4951.41-1","urgency":"not yet assigned"},"trixie":{"status":"resolved","repositories":{"trixie":"143.0.7499.169-1~deb13u1","trixie-security":"145.0.7632.159-1~deb13u1"},"fixed_version":"101.0.4951.41-1","urgency":"not yet assigned"}}},"CVE-2022-1633":{"description":"Use after free in Sharesheet in Google Chrome on Chrome OS prior to 101.0.4951.64 allowed a remote attacker who convinced a user to engage in specific UI interactions to potentially exploit heap corruption via specific user interactions.","scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"143.0.7499.169-1~deb12u1","bookworm-security":"145.0.7632.159-1~deb12u1"},"fixed_version":"101.0.4951.64-1","urgency":"not yet assigned"},"bullseye":{"status":"resolved","repositories":{"bullseye":"120.0.6099.224-1~deb11u1","bullseye-security":"120.0.6099.224-1~deb11u1"},"fixed_version":"101.0.4951.64-1~deb11u1","urgency":"not yet assigned"},"forky":{"status":"resolved","repositories":{"forky":"145.0.7632.159-1"},"fixed_version":"101.0.4951.64-1","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"146.0.7680.71-1"},"fixed_version":"101.0.4951.64-1","urgency":"not yet assigned"},"trixie":{"status":"resolved","repositories":{"trixie":"143.0.7499.169-1~deb13u1","trixie-security":"145.0.7632.159-1~deb13u1"},"fixed_version":"101.0.4951.64-1","urgency":"not yet assigned"}}},"CVE-2022-1634":{"description":"Use after free in Browser UI in Google Chrome prior to 101.0.4951.64 allowed a remote attacker who had convinced a user to engage in specific UI interaction to potentially exploit heap corruption via specific user interactions.","scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"143.0.7499.169-1~deb12u1","bookworm-security":"145.0.7632.159-1~deb12u1"},"fixed_version":"101.0.4951.64-1","urgency":"not yet assigned"},"bullseye":{"status":"resolved","repositories":{"bullseye":"120.0.6099.224-1~deb11u1","bullseye-security":"120.0.6099.224-1~deb11u1"},"fixed_version":"101.0.4951.64-1~deb11u1","urgency":"not yet assigned"},"forky":{"status":"resolved","repositories":{"forky":"145.0.7632.159-1"},"fixed_version":"101.0.4951.64-1","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"146.0.7680.71-1"},"fixed_version":"101.0.4951.64-1","urgency":"not yet assigned"},"trixie":{"status":"resolved","repositories":{"trixie":"143.0.7499.169-1~deb13u1","trixie-security":"145.0.7632.159-1~deb13u1"},"fixed_version":"101.0.4951.64-1","urgency":"not yet assigned"}}},"CVE-2022-1635":{"description":"Use after free in Permission Prompts in Google Chrome prior to 101.0.4951.64 allowed a remote attacker who convinced a user to engage in specific UI interactions to potentially exploit heap corruption via specific user interactions.","scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"143.0.7499.169-1~deb12u1","bookworm-security":"145.0.7632.159-1~deb12u1"},"fixed_version":"101.0.4951.64-1","urgency":"not yet assigned"},"bullseye":{"status":"resolved","repositories":{"bullseye":"120.0.6099.224-1~deb11u1","bullseye-security":"120.0.6099.224-1~deb11u1"},"fixed_version":"101.0.4951.64-1~deb11u1","urgency":"not yet assigned"},"forky":{"status":"resolved","repositories":{"forky":"145.0.7632.159-1"},"fixed_version":"101.0.4951.64-1","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"146.0.7680.71-1"},"fixed_version":"101.0.4951.64-1","urgency":"not yet assigned"},"trixie":{"status":"resolved","repositories":{"trixie":"143.0.7499.169-1~deb13u1","trixie-security":"145.0.7632.159-1~deb13u1"},"fixed_version":"101.0.4951.64-1","urgency":"not yet assigned"}}},"CVE-2022-1636":{"description":"Use after free in Performance APIs in Google Chrome prior to 101.0.4951.64 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page.","scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"143.0.7499.169-1~deb12u1","bookworm-security":"145.0.7632.159-1~deb12u1"},"fixed_version":"101.0.4951.64-1","urgency":"not yet assigned"},"bullseye":{"status":"resolved","repositories":{"bullseye":"120.0.6099.224-1~deb11u1","bullseye-security":"120.0.6099.224-1~deb11u1"},"fixed_version":"101.0.4951.64-1~deb11u1","urgency":"not yet assigned"},"forky":{"status":"resolved","repositories":{"forky":"145.0.7632.159-1"},"fixed_version":"101.0.4951.64-1","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"146.0.7680.71-1"},"fixed_version":"101.0.4951.64-1","urgency":"not yet assigned"},"trixie":{"status":"resolved","repositories":{"trixie":"143.0.7499.169-1~deb13u1","trixie-security":"145.0.7632.159-1~deb13u1"},"fixed_version":"101.0.4951.64-1","urgency":"not yet assigned"}}},"CVE-2022-1637":{"description":"Inappropriate implementation in Web Contents in Google Chrome prior to 101.0.4951.64 allowed a remote attacker to leak cross-origin data via a crafted HTML page.","scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"143.0.7499.169-1~deb12u1","bookworm-security":"145.0.7632.159-1~deb12u1"},"fixed_version":"101.0.4951.64-1","urgency":"not yet assigned"},"bullseye":{"status":"resolved","repositories":{"bullseye":"120.0.6099.224-1~deb11u1","bullseye-security":"120.0.6099.224-1~deb11u1"},"fixed_version":"101.0.4951.64-1~deb11u1","urgency":"not yet assigned"},"forky":{"status":"resolved","repositories":{"forky":"145.0.7632.159-1"},"fixed_version":"101.0.4951.64-1","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"146.0.7680.71-1"},"fixed_version":"101.0.4951.64-1","urgency":"not yet assigned"},"trixie":{"status":"resolved","repositories":{"trixie":"143.0.7499.169-1~deb13u1","trixie-security":"145.0.7632.159-1~deb13u1"},"fixed_version":"101.0.4951.64-1","urgency":"not yet assigned"}}},"CVE-2022-1638":{"description":"Heap buffer overflow in V8 Internationalization in Google Chrome prior to 101.0.4951.64 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page.","scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"143.0.7499.169-1~deb12u1","bookworm-security":"145.0.7632.159-1~deb12u1"},"fixed_version":"101.0.4951.64-1","urgency":"not yet assigned"},"bullseye":{"status":"resolved","repositories":{"bullseye":"120.0.6099.224-1~deb11u1","bullseye-security":"120.0.6099.224-1~deb11u1"},"fixed_version":"101.0.4951.64-1~deb11u1","urgency":"not yet assigned"},"forky":{"status":"resolved","repositories":{"forky":"145.0.7632.159-1"},"fixed_version":"101.0.4951.64-1","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"146.0.7680.71-1"},"fixed_version":"101.0.4951.64-1","urgency":"not yet assigned"},"trixie":{"status":"resolved","repositories":{"trixie":"143.0.7499.169-1~deb13u1","trixie-security":"145.0.7632.159-1~deb13u1"},"fixed_version":"101.0.4951.64-1","urgency":"not yet assigned"}}},"CVE-2022-1639":{"description":"Use after free in ANGLE in Google Chrome prior to 101.0.4951.64 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page.","scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"143.0.7499.169-1~deb12u1","bookworm-security":"145.0.7632.159-1~deb12u1"},"fixed_version":"101.0.4951.64-1","urgency":"not yet assigned"},"bullseye":{"status":"resolved","repositories":{"bullseye":"120.0.6099.224-1~deb11u1","bullseye-security":"120.0.6099.224-1~deb11u1"},"fixed_version":"101.0.4951.64-1~deb11u1","urgency":"not yet assigned"},"forky":{"status":"resolved","repositories":{"forky":"145.0.7632.159-1"},"fixed_version":"101.0.4951.64-1","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"146.0.7680.71-1"},"fixed_version":"101.0.4951.64-1","urgency":"not yet assigned"},"trixie":{"status":"resolved","repositories":{"trixie":"143.0.7499.169-1~deb13u1","trixie-security":"145.0.7632.159-1~deb13u1"},"fixed_version":"101.0.4951.64-1","urgency":"not yet assigned"}}},"CVE-2022-1640":{"description":"Use after free in Sharing in Google Chrome prior to 101.0.4951.64 allowed a remote attacker who convinced a user to engage in specific UI interactions to potentially exploit heap corruption via a crafted HTML page.","scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"143.0.7499.169-1~deb12u1","bookworm-security":"145.0.7632.159-1~deb12u1"},"fixed_version":"101.0.4951.64-1","urgency":"not yet assigned"},"bullseye":{"status":"resolved","repositories":{"bullseye":"120.0.6099.224-1~deb11u1","bullseye-security":"120.0.6099.224-1~deb11u1"},"fixed_version":"101.0.4951.64-1~deb11u1","urgency":"not yet assigned"},"forky":{"status":"resolved","repositories":{"forky":"145.0.7632.159-1"},"fixed_version":"101.0.4951.64-1","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"146.0.7680.71-1"},"fixed_version":"101.0.4951.64-1","urgency":"not yet assigned"},"trixie":{"status":"resolved","repositories":{"trixie":"143.0.7499.169-1~deb13u1","trixie-security":"145.0.7632.159-1~deb13u1"},"fixed_version":"101.0.4951.64-1","urgency":"not yet assigned"}}},"CVE-2022-1641":{"description":"Use after free in Web UI Diagnostics in Google Chrome on Chrome OS prior to 101.0.4951.64 allowed a remote attacker who convinced a user to engage in specific UI interactions to potentially exploit heap corruption via specific user interaction.","scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"143.0.7499.169-1~deb12u1","bookworm-security":"145.0.7632.159-1~deb12u1"},"fixed_version":"101.0.4951.64-1","urgency":"not yet assigned"},"bullseye":{"status":"resolved","repositories":{"bullseye":"120.0.6099.224-1~deb11u1","bullseye-security":"120.0.6099.224-1~deb11u1"},"fixed_version":"101.0.4951.64-1~deb11u1","urgency":"not yet assigned"},"forky":{"status":"resolved","repositories":{"forky":"145.0.7632.159-1"},"fixed_version":"101.0.4951.64-1","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"146.0.7680.71-1"},"fixed_version":"101.0.4951.64-1","urgency":"not yet assigned"},"trixie":{"status":"resolved","repositories":{"trixie":"143.0.7499.169-1~deb13u1","trixie-security":"145.0.7632.159-1~deb13u1"},"fixed_version":"101.0.4951.64-1","urgency":"not yet assigned"}}},"CVE-2022-1853":{"description":"Use after free in Indexed DB in Google Chrome prior to 102.0.5005.61 allowed a remote attacker to potentially perform a sandbox escape via a crafted HTML page.","scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"143.0.7499.169-1~deb12u1","bookworm-security":"145.0.7632.159-1~deb12u1"},"fixed_version":"102.0.5005.61-1","urgency":"not yet assigned"},"bullseye":{"status":"resolved","repositories":{"bullseye":"120.0.6099.224-1~deb11u1","bullseye-security":"120.0.6099.224-1~deb11u1"},"fixed_version":"102.0.5005.61-1~deb11u1","urgency":"not yet assigned"},"forky":{"status":"resolved","repositories":{"forky":"145.0.7632.159-1"},"fixed_version":"102.0.5005.61-1","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"146.0.7680.71-1"},"fixed_version":"102.0.5005.61-1","urgency":"not yet assigned"},"trixie":{"status":"resolved","repositories":{"trixie":"143.0.7499.169-1~deb13u1","trixie-security":"145.0.7632.159-1~deb13u1"},"fixed_version":"102.0.5005.61-1","urgency":"not yet assigned"}}},"CVE-2022-1854":{"description":"Use after free in ANGLE in Google Chrome prior to 102.0.5005.61 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page.","scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"143.0.7499.169-1~deb12u1","bookworm-security":"145.0.7632.159-1~deb12u1"},"fixed_version":"102.0.5005.61-1","urgency":"not yet assigned"},"bullseye":{"status":"resolved","repositories":{"bullseye":"120.0.6099.224-1~deb11u1","bullseye-security":"120.0.6099.224-1~deb11u1"},"fixed_version":"102.0.5005.61-1~deb11u1","urgency":"not yet assigned"},"forky":{"status":"resolved","repositories":{"forky":"145.0.7632.159-1"},"fixed_version":"102.0.5005.61-1","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"146.0.7680.71-1"},"fixed_version":"102.0.5005.61-1","urgency":"not yet assigned"},"trixie":{"status":"resolved","repositories":{"trixie":"143.0.7499.169-1~deb13u1","trixie-security":"145.0.7632.159-1~deb13u1"},"fixed_version":"102.0.5005.61-1","urgency":"not yet assigned"}}},"CVE-2022-1855":{"description":"Use after free in Messaging in Google Chrome prior to 102.0.5005.61 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page.","scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"143.0.7499.169-1~deb12u1","bookworm-security":"145.0.7632.159-1~deb12u1"},"fixed_version":"102.0.5005.61-1","urgency":"not yet assigned"},"bullseye":{"status":"resolved","repositories":{"bullseye":"120.0.6099.224-1~deb11u1","bullseye-security":"120.0.6099.224-1~deb11u1"},"fixed_version":"102.0.5005.61-1~deb11u1","urgency":"not yet assigned"},"forky":{"status":"resolved","repositories":{"forky":"145.0.7632.159-1"},"fixed_version":"102.0.5005.61-1","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"146.0.7680.71-1"},"fixed_version":"102.0.5005.61-1","urgency":"not yet assigned"},"trixie":{"status":"resolved","repositories":{"trixie":"143.0.7499.169-1~deb13u1","trixie-security":"145.0.7632.159-1~deb13u1"},"fixed_version":"102.0.5005.61-1","urgency":"not yet assigned"}}},"CVE-2022-1856":{"description":"Use after free in User Education in Google Chrome prior to 102.0.5005.61 allowed an attacker who convinced a user to install a malicious extension to potentially exploit heap corruption via a crafted Chrome Extension or specific user interaction.","scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"143.0.7499.169-1~deb12u1","bookworm-security":"145.0.7632.159-1~deb12u1"},"fixed_version":"102.0.5005.61-1","urgency":"not yet assigned"},"bullseye":{"status":"resolved","repositories":{"bullseye":"120.0.6099.224-1~deb11u1","bullseye-security":"120.0.6099.224-1~deb11u1"},"fixed_version":"102.0.5005.61-1~deb11u1","urgency":"not yet assigned"},"forky":{"status":"resolved","repositories":{"forky":"145.0.7632.159-1"},"fixed_version":"102.0.5005.61-1","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"146.0.7680.71-1"},"fixed_version":"102.0.5005.61-1","urgency":"not yet assigned"},"trixie":{"status":"resolved","repositories":{"trixie":"143.0.7499.169-1~deb13u1","trixie-security":"145.0.7632.159-1~deb13u1"},"fixed_version":"102.0.5005.61-1","urgency":"not yet assigned"}}},"CVE-2022-1857":{"description":"Insufficient policy enforcement in File System API in Google Chrome prior to 102.0.5005.61 allowed a remote attacker to bypass file system restrictions via a crafted HTML page.","scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"143.0.7499.169-1~deb12u1","bookworm-security":"145.0.7632.159-1~deb12u1"},"fixed_version":"102.0.5005.61-1","urgency":"not yet assigned"},"bullseye":{"status":"resolved","repositories":{"bullseye":"120.0.6099.224-1~deb11u1","bullseye-security":"120.0.6099.224-1~deb11u1"},"fixed_version":"102.0.5005.61-1~deb11u1","urgency":"not yet assigned"},"forky":{"status":"resolved","repositories":{"forky":"145.0.7632.159-1"},"fixed_version":"102.0.5005.61-1","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"146.0.7680.71-1"},"fixed_version":"102.0.5005.61-1","urgency":"not yet assigned"},"trixie":{"status":"resolved","repositories":{"trixie":"143.0.7499.169-1~deb13u1","trixie-security":"145.0.7632.159-1~deb13u1"},"fixed_version":"102.0.5005.61-1","urgency":"not yet assigned"}}},"CVE-2022-1858":{"description":"Out of bounds read in DevTools in Google Chrome prior to 102.0.5005.61 allowed a remote attacker to perform an out of bounds memory read via specific user interaction.","scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"143.0.7499.169-1~deb12u1","bookworm-security":"145.0.7632.159-1~deb12u1"},"fixed_version":"102.0.5005.61-1","urgency":"not yet assigned"},"bullseye":{"status":"resolved","repositories":{"bullseye":"120.0.6099.224-1~deb11u1","bullseye-security":"120.0.6099.224-1~deb11u1"},"fixed_version":"102.0.5005.61-1~deb11u1","urgency":"not yet assigned"},"forky":{"status":"resolved","repositories":{"forky":"145.0.7632.159-1"},"fixed_version":"102.0.5005.61-1","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"146.0.7680.71-1"},"fixed_version":"102.0.5005.61-1","urgency":"not yet assigned"},"trixie":{"status":"resolved","repositories":{"trixie":"143.0.7499.169-1~deb13u1","trixie-security":"145.0.7632.159-1~deb13u1"},"fixed_version":"102.0.5005.61-1","urgency":"not yet assigned"}}},"CVE-2022-1859":{"description":"Use after free in Performance Manager in Google Chrome prior to 102.0.5005.61 allowed a remote attacker who convinced a user to engage in specific user interaction to potentially exploit heap corruption via a crafted HTML page.","scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"143.0.7499.169-1~deb12u1","bookworm-security":"145.0.7632.159-1~deb12u1"},"fixed_version":"102.0.5005.61-1","urgency":"not yet assigned"},"bullseye":{"status":"resolved","repositories":{"bullseye":"120.0.6099.224-1~deb11u1","bullseye-security":"120.0.6099.224-1~deb11u1"},"fixed_version":"102.0.5005.61-1~deb11u1","urgency":"not yet assigned"},"forky":{"status":"resolved","repositories":{"forky":"145.0.7632.159-1"},"fixed_version":"102.0.5005.61-1","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"146.0.7680.71-1"},"fixed_version":"102.0.5005.61-1","urgency":"not yet assigned"},"trixie":{"status":"resolved","repositories":{"trixie":"143.0.7499.169-1~deb13u1","trixie-security":"145.0.7632.159-1~deb13u1"},"fixed_version":"102.0.5005.61-1","urgency":"not yet assigned"}}},"CVE-2022-1860":{"description":"Use after free in UI Foundations in Google Chrome on Chrome OS prior to 102.0.5005.61 allowed a remote attacker who convinced a user to engage in specific user interaction to potentially exploit heap corruption via specific user interactions.","scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"143.0.7499.169-1~deb12u1","bookworm-security":"145.0.7632.159-1~deb12u1"},"fixed_version":"102.0.5005.61-1","urgency":"not yet assigned"},"bullseye":{"status":"resolved","repositories":{"bullseye":"120.0.6099.224-1~deb11u1","bullseye-security":"120.0.6099.224-1~deb11u1"},"fixed_version":"102.0.5005.61-1~deb11u1","urgency":"not yet assigned"},"forky":{"status":"resolved","repositories":{"forky":"145.0.7632.159-1"},"fixed_version":"102.0.5005.61-1","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"146.0.7680.71-1"},"fixed_version":"102.0.5005.61-1","urgency":"not yet assigned"},"trixie":{"status":"resolved","repositories":{"trixie":"143.0.7499.169-1~deb13u1","trixie-security":"145.0.7632.159-1~deb13u1"},"fixed_version":"102.0.5005.61-1","urgency":"not yet assigned"}}},"CVE-2022-1861":{"description":"Use after free in Sharing in Google Chrome on Chrome OS prior to 102.0.5005.61 allowed a remote attacker who convinced a user to enage in specific user interactions to potentially exploit heap corruption via specific user interaction.","scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"143.0.7499.169-1~deb12u1","bookworm-security":"145.0.7632.159-1~deb12u1"},"fixed_version":"102.0.5005.61-1","urgency":"not yet assigned"},"bullseye":{"status":"resolved","repositories":{"bullseye":"120.0.6099.224-1~deb11u1","bullseye-security":"120.0.6099.224-1~deb11u1"},"fixed_version":"102.0.5005.61-1~deb11u1","urgency":"not yet assigned"},"forky":{"status":"resolved","repositories":{"forky":"145.0.7632.159-1"},"fixed_version":"102.0.5005.61-1","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"146.0.7680.71-1"},"fixed_version":"102.0.5005.61-1","urgency":"not yet assigned"},"trixie":{"status":"resolved","repositories":{"trixie":"143.0.7499.169-1~deb13u1","trixie-security":"145.0.7632.159-1~deb13u1"},"fixed_version":"102.0.5005.61-1","urgency":"not yet assigned"}}},"CVE-2022-1862":{"description":"Inappropriate implementation in Extensions in Google Chrome prior to 102.0.5005.61 allowed an attacker who convinced a user to install a malicious extension to bypass profile restrictions via a crafted HTML page.","scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"143.0.7499.169-1~deb12u1","bookworm-security":"145.0.7632.159-1~deb12u1"},"fixed_version":"102.0.5005.61-1","urgency":"not yet assigned"},"bullseye":{"status":"resolved","repositories":{"bullseye":"120.0.6099.224-1~deb11u1","bullseye-security":"120.0.6099.224-1~deb11u1"},"fixed_version":"102.0.5005.61-1~deb11u1","urgency":"not yet assigned"},"forky":{"status":"resolved","repositories":{"forky":"145.0.7632.159-1"},"fixed_version":"102.0.5005.61-1","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"146.0.7680.71-1"},"fixed_version":"102.0.5005.61-1","urgency":"not yet assigned"},"trixie":{"status":"resolved","repositories":{"trixie":"143.0.7499.169-1~deb13u1","trixie-security":"145.0.7632.159-1~deb13u1"},"fixed_version":"102.0.5005.61-1","urgency":"not yet assigned"}}},"CVE-2022-1863":{"description":"Use after free in Tab Groups in Google Chrome prior to 102.0.5005.61 allowed an attacker who convinced a user to install a malicious extension to potentially exploit heap corruption via a crafted Chrome Extension and specific user interaction.","scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"143.0.7499.169-1~deb12u1","bookworm-security":"145.0.7632.159-1~deb12u1"},"fixed_version":"102.0.5005.61-1","urgency":"not yet assigned"},"bullseye":{"status":"resolved","repositories":{"bullseye":"120.0.6099.224-1~deb11u1","bullseye-security":"120.0.6099.224-1~deb11u1"},"fixed_version":"102.0.5005.61-1~deb11u1","urgency":"not yet assigned"},"forky":{"status":"resolved","repositories":{"forky":"145.0.7632.159-1"},"fixed_version":"102.0.5005.61-1","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"146.0.7680.71-1"},"fixed_version":"102.0.5005.61-1","urgency":"not yet assigned"},"trixie":{"status":"resolved","repositories":{"trixie":"143.0.7499.169-1~deb13u1","trixie-security":"145.0.7632.159-1~deb13u1"},"fixed_version":"102.0.5005.61-1","urgency":"not yet assigned"}}},"CVE-2022-1864":{"description":"Use after free in WebApp Installs in Google Chrome prior to 102.0.5005.61 allowed an attacker who convinced a user to install a malicious extension to potentially exploit heap corruption via a crafted Chrome Extension and specific user interaction.","scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"143.0.7499.169-1~deb12u1","bookworm-security":"145.0.7632.159-1~deb12u1"},"fixed_version":"102.0.5005.61-1","urgency":"not yet assigned"},"bullseye":{"status":"resolved","repositories":{"bullseye":"120.0.6099.224-1~deb11u1","bullseye-security":"120.0.6099.224-1~deb11u1"},"fixed_version":"102.0.5005.61-1~deb11u1","urgency":"not yet assigned"},"forky":{"status":"resolved","repositories":{"forky":"145.0.7632.159-1"},"fixed_version":"102.0.5005.61-1","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"146.0.7680.71-1"},"fixed_version":"102.0.5005.61-1","urgency":"not yet assigned"},"trixie":{"status":"resolved","repositories":{"trixie":"143.0.7499.169-1~deb13u1","trixie-security":"145.0.7632.159-1~deb13u1"},"fixed_version":"102.0.5005.61-1","urgency":"not yet assigned"}}},"CVE-2022-1865":{"description":"Use after free in Bookmarks in Google Chrome prior to 102.0.5005.61 allowed an attacker who convinced a user to install a malicious extension to potentially exploit heap corruption via a crafted Chrome Extension and specific user interaction.","scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"143.0.7499.169-1~deb12u1","bookworm-security":"145.0.7632.159-1~deb12u1"},"fixed_version":"102.0.5005.61-1","urgency":"not yet assigned"},"bullseye":{"status":"resolved","repositories":{"bullseye":"120.0.6099.224-1~deb11u1","bullseye-security":"120.0.6099.224-1~deb11u1"},"fixed_version":"102.0.5005.61-1~deb11u1","urgency":"not yet assigned"},"forky":{"status":"resolved","repositories":{"forky":"145.0.7632.159-1"},"fixed_version":"102.0.5005.61-1","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"146.0.7680.71-1"},"fixed_version":"102.0.5005.61-1","urgency":"not yet assigned"},"trixie":{"status":"resolved","repositories":{"trixie":"143.0.7499.169-1~deb13u1","trixie-security":"145.0.7632.159-1~deb13u1"},"fixed_version":"102.0.5005.61-1","urgency":"not yet assigned"}}},"CVE-2022-1866":{"description":"Use after free in Tablet Mode in Google Chrome on Chrome OS prior to 102.0.5005.61 allowed a remote attacker who convinced a user to engage in specific user interactions to potentially exploit heap corruption via specific user interactions.","scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"143.0.7499.169-1~deb12u1","bookworm-security":"145.0.7632.159-1~deb12u1"},"fixed_version":"102.0.5005.61-1","urgency":"not yet assigned"},"bullseye":{"status":"resolved","repositories":{"bullseye":"120.0.6099.224-1~deb11u1","bullseye-security":"120.0.6099.224-1~deb11u1"},"fixed_version":"102.0.5005.61-1~deb11u1","urgency":"not yet assigned"},"forky":{"status":"resolved","repositories":{"forky":"145.0.7632.159-1"},"fixed_version":"102.0.5005.61-1","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"146.0.7680.71-1"},"fixed_version":"102.0.5005.61-1","urgency":"not yet assigned"},"trixie":{"status":"resolved","repositories":{"trixie":"143.0.7499.169-1~deb13u1","trixie-security":"145.0.7632.159-1~deb13u1"},"fixed_version":"102.0.5005.61-1","urgency":"not yet assigned"}}},"CVE-2022-1867":{"description":"Insufficient validation of untrusted input in Data Transfer in Google Chrome prior to 102.0.5005.61 allowed a remote attacker to bypass same origin policy via a crafted clipboard content.","scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"143.0.7499.169-1~deb12u1","bookworm-security":"145.0.7632.159-1~deb12u1"},"fixed_version":"102.0.5005.61-1","urgency":"not yet assigned"},"bullseye":{"status":"resolved","repositories":{"bullseye":"120.0.6099.224-1~deb11u1","bullseye-security":"120.0.6099.224-1~deb11u1"},"fixed_version":"102.0.5005.61-1~deb11u1","urgency":"not yet assigned"},"forky":{"status":"resolved","repositories":{"forky":"145.0.7632.159-1"},"fixed_version":"102.0.5005.61-1","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"146.0.7680.71-1"},"fixed_version":"102.0.5005.61-1","urgency":"not yet assigned"},"trixie":{"status":"resolved","repositories":{"trixie":"143.0.7499.169-1~deb13u1","trixie-security":"145.0.7632.159-1~deb13u1"},"fixed_version":"102.0.5005.61-1","urgency":"not yet assigned"}}},"CVE-2022-1868":{"description":"Inappropriate implementation in Extensions API in Google Chrome prior to 102.0.5005.61 allowed an attacker who convinced a user to install a malicious extension to bypass navigation restrictions via a crafted HTML page.","scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"143.0.7499.169-1~deb12u1","bookworm-security":"145.0.7632.159-1~deb12u1"},"fixed_version":"102.0.5005.61-1","urgency":"not yet assigned"},"bullseye":{"status":"resolved","repositories":{"bullseye":"120.0.6099.224-1~deb11u1","bullseye-security":"120.0.6099.224-1~deb11u1"},"fixed_version":"102.0.5005.61-1~deb11u1","urgency":"not yet assigned"},"forky":{"status":"resolved","repositories":{"forky":"145.0.7632.159-1"},"fixed_version":"102.0.5005.61-1","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"146.0.7680.71-1"},"fixed_version":"102.0.5005.61-1","urgency":"not yet assigned"},"trixie":{"status":"resolved","repositories":{"trixie":"143.0.7499.169-1~deb13u1","trixie-security":"145.0.7632.159-1~deb13u1"},"fixed_version":"102.0.5005.61-1","urgency":"not yet assigned"}}},"CVE-2022-1869":{"description":"Type Confusion in V8 in Google Chrome prior to 102.0.5005.61 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page.","scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"143.0.7499.169-1~deb12u1","bookworm-security":"145.0.7632.159-1~deb12u1"},"fixed_version":"102.0.5005.61-1","urgency":"not yet assigned"},"bullseye":{"status":"resolved","repositories":{"bullseye":"120.0.6099.224-1~deb11u1","bullseye-security":"120.0.6099.224-1~deb11u1"},"fixed_version":"102.0.5005.61-1~deb11u1","urgency":"not yet assigned"},"forky":{"status":"resolved","repositories":{"forky":"145.0.7632.159-1"},"fixed_version":"102.0.5005.61-1","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"146.0.7680.71-1"},"fixed_version":"102.0.5005.61-1","urgency":"not yet assigned"},"trixie":{"status":"resolved","repositories":{"trixie":"143.0.7499.169-1~deb13u1","trixie-security":"145.0.7632.159-1~deb13u1"},"fixed_version":"102.0.5005.61-1","urgency":"not yet assigned"}}},"CVE-2022-1870":{"description":"Use after free in App Service in Google Chrome prior to 102.0.5005.61 allowed an attacker who convinced a user to install a malicious extension to potentially exploit heap corruption via a crafted Chrome Extension.","scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"143.0.7499.169-1~deb12u1","bookworm-security":"145.0.7632.159-1~deb12u1"},"fixed_version":"102.0.5005.61-1","urgency":"not yet assigned"},"bullseye":{"status":"resolved","repositories":{"bullseye":"120.0.6099.224-1~deb11u1","bullseye-security":"120.0.6099.224-1~deb11u1"},"fixed_version":"102.0.5005.61-1~deb11u1","urgency":"not yet assigned"},"forky":{"status":"resolved","repositories":{"forky":"145.0.7632.159-1"},"fixed_version":"102.0.5005.61-1","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"146.0.7680.71-1"},"fixed_version":"102.0.5005.61-1","urgency":"not yet assigned"},"trixie":{"status":"resolved","repositories":{"trixie":"143.0.7499.169-1~deb13u1","trixie-security":"145.0.7632.159-1~deb13u1"},"fixed_version":"102.0.5005.61-1","urgency":"not yet assigned"}}},"CVE-2022-1871":{"description":"Insufficient policy enforcement in File System API in Google Chrome prior to 102.0.5005.61 allowed an attacker who convinced a user to install a malicious extension to bypass file system policy via a crafted HTML page.","scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"143.0.7499.169-1~deb12u1","bookworm-security":"145.0.7632.159-1~deb12u1"},"fixed_version":"102.0.5005.61-1","urgency":"not yet assigned"},"bullseye":{"status":"resolved","repositories":{"bullseye":"120.0.6099.224-1~deb11u1","bullseye-security":"120.0.6099.224-1~deb11u1"},"fixed_version":"102.0.5005.61-1~deb11u1","urgency":"not yet assigned"},"forky":{"status":"resolved","repositories":{"forky":"145.0.7632.159-1"},"fixed_version":"102.0.5005.61-1","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"146.0.7680.71-1"},"fixed_version":"102.0.5005.61-1","urgency":"not yet assigned"},"trixie":{"status":"resolved","repositories":{"trixie":"143.0.7499.169-1~deb13u1","trixie-security":"145.0.7632.159-1~deb13u1"},"fixed_version":"102.0.5005.61-1","urgency":"not yet assigned"}}},"CVE-2022-1872":{"description":"Insufficient policy enforcement in Extensions API in Google Chrome prior to 102.0.5005.61 allowed an attacker who convinced a user to install a malicious extension to bypass downloads policy via a crafted HTML page.","scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"143.0.7499.169-1~deb12u1","bookworm-security":"145.0.7632.159-1~deb12u1"},"fixed_version":"102.0.5005.61-1","urgency":"not yet assigned"},"bullseye":{"status":"resolved","repositories":{"bullseye":"120.0.6099.224-1~deb11u1","bullseye-security":"120.0.6099.224-1~deb11u1"},"fixed_version":"102.0.5005.61-1~deb11u1","urgency":"not yet assigned"},"forky":{"status":"resolved","repositories":{"forky":"145.0.7632.159-1"},"fixed_version":"102.0.5005.61-1","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"146.0.7680.71-1"},"fixed_version":"102.0.5005.61-1","urgency":"not yet assigned"},"trixie":{"status":"resolved","repositories":{"trixie":"143.0.7499.169-1~deb13u1","trixie-security":"145.0.7632.159-1~deb13u1"},"fixed_version":"102.0.5005.61-1","urgency":"not yet assigned"}}},"CVE-2022-1873":{"description":"Insufficient policy enforcement in COOP in Google Chrome prior to 102.0.5005.61 allowed a remote attacker to leak cross-origin data via a crafted HTML page.","scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"143.0.7499.169-1~deb12u1","bookworm-security":"145.0.7632.159-1~deb12u1"},"fixed_version":"102.0.5005.61-1","urgency":"not yet assigned"},"bullseye":{"status":"resolved","repositories":{"bullseye":"120.0.6099.224-1~deb11u1","bullseye-security":"120.0.6099.224-1~deb11u1"},"fixed_version":"102.0.5005.61-1~deb11u1","urgency":"not yet assigned"},"forky":{"status":"resolved","repositories":{"forky":"145.0.7632.159-1"},"fixed_version":"102.0.5005.61-1","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"146.0.7680.71-1"},"fixed_version":"102.0.5005.61-1","urgency":"not yet assigned"},"trixie":{"status":"resolved","repositories":{"trixie":"143.0.7499.169-1~deb13u1","trixie-security":"145.0.7632.159-1~deb13u1"},"fixed_version":"102.0.5005.61-1","urgency":"not yet assigned"}}},"CVE-2022-1874":{"description":"Insufficient policy enforcement in Safe Browsing in Google Chrome on Mac prior to 102.0.5005.61 allowed a remote attacker to bypass downloads protection policy via a crafted HTML page.","scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"143.0.7499.169-1~deb12u1","bookworm-security":"145.0.7632.159-1~deb12u1"},"fixed_version":"102.0.5005.61-1","urgency":"not yet assigned"},"bullseye":{"status":"resolved","repositories":{"bullseye":"120.0.6099.224-1~deb11u1","bullseye-security":"120.0.6099.224-1~deb11u1"},"fixed_version":"102.0.5005.61-1~deb11u1","urgency":"not yet assigned"},"forky":{"status":"resolved","repositories":{"forky":"145.0.7632.159-1"},"fixed_version":"102.0.5005.61-1","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"146.0.7680.71-1"},"fixed_version":"102.0.5005.61-1","urgency":"not yet assigned"},"trixie":{"status":"resolved","repositories":{"trixie":"143.0.7499.169-1~deb13u1","trixie-security":"145.0.7632.159-1~deb13u1"},"fixed_version":"102.0.5005.61-1","urgency":"not yet assigned"}}},"CVE-2022-1875":{"description":"Inappropriate implementation in PDF in Google Chrome prior to 102.0.5005.61 allowed a remote attacker to leak cross-origin data via a crafted HTML page.","scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"143.0.7499.169-1~deb12u1","bookworm-security":"145.0.7632.159-1~deb12u1"},"fixed_version":"102.0.5005.61-1","urgency":"not yet assigned"},"bullseye":{"status":"resolved","repositories":{"bullseye":"120.0.6099.224-1~deb11u1","bullseye-security":"120.0.6099.224-1~deb11u1"},"fixed_version":"102.0.5005.61-1~deb11u1","urgency":"not yet assigned"},"forky":{"status":"resolved","repositories":{"forky":"145.0.7632.159-1"},"fixed_version":"102.0.5005.61-1","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"146.0.7680.71-1"},"fixed_version":"102.0.5005.61-1","urgency":"not yet assigned"},"trixie":{"status":"resolved","repositories":{"trixie":"143.0.7499.169-1~deb13u1","trixie-security":"145.0.7632.159-1~deb13u1"},"fixed_version":"102.0.5005.61-1","urgency":"not yet assigned"}}},"CVE-2022-1876":{"description":"Heap buffer overflow in DevTools in Google Chrome prior to 102.0.5005.61 allowed an attacker who convinced a user to install a malicious extension to potentially exploit heap corruption via a crafted HTML page.","scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"143.0.7499.169-1~deb12u1","bookworm-security":"145.0.7632.159-1~deb12u1"},"fixed_version":"102.0.5005.61-1","urgency":"not yet assigned"},"bullseye":{"status":"resolved","repositories":{"bullseye":"120.0.6099.224-1~deb11u1","bullseye-security":"120.0.6099.224-1~deb11u1"},"fixed_version":"102.0.5005.61-1~deb11u1","urgency":"not yet assigned"},"forky":{"status":"resolved","repositories":{"forky":"145.0.7632.159-1"},"fixed_version":"102.0.5005.61-1","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"146.0.7680.71-1"},"fixed_version":"102.0.5005.61-1","urgency":"not yet assigned"},"trixie":{"status":"resolved","repositories":{"trixie":"143.0.7499.169-1~deb13u1","trixie-security":"145.0.7632.159-1~deb13u1"},"fixed_version":"102.0.5005.61-1","urgency":"not yet assigned"}}},"CVE-2022-2007":{"description":"Use after free in WebGPU in Google Chrome prior to 102.0.5005.115 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page.","scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"143.0.7499.169-1~deb12u1","bookworm-security":"145.0.7632.159-1~deb12u1"},"fixed_version":"102.0.5005.115-1","urgency":"not yet assigned"},"bullseye":{"status":"resolved","repositories":{"bullseye":"120.0.6099.224-1~deb11u1","bullseye-security":"120.0.6099.224-1~deb11u1"},"fixed_version":"102.0.5005.115-1~deb11u1","urgency":"not yet assigned"},"forky":{"status":"resolved","repositories":{"forky":"145.0.7632.159-1"},"fixed_version":"102.0.5005.115-1","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"146.0.7680.71-1"},"fixed_version":"102.0.5005.115-1","urgency":"not yet assigned"},"trixie":{"status":"resolved","repositories":{"trixie":"143.0.7499.169-1~deb13u1","trixie-security":"145.0.7632.159-1~deb13u1"},"fixed_version":"102.0.5005.115-1","urgency":"not yet assigned"}}},"CVE-2022-2008":{"description":"Double free in WebGL in Google Chrome prior to 102.0.5005.115 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page.","scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"143.0.7499.169-1~deb12u1","bookworm-security":"145.0.7632.159-1~deb12u1"},"fixed_version":"102.0.5005.115-1","urgency":"not yet assigned"},"bullseye":{"status":"resolved","repositories":{"bullseye":"120.0.6099.224-1~deb11u1","bullseye-security":"120.0.6099.224-1~deb11u1"},"fixed_version":"102.0.5005.115-1~deb11u1","urgency":"not yet assigned"},"forky":{"status":"resolved","repositories":{"forky":"145.0.7632.159-1"},"fixed_version":"102.0.5005.115-1","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"146.0.7680.71-1"},"fixed_version":"102.0.5005.115-1","urgency":"not yet assigned"},"trixie":{"status":"resolved","repositories":{"trixie":"143.0.7499.169-1~deb13u1","trixie-security":"145.0.7632.159-1~deb13u1"},"fixed_version":"102.0.5005.115-1","urgency":"not yet assigned"}}},"CVE-2022-2010":{"description":"Out of bounds read in compositing in Google Chrome prior to 102.0.5005.115 allowed a remote attacker who had compromised the renderer process to potentially perform a sandbox escape via a crafted HTML page.","scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"143.0.7499.169-1~deb12u1","bookworm-security":"145.0.7632.159-1~deb12u1"},"fixed_version":"102.0.5005.115-1","urgency":"not yet assigned"},"bullseye":{"status":"resolved","repositories":{"bullseye":"120.0.6099.224-1~deb11u1","bullseye-security":"120.0.6099.224-1~deb11u1"},"fixed_version":"102.0.5005.115-1~deb11u1","urgency":"not yet assigned"},"forky":{"status":"resolved","repositories":{"forky":"145.0.7632.159-1"},"fixed_version":"102.0.5005.115-1","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"146.0.7680.71-1"},"fixed_version":"102.0.5005.115-1","urgency":"not yet assigned"},"trixie":{"status":"resolved","repositories":{"trixie":"143.0.7499.169-1~deb13u1","trixie-security":"145.0.7632.159-1~deb13u1"},"fixed_version":"102.0.5005.115-1","urgency":"not yet assigned"}}},"CVE-2022-2011":{"description":"Use after free in ANGLE in Google Chrome prior to 102.0.5005.115 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page.","scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"143.0.7499.169-1~deb12u1","bookworm-security":"145.0.7632.159-1~deb12u1"},"fixed_version":"102.0.5005.115-1","urgency":"not yet assigned"},"bullseye":{"status":"resolved","repositories":{"bullseye":"120.0.6099.224-1~deb11u1","bullseye-security":"120.0.6099.224-1~deb11u1"},"fixed_version":"102.0.5005.115-1~deb11u1","urgency":"not yet assigned"},"forky":{"status":"resolved","repositories":{"forky":"145.0.7632.159-1"},"fixed_version":"102.0.5005.115-1","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"146.0.7680.71-1"},"fixed_version":"102.0.5005.115-1","urgency":"not yet assigned"},"trixie":{"status":"resolved","repositories":{"trixie":"143.0.7499.169-1~deb13u1","trixie-security":"145.0.7632.159-1~deb13u1"},"fixed_version":"102.0.5005.115-1","urgency":"not yet assigned"}}},"CVE-2022-2156":{"description":"Use after free in Core in Google Chrome prior to 103.0.5060.53 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page.","scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"143.0.7499.169-1~deb12u1","bookworm-security":"145.0.7632.159-1~deb12u1"},"fixed_version":"103.0.5060.53-1","urgency":"not yet assigned"},"bullseye":{"status":"resolved","repositories":{"bullseye":"120.0.6099.224-1~deb11u1","bullseye-security":"120.0.6099.224-1~deb11u1"},"fixed_version":"103.0.5060.53-1~deb11u1","urgency":"not yet assigned"},"forky":{"status":"resolved","repositories":{"forky":"145.0.7632.159-1"},"fixed_version":"103.0.5060.53-1","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"146.0.7680.71-1"},"fixed_version":"103.0.5060.53-1","urgency":"not yet assigned"},"trixie":{"status":"resolved","repositories":{"trixie":"143.0.7499.169-1~deb13u1","trixie-security":"145.0.7632.159-1~deb13u1"},"fixed_version":"103.0.5060.53-1","urgency":"not yet assigned"}}},"CVE-2022-2157":{"description":"Use after free in Interest groups in Google Chrome prior to 103.0.5060.53 allowed a remote attacker who had compromised the renderer process to potentially exploit heap corruption via a crafted HTML page.","scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"143.0.7499.169-1~deb12u1","bookworm-security":"145.0.7632.159-1~deb12u1"},"fixed_version":"103.0.5060.53-1","urgency":"not yet assigned"},"bullseye":{"status":"resolved","repositories":{"bullseye":"120.0.6099.224-1~deb11u1","bullseye-security":"120.0.6099.224-1~deb11u1"},"fixed_version":"103.0.5060.53-1~deb11u1","urgency":"not yet assigned"},"forky":{"status":"resolved","repositories":{"forky":"145.0.7632.159-1"},"fixed_version":"103.0.5060.53-1","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"146.0.7680.71-1"},"fixed_version":"103.0.5060.53-1","urgency":"not yet assigned"},"trixie":{"status":"resolved","repositories":{"trixie":"143.0.7499.169-1~deb13u1","trixie-security":"145.0.7632.159-1~deb13u1"},"fixed_version":"103.0.5060.53-1","urgency":"not yet assigned"}}},"CVE-2022-2158":{"description":"Type confusion in V8 in Google Chrome prior to 103.0.5060.53 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page.","scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"143.0.7499.169-1~deb12u1","bookworm-security":"145.0.7632.159-1~deb12u1"},"fixed_version":"103.0.5060.53-1","urgency":"not yet assigned"},"bullseye":{"status":"resolved","repositories":{"bullseye":"120.0.6099.224-1~deb11u1","bullseye-security":"120.0.6099.224-1~deb11u1"},"fixed_version":"103.0.5060.53-1~deb11u1","urgency":"not yet assigned"},"forky":{"status":"resolved","repositories":{"forky":"145.0.7632.159-1"},"fixed_version":"103.0.5060.53-1","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"146.0.7680.71-1"},"fixed_version":"103.0.5060.53-1","urgency":"not yet assigned"},"trixie":{"status":"resolved","repositories":{"trixie":"143.0.7499.169-1~deb13u1","trixie-security":"145.0.7632.159-1~deb13u1"},"fixed_version":"103.0.5060.53-1","urgency":"not yet assigned"}}},"CVE-2022-2160":{"description":"Insufficient policy enforcement in DevTools in Google Chrome on Windows prior to 103.0.5060.53 allowed an attacker who convinced a user to install a malicious extension to obtain potentially sensitive information from a user's local files via a crafted HTML page.","scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"143.0.7499.169-1~deb12u1","bookworm-security":"145.0.7632.159-1~deb12u1"},"fixed_version":"103.0.5060.53-1","urgency":"not yet assigned"},"bullseye":{"status":"resolved","repositories":{"bullseye":"120.0.6099.224-1~deb11u1","bullseye-security":"120.0.6099.224-1~deb11u1"},"fixed_version":"103.0.5060.53-1~deb11u1","urgency":"not yet assigned"},"forky":{"status":"resolved","repositories":{"forky":"145.0.7632.159-1"},"fixed_version":"103.0.5060.53-1","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"146.0.7680.71-1"},"fixed_version":"103.0.5060.53-1","urgency":"not yet assigned"},"trixie":{"status":"resolved","repositories":{"trixie":"143.0.7499.169-1~deb13u1","trixie-security":"145.0.7632.159-1~deb13u1"},"fixed_version":"103.0.5060.53-1","urgency":"not yet assigned"}}},"CVE-2022-2161":{"description":"Use after free in WebApp Provider in Google Chrome prior to 103.0.5060.53 allowed a remote attacker who convinced the user to engage in specific user interactions to potentially exploit heap corruption via specific UI interactions.","scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"143.0.7499.169-1~deb12u1","bookworm-security":"145.0.7632.159-1~deb12u1"},"fixed_version":"103.0.5060.53-1","urgency":"not yet assigned"},"bullseye":{"status":"resolved","repositories":{"bullseye":"120.0.6099.224-1~deb11u1","bullseye-security":"120.0.6099.224-1~deb11u1"},"fixed_version":"103.0.5060.53-1~deb11u1","urgency":"not yet assigned"},"forky":{"status":"resolved","repositories":{"forky":"145.0.7632.159-1"},"fixed_version":"103.0.5060.53-1","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"146.0.7680.71-1"},"fixed_version":"103.0.5060.53-1","urgency":"not yet assigned"},"trixie":{"status":"resolved","repositories":{"trixie":"143.0.7499.169-1~deb13u1","trixie-security":"145.0.7632.159-1~deb13u1"},"fixed_version":"103.0.5060.53-1","urgency":"not yet assigned"}}},"CVE-2022-2162":{"description":"Insufficient policy enforcement in File System API in Google Chrome on Windows prior to 103.0.5060.53 allowed a remote attacker to bypass file system access via a crafted HTML page.","scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"143.0.7499.169-1~deb12u1","bookworm-security":"145.0.7632.159-1~deb12u1"},"fixed_version":"103.0.5060.53-1","urgency":"not yet assigned"},"bullseye":{"status":"resolved","repositories":{"bullseye":"120.0.6099.224-1~deb11u1","bullseye-security":"120.0.6099.224-1~deb11u1"},"fixed_version":"103.0.5060.53-1~deb11u1","urgency":"not yet assigned"},"forky":{"status":"resolved","repositories":{"forky":"145.0.7632.159-1"},"fixed_version":"103.0.5060.53-1","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"146.0.7680.71-1"},"fixed_version":"103.0.5060.53-1","urgency":"not yet assigned"},"trixie":{"status":"resolved","repositories":{"trixie":"143.0.7499.169-1~deb13u1","trixie-security":"145.0.7632.159-1~deb13u1"},"fixed_version":"103.0.5060.53-1","urgency":"not yet assigned"}}},"CVE-2022-2163":{"description":"Use after free in Cast UI and Toolbar in Google Chrome prior to 103.0.5060.134 allowed an attacker who convinced a user to install a malicious extension to potentially exploit heap corruption via UI interaction.","scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"143.0.7499.169-1~deb12u1","bookworm-security":"145.0.7632.159-1~deb12u1"},"fixed_version":"103.0.5060.53-1","urgency":"not yet assigned"},"bullseye":{"status":"resolved","repositories":{"bullseye":"120.0.6099.224-1~deb11u1","bullseye-security":"120.0.6099.224-1~deb11u1"},"fixed_version":"103.0.5060.134-1~deb11u1","urgency":"not yet assigned"},"forky":{"status":"resolved","repositories":{"forky":"145.0.7632.159-1"},"fixed_version":"103.0.5060.53-1","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"146.0.7680.71-1"},"fixed_version":"103.0.5060.53-1","urgency":"not yet assigned"},"trixie":{"status":"resolved","repositories":{"trixie":"143.0.7499.169-1~deb13u1","trixie-security":"145.0.7632.159-1~deb13u1"},"fixed_version":"103.0.5060.53-1","urgency":"not yet assigned"}}},"CVE-2022-2164":{"description":"Inappropriate implementation in Extensions API in Google Chrome prior to 103.0.5060.53 allowed an attacker who convinced a user to install a malicious extension to bypass discretionary access control via a crafted HTML page.","scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"143.0.7499.169-1~deb12u1","bookworm-security":"145.0.7632.159-1~deb12u1"},"fixed_version":"103.0.5060.53-1","urgency":"not yet assigned"},"bullseye":{"status":"resolved","repositories":{"bullseye":"120.0.6099.224-1~deb11u1","bullseye-security":"120.0.6099.224-1~deb11u1"},"fixed_version":"103.0.5060.53-1~deb11u1","urgency":"not yet assigned"},"forky":{"status":"resolved","repositories":{"forky":"145.0.7632.159-1"},"fixed_version":"103.0.5060.53-1","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"146.0.7680.71-1"},"fixed_version":"103.0.5060.53-1","urgency":"not yet assigned"},"trixie":{"status":"resolved","repositories":{"trixie":"143.0.7499.169-1~deb13u1","trixie-security":"145.0.7632.159-1~deb13u1"},"fixed_version":"103.0.5060.53-1","urgency":"not yet assigned"}}},"CVE-2022-2165":{"description":"Insufficient data validation in URL formatting in Google Chrome prior to 103.0.5060.53 allowed a remote attacker to perform domain spoofing via IDN homographs via a crafted domain name.","scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"143.0.7499.169-1~deb12u1","bookworm-security":"145.0.7632.159-1~deb12u1"},"fixed_version":"103.0.5060.53-1","urgency":"not yet assigned"},"bullseye":{"status":"resolved","repositories":{"bullseye":"120.0.6099.224-1~deb11u1","bullseye-security":"120.0.6099.224-1~deb11u1"},"fixed_version":"103.0.5060.53-1~deb11u1","urgency":"not yet assigned"},"forky":{"status":"resolved","repositories":{"forky":"145.0.7632.159-1"},"fixed_version":"103.0.5060.53-1","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"146.0.7680.71-1"},"fixed_version":"103.0.5060.53-1","urgency":"not yet assigned"},"trixie":{"status":"resolved","repositories":{"trixie":"143.0.7499.169-1~deb13u1","trixie-security":"145.0.7632.159-1~deb13u1"},"fixed_version":"103.0.5060.53-1","urgency":"not yet assigned"}}},"CVE-2022-2294":{"description":"Heap buffer overflow in WebRTC in Google Chrome prior to 103.0.5060.114 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page.","scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"143.0.7499.169-1~deb12u1","bookworm-security":"145.0.7632.159-1~deb12u1"},"fixed_version":"103.0.5060.114-1","urgency":"not yet assigned"},"bullseye":{"status":"resolved","repositories":{"bullseye":"120.0.6099.224-1~deb11u1","bullseye-security":"120.0.6099.224-1~deb11u1"},"fixed_version":"103.0.5060.114-1~deb11u1","urgency":"not yet assigned"},"forky":{"status":"resolved","repositories":{"forky":"145.0.7632.159-1"},"fixed_version":"103.0.5060.114-1","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"146.0.7680.71-1"},"fixed_version":"103.0.5060.114-1","urgency":"not yet assigned"},"trixie":{"status":"resolved","repositories":{"trixie":"143.0.7499.169-1~deb13u1","trixie-security":"145.0.7632.159-1~deb13u1"},"fixed_version":"103.0.5060.114-1","urgency":"not yet assigned"}}},"CVE-2022-2295":{"description":"Type confusion in V8 in Google Chrome prior to 103.0.5060.114 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page.","scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"143.0.7499.169-1~deb12u1","bookworm-security":"145.0.7632.159-1~deb12u1"},"fixed_version":"103.0.5060.114-1","urgency":"not yet assigned"},"bullseye":{"status":"resolved","repositories":{"bullseye":"120.0.6099.224-1~deb11u1","bullseye-security":"120.0.6099.224-1~deb11u1"},"fixed_version":"103.0.5060.114-1~deb11u1","urgency":"not yet assigned"},"forky":{"status":"resolved","repositories":{"forky":"145.0.7632.159-1"},"fixed_version":"103.0.5060.114-1","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"146.0.7680.71-1"},"fixed_version":"103.0.5060.114-1","urgency":"not yet assigned"},"trixie":{"status":"resolved","repositories":{"trixie":"143.0.7499.169-1~deb13u1","trixie-security":"145.0.7632.159-1~deb13u1"},"fixed_version":"103.0.5060.114-1","urgency":"not yet assigned"}}},"CVE-2022-2296":{"description":"Use after free in Chrome OS Shell in Google Chrome on Chrome OS prior to 103.0.5060.114 allowed a remote attacker who convinced a user to engage in specific user interactions to potentially exploit heap corruption via direct UI interactions.","scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"143.0.7499.169-1~deb12u1","bookworm-security":"145.0.7632.159-1~deb12u1"},"fixed_version":"103.0.5060.114-1","urgency":"not yet assigned"},"bullseye":{"status":"resolved","repositories":{"bullseye":"120.0.6099.224-1~deb11u1","bullseye-security":"120.0.6099.224-1~deb11u1"},"fixed_version":"103.0.5060.114-1~deb11u1","urgency":"not yet assigned"},"forky":{"status":"resolved","repositories":{"forky":"145.0.7632.159-1"},"fixed_version":"103.0.5060.114-1","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"146.0.7680.71-1"},"fixed_version":"103.0.5060.114-1","urgency":"not yet assigned"},"trixie":{"status":"resolved","repositories":{"trixie":"143.0.7499.169-1~deb13u1","trixie-security":"145.0.7632.159-1~deb13u1"},"fixed_version":"103.0.5060.114-1","urgency":"not yet assigned"}}},"CVE-2022-2399":{"description":"Use after free in WebGPU in Google Chrome prior to 100.0.4896.88 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page.","scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"143.0.7499.169-1~deb12u1","bookworm-security":"145.0.7632.159-1~deb12u1"},"fixed_version":"100.0.4896.88-1","urgency":"not yet assigned"},"bullseye":{"status":"resolved","repositories":{"bullseye":"120.0.6099.224-1~deb11u1","bullseye-security":"120.0.6099.224-1~deb11u1"},"fixed_version":"100.0.4896.88-1~deb11u1","urgency":"not yet assigned"},"forky":{"status":"resolved","repositories":{"forky":"145.0.7632.159-1"},"fixed_version":"100.0.4896.88-1","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"146.0.7680.71-1"},"fixed_version":"100.0.4896.88-1","urgency":"not yet assigned"},"trixie":{"status":"resolved","repositories":{"trixie":"143.0.7499.169-1~deb13u1","trixie-security":"145.0.7632.159-1~deb13u1"},"fixed_version":"100.0.4896.88-1","urgency":"not yet assigned"}}},"CVE-2022-2415":{"description":"Heap buffer overflow in WebGL in Google Chrome prior to 103.0.5060.53 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page.","scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"143.0.7499.169-1~deb12u1","bookworm-security":"145.0.7632.159-1~deb12u1"},"fixed_version":"103.0.5060.53-1","urgency":"not yet assigned"},"bullseye":{"status":"resolved","repositories":{"bullseye":"120.0.6099.224-1~deb11u1","bullseye-security":"120.0.6099.224-1~deb11u1"},"fixed_version":"103.0.5060.53-1~deb11u1","urgency":"not yet assigned"},"forky":{"status":"resolved","repositories":{"forky":"145.0.7632.159-1"},"fixed_version":"103.0.5060.53-1","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"146.0.7680.71-1"},"fixed_version":"103.0.5060.53-1","urgency":"not yet assigned"},"trixie":{"status":"resolved","repositories":{"trixie":"143.0.7499.169-1~deb13u1","trixie-security":"145.0.7632.159-1~deb13u1"},"fixed_version":"103.0.5060.53-1","urgency":"not yet assigned"}}},"CVE-2022-2477":{"description":"Use after free in Guest View in Google Chrome prior to 103.0.5060.134 allowed an attacker who convinced a user to install a malicious extension to potentially exploit heap corruption via a crafted HTML page.","scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"143.0.7499.169-1~deb12u1","bookworm-security":"145.0.7632.159-1~deb12u1"},"fixed_version":"103.0.5060.134-1","urgency":"not yet assigned"},"bullseye":{"status":"resolved","repositories":{"bullseye":"120.0.6099.224-1~deb11u1","bullseye-security":"120.0.6099.224-1~deb11u1"},"fixed_version":"103.0.5060.134-1~deb11u1","urgency":"not yet assigned"},"forky":{"status":"resolved","repositories":{"forky":"145.0.7632.159-1"},"fixed_version":"103.0.5060.134-1","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"146.0.7680.71-1"},"fixed_version":"103.0.5060.134-1","urgency":"not yet assigned"},"trixie":{"status":"resolved","repositories":{"trixie":"143.0.7499.169-1~deb13u1","trixie-security":"145.0.7632.159-1~deb13u1"},"fixed_version":"103.0.5060.134-1","urgency":"not yet assigned"}}},"CVE-2022-2478":{"description":"Use after free in PDF in Google Chrome prior to 103.0.5060.134 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page.","scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"143.0.7499.169-1~deb12u1","bookworm-security":"145.0.7632.159-1~deb12u1"},"fixed_version":"103.0.5060.134-1","urgency":"not yet assigned"},"bullseye":{"status":"resolved","repositories":{"bullseye":"120.0.6099.224-1~deb11u1","bullseye-security":"120.0.6099.224-1~deb11u1"},"fixed_version":"103.0.5060.134-1~deb11u1","urgency":"not yet assigned"},"forky":{"status":"resolved","repositories":{"forky":"145.0.7632.159-1"},"fixed_version":"103.0.5060.134-1","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"146.0.7680.71-1"},"fixed_version":"103.0.5060.134-1","urgency":"not yet assigned"},"trixie":{"status":"resolved","repositories":{"trixie":"143.0.7499.169-1~deb13u1","trixie-security":"145.0.7632.159-1~deb13u1"},"fixed_version":"103.0.5060.134-1","urgency":"not yet assigned"}}},"CVE-2022-2479":{"description":"Insufficient validation of untrusted input in File in Google Chrome on Android prior to 103.0.5060.134 allowed an attacker who convinced a user to install a malicious app to obtain potentially sensitive information from internal file directories via a crafted HTML page.","scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"143.0.7499.169-1~deb12u1","bookworm-security":"145.0.7632.159-1~deb12u1"},"fixed_version":"103.0.5060.134-1","urgency":"not yet assigned"},"bullseye":{"status":"resolved","repositories":{"bullseye":"120.0.6099.224-1~deb11u1","bullseye-security":"120.0.6099.224-1~deb11u1"},"fixed_version":"103.0.5060.134-1~deb11u1","urgency":"not yet assigned"},"forky":{"status":"resolved","repositories":{"forky":"145.0.7632.159-1"},"fixed_version":"103.0.5060.134-1","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"146.0.7680.71-1"},"fixed_version":"103.0.5060.134-1","urgency":"not yet assigned"},"trixie":{"status":"resolved","repositories":{"trixie":"143.0.7499.169-1~deb13u1","trixie-security":"145.0.7632.159-1~deb13u1"},"fixed_version":"103.0.5060.134-1","urgency":"not yet assigned"}}},"CVE-2022-2480":{"description":"Use after free in Service Worker API in Google Chrome prior to 103.0.5060.134 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page.","scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"143.0.7499.169-1~deb12u1","bookworm-security":"145.0.7632.159-1~deb12u1"},"fixed_version":"103.0.5060.134-1","urgency":"not yet assigned"},"bullseye":{"status":"resolved","repositories":{"bullseye":"120.0.6099.224-1~deb11u1","bullseye-security":"120.0.6099.224-1~deb11u1"},"fixed_version":"103.0.5060.134-1~deb11u1","urgency":"not yet assigned"},"forky":{"status":"resolved","repositories":{"forky":"145.0.7632.159-1"},"fixed_version":"103.0.5060.134-1","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"146.0.7680.71-1"},"fixed_version":"103.0.5060.134-1","urgency":"not yet assigned"},"trixie":{"status":"resolved","repositories":{"trixie":"143.0.7499.169-1~deb13u1","trixie-security":"145.0.7632.159-1~deb13u1"},"fixed_version":"103.0.5060.134-1","urgency":"not yet assigned"}}},"CVE-2022-2481":{"description":"Use after free in Views in Google Chrome prior to 103.0.5060.134 allowed a remote attacker who convinced a user to engage in specific user interactions to potentially exploit heap corruption via UI interaction.","scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"143.0.7499.169-1~deb12u1","bookworm-security":"145.0.7632.159-1~deb12u1"},"fixed_version":"103.0.5060.134-1","urgency":"not yet assigned"},"bullseye":{"status":"resolved","repositories":{"bullseye":"120.0.6099.224-1~deb11u1","bullseye-security":"120.0.6099.224-1~deb11u1"},"fixed_version":"103.0.5060.134-1~deb11u1","urgency":"not yet assigned"},"forky":{"status":"resolved","repositories":{"forky":"145.0.7632.159-1"},"fixed_version":"103.0.5060.134-1","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"146.0.7680.71-1"},"fixed_version":"103.0.5060.134-1","urgency":"not yet assigned"},"trixie":{"status":"resolved","repositories":{"trixie":"143.0.7499.169-1~deb13u1","trixie-security":"145.0.7632.159-1~deb13u1"},"fixed_version":"103.0.5060.134-1","urgency":"not yet assigned"}}},"CVE-2022-2587":{"description":"Out of bounds write in Chrome OS Audio Server in Google Chrome on Chrome OS prior to 102.0.5005.125 allowed a remote attacker to potentially exploit heap corruption via crafted audio metadata.","scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"143.0.7499.169-1~deb12u1","bookworm-security":"145.0.7632.159-1~deb12u1"},"fixed_version":"0","urgency":"unimportant"},"bullseye":{"status":"resolved","repositories":{"bullseye":"120.0.6099.224-1~deb11u1","bullseye-security":"120.0.6099.224-1~deb11u1"},"fixed_version":"0","urgency":"unimportant"},"forky":{"status":"resolved","repositories":{"forky":"145.0.7632.159-1"},"fixed_version":"0","urgency":"unimportant"},"sid":{"status":"resolved","repositories":{"sid":"146.0.7680.71-1"},"fixed_version":"0","urgency":"unimportant"},"trixie":{"status":"resolved","repositories":{"trixie":"143.0.7499.169-1~deb13u1","trixie-security":"145.0.7632.159-1~deb13u1"},"fixed_version":"0","urgency":"unimportant"}}},"CVE-2022-2603":{"description":"Use after free in Omnibox in Google Chrome prior to 104.0.5112.79 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page.","scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"143.0.7499.169-1~deb12u1","bookworm-security":"145.0.7632.159-1~deb12u1"},"fixed_version":"104.0.5112.79-1","urgency":"not yet assigned"},"bullseye":{"status":"resolved","repositories":{"bullseye":"120.0.6099.224-1~deb11u1","bullseye-security":"120.0.6099.224-1~deb11u1"},"fixed_version":"104.0.5112.79-1~deb11u1","urgency":"not yet assigned"},"forky":{"status":"resolved","repositories":{"forky":"145.0.7632.159-1"},"fixed_version":"104.0.5112.79-1","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"146.0.7680.71-1"},"fixed_version":"104.0.5112.79-1","urgency":"not yet assigned"},"trixie":{"status":"resolved","repositories":{"trixie":"143.0.7499.169-1~deb13u1","trixie-security":"145.0.7632.159-1~deb13u1"},"fixed_version":"104.0.5112.79-1","urgency":"not yet assigned"}}},"CVE-2022-2604":{"description":"Use after free in Safe Browsing in Google Chrome prior to 104.0.5112.79 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page.","scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"143.0.7499.169-1~deb12u1","bookworm-security":"145.0.7632.159-1~deb12u1"},"fixed_version":"104.0.5112.79-1","urgency":"not yet assigned"},"bullseye":{"status":"resolved","repositories":{"bullseye":"120.0.6099.224-1~deb11u1","bullseye-security":"120.0.6099.224-1~deb11u1"},"fixed_version":"104.0.5112.79-1~deb11u1","urgency":"not yet assigned"},"forky":{"status":"resolved","repositories":{"forky":"145.0.7632.159-1"},"fixed_version":"104.0.5112.79-1","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"146.0.7680.71-1"},"fixed_version":"104.0.5112.79-1","urgency":"not yet assigned"},"trixie":{"status":"resolved","repositories":{"trixie":"143.0.7499.169-1~deb13u1","trixie-security":"145.0.7632.159-1~deb13u1"},"fixed_version":"104.0.5112.79-1","urgency":"not yet assigned"}}},"CVE-2022-2605":{"description":"Out of bounds read in Dawn in Google Chrome prior to 104.0.5112.79 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page.","scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"143.0.7499.169-1~deb12u1","bookworm-security":"145.0.7632.159-1~deb12u1"},"fixed_version":"104.0.5112.79-1","urgency":"not yet assigned"},"bullseye":{"status":"resolved","repositories":{"bullseye":"120.0.6099.224-1~deb11u1","bullseye-security":"120.0.6099.224-1~deb11u1"},"fixed_version":"104.0.5112.79-1~deb11u1","urgency":"not yet assigned"},"forky":{"status":"resolved","repositories":{"forky":"145.0.7632.159-1"},"fixed_version":"104.0.5112.79-1","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"146.0.7680.71-1"},"fixed_version":"104.0.5112.79-1","urgency":"not yet assigned"},"trixie":{"status":"resolved","repositories":{"trixie":"143.0.7499.169-1~deb13u1","trixie-security":"145.0.7632.159-1~deb13u1"},"fixed_version":"104.0.5112.79-1","urgency":"not yet assigned"}}},"CVE-2022-2606":{"description":"Use after free in Managed devices API in Google Chrome prior to 104.0.5112.79 allowed a remote attacker who convinced a user to enable a specific Enterprise policy to potentially exploit heap corruption via a crafted HTML page.","scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"143.0.7499.169-1~deb12u1","bookworm-security":"145.0.7632.159-1~deb12u1"},"fixed_version":"104.0.5112.79-1","urgency":"not yet assigned"},"bullseye":{"status":"resolved","repositories":{"bullseye":"120.0.6099.224-1~deb11u1","bullseye-security":"120.0.6099.224-1~deb11u1"},"fixed_version":"104.0.5112.79-1~deb11u1","urgency":"not yet assigned"},"forky":{"status":"resolved","repositories":{"forky":"145.0.7632.159-1"},"fixed_version":"104.0.5112.79-1","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"146.0.7680.71-1"},"fixed_version":"104.0.5112.79-1","urgency":"not yet assigned"},"trixie":{"status":"resolved","repositories":{"trixie":"143.0.7499.169-1~deb13u1","trixie-security":"145.0.7632.159-1~deb13u1"},"fixed_version":"104.0.5112.79-1","urgency":"not yet assigned"}}},"CVE-2022-2607":{"description":"Use after free in Tab Strip in Google Chrome on Chrome OS prior to 104.0.5112.79 allowed a remote attacker who convinced a user to engage in specific user interactions to potentially exploit heap corruption via specific UI interactions.","scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"143.0.7499.169-1~deb12u1","bookworm-security":"145.0.7632.159-1~deb12u1"},"fixed_version":"104.0.5112.79-1","urgency":"not yet assigned"},"bullseye":{"status":"resolved","repositories":{"bullseye":"120.0.6099.224-1~deb11u1","bullseye-security":"120.0.6099.224-1~deb11u1"},"fixed_version":"104.0.5112.79-1~deb11u1","urgency":"not yet assigned"},"forky":{"status":"resolved","repositories":{"forky":"145.0.7632.159-1"},"fixed_version":"104.0.5112.79-1","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"146.0.7680.71-1"},"fixed_version":"104.0.5112.79-1","urgency":"not yet assigned"},"trixie":{"status":"resolved","repositories":{"trixie":"143.0.7499.169-1~deb13u1","trixie-security":"145.0.7632.159-1~deb13u1"},"fixed_version":"104.0.5112.79-1","urgency":"not yet assigned"}}},"CVE-2022-2608":{"description":"Use after free in Overview Mode in Google Chrome on Chrome OS prior to 104.0.5112.79 allowed a remote attacker who convinced a user to engage in specific user interactions to potentially exploit heap corruption via specific UI interactions.","scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"143.0.7499.169-1~deb12u1","bookworm-security":"145.0.7632.159-1~deb12u1"},"fixed_version":"104.0.5112.79-1","urgency":"not yet assigned"},"bullseye":{"status":"resolved","repositories":{"bullseye":"120.0.6099.224-1~deb11u1","bullseye-security":"120.0.6099.224-1~deb11u1"},"fixed_version":"104.0.5112.79-1~deb11u1","urgency":"not yet assigned"},"forky":{"status":"resolved","repositories":{"forky":"145.0.7632.159-1"},"fixed_version":"104.0.5112.79-1","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"146.0.7680.71-1"},"fixed_version":"104.0.5112.79-1","urgency":"not yet assigned"},"trixie":{"status":"resolved","repositories":{"trixie":"143.0.7499.169-1~deb13u1","trixie-security":"145.0.7632.159-1~deb13u1"},"fixed_version":"104.0.5112.79-1","urgency":"not yet assigned"}}},"CVE-2022-2609":{"description":"Use after free in Nearby Share in Google Chrome on Chrome OS prior to 104.0.5112.79 allowed a remote attacker who convinced a user to engage in specific user interactions to potentially exploit heap corruption via specific UI interactions.","scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"143.0.7499.169-1~deb12u1","bookworm-security":"145.0.7632.159-1~deb12u1"},"fixed_version":"104.0.5112.79-1","urgency":"not yet assigned"},"bullseye":{"status":"resolved","repositories":{"bullseye":"120.0.6099.224-1~deb11u1","bullseye-security":"120.0.6099.224-1~deb11u1"},"fixed_version":"104.0.5112.79-1~deb11u1","urgency":"not yet assigned"},"forky":{"status":"resolved","repositories":{"forky":"145.0.7632.159-1"},"fixed_version":"104.0.5112.79-1","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"146.0.7680.71-1"},"fixed_version":"104.0.5112.79-1","urgency":"not yet assigned"},"trixie":{"status":"resolved","repositories":{"trixie":"143.0.7499.169-1~deb13u1","trixie-security":"145.0.7632.159-1~deb13u1"},"fixed_version":"104.0.5112.79-1","urgency":"not yet assigned"}}},"CVE-2022-2610":{"description":"Insufficient policy enforcement in Background Fetch in Google Chrome prior to 104.0.5112.79 allowed a remote attacker to leak cross-origin data via a crafted HTML page.","scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"143.0.7499.169-1~deb12u1","bookworm-security":"145.0.7632.159-1~deb12u1"},"fixed_version":"104.0.5112.79-1","urgency":"not yet assigned"},"bullseye":{"status":"resolved","repositories":{"bullseye":"120.0.6099.224-1~deb11u1","bullseye-security":"120.0.6099.224-1~deb11u1"},"fixed_version":"104.0.5112.79-1~deb11u1","urgency":"not yet assigned"},"forky":{"status":"resolved","repositories":{"forky":"145.0.7632.159-1"},"fixed_version":"104.0.5112.79-1","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"146.0.7680.71-1"},"fixed_version":"104.0.5112.79-1","urgency":"not yet assigned"},"trixie":{"status":"resolved","repositories":{"trixie":"143.0.7499.169-1~deb13u1","trixie-security":"145.0.7632.159-1~deb13u1"},"fixed_version":"104.0.5112.79-1","urgency":"not yet assigned"}}},"CVE-2022-2611":{"description":"Inappropriate implementation in Fullscreen API in Google Chrome on Android prior to 104.0.5112.79 allowed a remote attacker to spoof the contents of the Omnibox (URL bar) via a crafted HTML page.","scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"143.0.7499.169-1~deb12u1","bookworm-security":"145.0.7632.159-1~deb12u1"},"fixed_version":"104.0.5112.79-1","urgency":"not yet assigned"},"bullseye":{"status":"resolved","repositories":{"bullseye":"120.0.6099.224-1~deb11u1","bullseye-security":"120.0.6099.224-1~deb11u1"},"fixed_version":"104.0.5112.79-1~deb11u1","urgency":"not yet assigned"},"forky":{"status":"resolved","repositories":{"forky":"145.0.7632.159-1"},"fixed_version":"104.0.5112.79-1","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"146.0.7680.71-1"},"fixed_version":"104.0.5112.79-1","urgency":"not yet assigned"},"trixie":{"status":"resolved","repositories":{"trixie":"143.0.7499.169-1~deb13u1","trixie-security":"145.0.7632.159-1~deb13u1"},"fixed_version":"104.0.5112.79-1","urgency":"not yet assigned"}}},"CVE-2022-2612":{"description":"Side-channel information leakage in Keyboard input in Google Chrome prior to 104.0.5112.79 allowed a remote attacker who had compromised the renderer process to obtain potentially sensitive information from process memory via a crafted HTML page.","scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"143.0.7499.169-1~deb12u1","bookworm-security":"145.0.7632.159-1~deb12u1"},"fixed_version":"104.0.5112.79-1","urgency":"not yet assigned"},"bullseye":{"status":"resolved","repositories":{"bullseye":"120.0.6099.224-1~deb11u1","bullseye-security":"120.0.6099.224-1~deb11u1"},"fixed_version":"104.0.5112.79-1~deb11u1","urgency":"not yet assigned"},"forky":{"status":"resolved","repositories":{"forky":"145.0.7632.159-1"},"fixed_version":"104.0.5112.79-1","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"146.0.7680.71-1"},"fixed_version":"104.0.5112.79-1","urgency":"not yet assigned"},"trixie":{"status":"resolved","repositories":{"trixie":"143.0.7499.169-1~deb13u1","trixie-security":"145.0.7632.159-1~deb13u1"},"fixed_version":"104.0.5112.79-1","urgency":"not yet assigned"}}},"CVE-2022-2613":{"description":"Use after free in Input in Google Chrome on Chrome OS prior to 104.0.5112.79 allowed a remote attacker who convinced a user to enage in specific user interactions to potentially exploit heap corruption via specific UI interactions.","scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"143.0.7499.169-1~deb12u1","bookworm-security":"145.0.7632.159-1~deb12u1"},"fixed_version":"104.0.5112.79-1","urgency":"not yet assigned"},"bullseye":{"status":"resolved","repositories":{"bullseye":"120.0.6099.224-1~deb11u1","bullseye-security":"120.0.6099.224-1~deb11u1"},"fixed_version":"104.0.5112.79-1~deb11u1","urgency":"not yet assigned"},"forky":{"status":"resolved","repositories":{"forky":"145.0.7632.159-1"},"fixed_version":"104.0.5112.79-1","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"146.0.7680.71-1"},"fixed_version":"104.0.5112.79-1","urgency":"not yet assigned"},"trixie":{"status":"resolved","repositories":{"trixie":"143.0.7499.169-1~deb13u1","trixie-security":"145.0.7632.159-1~deb13u1"},"fixed_version":"104.0.5112.79-1","urgency":"not yet assigned"}}},"CVE-2022-2614":{"description":"Use after free in Sign-In Flow in Google Chrome prior to 104.0.5112.79 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page.","scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"143.0.7499.169-1~deb12u1","bookworm-security":"145.0.7632.159-1~deb12u1"},"fixed_version":"104.0.5112.79-1","urgency":"not yet assigned"},"bullseye":{"status":"resolved","repositories":{"bullseye":"120.0.6099.224-1~deb11u1","bullseye-security":"120.0.6099.224-1~deb11u1"},"fixed_version":"104.0.5112.79-1~deb11u1","urgency":"not yet assigned"},"forky":{"status":"resolved","repositories":{"forky":"145.0.7632.159-1"},"fixed_version":"104.0.5112.79-1","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"146.0.7680.71-1"},"fixed_version":"104.0.5112.79-1","urgency":"not yet assigned"},"trixie":{"status":"resolved","repositories":{"trixie":"143.0.7499.169-1~deb13u1","trixie-security":"145.0.7632.159-1~deb13u1"},"fixed_version":"104.0.5112.79-1","urgency":"not yet assigned"}}},"CVE-2022-2615":{"description":"Insufficient policy enforcement in Cookies in Google Chrome prior to 104.0.5112.79 allowed a remote attacker to leak cross-origin data via a crafted HTML page.","scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"143.0.7499.169-1~deb12u1","bookworm-security":"145.0.7632.159-1~deb12u1"},"fixed_version":"104.0.5112.79-1","urgency":"not yet assigned"},"bullseye":{"status":"resolved","repositories":{"bullseye":"120.0.6099.224-1~deb11u1","bullseye-security":"120.0.6099.224-1~deb11u1"},"fixed_version":"104.0.5112.79-1~deb11u1","urgency":"not yet assigned"},"forky":{"status":"resolved","repositories":{"forky":"145.0.7632.159-1"},"fixed_version":"104.0.5112.79-1","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"146.0.7680.71-1"},"fixed_version":"104.0.5112.79-1","urgency":"not yet assigned"},"trixie":{"status":"resolved","repositories":{"trixie":"143.0.7499.169-1~deb13u1","trixie-security":"145.0.7632.159-1~deb13u1"},"fixed_version":"104.0.5112.79-1","urgency":"not yet assigned"}}},"CVE-2022-2616":{"description":"Inappropriate implementation in Extensions API in Google Chrome prior to 104.0.5112.79 allowed an attacker who convinced a user to install a malicious extension to spoof the contents of the Omnibox (URL bar) via a crafted Chrome Extension.","scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"143.0.7499.169-1~deb12u1","bookworm-security":"145.0.7632.159-1~deb12u1"},"fixed_version":"104.0.5112.79-1","urgency":"not yet assigned"},"bullseye":{"status":"resolved","repositories":{"bullseye":"120.0.6099.224-1~deb11u1","bullseye-security":"120.0.6099.224-1~deb11u1"},"fixed_version":"104.0.5112.79-1~deb11u1","urgency":"not yet assigned"},"forky":{"status":"resolved","repositories":{"forky":"145.0.7632.159-1"},"fixed_version":"104.0.5112.79-1","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"146.0.7680.71-1"},"fixed_version":"104.0.5112.79-1","urgency":"not yet assigned"},"trixie":{"status":"resolved","repositories":{"trixie":"143.0.7499.169-1~deb13u1","trixie-security":"145.0.7632.159-1~deb13u1"},"fixed_version":"104.0.5112.79-1","urgency":"not yet assigned"}}},"CVE-2022-2617":{"description":"Use after free in Extensions API in Google Chrome prior to 104.0.5112.79 allowed an attacker who convinced a user to install a malicious extension to potentially exploit heap corruption via specific UI interactions.","scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"143.0.7499.169-1~deb12u1","bookworm-security":"145.0.7632.159-1~deb12u1"},"fixed_version":"104.0.5112.79-1","urgency":"not yet assigned"},"bullseye":{"status":"resolved","repositories":{"bullseye":"120.0.6099.224-1~deb11u1","bullseye-security":"120.0.6099.224-1~deb11u1"},"fixed_version":"104.0.5112.79-1~deb11u1","urgency":"not yet assigned"},"forky":{"status":"resolved","repositories":{"forky":"145.0.7632.159-1"},"fixed_version":"104.0.5112.79-1","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"146.0.7680.71-1"},"fixed_version":"104.0.5112.79-1","urgency":"not yet assigned"},"trixie":{"status":"resolved","repositories":{"trixie":"143.0.7499.169-1~deb13u1","trixie-security":"145.0.7632.159-1~deb13u1"},"fixed_version":"104.0.5112.79-1","urgency":"not yet assigned"}}},"CVE-2022-2618":{"description":"Insufficient validation of untrusted input in Internals in Google Chrome prior to 104.0.5112.79 allowed a remote attacker to bypass download restrictions via a malicious file .","scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"143.0.7499.169-1~deb12u1","bookworm-security":"145.0.7632.159-1~deb12u1"},"fixed_version":"104.0.5112.79-1","urgency":"not yet assigned"},"bullseye":{"status":"resolved","repositories":{"bullseye":"120.0.6099.224-1~deb11u1","bullseye-security":"120.0.6099.224-1~deb11u1"},"fixed_version":"104.0.5112.79-1~deb11u1","urgency":"not yet assigned"},"forky":{"status":"resolved","repositories":{"forky":"145.0.7632.159-1"},"fixed_version":"104.0.5112.79-1","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"146.0.7680.71-1"},"fixed_version":"104.0.5112.79-1","urgency":"not yet assigned"},"trixie":{"status":"resolved","repositories":{"trixie":"143.0.7499.169-1~deb13u1","trixie-security":"145.0.7632.159-1~deb13u1"},"fixed_version":"104.0.5112.79-1","urgency":"not yet assigned"}}},"CVE-2022-2619":{"description":"Insufficient validation of untrusted input in Settings in Google Chrome prior to 104.0.5112.79 allowed an attacker who convinced a user to install a malicious extension to inject scripts or HTML into a privileged page via a crafted HTML page.","scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"143.0.7499.169-1~deb12u1","bookworm-security":"145.0.7632.159-1~deb12u1"},"fixed_version":"104.0.5112.79-1","urgency":"not yet assigned"},"bullseye":{"status":"resolved","repositories":{"bullseye":"120.0.6099.224-1~deb11u1","bullseye-security":"120.0.6099.224-1~deb11u1"},"fixed_version":"104.0.5112.79-1~deb11u1","urgency":"not yet assigned"},"forky":{"status":"resolved","repositories":{"forky":"145.0.7632.159-1"},"fixed_version":"104.0.5112.79-1","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"146.0.7680.71-1"},"fixed_version":"104.0.5112.79-1","urgency":"not yet assigned"},"trixie":{"status":"resolved","repositories":{"trixie":"143.0.7499.169-1~deb13u1","trixie-security":"145.0.7632.159-1~deb13u1"},"fixed_version":"104.0.5112.79-1","urgency":"not yet assigned"}}},"CVE-2022-2620":{"description":"Use after free in WebUI in Google Chrome on Chrome OS prior to 104.0.5112.79 allowed a remote attacker who convinced a user to engage in specific user interactions to potentially exploit heap corruption via specific UI interactions.","scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"143.0.7499.169-1~deb12u1","bookworm-security":"145.0.7632.159-1~deb12u1"},"fixed_version":"104.0.5112.79-1","urgency":"not yet assigned"},"bullseye":{"status":"resolved","repositories":{"bullseye":"120.0.6099.224-1~deb11u1","bullseye-security":"120.0.6099.224-1~deb11u1"},"fixed_version":"104.0.5112.79-1~deb11u1","urgency":"not yet assigned"},"forky":{"status":"resolved","repositories":{"forky":"145.0.7632.159-1"},"fixed_version":"104.0.5112.79-1","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"146.0.7680.71-1"},"fixed_version":"104.0.5112.79-1","urgency":"not yet assigned"},"trixie":{"status":"resolved","repositories":{"trixie":"143.0.7499.169-1~deb13u1","trixie-security":"145.0.7632.159-1~deb13u1"},"fixed_version":"104.0.5112.79-1","urgency":"not yet assigned"}}},"CVE-2022-2621":{"description":"Use after free in Extensions in Google Chrome prior to 104.0.5112.79 allowed an attacker who convinced a user to install a malicious extension to potentially exploit heap corruption via specific UI interactions.","scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"143.0.7499.169-1~deb12u1","bookworm-security":"145.0.7632.159-1~deb12u1"},"fixed_version":"104.0.5112.79-1","urgency":"not yet assigned"},"bullseye":{"status":"resolved","repositories":{"bullseye":"120.0.6099.224-1~deb11u1","bullseye-security":"120.0.6099.224-1~deb11u1"},"fixed_version":"104.0.5112.79-1~deb11u1","urgency":"not yet assigned"},"forky":{"status":"resolved","repositories":{"forky":"145.0.7632.159-1"},"fixed_version":"104.0.5112.79-1","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"146.0.7680.71-1"},"fixed_version":"104.0.5112.79-1","urgency":"not yet assigned"},"trixie":{"status":"resolved","repositories":{"trixie":"143.0.7499.169-1~deb13u1","trixie-security":"145.0.7632.159-1~deb13u1"},"fixed_version":"104.0.5112.79-1","urgency":"not yet assigned"}}},"CVE-2022-2622":{"description":"Insufficient validation of untrusted input in Safe Browsing in Google Chrome on Windows prior to 104.0.5112.79 allowed a remote attacker to bypass download restrictions via a crafted file.","scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"143.0.7499.169-1~deb12u1","bookworm-security":"145.0.7632.159-1~deb12u1"},"fixed_version":"104.0.5112.79-1","urgency":"not yet assigned"},"bullseye":{"status":"resolved","repositories":{"bullseye":"120.0.6099.224-1~deb11u1","bullseye-security":"120.0.6099.224-1~deb11u1"},"fixed_version":"104.0.5112.79-1~deb11u1","urgency":"not yet assigned"},"forky":{"status":"resolved","repositories":{"forky":"145.0.7632.159-1"},"fixed_version":"104.0.5112.79-1","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"146.0.7680.71-1"},"fixed_version":"104.0.5112.79-1","urgency":"not yet assigned"},"trixie":{"status":"resolved","repositories":{"trixie":"143.0.7499.169-1~deb13u1","trixie-security":"145.0.7632.159-1~deb13u1"},"fixed_version":"104.0.5112.79-1","urgency":"not yet assigned"}}},"CVE-2022-2623":{"description":"Use after free in Offline in Google Chrome on Android prior to 104.0.5112.79 allowed a remote attacker who convinced a user to engage in specific user interactions to potentially exploit heap corruption via specific UI interactions.","scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"143.0.7499.169-1~deb12u1","bookworm-security":"145.0.7632.159-1~deb12u1"},"fixed_version":"104.0.5112.79-1","urgency":"not yet assigned"},"bullseye":{"status":"resolved","repositories":{"bullseye":"120.0.6099.224-1~deb11u1","bullseye-security":"120.0.6099.224-1~deb11u1"},"fixed_version":"104.0.5112.79-1~deb11u1","urgency":"not yet assigned"},"forky":{"status":"resolved","repositories":{"forky":"145.0.7632.159-1"},"fixed_version":"104.0.5112.79-1","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"146.0.7680.71-1"},"fixed_version":"104.0.5112.79-1","urgency":"not yet assigned"},"trixie":{"status":"resolved","repositories":{"trixie":"143.0.7499.169-1~deb13u1","trixie-security":"145.0.7632.159-1~deb13u1"},"fixed_version":"104.0.5112.79-1","urgency":"not yet assigned"}}},"CVE-2022-2624":{"description":"Heap buffer overflow in PDF in Google Chrome prior to 104.0.5112.79 allowed a remote attacker who convinced a user to engage in specific user interactions to potentially exploit heap corruption via a crafted PDF file.","scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"143.0.7499.169-1~deb12u1","bookworm-security":"145.0.7632.159-1~deb12u1"},"fixed_version":"104.0.5112.79-1","urgency":"not yet assigned"},"bullseye":{"status":"resolved","repositories":{"bullseye":"120.0.6099.224-1~deb11u1","bullseye-security":"120.0.6099.224-1~deb11u1"},"fixed_version":"104.0.5112.79-1~deb11u1","urgency":"not yet assigned"},"forky":{"status":"resolved","repositories":{"forky":"145.0.7632.159-1"},"fixed_version":"104.0.5112.79-1","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"146.0.7680.71-1"},"fixed_version":"104.0.5112.79-1","urgency":"not yet assigned"},"trixie":{"status":"resolved","repositories":{"trixie":"143.0.7499.169-1~deb13u1","trixie-security":"145.0.7632.159-1~deb13u1"},"fixed_version":"104.0.5112.79-1","urgency":"not yet assigned"}}},"CVE-2022-2742":{"description":"Use after free in Exosphere in Google Chrome on Chrome OS and Lacros prior to 104.0.5112.79 allowed a remote attacker who convinced a user to engage in specific UI interactions to potentially exploit heap corruption via crafted UI interactions. (Chrome security severity: High)","scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"143.0.7499.169-1~deb12u1","bookworm-security":"145.0.7632.159-1~deb12u1"},"fixed_version":"104.0.5112.79-1","urgency":"not yet assigned"},"bullseye":{"status":"resolved","repositories":{"bullseye":"120.0.6099.224-1~deb11u1","bullseye-security":"120.0.6099.224-1~deb11u1"},"fixed_version":"104.0.5112.79-1~deb11u1","urgency":"not yet assigned"},"forky":{"status":"resolved","repositories":{"forky":"145.0.7632.159-1"},"fixed_version":"104.0.5112.79-1","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"146.0.7680.71-1"},"fixed_version":"104.0.5112.79-1","urgency":"not yet assigned"},"trixie":{"status":"resolved","repositories":{"trixie":"143.0.7499.169-1~deb13u1","trixie-security":"145.0.7632.159-1~deb13u1"},"fixed_version":"104.0.5112.79-1","urgency":"not yet assigned"}}},"CVE-2022-2743":{"description":"Integer overflow in Window Manager in Google Chrome on Chrome OS and Lacros prior to 104.0.5112.79 allowed a remote attacker who convinced a user to engage in specific UI interactions to perform an out of bounds memory write via crafted UI interactions. (Chrome security severity: High)","scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"143.0.7499.169-1~deb12u1","bookworm-security":"145.0.7632.159-1~deb12u1"},"fixed_version":"104.0.5112.79-1","urgency":"not yet assigned"},"bullseye":{"status":"resolved","repositories":{"bullseye":"120.0.6099.224-1~deb11u1","bullseye-security":"120.0.6099.224-1~deb11u1"},"fixed_version":"104.0.5112.79-1~deb11u1","urgency":"not yet assigned"},"forky":{"status":"resolved","repositories":{"forky":"145.0.7632.159-1"},"fixed_version":"104.0.5112.79-1","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"146.0.7680.71-1"},"fixed_version":"104.0.5112.79-1","urgency":"not yet assigned"},"trixie":{"status":"resolved","repositories":{"trixie":"143.0.7499.169-1~deb13u1","trixie-security":"145.0.7632.159-1~deb13u1"},"fixed_version":"104.0.5112.79-1","urgency":"not yet assigned"}}},"CVE-2022-2852":{"description":"Use after free in FedCM in Google Chrome prior to 104.0.5112.101 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page.","scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"143.0.7499.169-1~deb12u1","bookworm-security":"145.0.7632.159-1~deb12u1"},"fixed_version":"104.0.5112.101-1","urgency":"not yet assigned"},"bullseye":{"status":"resolved","repositories":{"bullseye":"120.0.6099.224-1~deb11u1","bullseye-security":"120.0.6099.224-1~deb11u1"},"fixed_version":"104.0.5112.101-1~deb11u1","urgency":"not yet assigned"},"forky":{"status":"resolved","repositories":{"forky":"145.0.7632.159-1"},"fixed_version":"104.0.5112.101-1","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"146.0.7680.71-1"},"fixed_version":"104.0.5112.101-1","urgency":"not yet assigned"},"trixie":{"status":"resolved","repositories":{"trixie":"143.0.7499.169-1~deb13u1","trixie-security":"145.0.7632.159-1~deb13u1"},"fixed_version":"104.0.5112.101-1","urgency":"not yet assigned"}}},"CVE-2022-2853":{"description":"Heap buffer overflow in Downloads in Google Chrome on Android prior to 104.0.5112.101 allowed a remote attacker who had compromised the renderer process to potentially exploit heap corruption via a crafted HTML page.","scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"143.0.7499.169-1~deb12u1","bookworm-security":"145.0.7632.159-1~deb12u1"},"fixed_version":"104.0.5112.101-1","urgency":"not yet assigned"},"bullseye":{"status":"resolved","repositories":{"bullseye":"120.0.6099.224-1~deb11u1","bullseye-security":"120.0.6099.224-1~deb11u1"},"fixed_version":"104.0.5112.101-1~deb11u1","urgency":"not yet assigned"},"forky":{"status":"resolved","repositories":{"forky":"145.0.7632.159-1"},"fixed_version":"104.0.5112.101-1","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"146.0.7680.71-1"},"fixed_version":"104.0.5112.101-1","urgency":"not yet assigned"},"trixie":{"status":"resolved","repositories":{"trixie":"143.0.7499.169-1~deb13u1","trixie-security":"145.0.7632.159-1~deb13u1"},"fixed_version":"104.0.5112.101-1","urgency":"not yet assigned"}}},"CVE-2022-2854":{"description":"Use after free in SwiftShader in Google Chrome prior to 104.0.5112.101 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page.","scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"143.0.7499.169-1~deb12u1","bookworm-security":"145.0.7632.159-1~deb12u1"},"fixed_version":"104.0.5112.101-1","urgency":"not yet assigned"},"bullseye":{"status":"resolved","repositories":{"bullseye":"120.0.6099.224-1~deb11u1","bullseye-security":"120.0.6099.224-1~deb11u1"},"fixed_version":"104.0.5112.101-1~deb11u1","urgency":"not yet assigned"},"forky":{"status":"resolved","repositories":{"forky":"145.0.7632.159-1"},"fixed_version":"104.0.5112.101-1","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"146.0.7680.71-1"},"fixed_version":"104.0.5112.101-1","urgency":"not yet assigned"},"trixie":{"status":"resolved","repositories":{"trixie":"143.0.7499.169-1~deb13u1","trixie-security":"145.0.7632.159-1~deb13u1"},"fixed_version":"104.0.5112.101-1","urgency":"not yet assigned"}}},"CVE-2022-2855":{"description":"Use after free in ANGLE in Google Chrome prior to 104.0.5112.101 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page.","scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"143.0.7499.169-1~deb12u1","bookworm-security":"145.0.7632.159-1~deb12u1"},"fixed_version":"104.0.5112.101-1","urgency":"not yet assigned"},"bullseye":{"status":"resolved","repositories":{"bullseye":"120.0.6099.224-1~deb11u1","bullseye-security":"120.0.6099.224-1~deb11u1"},"fixed_version":"104.0.5112.101-1~deb11u1","urgency":"not yet assigned"},"forky":{"status":"resolved","repositories":{"forky":"145.0.7632.159-1"},"fixed_version":"104.0.5112.101-1","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"146.0.7680.71-1"},"fixed_version":"104.0.5112.101-1","urgency":"not yet assigned"},"trixie":{"status":"resolved","repositories":{"trixie":"143.0.7499.169-1~deb13u1","trixie-security":"145.0.7632.159-1~deb13u1"},"fixed_version":"104.0.5112.101-1","urgency":"not yet assigned"}}},"CVE-2022-2856":{"description":"Insufficient validation of untrusted input in Intents in Google Chrome on Android prior to 104.0.5112.101 allowed a remote attacker to arbitrarily browse to a malicious website via a crafted HTML page.","scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"143.0.7499.169-1~deb12u1","bookworm-security":"145.0.7632.159-1~deb12u1"},"fixed_version":"104.0.5112.101-1","urgency":"not yet assigned"},"bullseye":{"status":"resolved","repositories":{"bullseye":"120.0.6099.224-1~deb11u1","bullseye-security":"120.0.6099.224-1~deb11u1"},"fixed_version":"104.0.5112.101-1~deb11u1","urgency":"not yet assigned"},"forky":{"status":"resolved","repositories":{"forky":"145.0.7632.159-1"},"fixed_version":"104.0.5112.101-1","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"146.0.7680.71-1"},"fixed_version":"104.0.5112.101-1","urgency":"not yet assigned"},"trixie":{"status":"resolved","repositories":{"trixie":"143.0.7499.169-1~deb13u1","trixie-security":"145.0.7632.159-1~deb13u1"},"fixed_version":"104.0.5112.101-1","urgency":"not yet assigned"}}},"CVE-2022-2857":{"description":"Use after free in Blink in Google Chrome prior to 104.0.5112.101 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page.","scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"143.0.7499.169-1~deb12u1","bookworm-security":"145.0.7632.159-1~deb12u1"},"fixed_version":"104.0.5112.101-1","urgency":"not yet assigned"},"bullseye":{"status":"resolved","repositories":{"bullseye":"120.0.6099.224-1~deb11u1","bullseye-security":"120.0.6099.224-1~deb11u1"},"fixed_version":"104.0.5112.101-1~deb11u1","urgency":"not yet assigned"},"forky":{"status":"resolved","repositories":{"forky":"145.0.7632.159-1"},"fixed_version":"104.0.5112.101-1","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"146.0.7680.71-1"},"fixed_version":"104.0.5112.101-1","urgency":"not yet assigned"},"trixie":{"status":"resolved","repositories":{"trixie":"143.0.7499.169-1~deb13u1","trixie-security":"145.0.7632.159-1~deb13u1"},"fixed_version":"104.0.5112.101-1","urgency":"not yet assigned"}}},"CVE-2022-2858":{"description":"Use after free in Sign-In Flow in Google Chrome prior to 104.0.5112.101 allowed a remote attacker to potentially exploit heap corruption via specific UI interaction.","scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"143.0.7499.169-1~deb12u1","bookworm-security":"145.0.7632.159-1~deb12u1"},"fixed_version":"104.0.5112.101-1","urgency":"not yet assigned"},"bullseye":{"status":"resolved","repositories":{"bullseye":"120.0.6099.224-1~deb11u1","bullseye-security":"120.0.6099.224-1~deb11u1"},"fixed_version":"104.0.5112.101-1~deb11u1","urgency":"not yet assigned"},"forky":{"status":"resolved","repositories":{"forky":"145.0.7632.159-1"},"fixed_version":"104.0.5112.101-1","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"146.0.7680.71-1"},"fixed_version":"104.0.5112.101-1","urgency":"not yet assigned"},"trixie":{"status":"resolved","repositories":{"trixie":"143.0.7499.169-1~deb13u1","trixie-security":"145.0.7632.159-1~deb13u1"},"fixed_version":"104.0.5112.101-1","urgency":"not yet assigned"}}},"CVE-2022-2859":{"description":"Use after free in Chrome OS Shell in Google Chrome prior to 104.0.5112.101 allowed a remote attacker who convinced a user to engage in specific UI interactions to potentially exploit heap corruption via specific UI interactions.","scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"143.0.7499.169-1~deb12u1","bookworm-security":"145.0.7632.159-1~deb12u1"},"fixed_version":"104.0.5112.101-1","urgency":"not yet assigned"},"bullseye":{"status":"resolved","repositories":{"bullseye":"120.0.6099.224-1~deb11u1","bullseye-security":"120.0.6099.224-1~deb11u1"},"fixed_version":"104.0.5112.101-1~deb11u1","urgency":"not yet assigned"},"forky":{"status":"resolved","repositories":{"forky":"145.0.7632.159-1"},"fixed_version":"104.0.5112.101-1","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"146.0.7680.71-1"},"fixed_version":"104.0.5112.101-1","urgency":"not yet assigned"},"trixie":{"status":"resolved","repositories":{"trixie":"143.0.7499.169-1~deb13u1","trixie-security":"145.0.7632.159-1~deb13u1"},"fixed_version":"104.0.5112.101-1","urgency":"not yet assigned"}}},"CVE-2022-2860":{"description":"Insufficient policy enforcement in Cookies in Google Chrome prior to 104.0.5112.101 allowed a remote attacker to bypass cookie prefix restrictions via a crafted HTML page.","scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"143.0.7499.169-1~deb12u1","bookworm-security":"145.0.7632.159-1~deb12u1"},"fixed_version":"104.0.5112.101-1","urgency":"not yet assigned"},"bullseye":{"status":"resolved","repositories":{"bullseye":"120.0.6099.224-1~deb11u1","bullseye-security":"120.0.6099.224-1~deb11u1"},"fixed_version":"104.0.5112.101-1~deb11u1","urgency":"not yet assigned"},"forky":{"status":"resolved","repositories":{"forky":"145.0.7632.159-1"},"fixed_version":"104.0.5112.101-1","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"146.0.7680.71-1"},"fixed_version":"104.0.5112.101-1","urgency":"not yet assigned"},"trixie":{"status":"resolved","repositories":{"trixie":"143.0.7499.169-1~deb13u1","trixie-security":"145.0.7632.159-1~deb13u1"},"fixed_version":"104.0.5112.101-1","urgency":"not yet assigned"}}},"CVE-2022-2861":{"description":"Inappropriate implementation in Extensions API in Google Chrome prior to 104.0.5112.101 allowed an attacker who convinced a user to install a malicious extension to inject arbitrary scripts into WebUI via a crafted HTML page.","scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"143.0.7499.169-1~deb12u1","bookworm-security":"145.0.7632.159-1~deb12u1"},"fixed_version":"104.0.5112.101-1","urgency":"not yet assigned"},"bullseye":{"status":"resolved","repositories":{"bullseye":"120.0.6099.224-1~deb11u1","bullseye-security":"120.0.6099.224-1~deb11u1"},"fixed_version":"104.0.5112.101-1~deb11u1","urgency":"not yet assigned"},"forky":{"status":"resolved","repositories":{"forky":"145.0.7632.159-1"},"fixed_version":"104.0.5112.101-1","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"146.0.7680.71-1"},"fixed_version":"104.0.5112.101-1","urgency":"not yet assigned"},"trixie":{"status":"resolved","repositories":{"trixie":"143.0.7499.169-1~deb13u1","trixie-security":"145.0.7632.159-1~deb13u1"},"fixed_version":"104.0.5112.101-1","urgency":"not yet assigned"}}},"CVE-2022-2998":{"description":"Use after free in Browser Creation in Google Chrome prior to 104.0.5112.101 allowed a remote attacker who had convinced a user to engage in a specific UI interaction to potentially exploit heap corruption via a crafted HTML page.","scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"143.0.7499.169-1~deb12u1","bookworm-security":"145.0.7632.159-1~deb12u1"},"fixed_version":"104.0.5112.101-1","urgency":"not yet assigned"},"bullseye":{"status":"resolved","repositories":{"bullseye":"120.0.6099.224-1~deb11u1","bullseye-security":"120.0.6099.224-1~deb11u1"},"fixed_version":"104.0.5112.101-1~deb11u1","urgency":"not yet assigned"},"forky":{"status":"resolved","repositories":{"forky":"145.0.7632.159-1"},"fixed_version":"104.0.5112.101-1","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"146.0.7680.71-1"},"fixed_version":"104.0.5112.101-1","urgency":"not yet assigned"},"trixie":{"status":"resolved","repositories":{"trixie":"143.0.7499.169-1~deb13u1","trixie-security":"145.0.7632.159-1~deb13u1"},"fixed_version":"104.0.5112.101-1","urgency":"not yet assigned"}}},"CVE-2022-3038":{"description":"Use after free in Network Service in Google Chrome prior to 105.0.5195.52 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page.","scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"143.0.7499.169-1~deb12u1","bookworm-security":"145.0.7632.159-1~deb12u1"},"fixed_version":"105.0.5195.52-1","urgency":"not yet assigned"},"bullseye":{"status":"resolved","repositories":{"bullseye":"120.0.6099.224-1~deb11u1","bullseye-security":"120.0.6099.224-1~deb11u1"},"fixed_version":"105.0.5195.52-1~deb11u1","urgency":"not yet assigned"},"forky":{"status":"resolved","repositories":{"forky":"145.0.7632.159-1"},"fixed_version":"105.0.5195.52-1","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"146.0.7680.71-1"},"fixed_version":"105.0.5195.52-1","urgency":"not yet assigned"},"trixie":{"status":"resolved","repositories":{"trixie":"143.0.7499.169-1~deb13u1","trixie-security":"145.0.7632.159-1~deb13u1"},"fixed_version":"105.0.5195.52-1","urgency":"not yet assigned"}}},"CVE-2022-3039":{"description":"Use after free in WebSQL in Google Chrome prior to 105.0.5195.52 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page.","scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"143.0.7499.169-1~deb12u1","bookworm-security":"145.0.7632.159-1~deb12u1"},"fixed_version":"105.0.5195.52-1","urgency":"not yet assigned"},"bullseye":{"status":"resolved","repositories":{"bullseye":"120.0.6099.224-1~deb11u1","bullseye-security":"120.0.6099.224-1~deb11u1"},"fixed_version":"105.0.5195.52-1~deb11u1","urgency":"not yet assigned"},"forky":{"status":"resolved","repositories":{"forky":"145.0.7632.159-1"},"fixed_version":"105.0.5195.52-1","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"146.0.7680.71-1"},"fixed_version":"105.0.5195.52-1","urgency":"not yet assigned"},"trixie":{"status":"resolved","repositories":{"trixie":"143.0.7499.169-1~deb13u1","trixie-security":"145.0.7632.159-1~deb13u1"},"fixed_version":"105.0.5195.52-1","urgency":"not yet assigned"}}},"CVE-2022-3040":{"description":"Use after free in Layout in Google Chrome prior to 105.0.5195.52 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page.","scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"143.0.7499.169-1~deb12u1","bookworm-security":"145.0.7632.159-1~deb12u1"},"fixed_version":"105.0.5195.52-1","urgency":"not yet assigned"},"bullseye":{"status":"resolved","repositories":{"bullseye":"120.0.6099.224-1~deb11u1","bullseye-security":"120.0.6099.224-1~deb11u1"},"fixed_version":"105.0.5195.52-1~deb11u1","urgency":"not yet assigned"},"forky":{"status":"resolved","repositories":{"forky":"145.0.7632.159-1"},"fixed_version":"105.0.5195.52-1","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"146.0.7680.71-1"},"fixed_version":"105.0.5195.52-1","urgency":"not yet assigned"},"trixie":{"status":"resolved","repositories":{"trixie":"143.0.7499.169-1~deb13u1","trixie-security":"145.0.7632.159-1~deb13u1"},"fixed_version":"105.0.5195.52-1","urgency":"not yet assigned"}}},"CVE-2022-3041":{"description":"Use after free in WebSQL in Google Chrome prior to 105.0.5195.52 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page.","scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"143.0.7499.169-1~deb12u1","bookworm-security":"145.0.7632.159-1~deb12u1"},"fixed_version":"105.0.5195.52-1","urgency":"not yet assigned"},"bullseye":{"status":"resolved","repositories":{"bullseye":"120.0.6099.224-1~deb11u1","bullseye-security":"120.0.6099.224-1~deb11u1"},"fixed_version":"105.0.5195.52-1~deb11u1","urgency":"not yet assigned"},"forky":{"status":"resolved","repositories":{"forky":"145.0.7632.159-1"},"fixed_version":"105.0.5195.52-1","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"146.0.7680.71-1"},"fixed_version":"105.0.5195.52-1","urgency":"not yet assigned"},"trixie":{"status":"resolved","repositories":{"trixie":"143.0.7499.169-1~deb13u1","trixie-security":"145.0.7632.159-1~deb13u1"},"fixed_version":"105.0.5195.52-1","urgency":"not yet assigned"}}},"CVE-2022-3042":{"description":"Use after free in PhoneHub in Google Chrome on Chrome OS prior to 105.0.5195.52 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page.","scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"143.0.7499.169-1~deb12u1","bookworm-security":"145.0.7632.159-1~deb12u1"},"fixed_version":"105.0.5195.52-1","urgency":"not yet assigned"},"bullseye":{"status":"resolved","repositories":{"bullseye":"120.0.6099.224-1~deb11u1","bullseye-security":"120.0.6099.224-1~deb11u1"},"fixed_version":"105.0.5195.52-1~deb11u1","urgency":"not yet assigned"},"forky":{"status":"resolved","repositories":{"forky":"145.0.7632.159-1"},"fixed_version":"105.0.5195.52-1","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"146.0.7680.71-1"},"fixed_version":"105.0.5195.52-1","urgency":"not yet assigned"},"trixie":{"status":"resolved","repositories":{"trixie":"143.0.7499.169-1~deb13u1","trixie-security":"145.0.7632.159-1~deb13u1"},"fixed_version":"105.0.5195.52-1","urgency":"not yet assigned"}}},"CVE-2022-3043":{"description":"Heap buffer overflow in Screen Capture in Google Chrome on Chrome OS prior to 105.0.5195.52 allowed a remote attacker who convinced a user to engage in specific UI interactions to potentially exploit heap corruption via a crafted HTML page.","scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"143.0.7499.169-1~deb12u1","bookworm-security":"145.0.7632.159-1~deb12u1"},"fixed_version":"105.0.5195.52-1","urgency":"not yet assigned"},"bullseye":{"status":"resolved","repositories":{"bullseye":"120.0.6099.224-1~deb11u1","bullseye-security":"120.0.6099.224-1~deb11u1"},"fixed_version":"105.0.5195.52-1~deb11u1","urgency":"not yet assigned"},"forky":{"status":"resolved","repositories":{"forky":"145.0.7632.159-1"},"fixed_version":"105.0.5195.52-1","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"146.0.7680.71-1"},"fixed_version":"105.0.5195.52-1","urgency":"not yet assigned"},"trixie":{"status":"resolved","repositories":{"trixie":"143.0.7499.169-1~deb13u1","trixie-security":"145.0.7632.159-1~deb13u1"},"fixed_version":"105.0.5195.52-1","urgency":"not yet assigned"}}},"CVE-2022-3044":{"description":"Inappropriate implementation in Site Isolation in Google Chrome prior to 105.0.5195.52 allowed a remote attacker who had compromised the renderer process to bypass site isolation via a crafted HTML page.","scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"143.0.7499.169-1~deb12u1","bookworm-security":"145.0.7632.159-1~deb12u1"},"fixed_version":"105.0.5195.52-1","urgency":"not yet assigned"},"bullseye":{"status":"resolved","repositories":{"bullseye":"120.0.6099.224-1~deb11u1","bullseye-security":"120.0.6099.224-1~deb11u1"},"fixed_version":"105.0.5195.52-1~deb11u1","urgency":"not yet assigned"},"forky":{"status":"resolved","repositories":{"forky":"145.0.7632.159-1"},"fixed_version":"105.0.5195.52-1","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"146.0.7680.71-1"},"fixed_version":"105.0.5195.52-1","urgency":"not yet assigned"},"trixie":{"status":"resolved","repositories":{"trixie":"143.0.7499.169-1~deb13u1","trixie-security":"145.0.7632.159-1~deb13u1"},"fixed_version":"105.0.5195.52-1","urgency":"not yet assigned"}}},"CVE-2022-3045":{"description":"Insufficient validation of untrusted input in V8 in Google Chrome prior to 105.0.5195.52 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page.","scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"143.0.7499.169-1~deb12u1","bookworm-security":"145.0.7632.159-1~deb12u1"},"fixed_version":"105.0.5195.52-1","urgency":"not yet assigned"},"bullseye":{"status":"resolved","repositories":{"bullseye":"120.0.6099.224-1~deb11u1","bullseye-security":"120.0.6099.224-1~deb11u1"},"fixed_version":"105.0.5195.52-1~deb11u1","urgency":"not yet assigned"},"forky":{"status":"resolved","repositories":{"forky":"145.0.7632.159-1"},"fixed_version":"105.0.5195.52-1","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"146.0.7680.71-1"},"fixed_version":"105.0.5195.52-1","urgency":"not yet assigned"},"trixie":{"status":"resolved","repositories":{"trixie":"143.0.7499.169-1~deb13u1","trixie-security":"145.0.7632.159-1~deb13u1"},"fixed_version":"105.0.5195.52-1","urgency":"not yet assigned"}}},"CVE-2022-3046":{"description":"Use after free in Browser Tag in Google Chrome prior to 105.0.5195.52 allowed an attacker who convinced a user to install a malicious extension to potentially exploit heap corruption via a crafted HTML page.","scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"143.0.7499.169-1~deb12u1","bookworm-security":"145.0.7632.159-1~deb12u1"},"fixed_version":"105.0.5195.52-1","urgency":"not yet assigned"},"bullseye":{"status":"resolved","repositories":{"bullseye":"120.0.6099.224-1~deb11u1","bullseye-security":"120.0.6099.224-1~deb11u1"},"fixed_version":"105.0.5195.52-1~deb11u1","urgency":"not yet assigned"},"forky":{"status":"resolved","repositories":{"forky":"145.0.7632.159-1"},"fixed_version":"105.0.5195.52-1","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"146.0.7680.71-1"},"fixed_version":"105.0.5195.52-1","urgency":"not yet assigned"},"trixie":{"status":"resolved","repositories":{"trixie":"143.0.7499.169-1~deb13u1","trixie-security":"145.0.7632.159-1~deb13u1"},"fixed_version":"105.0.5195.52-1","urgency":"not yet assigned"}}},"CVE-2022-3047":{"description":"Insufficient policy enforcement in Extensions API in Google Chrome prior to 105.0.5195.52 allowed an attacker who convinced a user to install a malicious extension to bypass downloads policy via a crafted HTML page.","scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"143.0.7499.169-1~deb12u1","bookworm-security":"145.0.7632.159-1~deb12u1"},"fixed_version":"105.0.5195.52-1","urgency":"not yet assigned"},"bullseye":{"status":"resolved","repositories":{"bullseye":"120.0.6099.224-1~deb11u1","bullseye-security":"120.0.6099.224-1~deb11u1"},"fixed_version":"105.0.5195.52-1~deb11u1","urgency":"not yet assigned"},"forky":{"status":"resolved","repositories":{"forky":"145.0.7632.159-1"},"fixed_version":"105.0.5195.52-1","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"146.0.7680.71-1"},"fixed_version":"105.0.5195.52-1","urgency":"not yet assigned"},"trixie":{"status":"resolved","repositories":{"trixie":"143.0.7499.169-1~deb13u1","trixie-security":"145.0.7632.159-1~deb13u1"},"fixed_version":"105.0.5195.52-1","urgency":"not yet assigned"}}},"CVE-2022-3048":{"description":"Inappropriate implementation in Chrome OS lockscreen in Google Chrome on Chrome OS prior to 105.0.5195.52 allowed a local attacker to bypass lockscreen navigation restrictions via physical access to the device.","scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"143.0.7499.169-1~deb12u1","bookworm-security":"145.0.7632.159-1~deb12u1"},"fixed_version":"105.0.5195.52-1","urgency":"not yet assigned"},"bullseye":{"status":"resolved","repositories":{"bullseye":"120.0.6099.224-1~deb11u1","bullseye-security":"120.0.6099.224-1~deb11u1"},"fixed_version":"105.0.5195.52-1~deb11u1","urgency":"not yet assigned"},"forky":{"status":"resolved","repositories":{"forky":"145.0.7632.159-1"},"fixed_version":"105.0.5195.52-1","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"146.0.7680.71-1"},"fixed_version":"105.0.5195.52-1","urgency":"not yet assigned"},"trixie":{"status":"resolved","repositories":{"trixie":"143.0.7499.169-1~deb13u1","trixie-security":"145.0.7632.159-1~deb13u1"},"fixed_version":"105.0.5195.52-1","urgency":"not yet assigned"}}},"CVE-2022-3049":{"description":"Use after free in SplitScreen in Google Chrome on Chrome OS, Lacros prior to 105.0.5195.52 allowed a remote attacker who convinced a user to engage in specific UI interactions to potentially exploit heap corruption via a crafted HTML page.","scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"143.0.7499.169-1~deb12u1","bookworm-security":"145.0.7632.159-1~deb12u1"},"fixed_version":"105.0.5195.52-1","urgency":"not yet assigned"},"bullseye":{"status":"resolved","repositories":{"bullseye":"120.0.6099.224-1~deb11u1","bullseye-security":"120.0.6099.224-1~deb11u1"},"fixed_version":"105.0.5195.52-1~deb11u1","urgency":"not yet assigned"},"forky":{"status":"resolved","repositories":{"forky":"145.0.7632.159-1"},"fixed_version":"105.0.5195.52-1","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"146.0.7680.71-1"},"fixed_version":"105.0.5195.52-1","urgency":"not yet assigned"},"trixie":{"status":"resolved","repositories":{"trixie":"143.0.7499.169-1~deb13u1","trixie-security":"145.0.7632.159-1~deb13u1"},"fixed_version":"105.0.5195.52-1","urgency":"not yet assigned"}}},"CVE-2022-3050":{"description":"Heap buffer overflow in WebUI in Google Chrome on Chrome OS prior to 105.0.5195.52 allowed a remote attacker who convinced a user to engage in specific UI interactions to potentially exploit heap corruption via crafted UI interactions.","scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"143.0.7499.169-1~deb12u1","bookworm-security":"145.0.7632.159-1~deb12u1"},"fixed_version":"105.0.5195.52-1","urgency":"not yet assigned"},"bullseye":{"status":"resolved","repositories":{"bullseye":"120.0.6099.224-1~deb11u1","bullseye-security":"120.0.6099.224-1~deb11u1"},"fixed_version":"105.0.5195.52-1~deb11u1","urgency":"not yet assigned"},"forky":{"status":"resolved","repositories":{"forky":"145.0.7632.159-1"},"fixed_version":"105.0.5195.52-1","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"146.0.7680.71-1"},"fixed_version":"105.0.5195.52-1","urgency":"not yet assigned"},"trixie":{"status":"resolved","repositories":{"trixie":"143.0.7499.169-1~deb13u1","trixie-security":"145.0.7632.159-1~deb13u1"},"fixed_version":"105.0.5195.52-1","urgency":"not yet assigned"}}},"CVE-2022-3051":{"description":"Heap buffer overflow in Exosphere in Google Chrome on Chrome OS, Lacros prior to 105.0.5195.52 allowed a remote attacker who convinced a user to engage in specific UI interactions to potentially exploit heap corruption via crafted UI interactions.","scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"143.0.7499.169-1~deb12u1","bookworm-security":"145.0.7632.159-1~deb12u1"},"fixed_version":"105.0.5195.52-1","urgency":"not yet assigned"},"bullseye":{"status":"resolved","repositories":{"bullseye":"120.0.6099.224-1~deb11u1","bullseye-security":"120.0.6099.224-1~deb11u1"},"fixed_version":"105.0.5195.52-1~deb11u1","urgency":"not yet assigned"},"forky":{"status":"resolved","repositories":{"forky":"145.0.7632.159-1"},"fixed_version":"105.0.5195.52-1","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"146.0.7680.71-1"},"fixed_version":"105.0.5195.52-1","urgency":"not yet assigned"},"trixie":{"status":"resolved","repositories":{"trixie":"143.0.7499.169-1~deb13u1","trixie-security":"145.0.7632.159-1~deb13u1"},"fixed_version":"105.0.5195.52-1","urgency":"not yet assigned"}}},"CVE-2022-3052":{"description":"Heap buffer overflow in Window Manager in Google Chrome on Chrome OS, Lacros prior to 105.0.5195.52 allowed a remote attacker who convinced a user to engage in specific UI interactions to potentially exploit heap corruption via crafted UI interactions.","scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"143.0.7499.169-1~deb12u1","bookworm-security":"145.0.7632.159-1~deb12u1"},"fixed_version":"105.0.5195.52-1","urgency":"not yet assigned"},"bullseye":{"status":"resolved","repositories":{"bullseye":"120.0.6099.224-1~deb11u1","bullseye-security":"120.0.6099.224-1~deb11u1"},"fixed_version":"105.0.5195.52-1~deb11u1","urgency":"not yet assigned"},"forky":{"status":"resolved","repositories":{"forky":"145.0.7632.159-1"},"fixed_version":"105.0.5195.52-1","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"146.0.7680.71-1"},"fixed_version":"105.0.5195.52-1","urgency":"not yet assigned"},"trixie":{"status":"resolved","repositories":{"trixie":"143.0.7499.169-1~deb13u1","trixie-security":"145.0.7632.159-1~deb13u1"},"fixed_version":"105.0.5195.52-1","urgency":"not yet assigned"}}},"CVE-2022-3053":{"description":"Inappropriate implementation in Pointer Lock in Google Chrome on Mac prior to 105.0.5195.52 allowed a remote attacker to restrict user navigation via a crafted HTML page.","scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"143.0.7499.169-1~deb12u1","bookworm-security":"145.0.7632.159-1~deb12u1"},"fixed_version":"105.0.5195.52-1","urgency":"not yet assigned"},"bullseye":{"status":"resolved","repositories":{"bullseye":"120.0.6099.224-1~deb11u1","bullseye-security":"120.0.6099.224-1~deb11u1"},"fixed_version":"105.0.5195.52-1~deb11u1","urgency":"not yet assigned"},"forky":{"status":"resolved","repositories":{"forky":"145.0.7632.159-1"},"fixed_version":"105.0.5195.52-1","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"146.0.7680.71-1"},"fixed_version":"105.0.5195.52-1","urgency":"not yet assigned"},"trixie":{"status":"resolved","repositories":{"trixie":"143.0.7499.169-1~deb13u1","trixie-security":"145.0.7632.159-1~deb13u1"},"fixed_version":"105.0.5195.52-1","urgency":"not yet assigned"}}},"CVE-2022-3054":{"description":"Insufficient policy enforcement in DevTools in Google Chrome prior to 105.0.5195.52 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page.","scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"143.0.7499.169-1~deb12u1","bookworm-security":"145.0.7632.159-1~deb12u1"},"fixed_version":"105.0.5195.52-1","urgency":"not yet assigned"},"bullseye":{"status":"resolved","repositories":{"bullseye":"120.0.6099.224-1~deb11u1","bullseye-security":"120.0.6099.224-1~deb11u1"},"fixed_version":"105.0.5195.52-1~deb11u1","urgency":"not yet assigned"},"forky":{"status":"resolved","repositories":{"forky":"145.0.7632.159-1"},"fixed_version":"105.0.5195.52-1","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"146.0.7680.71-1"},"fixed_version":"105.0.5195.52-1","urgency":"not yet assigned"},"trixie":{"status":"resolved","repositories":{"trixie":"143.0.7499.169-1~deb13u1","trixie-security":"145.0.7632.159-1~deb13u1"},"fixed_version":"105.0.5195.52-1","urgency":"not yet assigned"}}},"CVE-2022-3055":{"description":"Use after free in Passwords in Google Chrome prior to 105.0.5195.52 allowed a remote attacker who convinced a user to engage in specific UI interactions to potentially exploit heap corruption via a crafted HTML page.","scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"143.0.7499.169-1~deb12u1","bookworm-security":"145.0.7632.159-1~deb12u1"},"fixed_version":"105.0.5195.52-1","urgency":"not yet assigned"},"bullseye":{"status":"resolved","repositories":{"bullseye":"120.0.6099.224-1~deb11u1","bullseye-security":"120.0.6099.224-1~deb11u1"},"fixed_version":"105.0.5195.52-1~deb11u1","urgency":"not yet assigned"},"forky":{"status":"resolved","repositories":{"forky":"145.0.7632.159-1"},"fixed_version":"105.0.5195.52-1","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"146.0.7680.71-1"},"fixed_version":"105.0.5195.52-1","urgency":"not yet assigned"},"trixie":{"status":"resolved","repositories":{"trixie":"143.0.7499.169-1~deb13u1","trixie-security":"145.0.7632.159-1~deb13u1"},"fixed_version":"105.0.5195.52-1","urgency":"not yet assigned"}}},"CVE-2022-3056":{"description":"Insufficient policy enforcement in Content Security Policy in Google Chrome prior to 105.0.5195.52 allowed a remote attacker to bypass content security policy via a crafted HTML page.","scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"143.0.7499.169-1~deb12u1","bookworm-security":"145.0.7632.159-1~deb12u1"},"fixed_version":"105.0.5195.52-1","urgency":"not yet assigned"},"bullseye":{"status":"resolved","repositories":{"bullseye":"120.0.6099.224-1~deb11u1","bullseye-security":"120.0.6099.224-1~deb11u1"},"fixed_version":"105.0.5195.52-1~deb11u1","urgency":"not yet assigned"},"forky":{"status":"resolved","repositories":{"forky":"145.0.7632.159-1"},"fixed_version":"105.0.5195.52-1","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"146.0.7680.71-1"},"fixed_version":"105.0.5195.52-1","urgency":"not yet assigned"},"trixie":{"status":"resolved","repositories":{"trixie":"143.0.7499.169-1~deb13u1","trixie-security":"145.0.7632.159-1~deb13u1"},"fixed_version":"105.0.5195.52-1","urgency":"not yet assigned"}}},"CVE-2022-3057":{"description":"Inappropriate implementation in iframe Sandbox in Google Chrome prior to 105.0.5195.52 allowed a remote attacker to leak cross-origin data via a crafted HTML page.","scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"143.0.7499.169-1~deb12u1","bookworm-security":"145.0.7632.159-1~deb12u1"},"fixed_version":"105.0.5195.52-1","urgency":"not yet assigned"},"bullseye":{"status":"resolved","repositories":{"bullseye":"120.0.6099.224-1~deb11u1","bullseye-security":"120.0.6099.224-1~deb11u1"},"fixed_version":"105.0.5195.52-1~deb11u1","urgency":"not yet assigned"},"forky":{"status":"resolved","repositories":{"forky":"145.0.7632.159-1"},"fixed_version":"105.0.5195.52-1","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"146.0.7680.71-1"},"fixed_version":"105.0.5195.52-1","urgency":"not yet assigned"},"trixie":{"status":"resolved","repositories":{"trixie":"143.0.7499.169-1~deb13u1","trixie-security":"145.0.7632.159-1~deb13u1"},"fixed_version":"105.0.5195.52-1","urgency":"not yet assigned"}}},"CVE-2022-3058":{"description":"Use after free in Sign-In Flow in Google Chrome prior to 105.0.5195.52 allowed a remote attacker who convinced a user to engage in specific UI interactions to potentially exploit heap corruption via crafted UI interaction.","scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"143.0.7499.169-1~deb12u1","bookworm-security":"145.0.7632.159-1~deb12u1"},"fixed_version":"105.0.5195.52-1","urgency":"not yet assigned"},"bullseye":{"status":"resolved","repositories":{"bullseye":"120.0.6099.224-1~deb11u1","bullseye-security":"120.0.6099.224-1~deb11u1"},"fixed_version":"105.0.5195.52-1~deb11u1","urgency":"not yet assigned"},"forky":{"status":"resolved","repositories":{"forky":"145.0.7632.159-1"},"fixed_version":"105.0.5195.52-1","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"146.0.7680.71-1"},"fixed_version":"105.0.5195.52-1","urgency":"not yet assigned"},"trixie":{"status":"resolved","repositories":{"trixie":"143.0.7499.169-1~deb13u1","trixie-security":"145.0.7632.159-1~deb13u1"},"fixed_version":"105.0.5195.52-1","urgency":"not yet assigned"}}},"CVE-2022-3071":{"description":"Use after free in Tab Strip in Google Chrome on Chrome OS, Lacros prior to 105.0.5195.52 allowed a remote attacker who convinced a user to engage in specific UI interactions to potentially exploit heap corruption via crafted UI interaction.","scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"143.0.7499.169-1~deb12u1","bookworm-security":"145.0.7632.159-1~deb12u1"},"fixed_version":"105.0.5195.52-1","urgency":"not yet assigned"},"bullseye":{"status":"resolved","repositories":{"bullseye":"120.0.6099.224-1~deb11u1","bullseye-security":"120.0.6099.224-1~deb11u1"},"fixed_version":"105.0.5195.52-1~deb11u1","urgency":"not yet assigned"},"forky":{"status":"resolved","repositories":{"forky":"145.0.7632.159-1"},"fixed_version":"105.0.5195.52-1","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"146.0.7680.71-1"},"fixed_version":"105.0.5195.52-1","urgency":"not yet assigned"},"trixie":{"status":"resolved","repositories":{"trixie":"143.0.7499.169-1~deb13u1","trixie-security":"145.0.7632.159-1~deb13u1"},"fixed_version":"105.0.5195.52-1","urgency":"not yet assigned"}}},"CVE-2022-3075":{"description":"Insufficient data validation in Mojo in Google Chrome prior to 105.0.5195.102 allowed a remote attacker who had compromised the renderer process to potentially perform a sandbox escape via a crafted HTML page.","scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"143.0.7499.169-1~deb12u1","bookworm-security":"145.0.7632.159-1~deb12u1"},"fixed_version":"105.0.5195.102-1","urgency":"not yet assigned"},"bullseye":{"status":"resolved","repositories":{"bullseye":"120.0.6099.224-1~deb11u1","bullseye-security":"120.0.6099.224-1~deb11u1"},"fixed_version":"105.0.5195.102-1~deb11u1","urgency":"not yet assigned"},"forky":{"status":"resolved","repositories":{"forky":"145.0.7632.159-1"},"fixed_version":"105.0.5195.102-1","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"146.0.7680.71-1"},"fixed_version":"105.0.5195.102-1","urgency":"not yet assigned"},"trixie":{"status":"resolved","repositories":{"trixie":"143.0.7499.169-1~deb13u1","trixie-security":"145.0.7632.159-1~deb13u1"},"fixed_version":"105.0.5195.102-1","urgency":"not yet assigned"}}},"CVE-2022-3195":{"description":"Out of bounds write in Storage in Google Chrome prior to 105.0.5195.125 allowed a remote attacker to perform an out of bounds memory write via a crafted HTML page. (Chromium security severity: High)","scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"143.0.7499.169-1~deb12u1","bookworm-security":"145.0.7632.159-1~deb12u1"},"fixed_version":"105.0.5195.125-1","urgency":"not yet assigned"},"bullseye":{"status":"resolved","repositories":{"bullseye":"120.0.6099.224-1~deb11u1","bullseye-security":"120.0.6099.224-1~deb11u1"},"fixed_version":"105.0.5195.125-1~deb11u1","urgency":"not yet assigned"},"forky":{"status":"resolved","repositories":{"forky":"145.0.7632.159-1"},"fixed_version":"105.0.5195.125-1","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"146.0.7680.71-1"},"fixed_version":"105.0.5195.125-1","urgency":"not yet assigned"},"trixie":{"status":"resolved","repositories":{"trixie":"143.0.7499.169-1~deb13u1","trixie-security":"145.0.7632.159-1~deb13u1"},"fixed_version":"105.0.5195.125-1","urgency":"not yet assigned"}}},"CVE-2022-3196":{"description":"Use after free in PDF in Google Chrome prior to 105.0.5195.125 allowed a remote attacker to potentially exploit heap corruption via a crafted PDF file. (Chromium security severity: High)","scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"143.0.7499.169-1~deb12u1","bookworm-security":"145.0.7632.159-1~deb12u1"},"fixed_version":"105.0.5195.125-1","urgency":"not yet assigned"},"bullseye":{"status":"resolved","repositories":{"bullseye":"120.0.6099.224-1~deb11u1","bullseye-security":"120.0.6099.224-1~deb11u1"},"fixed_version":"105.0.5195.125-1~deb11u1","urgency":"not yet assigned"},"forky":{"status":"resolved","repositories":{"forky":"145.0.7632.159-1"},"fixed_version":"105.0.5195.125-1","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"146.0.7680.71-1"},"fixed_version":"105.0.5195.125-1","urgency":"not yet assigned"},"trixie":{"status":"resolved","repositories":{"trixie":"143.0.7499.169-1~deb13u1","trixie-security":"145.0.7632.159-1~deb13u1"},"fixed_version":"105.0.5195.125-1","urgency":"not yet assigned"}}},"CVE-2022-3197":{"description":"Use after free in PDF in Google Chrome prior to 105.0.5195.125 allowed a remote attacker to potentially exploit heap corruption via a crafted PDF file. (Chromium security severity: High)","scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"143.0.7499.169-1~deb12u1","bookworm-security":"145.0.7632.159-1~deb12u1"},"fixed_version":"105.0.5195.125-1","urgency":"not yet assigned"},"bullseye":{"status":"resolved","repositories":{"bullseye":"120.0.6099.224-1~deb11u1","bullseye-security":"120.0.6099.224-1~deb11u1"},"fixed_version":"105.0.5195.125-1~deb11u1","urgency":"not yet assigned"},"forky":{"status":"resolved","repositories":{"forky":"145.0.7632.159-1"},"fixed_version":"105.0.5195.125-1","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"146.0.7680.71-1"},"fixed_version":"105.0.5195.125-1","urgency":"not yet assigned"},"trixie":{"status":"resolved","repositories":{"trixie":"143.0.7499.169-1~deb13u1","trixie-security":"145.0.7632.159-1~deb13u1"},"fixed_version":"105.0.5195.125-1","urgency":"not yet assigned"}}},"CVE-2022-3198":{"description":"Use after free in PDF in Google Chrome prior to 105.0.5195.125 allowed a remote attacker to potentially exploit heap corruption via a crafted PDF file. (Chromium security severity: High)","scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"143.0.7499.169-1~deb12u1","bookworm-security":"145.0.7632.159-1~deb12u1"},"fixed_version":"105.0.5195.125-1","urgency":"not yet assigned"},"bullseye":{"status":"resolved","repositories":{"bullseye":"120.0.6099.224-1~deb11u1","bullseye-security":"120.0.6099.224-1~deb11u1"},"fixed_version":"105.0.5195.125-1~deb11u1","urgency":"not yet assigned"},"forky":{"status":"resolved","repositories":{"forky":"145.0.7632.159-1"},"fixed_version":"105.0.5195.125-1","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"146.0.7680.71-1"},"fixed_version":"105.0.5195.125-1","urgency":"not yet assigned"},"trixie":{"status":"resolved","repositories":{"trixie":"143.0.7499.169-1~deb13u1","trixie-security":"145.0.7632.159-1~deb13u1"},"fixed_version":"105.0.5195.125-1","urgency":"not yet assigned"}}},"CVE-2022-3199":{"description":"Use after free in Frames in Google Chrome prior to 105.0.5195.125 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. (Chromium security severity: High)","scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"143.0.7499.169-1~deb12u1","bookworm-security":"145.0.7632.159-1~deb12u1"},"fixed_version":"105.0.5195.125-1","urgency":"not yet assigned"},"bullseye":{"status":"resolved","repositories":{"bullseye":"120.0.6099.224-1~deb11u1","bullseye-security":"120.0.6099.224-1~deb11u1"},"fixed_version":"105.0.5195.125-1~deb11u1","urgency":"not yet assigned"},"forky":{"status":"resolved","repositories":{"forky":"145.0.7632.159-1"},"fixed_version":"105.0.5195.125-1","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"146.0.7680.71-1"},"fixed_version":"105.0.5195.125-1","urgency":"not yet assigned"},"trixie":{"status":"resolved","repositories":{"trixie":"143.0.7499.169-1~deb13u1","trixie-security":"145.0.7632.159-1~deb13u1"},"fixed_version":"105.0.5195.125-1","urgency":"not yet assigned"}}},"CVE-2022-3200":{"description":"Heap buffer overflow in Internals in Google Chrome prior to 105.0.5195.125 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. (Chromium security severity: High)","scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"143.0.7499.169-1~deb12u1","bookworm-security":"145.0.7632.159-1~deb12u1"},"fixed_version":"105.0.5195.125-1","urgency":"not yet assigned"},"bullseye":{"status":"resolved","repositories":{"bullseye":"120.0.6099.224-1~deb11u1","bullseye-security":"120.0.6099.224-1~deb11u1"},"fixed_version":"105.0.5195.125-1~deb11u1","urgency":"not yet assigned"},"forky":{"status":"resolved","repositories":{"forky":"145.0.7632.159-1"},"fixed_version":"105.0.5195.125-1","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"146.0.7680.71-1"},"fixed_version":"105.0.5195.125-1","urgency":"not yet assigned"},"trixie":{"status":"resolved","repositories":{"trixie":"143.0.7499.169-1~deb13u1","trixie-security":"145.0.7632.159-1~deb13u1"},"fixed_version":"105.0.5195.125-1","urgency":"not yet assigned"}}},"CVE-2022-3201":{"description":"Insufficient validation of untrusted input in DevTools in Google Chrome on Chrome OS prior to 105.0.5195.125 allowed an attacker who convinced a user to install a malicious extension to bypass navigation restrictions via a crafted HTML page. (Chromium security severity: High)","scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"143.0.7499.169-1~deb12u1","bookworm-security":"145.0.7632.159-1~deb12u1"},"fixed_version":"106.0.5249.61-1","urgency":"not yet assigned"},"bullseye":{"status":"resolved","repositories":{"bullseye":"120.0.6099.224-1~deb11u1","bullseye-security":"120.0.6099.224-1~deb11u1"},"fixed_version":"106.0.5249.61-1~deb11u1","urgency":"not yet assigned"},"forky":{"status":"resolved","repositories":{"forky":"145.0.7632.159-1"},"fixed_version":"106.0.5249.61-1","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"146.0.7680.71-1"},"fixed_version":"106.0.5249.61-1","urgency":"not yet assigned"},"trixie":{"status":"resolved","repositories":{"trixie":"143.0.7499.169-1~deb13u1","trixie-security":"145.0.7632.159-1~deb13u1"},"fixed_version":"106.0.5249.61-1","urgency":"not yet assigned"}}},"CVE-2022-3304":{"description":"Use after free in CSS in Google Chrome prior to 106.0.5249.62 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. (Chromium security severity: High)","scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"143.0.7499.169-1~deb12u1","bookworm-security":"145.0.7632.159-1~deb12u1"},"fixed_version":"106.0.5249.61-1","urgency":"not yet assigned"},"bullseye":{"status":"resolved","repositories":{"bullseye":"120.0.6099.224-1~deb11u1","bullseye-security":"120.0.6099.224-1~deb11u1"},"fixed_version":"106.0.5249.61-1~deb11u1","urgency":"not yet assigned"},"forky":{"status":"resolved","repositories":{"forky":"145.0.7632.159-1"},"fixed_version":"106.0.5249.61-1","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"146.0.7680.71-1"},"fixed_version":"106.0.5249.61-1","urgency":"not yet assigned"},"trixie":{"status":"resolved","repositories":{"trixie":"143.0.7499.169-1~deb13u1","trixie-security":"145.0.7632.159-1~deb13u1"},"fixed_version":"106.0.5249.61-1","urgency":"not yet assigned"}}},"CVE-2022-3305":{"description":"Use after free in survey in Google Chrome on ChromeOS prior to 106.0.5249.62 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. (Chromium security severity: High)","scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"143.0.7499.169-1~deb12u1","bookworm-security":"145.0.7632.159-1~deb12u1"},"fixed_version":"106.0.5249.61-1","urgency":"not yet assigned"},"bullseye":{"status":"resolved","repositories":{"bullseye":"120.0.6099.224-1~deb11u1","bullseye-security":"120.0.6099.224-1~deb11u1"},"fixed_version":"106.0.5249.61-1~deb11u1","urgency":"not yet assigned"},"forky":{"status":"resolved","repositories":{"forky":"145.0.7632.159-1"},"fixed_version":"106.0.5249.61-1","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"146.0.7680.71-1"},"fixed_version":"106.0.5249.61-1","urgency":"not yet assigned"},"trixie":{"status":"resolved","repositories":{"trixie":"143.0.7499.169-1~deb13u1","trixie-security":"145.0.7632.159-1~deb13u1"},"fixed_version":"106.0.5249.61-1","urgency":"not yet assigned"}}},"CVE-2022-3306":{"description":"Use after free in survey in Google Chrome on ChromeOS prior to 106.0.5249.62 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. (Chromium security severity: High)","scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"143.0.7499.169-1~deb12u1","bookworm-security":"145.0.7632.159-1~deb12u1"},"fixed_version":"106.0.5249.61-1","urgency":"not yet assigned"},"bullseye":{"status":"resolved","repositories":{"bullseye":"120.0.6099.224-1~deb11u1","bullseye-security":"120.0.6099.224-1~deb11u1"},"fixed_version":"106.0.5249.61-1~deb11u1","urgency":"not yet assigned"},"forky":{"status":"resolved","repositories":{"forky":"145.0.7632.159-1"},"fixed_version":"106.0.5249.61-1","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"146.0.7680.71-1"},"fixed_version":"106.0.5249.61-1","urgency":"not yet assigned"},"trixie":{"status":"resolved","repositories":{"trixie":"143.0.7499.169-1~deb13u1","trixie-security":"145.0.7632.159-1~deb13u1"},"fixed_version":"106.0.5249.61-1","urgency":"not yet assigned"}}},"CVE-2022-3307":{"description":"Use after free in media in Google Chrome prior to 106.0.5249.62 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. (Chromium security severity: High)","scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"143.0.7499.169-1~deb12u1","bookworm-security":"145.0.7632.159-1~deb12u1"},"fixed_version":"106.0.5249.61-1","urgency":"not yet assigned"},"bullseye":{"status":"resolved","repositories":{"bullseye":"120.0.6099.224-1~deb11u1","bullseye-security":"120.0.6099.224-1~deb11u1"},"fixed_version":"106.0.5249.61-1~deb11u1","urgency":"not yet assigned"},"forky":{"status":"resolved","repositories":{"forky":"145.0.7632.159-1"},"fixed_version":"106.0.5249.61-1","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"146.0.7680.71-1"},"fixed_version":"106.0.5249.61-1","urgency":"not yet assigned"},"trixie":{"status":"resolved","repositories":{"trixie":"143.0.7499.169-1~deb13u1","trixie-security":"145.0.7632.159-1~deb13u1"},"fixed_version":"106.0.5249.61-1","urgency":"not yet assigned"}}},"CVE-2022-3308":{"description":"Insufficient policy enforcement in developer tools in Google Chrome prior to 106.0.5249.62 allowed a remote attacker to potentially perform a sandbox escape via a crafted HTML page. (Chromium security severity: Medium)","scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"143.0.7499.169-1~deb12u1","bookworm-security":"145.0.7632.159-1~deb12u1"},"fixed_version":"106.0.5249.61-1","urgency":"not yet assigned"},"bullseye":{"status":"resolved","repositories":{"bullseye":"120.0.6099.224-1~deb11u1","bullseye-security":"120.0.6099.224-1~deb11u1"},"fixed_version":"106.0.5249.61-1~deb11u1","urgency":"not yet assigned"},"forky":{"status":"resolved","repositories":{"forky":"145.0.7632.159-1"},"fixed_version":"106.0.5249.61-1","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"146.0.7680.71-1"},"fixed_version":"106.0.5249.61-1","urgency":"not yet assigned"},"trixie":{"status":"resolved","repositories":{"trixie":"143.0.7499.169-1~deb13u1","trixie-security":"145.0.7632.159-1~deb13u1"},"fixed_version":"106.0.5249.61-1","urgency":"not yet assigned"}}},"CVE-2022-3309":{"description":"Use after free in assistant in Google Chrome on ChromeOS prior to 106.0.5249.62 allowed a remote attacker who convinced a user to engage in specific UI gestures to potentially perform a sandbox escape via specific UI gestures. (Chromium security severity: Medium)","scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"143.0.7499.169-1~deb12u1","bookworm-security":"145.0.7632.159-1~deb12u1"},"fixed_version":"106.0.5249.61-1","urgency":"not yet assigned"},"bullseye":{"status":"resolved","repositories":{"bullseye":"120.0.6099.224-1~deb11u1","bullseye-security":"120.0.6099.224-1~deb11u1"},"fixed_version":"106.0.5249.61-1~deb11u1","urgency":"not yet assigned"},"forky":{"status":"resolved","repositories":{"forky":"145.0.7632.159-1"},"fixed_version":"106.0.5249.61-1","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"146.0.7680.71-1"},"fixed_version":"106.0.5249.61-1","urgency":"not yet assigned"},"trixie":{"status":"resolved","repositories":{"trixie":"143.0.7499.169-1~deb13u1","trixie-security":"145.0.7632.159-1~deb13u1"},"fixed_version":"106.0.5249.61-1","urgency":"not yet assigned"}}},"CVE-2022-3310":{"description":"Insufficient policy enforcement in custom tabs in Google Chrome on Android prior to 106.0.5249.62 allowed an attacker who convinced the user to install an application to bypass same origin policy via a crafted application. (Chromium security severity: Medium)","scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"143.0.7499.169-1~deb12u1","bookworm-security":"145.0.7632.159-1~deb12u1"},"fixed_version":"106.0.5249.61-1","urgency":"not yet assigned"},"bullseye":{"status":"resolved","repositories":{"bullseye":"120.0.6099.224-1~deb11u1","bullseye-security":"120.0.6099.224-1~deb11u1"},"fixed_version":"106.0.5249.61-1~deb11u1","urgency":"not yet assigned"},"forky":{"status":"resolved","repositories":{"forky":"145.0.7632.159-1"},"fixed_version":"106.0.5249.61-1","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"146.0.7680.71-1"},"fixed_version":"106.0.5249.61-1","urgency":"not yet assigned"},"trixie":{"status":"resolved","repositories":{"trixie":"143.0.7499.169-1~deb13u1","trixie-security":"145.0.7632.159-1~deb13u1"},"fixed_version":"106.0.5249.61-1","urgency":"not yet assigned"}}},"CVE-2022-3311":{"description":"Use after free in import in Google Chrome prior to 106.0.5249.62 allowed a remote attacker who had compromised a WebUI process to potentially perform a sandbox escape via a crafted HTML page. (Chromium security severity: Medium)","scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"143.0.7499.169-1~deb12u1","bookworm-security":"145.0.7632.159-1~deb12u1"},"fixed_version":"106.0.5249.61-1","urgency":"not yet assigned"},"bullseye":{"status":"resolved","repositories":{"bullseye":"120.0.6099.224-1~deb11u1","bullseye-security":"120.0.6099.224-1~deb11u1"},"fixed_version":"106.0.5249.61-1~deb11u1","urgency":"not yet assigned"},"forky":{"status":"resolved","repositories":{"forky":"145.0.7632.159-1"},"fixed_version":"106.0.5249.61-1","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"146.0.7680.71-1"},"fixed_version":"106.0.5249.61-1","urgency":"not yet assigned"},"trixie":{"status":"resolved","repositories":{"trixie":"143.0.7499.169-1~deb13u1","trixie-security":"145.0.7632.159-1~deb13u1"},"fixed_version":"106.0.5249.61-1","urgency":"not yet assigned"}}},"CVE-2022-3312":{"description":"Insufficient validation of untrusted input in VPN in Google Chrome on ChromeOS prior to 106.0.5249.62 allowed a local attacker to bypass managed device restrictions via physical access to the device. (Chromium security severity: Medium)","scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"143.0.7499.169-1~deb12u1","bookworm-security":"145.0.7632.159-1~deb12u1"},"fixed_version":"106.0.5249.61-1","urgency":"not yet assigned"},"bullseye":{"status":"resolved","repositories":{"bullseye":"120.0.6099.224-1~deb11u1","bullseye-security":"120.0.6099.224-1~deb11u1"},"fixed_version":"106.0.5249.61-1~deb11u1","urgency":"not yet assigned"},"forky":{"status":"resolved","repositories":{"forky":"145.0.7632.159-1"},"fixed_version":"106.0.5249.61-1","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"146.0.7680.71-1"},"fixed_version":"106.0.5249.61-1","urgency":"not yet assigned"},"trixie":{"status":"resolved","repositories":{"trixie":"143.0.7499.169-1~deb13u1","trixie-security":"145.0.7632.159-1~deb13u1"},"fixed_version":"106.0.5249.61-1","urgency":"not yet assigned"}}},"CVE-2022-3313":{"description":"Incorrect security UI in full screen in Google Chrome prior to 106.0.5249.62 allowed a remote attacker to spoof security UI via a crafted HTML page. (Chromium security severity: Medium)","scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"143.0.7499.169-1~deb12u1","bookworm-security":"145.0.7632.159-1~deb12u1"},"fixed_version":"106.0.5249.61-1","urgency":"not yet assigned"},"bullseye":{"status":"resolved","repositories":{"bullseye":"120.0.6099.224-1~deb11u1","bullseye-security":"120.0.6099.224-1~deb11u1"},"fixed_version":"106.0.5249.61-1~deb11u1","urgency":"not yet assigned"},"forky":{"status":"resolved","repositories":{"forky":"145.0.7632.159-1"},"fixed_version":"106.0.5249.61-1","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"146.0.7680.71-1"},"fixed_version":"106.0.5249.61-1","urgency":"not yet assigned"},"trixie":{"status":"resolved","repositories":{"trixie":"143.0.7499.169-1~deb13u1","trixie-security":"145.0.7632.159-1~deb13u1"},"fixed_version":"106.0.5249.61-1","urgency":"not yet assigned"}}},"CVE-2022-3314":{"description":"Use after free in logging in Google Chrome prior to 106.0.5249.62 allowed a remote attacker who had compromised a WebUI process to potentially perform a sandbox escape via a crafted HTML page. (Chromium security severity: Medium)","scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"143.0.7499.169-1~deb12u1","bookworm-security":"145.0.7632.159-1~deb12u1"},"fixed_version":"106.0.5249.61-1","urgency":"not yet assigned"},"bullseye":{"status":"resolved","repositories":{"bullseye":"120.0.6099.224-1~deb11u1","bullseye-security":"120.0.6099.224-1~deb11u1"},"fixed_version":"106.0.5249.61-1~deb11u1","urgency":"not yet assigned"},"forky":{"status":"resolved","repositories":{"forky":"145.0.7632.159-1"},"fixed_version":"106.0.5249.61-1","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"146.0.7680.71-1"},"fixed_version":"106.0.5249.61-1","urgency":"not yet assigned"},"trixie":{"status":"resolved","repositories":{"trixie":"143.0.7499.169-1~deb13u1","trixie-security":"145.0.7632.159-1~deb13u1"},"fixed_version":"106.0.5249.61-1","urgency":"not yet assigned"}}},"CVE-2022-3315":{"description":"Type confusion in Blink in Google Chrome prior to 106.0.5249.62 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. (Chromium security severity: Low)","scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"143.0.7499.169-1~deb12u1","bookworm-security":"145.0.7632.159-1~deb12u1"},"fixed_version":"106.0.5249.61-1","urgency":"not yet assigned"},"bullseye":{"status":"resolved","repositories":{"bullseye":"120.0.6099.224-1~deb11u1","bullseye-security":"120.0.6099.224-1~deb11u1"},"fixed_version":"106.0.5249.61-1~deb11u1","urgency":"not yet assigned"},"forky":{"status":"resolved","repositories":{"forky":"145.0.7632.159-1"},"fixed_version":"106.0.5249.61-1","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"146.0.7680.71-1"},"fixed_version":"106.0.5249.61-1","urgency":"not yet assigned"},"trixie":{"status":"resolved","repositories":{"trixie":"143.0.7499.169-1~deb13u1","trixie-security":"145.0.7632.159-1~deb13u1"},"fixed_version":"106.0.5249.61-1","urgency":"not yet assigned"}}},"CVE-2022-3316":{"description":"Insufficient validation of untrusted input in Safe Browsing in Google Chrome prior to 106.0.5249.62 allowed a remote attacker to bypass security feature via a crafted HTML page. (Chromium security severity: Low)","scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"143.0.7499.169-1~deb12u1","bookworm-security":"145.0.7632.159-1~deb12u1"},"fixed_version":"106.0.5249.61-1","urgency":"not yet assigned"},"bullseye":{"status":"resolved","repositories":{"bullseye":"120.0.6099.224-1~deb11u1","bullseye-security":"120.0.6099.224-1~deb11u1"},"fixed_version":"106.0.5249.61-1~deb11u1","urgency":"not yet assigned"},"forky":{"status":"resolved","repositories":{"forky":"145.0.7632.159-1"},"fixed_version":"106.0.5249.61-1","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"146.0.7680.71-1"},"fixed_version":"106.0.5249.61-1","urgency":"not yet assigned"},"trixie":{"status":"resolved","repositories":{"trixie":"143.0.7499.169-1~deb13u1","trixie-security":"145.0.7632.159-1~deb13u1"},"fixed_version":"106.0.5249.61-1","urgency":"not yet assigned"}}},"CVE-2022-3317":{"description":"Insufficient validation of untrusted input in Intents in Google Chrome on Android prior to 106.0.5249.62 allowed a remote attacker to bypass navigation restrictions via a crafted HTML page. (Chromium security severity: Low)","scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"143.0.7499.169-1~deb12u1","bookworm-security":"145.0.7632.159-1~deb12u1"},"fixed_version":"106.0.5249.61-1","urgency":"not yet assigned"},"bullseye":{"status":"resolved","repositories":{"bullseye":"120.0.6099.224-1~deb11u1","bullseye-security":"120.0.6099.224-1~deb11u1"},"fixed_version":"106.0.5249.61-1~deb11u1","urgency":"not yet assigned"},"forky":{"status":"resolved","repositories":{"forky":"145.0.7632.159-1"},"fixed_version":"106.0.5249.61-1","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"146.0.7680.71-1"},"fixed_version":"106.0.5249.61-1","urgency":"not yet assigned"},"trixie":{"status":"resolved","repositories":{"trixie":"143.0.7499.169-1~deb13u1","trixie-security":"145.0.7632.159-1~deb13u1"},"fixed_version":"106.0.5249.61-1","urgency":"not yet assigned"}}},"CVE-2022-3318":{"description":"Use after free in ChromeOS Notifications in Google Chrome on ChromeOS prior to 106.0.5249.62 allowed a remote attacker who convinced a user to reboot Chrome OS to potentially exploit heap corruption via UI interaction. (Chromium security severity: Low)","scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"143.0.7499.169-1~deb12u1","bookworm-security":"145.0.7632.159-1~deb12u1"},"fixed_version":"106.0.5249.61-1","urgency":"not yet assigned"},"bullseye":{"status":"resolved","repositories":{"bullseye":"120.0.6099.224-1~deb11u1","bullseye-security":"120.0.6099.224-1~deb11u1"},"fixed_version":"106.0.5249.61-1~deb11u1","urgency":"not yet assigned"},"forky":{"status":"resolved","repositories":{"forky":"145.0.7632.159-1"},"fixed_version":"106.0.5249.61-1","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"146.0.7680.71-1"},"fixed_version":"106.0.5249.61-1","urgency":"not yet assigned"},"trixie":{"status":"resolved","repositories":{"trixie":"143.0.7499.169-1~deb13u1","trixie-security":"145.0.7632.159-1~deb13u1"},"fixed_version":"106.0.5249.61-1","urgency":"not yet assigned"}}},"CVE-2022-3370":{"description":"Use after free in Custom Elements in Google Chrome prior to 106.0.5249.91 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. (Chromium security severity: High)","scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"143.0.7499.169-1~deb12u1","bookworm-security":"145.0.7632.159-1~deb12u1"},"fixed_version":"106.0.5249.91-1","urgency":"not yet assigned"},"bullseye":{"status":"resolved","repositories":{"bullseye":"120.0.6099.224-1~deb11u1","bullseye-security":"120.0.6099.224-1~deb11u1"},"fixed_version":"106.0.5249.91-1~deb11u1","urgency":"not yet assigned"},"forky":{"status":"resolved","repositories":{"forky":"145.0.7632.159-1"},"fixed_version":"106.0.5249.91-1","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"146.0.7680.71-1"},"fixed_version":"106.0.5249.91-1","urgency":"not yet assigned"},"trixie":{"status":"resolved","repositories":{"trixie":"143.0.7499.169-1~deb13u1","trixie-security":"145.0.7632.159-1~deb13u1"},"fixed_version":"106.0.5249.91-1","urgency":"not yet assigned"}}},"CVE-2022-3373":{"description":"Out of bounds write in V8 in Google Chrome prior to 106.0.5249.91 allowed a remote attacker to perform an out of bounds memory write via a crafted HTML page. (Chromium security severity: High)","scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"143.0.7499.169-1~deb12u1","bookworm-security":"145.0.7632.159-1~deb12u1"},"fixed_version":"106.0.5249.91-1","urgency":"not yet assigned"},"bullseye":{"status":"resolved","repositories":{"bullseye":"120.0.6099.224-1~deb11u1","bullseye-security":"120.0.6099.224-1~deb11u1"},"fixed_version":"106.0.5249.91-1~deb11u1","urgency":"not yet assigned"},"forky":{"status":"resolved","repositories":{"forky":"145.0.7632.159-1"},"fixed_version":"106.0.5249.91-1","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"146.0.7680.71-1"},"fixed_version":"106.0.5249.91-1","urgency":"not yet assigned"},"trixie":{"status":"resolved","repositories":{"trixie":"143.0.7499.169-1~deb13u1","trixie-security":"145.0.7632.159-1~deb13u1"},"fixed_version":"106.0.5249.91-1","urgency":"not yet assigned"}}},"CVE-2022-3443":{"description":"Insufficient data validation in File System API in Google Chrome prior to 106.0.5249.62 allowed a remote attacker to bypass File System restrictions via a crafted HTML page. (Chromium security severity: Low)","scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"143.0.7499.169-1~deb12u1","bookworm-security":"145.0.7632.159-1~deb12u1"},"fixed_version":"106.0.5249.61-1","urgency":"not yet assigned"},"bullseye":{"status":"resolved","repositories":{"bullseye":"120.0.6099.224-1~deb11u1","bullseye-security":"120.0.6099.224-1~deb11u1"},"fixed_version":"106.0.5249.61-1~deb11u1","urgency":"not yet assigned"},"forky":{"status":"resolved","repositories":{"forky":"145.0.7632.159-1"},"fixed_version":"106.0.5249.61-1","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"146.0.7680.71-1"},"fixed_version":"106.0.5249.61-1","urgency":"not yet assigned"},"trixie":{"status":"resolved","repositories":{"trixie":"143.0.7499.169-1~deb13u1","trixie-security":"145.0.7632.159-1~deb13u1"},"fixed_version":"106.0.5249.61-1","urgency":"not yet assigned"}}},"CVE-2022-3444":{"description":"Insufficient data validation in File System API in Google Chrome prior to 106.0.5249.62 allowed a remote attacker to bypass File System restrictions via a crafted HTML page and malicious file. (Chromium security severity: Low)","scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"143.0.7499.169-1~deb12u1","bookworm-security":"145.0.7632.159-1~deb12u1"},"fixed_version":"106.0.5249.61-1","urgency":"not yet assigned"},"bullseye":{"status":"resolved","repositories":{"bullseye":"120.0.6099.224-1~deb11u1","bullseye-security":"120.0.6099.224-1~deb11u1"},"fixed_version":"106.0.5249.61-1~deb11u1","urgency":"not yet assigned"},"forky":{"status":"resolved","repositories":{"forky":"145.0.7632.159-1"},"fixed_version":"106.0.5249.61-1","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"146.0.7680.71-1"},"fixed_version":"106.0.5249.61-1","urgency":"not yet assigned"},"trixie":{"status":"resolved","repositories":{"trixie":"143.0.7499.169-1~deb13u1","trixie-security":"145.0.7632.159-1~deb13u1"},"fixed_version":"106.0.5249.61-1","urgency":"not yet assigned"}}},"CVE-2022-3445":{"description":"Use after free in Skia in Google Chrome prior to 106.0.5249.119 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. (Chromium security severity: High)","scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"143.0.7499.169-1~deb12u1","bookworm-security":"145.0.7632.159-1~deb12u1"},"fixed_version":"106.0.5249.119-1","urgency":"not yet assigned"},"bullseye":{"status":"resolved","repositories":{"bullseye":"120.0.6099.224-1~deb11u1","bullseye-security":"120.0.6099.224-1~deb11u1"},"fixed_version":"106.0.5249.119-1~deb11u1","urgency":"not yet assigned"},"forky":{"status":"resolved","repositories":{"forky":"145.0.7632.159-1"},"fixed_version":"106.0.5249.119-1","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"146.0.7680.71-1"},"fixed_version":"106.0.5249.119-1","urgency":"not yet assigned"},"trixie":{"status":"resolved","repositories":{"trixie":"143.0.7499.169-1~deb13u1","trixie-security":"145.0.7632.159-1~deb13u1"},"fixed_version":"106.0.5249.119-1","urgency":"not yet assigned"}}},"CVE-2022-3446":{"description":"Heap buffer overflow in WebSQL in Google Chrome prior to 106.0.5249.119 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. (Chromium security severity: High)","scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"143.0.7499.169-1~deb12u1","bookworm-security":"145.0.7632.159-1~deb12u1"},"fixed_version":"106.0.5249.119-1","urgency":"not yet assigned"},"bullseye":{"status":"resolved","repositories":{"bullseye":"120.0.6099.224-1~deb11u1","bullseye-security":"120.0.6099.224-1~deb11u1"},"fixed_version":"106.0.5249.119-1~deb11u1","urgency":"not yet assigned"},"forky":{"status":"resolved","repositories":{"forky":"145.0.7632.159-1"},"fixed_version":"106.0.5249.119-1","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"146.0.7680.71-1"},"fixed_version":"106.0.5249.119-1","urgency":"not yet assigned"},"trixie":{"status":"resolved","repositories":{"trixie":"143.0.7499.169-1~deb13u1","trixie-security":"145.0.7632.159-1~deb13u1"},"fixed_version":"106.0.5249.119-1","urgency":"not yet assigned"}}},"CVE-2022-3447":{"description":"Inappropriate implementation in Custom Tabs in Google Chrome on Android prior to 106.0.5249.119 allowed a remote attacker to spoof the contents of the Omnibox (URL bar) via a crafted HTML page. (Chromium security severity: High)","scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"143.0.7499.169-1~deb12u1","bookworm-security":"145.0.7632.159-1~deb12u1"},"fixed_version":"106.0.5249.119-1","urgency":"not yet assigned"},"bullseye":{"status":"resolved","repositories":{"bullseye":"120.0.6099.224-1~deb11u1","bullseye-security":"120.0.6099.224-1~deb11u1"},"fixed_version":"106.0.5249.119-1~deb11u1","urgency":"not yet assigned"},"forky":{"status":"resolved","repositories":{"forky":"145.0.7632.159-1"},"fixed_version":"106.0.5249.119-1","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"146.0.7680.71-1"},"fixed_version":"106.0.5249.119-1","urgency":"not yet assigned"},"trixie":{"status":"resolved","repositories":{"trixie":"143.0.7499.169-1~deb13u1","trixie-security":"145.0.7632.159-1~deb13u1"},"fixed_version":"106.0.5249.119-1","urgency":"not yet assigned"}}},"CVE-2022-3448":{"description":"Use after free in Permissions API in Google Chrome prior to 106.0.5249.119 allowed a remote attacker who convinced a user to engage in specific UI gestures to potentially exploit heap corruption via a crafted HTML page. (Chromium security severity: High)","scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"143.0.7499.169-1~deb12u1","bookworm-security":"145.0.7632.159-1~deb12u1"},"fixed_version":"106.0.5249.119-1","urgency":"not yet assigned"},"bullseye":{"status":"resolved","repositories":{"bullseye":"120.0.6099.224-1~deb11u1","bullseye-security":"120.0.6099.224-1~deb11u1"},"fixed_version":"106.0.5249.119-1~deb11u1","urgency":"not yet assigned"},"forky":{"status":"resolved","repositories":{"forky":"145.0.7632.159-1"},"fixed_version":"106.0.5249.119-1","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"146.0.7680.71-1"},"fixed_version":"106.0.5249.119-1","urgency":"not yet assigned"},"trixie":{"status":"resolved","repositories":{"trixie":"143.0.7499.169-1~deb13u1","trixie-security":"145.0.7632.159-1~deb13u1"},"fixed_version":"106.0.5249.119-1","urgency":"not yet assigned"}}},"CVE-2022-3449":{"description":"Use after free in Safe Browsing in Google Chrome prior to 106.0.5249.119 allowed an attacker who convinced a user to install a malicious extension to potentially exploit heap corruption via a crafted Chrome Extension. (Chromium security severity: High)","scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"143.0.7499.169-1~deb12u1","bookworm-security":"145.0.7632.159-1~deb12u1"},"fixed_version":"106.0.5249.119-1","urgency":"not yet assigned"},"bullseye":{"status":"resolved","repositories":{"bullseye":"120.0.6099.224-1~deb11u1","bullseye-security":"120.0.6099.224-1~deb11u1"},"fixed_version":"106.0.5249.119-1~deb11u1","urgency":"not yet assigned"},"forky":{"status":"resolved","repositories":{"forky":"145.0.7632.159-1"},"fixed_version":"106.0.5249.119-1","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"146.0.7680.71-1"},"fixed_version":"106.0.5249.119-1","urgency":"not yet assigned"},"trixie":{"status":"resolved","repositories":{"trixie":"143.0.7499.169-1~deb13u1","trixie-security":"145.0.7632.159-1~deb13u1"},"fixed_version":"106.0.5249.119-1","urgency":"not yet assigned"}}},"CVE-2022-3450":{"description":"Use after free in Peer Connection in Google Chrome prior to 106.0.5249.119 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. (Chromium security severity: High)","scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"143.0.7499.169-1~deb12u1","bookworm-security":"145.0.7632.159-1~deb12u1"},"fixed_version":"106.0.5249.119-1","urgency":"not yet assigned"},"bullseye":{"status":"resolved","repositories":{"bullseye":"120.0.6099.224-1~deb11u1","bullseye-security":"120.0.6099.224-1~deb11u1"},"fixed_version":"106.0.5249.119-1~deb11u1","urgency":"not yet assigned"},"forky":{"status":"resolved","repositories":{"forky":"145.0.7632.159-1"},"fixed_version":"106.0.5249.119-1","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"146.0.7680.71-1"},"fixed_version":"106.0.5249.119-1","urgency":"not yet assigned"},"trixie":{"status":"resolved","repositories":{"trixie":"143.0.7499.169-1~deb13u1","trixie-security":"145.0.7632.159-1~deb13u1"},"fixed_version":"106.0.5249.119-1","urgency":"not yet assigned"}}},"CVE-2022-3652":{"description":"Type confusion in V8 in Google Chrome prior to 107.0.5304.62 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. (Chromium security severity: High)","scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"143.0.7499.169-1~deb12u1","bookworm-security":"145.0.7632.159-1~deb12u1"},"fixed_version":"107.0.5304.68-1","urgency":"not yet assigned"},"bullseye":{"status":"resolved","repositories":{"bullseye":"120.0.6099.224-1~deb11u1","bullseye-security":"120.0.6099.224-1~deb11u1"},"fixed_version":"107.0.5304.68-1~deb11u1","urgency":"not yet assigned"},"forky":{"status":"resolved","repositories":{"forky":"145.0.7632.159-1"},"fixed_version":"107.0.5304.68-1","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"146.0.7680.71-1"},"fixed_version":"107.0.5304.68-1","urgency":"not yet assigned"},"trixie":{"status":"resolved","repositories":{"trixie":"143.0.7499.169-1~deb13u1","trixie-security":"145.0.7632.159-1~deb13u1"},"fixed_version":"107.0.5304.68-1","urgency":"not yet assigned"}}},"CVE-2022-3653":{"description":"Heap buffer overflow in Vulkan in Google Chrome prior to 107.0.5304.62 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. (Chromium security severity: High)","scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"143.0.7499.169-1~deb12u1","bookworm-security":"145.0.7632.159-1~deb12u1"},"fixed_version":"107.0.5304.68-1","urgency":"not yet assigned"},"bullseye":{"status":"resolved","repositories":{"bullseye":"120.0.6099.224-1~deb11u1","bullseye-security":"120.0.6099.224-1~deb11u1"},"fixed_version":"107.0.5304.68-1~deb11u1","urgency":"not yet assigned"},"forky":{"status":"resolved","repositories":{"forky":"145.0.7632.159-1"},"fixed_version":"107.0.5304.68-1","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"146.0.7680.71-1"},"fixed_version":"107.0.5304.68-1","urgency":"not yet assigned"},"trixie":{"status":"resolved","repositories":{"trixie":"143.0.7499.169-1~deb13u1","trixie-security":"145.0.7632.159-1~deb13u1"},"fixed_version":"107.0.5304.68-1","urgency":"not yet assigned"}}},"CVE-2022-3654":{"description":"Use after free in Layout in Google Chrome prior to 107.0.5304.62 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. (Chromium security severity: High)","scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"143.0.7499.169-1~deb12u1","bookworm-security":"145.0.7632.159-1~deb12u1"},"fixed_version":"107.0.5304.68-1","urgency":"not yet assigned"},"bullseye":{"status":"resolved","repositories":{"bullseye":"120.0.6099.224-1~deb11u1","bullseye-security":"120.0.6099.224-1~deb11u1"},"fixed_version":"107.0.5304.68-1~deb11u1","urgency":"not yet assigned"},"forky":{"status":"resolved","repositories":{"forky":"145.0.7632.159-1"},"fixed_version":"107.0.5304.68-1","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"146.0.7680.71-1"},"fixed_version":"107.0.5304.68-1","urgency":"not yet assigned"},"trixie":{"status":"resolved","repositories":{"trixie":"143.0.7499.169-1~deb13u1","trixie-security":"145.0.7632.159-1~deb13u1"},"fixed_version":"107.0.5304.68-1","urgency":"not yet assigned"}}},"CVE-2022-3655":{"description":"Heap buffer overflow in Media Galleries in Google Chrome prior to 107.0.5304.62 allowed an attacker who convinced a user to install a malicious extension to potentially exploit heap corruption via a crafted HTML page. (Chromium security severity: Medium)","scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"143.0.7499.169-1~deb12u1","bookworm-security":"145.0.7632.159-1~deb12u1"},"fixed_version":"107.0.5304.68-1","urgency":"not yet assigned"},"bullseye":{"status":"resolved","repositories":{"bullseye":"120.0.6099.224-1~deb11u1","bullseye-security":"120.0.6099.224-1~deb11u1"},"fixed_version":"107.0.5304.68-1~deb11u1","urgency":"not yet assigned"},"forky":{"status":"resolved","repositories":{"forky":"145.0.7632.159-1"},"fixed_version":"107.0.5304.68-1","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"146.0.7680.71-1"},"fixed_version":"107.0.5304.68-1","urgency":"not yet assigned"},"trixie":{"status":"resolved","repositories":{"trixie":"143.0.7499.169-1~deb13u1","trixie-security":"145.0.7632.159-1~deb13u1"},"fixed_version":"107.0.5304.68-1","urgency":"not yet assigned"}}},"CVE-2022-3656":{"description":"Insufficient data validation in File System in Google Chrome prior to 107.0.5304.62 allowed a remote attacker to bypass file system restrictions via a crafted HTML page. (Chromium security severity: Medium)","scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"143.0.7499.169-1~deb12u1","bookworm-security":"145.0.7632.159-1~deb12u1"},"fixed_version":"107.0.5304.68-1","urgency":"not yet assigned"},"bullseye":{"status":"resolved","repositories":{"bullseye":"120.0.6099.224-1~deb11u1","bullseye-security":"120.0.6099.224-1~deb11u1"},"fixed_version":"107.0.5304.68-1~deb11u1","urgency":"not yet assigned"},"forky":{"status":"resolved","repositories":{"forky":"145.0.7632.159-1"},"fixed_version":"107.0.5304.68-1","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"146.0.7680.71-1"},"fixed_version":"107.0.5304.68-1","urgency":"not yet assigned"},"trixie":{"status":"resolved","repositories":{"trixie":"143.0.7499.169-1~deb13u1","trixie-security":"145.0.7632.159-1~deb13u1"},"fixed_version":"107.0.5304.68-1","urgency":"not yet assigned"}}},"CVE-2022-3657":{"description":"Use after free in Extensions in Google Chrome prior to 107.0.5304.62 allowed an attacker who convinced a user to install a malicious extension to potentially exploit heap corruption via a crafted Chrome Extension. (Chromium security severity: Medium)","scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"143.0.7499.169-1~deb12u1","bookworm-security":"145.0.7632.159-1~deb12u1"},"fixed_version":"107.0.5304.68-1","urgency":"not yet assigned"},"bullseye":{"status":"resolved","repositories":{"bullseye":"120.0.6099.224-1~deb11u1","bullseye-security":"120.0.6099.224-1~deb11u1"},"fixed_version":"107.0.5304.68-1~deb11u1","urgency":"not yet assigned"},"forky":{"status":"resolved","repositories":{"forky":"145.0.7632.159-1"},"fixed_version":"107.0.5304.68-1","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"146.0.7680.71-1"},"fixed_version":"107.0.5304.68-1","urgency":"not yet assigned"},"trixie":{"status":"resolved","repositories":{"trixie":"143.0.7499.169-1~deb13u1","trixie-security":"145.0.7632.159-1~deb13u1"},"fixed_version":"107.0.5304.68-1","urgency":"not yet assigned"}}},"CVE-2022-3658":{"description":"Use after free in Feedback service on Chrome OS in Google Chrome on Chrome OS prior to 107.0.5304.62 allowed an attacker who convinced a user to install a malicious extension to potentially exploit heap corruption via specific UI interaction. (Chromium security severity: Medium)","scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"143.0.7499.169-1~deb12u1","bookworm-security":"145.0.7632.159-1~deb12u1"},"fixed_version":"107.0.5304.68-1","urgency":"not yet assigned"},"bullseye":{"status":"resolved","repositories":{"bullseye":"120.0.6099.224-1~deb11u1","bullseye-security":"120.0.6099.224-1~deb11u1"},"fixed_version":"107.0.5304.68-1~deb11u1","urgency":"not yet assigned"},"forky":{"status":"resolved","repositories":{"forky":"145.0.7632.159-1"},"fixed_version":"107.0.5304.68-1","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"146.0.7680.71-1"},"fixed_version":"107.0.5304.68-1","urgency":"not yet assigned"},"trixie":{"status":"resolved","repositories":{"trixie":"143.0.7499.169-1~deb13u1","trixie-security":"145.0.7632.159-1~deb13u1"},"fixed_version":"107.0.5304.68-1","urgency":"not yet assigned"}}},"CVE-2022-3659":{"description":"Use after free in Accessibility in Google Chrome on Chrome OS prior to 107.0.5304.62 allowed a remote attacker who convinced a user to engage in specific UI interactions to potentially exploit heap corruption via specific UI interactions. (Chromium security severity: Medium)","scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"143.0.7499.169-1~deb12u1","bookworm-security":"145.0.7632.159-1~deb12u1"},"fixed_version":"107.0.5304.68-1","urgency":"not yet assigned"},"bullseye":{"status":"resolved","repositories":{"bullseye":"120.0.6099.224-1~deb11u1","bullseye-security":"120.0.6099.224-1~deb11u1"},"fixed_version":"107.0.5304.68-1~deb11u1","urgency":"not yet assigned"},"forky":{"status":"resolved","repositories":{"forky":"145.0.7632.159-1"},"fixed_version":"107.0.5304.68-1","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"146.0.7680.71-1"},"fixed_version":"107.0.5304.68-1","urgency":"not yet assigned"},"trixie":{"status":"resolved","repositories":{"trixie":"143.0.7499.169-1~deb13u1","trixie-security":"145.0.7632.159-1~deb13u1"},"fixed_version":"107.0.5304.68-1","urgency":"not yet assigned"}}},"CVE-2022-3660":{"description":"Inappropriate implementation in Full screen mode in Google Chrome on Android prior to 107.0.5304.62 allowed a remote attacker to hide the contents of the Omnibox (URL bar) via a crafted HTML page. (Chromium security severity: Medium)","scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"143.0.7499.169-1~deb12u1","bookworm-security":"145.0.7632.159-1~deb12u1"},"fixed_version":"107.0.5304.68-1","urgency":"not yet assigned"},"bullseye":{"status":"resolved","repositories":{"bullseye":"120.0.6099.224-1~deb11u1","bullseye-security":"120.0.6099.224-1~deb11u1"},"fixed_version":"107.0.5304.68-1~deb11u1","urgency":"not yet assigned"},"forky":{"status":"resolved","repositories":{"forky":"145.0.7632.159-1"},"fixed_version":"107.0.5304.68-1","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"146.0.7680.71-1"},"fixed_version":"107.0.5304.68-1","urgency":"not yet assigned"},"trixie":{"status":"resolved","repositories":{"trixie":"143.0.7499.169-1~deb13u1","trixie-security":"145.0.7632.159-1~deb13u1"},"fixed_version":"107.0.5304.68-1","urgency":"not yet assigned"}}},"CVE-2022-3661":{"description":"Insufficient data validation in Extensions in Google Chrome prior to 107.0.5304.62 allowed a remote attacker who had compromised the renderer process to leak cross-origin data via a crafted Chrome extension. (Chromium security severity: Low)","scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"143.0.7499.169-1~deb12u1","bookworm-security":"145.0.7632.159-1~deb12u1"},"fixed_version":"107.0.5304.68-1","urgency":"not yet assigned"},"bullseye":{"status":"resolved","repositories":{"bullseye":"120.0.6099.224-1~deb11u1","bullseye-security":"120.0.6099.224-1~deb11u1"},"fixed_version":"107.0.5304.68-1~deb11u1","urgency":"not yet assigned"},"forky":{"status":"resolved","repositories":{"forky":"145.0.7632.159-1"},"fixed_version":"107.0.5304.68-1","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"146.0.7680.71-1"},"fixed_version":"107.0.5304.68-1","urgency":"not yet assigned"},"trixie":{"status":"resolved","repositories":{"trixie":"143.0.7499.169-1~deb13u1","trixie-security":"145.0.7632.159-1~deb13u1"},"fixed_version":"107.0.5304.68-1","urgency":"not yet assigned"}}},"CVE-2022-3723":{"description":"Type confusion in V8 in Google Chrome prior to 107.0.5304.87 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. (Chromium security severity: High)","scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"143.0.7499.169-1~deb12u1","bookworm-security":"145.0.7632.159-1~deb12u1"},"fixed_version":"107.0.5304.87-1","urgency":"not yet assigned"},"bullseye":{"status":"resolved","repositories":{"bullseye":"120.0.6099.224-1~deb11u1","bullseye-security":"120.0.6099.224-1~deb11u1"},"fixed_version":"107.0.5304.87-1~deb11u1","urgency":"not yet assigned"},"forky":{"status":"resolved","repositories":{"forky":"145.0.7632.159-1"},"fixed_version":"107.0.5304.87-1","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"146.0.7680.71-1"},"fixed_version":"107.0.5304.87-1","urgency":"not yet assigned"},"trixie":{"status":"resolved","repositories":{"trixie":"143.0.7499.169-1~deb13u1","trixie-security":"145.0.7632.159-1~deb13u1"},"fixed_version":"107.0.5304.87-1","urgency":"not yet assigned"}}},"CVE-2022-3842":{"description":"Use after free in Passwords in Google Chrome prior to 105.0.5195.125 allowed a remote attacker who had compromised the renderer process to potentially exploit heap corruption via a crafted HTML page. (Chromium security severity: High)","scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"143.0.7499.169-1~deb12u1","bookworm-security":"145.0.7632.159-1~deb12u1"},"fixed_version":"105.0.5195.125-1","urgency":"not yet assigned"},"bullseye":{"status":"resolved","repositories":{"bullseye":"120.0.6099.224-1~deb11u1","bullseye-security":"120.0.6099.224-1~deb11u1"},"fixed_version":"105.0.5195.125-1~deb11u1","urgency":"not yet assigned"},"forky":{"status":"resolved","repositories":{"forky":"145.0.7632.159-1"},"fixed_version":"105.0.5195.125-1","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"146.0.7680.71-1"},"fixed_version":"105.0.5195.125-1","urgency":"not yet assigned"},"trixie":{"status":"resolved","repositories":{"trixie":"143.0.7499.169-1~deb13u1","trixie-security":"145.0.7632.159-1~deb13u1"},"fixed_version":"105.0.5195.125-1","urgency":"not yet assigned"}}},"CVE-2022-3863":{"description":"Use after free in Browser History in Google Chrome prior to 100.0.4896.75 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. (Chrome security severity: High)","scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"143.0.7499.169-1~deb12u1","bookworm-security":"145.0.7632.159-1~deb12u1"},"fixed_version":"100.0.4896.75-1","urgency":"not yet assigned"},"bullseye":{"status":"resolved","repositories":{"bullseye":"120.0.6099.224-1~deb11u1","bullseye-security":"120.0.6099.224-1~deb11u1"},"fixed_version":"100.0.4896.75-1~deb11u1","urgency":"not yet assigned"},"forky":{"status":"resolved","repositories":{"forky":"145.0.7632.159-1"},"fixed_version":"100.0.4896.75-1","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"146.0.7680.71-1"},"fixed_version":"100.0.4896.75-1","urgency":"not yet assigned"},"trixie":{"status":"resolved","repositories":{"trixie":"143.0.7499.169-1~deb13u1","trixie-security":"145.0.7632.159-1~deb13u1"},"fixed_version":"100.0.4896.75-1","urgency":"not yet assigned"}}},"CVE-2022-3885":{"description":"Use after free in V8 in Google Chrome prior to 107.0.5304.106 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. (Chromium security severity: High)","scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"143.0.7499.169-1~deb12u1","bookworm-security":"145.0.7632.159-1~deb12u1"},"fixed_version":"107.0.5304.110-1","urgency":"not yet assigned"},"bullseye":{"status":"resolved","repositories":{"bullseye":"120.0.6099.224-1~deb11u1","bullseye-security":"120.0.6099.224-1~deb11u1"},"fixed_version":"107.0.5304.110-1~deb11u1","urgency":"not yet assigned"},"forky":{"status":"resolved","repositories":{"forky":"145.0.7632.159-1"},"fixed_version":"107.0.5304.110-1","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"146.0.7680.71-1"},"fixed_version":"107.0.5304.110-1","urgency":"not yet assigned"},"trixie":{"status":"resolved","repositories":{"trixie":"143.0.7499.169-1~deb13u1","trixie-security":"145.0.7632.159-1~deb13u1"},"fixed_version":"107.0.5304.110-1","urgency":"not yet assigned"}}},"CVE-2022-3886":{"description":"Use after free in Speech Recognition in Google Chrome prior to 107.0.5304.106 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. (Chromium security severity: High)","scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"143.0.7499.169-1~deb12u1","bookworm-security":"145.0.7632.159-1~deb12u1"},"fixed_version":"107.0.5304.110-1","urgency":"not yet assigned"},"bullseye":{"status":"resolved","repositories":{"bullseye":"120.0.6099.224-1~deb11u1","bullseye-security":"120.0.6099.224-1~deb11u1"},"fixed_version":"107.0.5304.110-1~deb11u1","urgency":"not yet assigned"},"forky":{"status":"resolved","repositories":{"forky":"145.0.7632.159-1"},"fixed_version":"107.0.5304.110-1","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"146.0.7680.71-1"},"fixed_version":"107.0.5304.110-1","urgency":"not yet assigned"},"trixie":{"status":"resolved","repositories":{"trixie":"143.0.7499.169-1~deb13u1","trixie-security":"145.0.7632.159-1~deb13u1"},"fixed_version":"107.0.5304.110-1","urgency":"not yet assigned"}}},"CVE-2022-3887":{"description":"Use after free in Web Workers in Google Chrome prior to 107.0.5304.106 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. (Chromium security severity: High)","scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"143.0.7499.169-1~deb12u1","bookworm-security":"145.0.7632.159-1~deb12u1"},"fixed_version":"107.0.5304.110-1","urgency":"not yet assigned"},"bullseye":{"status":"resolved","repositories":{"bullseye":"120.0.6099.224-1~deb11u1","bullseye-security":"120.0.6099.224-1~deb11u1"},"fixed_version":"107.0.5304.110-1~deb11u1","urgency":"not yet assigned"},"forky":{"status":"resolved","repositories":{"forky":"145.0.7632.159-1"},"fixed_version":"107.0.5304.110-1","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"146.0.7680.71-1"},"fixed_version":"107.0.5304.110-1","urgency":"not yet assigned"},"trixie":{"status":"resolved","repositories":{"trixie":"143.0.7499.169-1~deb13u1","trixie-security":"145.0.7632.159-1~deb13u1"},"fixed_version":"107.0.5304.110-1","urgency":"not yet assigned"}}},"CVE-2022-3888":{"description":"Use after free in WebCodecs in Google Chrome prior to 107.0.5304.106 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. (Chromium security severity: High)","scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"143.0.7499.169-1~deb12u1","bookworm-security":"145.0.7632.159-1~deb12u1"},"fixed_version":"107.0.5304.110-1","urgency":"not yet assigned"},"bullseye":{"status":"resolved","repositories":{"bullseye":"120.0.6099.224-1~deb11u1","bullseye-security":"120.0.6099.224-1~deb11u1"},"fixed_version":"107.0.5304.110-1~deb11u1","urgency":"not yet assigned"},"forky":{"status":"resolved","repositories":{"forky":"145.0.7632.159-1"},"fixed_version":"107.0.5304.110-1","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"146.0.7680.71-1"},"fixed_version":"107.0.5304.110-1","urgency":"not yet assigned"},"trixie":{"status":"resolved","repositories":{"trixie":"143.0.7499.169-1~deb13u1","trixie-security":"145.0.7632.159-1~deb13u1"},"fixed_version":"107.0.5304.110-1","urgency":"not yet assigned"}}},"CVE-2022-3889":{"description":"Type confusion in V8 in Google Chrome prior to 107.0.5304.106 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. (Chromium security severity: High)","scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"143.0.7499.169-1~deb12u1","bookworm-security":"145.0.7632.159-1~deb12u1"},"fixed_version":"107.0.5304.110-1","urgency":"not yet assigned"},"bullseye":{"status":"resolved","repositories":{"bullseye":"120.0.6099.224-1~deb11u1","bullseye-security":"120.0.6099.224-1~deb11u1"},"fixed_version":"107.0.5304.110-1~deb11u1","urgency":"not yet assigned"},"forky":{"status":"resolved","repositories":{"forky":"145.0.7632.159-1"},"fixed_version":"107.0.5304.110-1","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"146.0.7680.71-1"},"fixed_version":"107.0.5304.110-1","urgency":"not yet assigned"},"trixie":{"status":"resolved","repositories":{"trixie":"143.0.7499.169-1~deb13u1","trixie-security":"145.0.7632.159-1~deb13u1"},"fixed_version":"107.0.5304.110-1","urgency":"not yet assigned"}}},"CVE-2022-3890":{"description":"Heap buffer overflow in Crashpad in Google Chrome on Android prior to 107.0.5304.106 allowed a remote attacker who had compromised the renderer process to potentially perform a sandbox escape via a crafted HTML page. (Chromium security severity: High)","scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"143.0.7499.169-1~deb12u1","bookworm-security":"145.0.7632.159-1~deb12u1"},"fixed_version":"107.0.5304.110-1","urgency":"not yet assigned"},"bullseye":{"status":"resolved","repositories":{"bullseye":"120.0.6099.224-1~deb11u1","bullseye-security":"120.0.6099.224-1~deb11u1"},"fixed_version":"107.0.5304.110-1~deb11u1","urgency":"not yet assigned"},"forky":{"status":"resolved","repositories":{"forky":"145.0.7632.159-1"},"fixed_version":"107.0.5304.110-1","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"146.0.7680.71-1"},"fixed_version":"107.0.5304.110-1","urgency":"not yet assigned"},"trixie":{"status":"resolved","repositories":{"trixie":"143.0.7499.169-1~deb13u1","trixie-security":"145.0.7632.159-1~deb13u1"},"fixed_version":"107.0.5304.110-1","urgency":"not yet assigned"}}},"CVE-2022-4025":{"description":"Inappropriate implementation in Paint in Google Chrome prior to 98.0.4758.80 allowed a remote attacker to leak cross-origin data outside an iframe via a crafted HTML page. (Chrome security severity: Low)","scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"143.0.7499.169-1~deb12u1","bookworm-security":"145.0.7632.159-1~deb12u1"},"fixed_version":"98.0.4758.80-1","urgency":"not yet assigned"},"bullseye":{"status":"resolved","repositories":{"bullseye":"120.0.6099.224-1~deb11u1","bullseye-security":"120.0.6099.224-1~deb11u1"},"fixed_version":"98.0.4758.80-1~deb11u1","urgency":"not yet assigned"},"forky":{"status":"resolved","repositories":{"forky":"145.0.7632.159-1"},"fixed_version":"98.0.4758.80-1","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"146.0.7680.71-1"},"fixed_version":"98.0.4758.80-1","urgency":"not yet assigned"},"trixie":{"status":"resolved","repositories":{"trixie":"143.0.7499.169-1~deb13u1","trixie-security":"145.0.7632.159-1~deb13u1"},"fixed_version":"98.0.4758.80-1","urgency":"not yet assigned"}}},"CVE-2022-4135":{"description":"Heap buffer overflow in GPU in Google Chrome prior to 107.0.5304.121 allowed a remote attacker who had compromised the renderer process to potentially perform a sandbox escape via a crafted HTML page. (Chromium security severity: High)","scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"143.0.7499.169-1~deb12u1","bookworm-security":"145.0.7632.159-1~deb12u1"},"fixed_version":"107.0.5304.121-1","urgency":"not yet assigned"},"bullseye":{"status":"resolved","repositories":{"bullseye":"120.0.6099.224-1~deb11u1","bullseye-security":"120.0.6099.224-1~deb11u1"},"fixed_version":"107.0.5304.121-1~deb11u1","urgency":"not yet assigned"},"forky":{"status":"resolved","repositories":{"forky":"145.0.7632.159-1"},"fixed_version":"107.0.5304.121-1","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"146.0.7680.71-1"},"fixed_version":"107.0.5304.121-1","urgency":"not yet assigned"},"trixie":{"status":"resolved","repositories":{"trixie":"143.0.7499.169-1~deb13u1","trixie-security":"145.0.7632.159-1~deb13u1"},"fixed_version":"107.0.5304.121-1","urgency":"not yet assigned"}}},"CVE-2022-4174":{"description":"Type confusion in V8 in Google Chrome prior to 108.0.5359.71 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. (Chromium security severity: High)","scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"143.0.7499.169-1~deb12u1","bookworm-security":"145.0.7632.159-1~deb12u1"},"fixed_version":"108.0.5359.71-1","urgency":"not yet assigned"},"bullseye":{"status":"resolved","repositories":{"bullseye":"120.0.6099.224-1~deb11u1","bullseye-security":"120.0.6099.224-1~deb11u1"},"fixed_version":"108.0.5359.71-2~deb11u1","urgency":"not yet assigned"},"forky":{"status":"resolved","repositories":{"forky":"145.0.7632.159-1"},"fixed_version":"108.0.5359.71-1","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"146.0.7680.71-1"},"fixed_version":"108.0.5359.71-1","urgency":"not yet assigned"},"trixie":{"status":"resolved","repositories":{"trixie":"143.0.7499.169-1~deb13u1","trixie-security":"145.0.7632.159-1~deb13u1"},"fixed_version":"108.0.5359.71-1","urgency":"not yet assigned"}}},"CVE-2022-4175":{"description":"Use after free in Camera Capture in Google Chrome prior to 108.0.5359.71 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. (Chromium security severity: High)","scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"143.0.7499.169-1~deb12u1","bookworm-security":"145.0.7632.159-1~deb12u1"},"fixed_version":"108.0.5359.71-1","urgency":"not yet assigned"},"bullseye":{"status":"resolved","repositories":{"bullseye":"120.0.6099.224-1~deb11u1","bullseye-security":"120.0.6099.224-1~deb11u1"},"fixed_version":"108.0.5359.71-2~deb11u1","urgency":"not yet assigned"},"forky":{"status":"resolved","repositories":{"forky":"145.0.7632.159-1"},"fixed_version":"108.0.5359.71-1","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"146.0.7680.71-1"},"fixed_version":"108.0.5359.71-1","urgency":"not yet assigned"},"trixie":{"status":"resolved","repositories":{"trixie":"143.0.7499.169-1~deb13u1","trixie-security":"145.0.7632.159-1~deb13u1"},"fixed_version":"108.0.5359.71-1","urgency":"not yet assigned"}}},"CVE-2022-4176":{"description":"Out of bounds write in Lacros Graphics in Google Chrome on Chrome OS and Lacros prior to 108.0.5359.71 allowed a remote attacker who convinced a user to engage in specific UI interactions to potentially exploit heap corruption via UI interactions. (Chromium security severity: High)","scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"143.0.7499.169-1~deb12u1","bookworm-security":"145.0.7632.159-1~deb12u1"},"fixed_version":"108.0.5359.71-1","urgency":"not yet assigned"},"bullseye":{"status":"resolved","repositories":{"bullseye":"120.0.6099.224-1~deb11u1","bullseye-security":"120.0.6099.224-1~deb11u1"},"fixed_version":"108.0.5359.71-2~deb11u1","urgency":"not yet assigned"},"forky":{"status":"resolved","repositories":{"forky":"145.0.7632.159-1"},"fixed_version":"108.0.5359.71-1","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"146.0.7680.71-1"},"fixed_version":"108.0.5359.71-1","urgency":"not yet assigned"},"trixie":{"status":"resolved","repositories":{"trixie":"143.0.7499.169-1~deb13u1","trixie-security":"145.0.7632.159-1~deb13u1"},"fixed_version":"108.0.5359.71-1","urgency":"not yet assigned"}}},"CVE-2022-4177":{"description":"Use after free in Extensions in Google Chrome prior to 108.0.5359.71 allowed an attacker who convinced a user to install an extension to potentially exploit heap corruption via a crafted Chrome Extension and UI interaction. (Chromium security severity: High)","scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"143.0.7499.169-1~deb12u1","bookworm-security":"145.0.7632.159-1~deb12u1"},"fixed_version":"108.0.5359.71-1","urgency":"not yet assigned"},"bullseye":{"status":"resolved","repositories":{"bullseye":"120.0.6099.224-1~deb11u1","bullseye-security":"120.0.6099.224-1~deb11u1"},"fixed_version":"108.0.5359.71-2~deb11u1","urgency":"not yet assigned"},"forky":{"status":"resolved","repositories":{"forky":"145.0.7632.159-1"},"fixed_version":"108.0.5359.71-1","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"146.0.7680.71-1"},"fixed_version":"108.0.5359.71-1","urgency":"not yet assigned"},"trixie":{"status":"resolved","repositories":{"trixie":"143.0.7499.169-1~deb13u1","trixie-security":"145.0.7632.159-1~deb13u1"},"fixed_version":"108.0.5359.71-1","urgency":"not yet assigned"}}},"CVE-2022-4178":{"description":"Use after free in Mojo in Google Chrome prior to 108.0.5359.71 allowed a remote attacker who had compromised the renderer process to potentially exploit heap corruption via a crafted HTML page. (Chromium security severity: High)","scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"143.0.7499.169-1~deb12u1","bookworm-security":"145.0.7632.159-1~deb12u1"},"fixed_version":"108.0.5359.71-1","urgency":"not yet assigned"},"bullseye":{"status":"resolved","repositories":{"bullseye":"120.0.6099.224-1~deb11u1","bullseye-security":"120.0.6099.224-1~deb11u1"},"fixed_version":"108.0.5359.71-2~deb11u1","urgency":"not yet assigned"},"forky":{"status":"resolved","repositories":{"forky":"145.0.7632.159-1"},"fixed_version":"108.0.5359.71-1","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"146.0.7680.71-1"},"fixed_version":"108.0.5359.71-1","urgency":"not yet assigned"},"trixie":{"status":"resolved","repositories":{"trixie":"143.0.7499.169-1~deb13u1","trixie-security":"145.0.7632.159-1~deb13u1"},"fixed_version":"108.0.5359.71-1","urgency":"not yet assigned"}}},"CVE-2022-4179":{"description":"Use after free in Audio in Google Chrome prior to 108.0.5359.71 allowed an attacker who convinced a user to install a malicious extension to potentially exploit heap corruption via a crafted Chrome Extension. (Chromium security severity: High)","scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"143.0.7499.169-1~deb12u1","bookworm-security":"145.0.7632.159-1~deb12u1"},"fixed_version":"108.0.5359.71-1","urgency":"not yet assigned"},"bullseye":{"status":"resolved","repositories":{"bullseye":"120.0.6099.224-1~deb11u1","bullseye-security":"120.0.6099.224-1~deb11u1"},"fixed_version":"108.0.5359.71-2~deb11u1","urgency":"not yet assigned"},"forky":{"status":"resolved","repositories":{"forky":"145.0.7632.159-1"},"fixed_version":"108.0.5359.71-1","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"146.0.7680.71-1"},"fixed_version":"108.0.5359.71-1","urgency":"not yet assigned"},"trixie":{"status":"resolved","repositories":{"trixie":"143.0.7499.169-1~deb13u1","trixie-security":"145.0.7632.159-1~deb13u1"},"fixed_version":"108.0.5359.71-1","urgency":"not yet assigned"}}},"CVE-2022-4180":{"description":"Use after free in Mojo in Google Chrome prior to 108.0.5359.71 allowed an attacker who convinced a user to install a malicious extension to potentially exploit heap corruption via a crafted Chrome Extension. (Chromium security severity: High)","scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"143.0.7499.169-1~deb12u1","bookworm-security":"145.0.7632.159-1~deb12u1"},"fixed_version":"108.0.5359.71-1","urgency":"not yet assigned"},"bullseye":{"status":"resolved","repositories":{"bullseye":"120.0.6099.224-1~deb11u1","bullseye-security":"120.0.6099.224-1~deb11u1"},"fixed_version":"108.0.5359.71-2~deb11u1","urgency":"not yet assigned"},"forky":{"status":"resolved","repositories":{"forky":"145.0.7632.159-1"},"fixed_version":"108.0.5359.71-1","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"146.0.7680.71-1"},"fixed_version":"108.0.5359.71-1","urgency":"not yet assigned"},"trixie":{"status":"resolved","repositories":{"trixie":"143.0.7499.169-1~deb13u1","trixie-security":"145.0.7632.159-1~deb13u1"},"fixed_version":"108.0.5359.71-1","urgency":"not yet assigned"}}},"CVE-2022-4181":{"description":"Use after free in Forms in Google Chrome prior to 108.0.5359.71 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. (Chromium security severity: High)","scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"143.0.7499.169-1~deb12u1","bookworm-security":"145.0.7632.159-1~deb12u1"},"fixed_version":"108.0.5359.71-1","urgency":"not yet assigned"},"bullseye":{"status":"resolved","repositories":{"bullseye":"120.0.6099.224-1~deb11u1","bullseye-security":"120.0.6099.224-1~deb11u1"},"fixed_version":"108.0.5359.71-2~deb11u1","urgency":"not yet assigned"},"forky":{"status":"resolved","repositories":{"forky":"145.0.7632.159-1"},"fixed_version":"108.0.5359.71-1","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"146.0.7680.71-1"},"fixed_version":"108.0.5359.71-1","urgency":"not yet assigned"},"trixie":{"status":"resolved","repositories":{"trixie":"143.0.7499.169-1~deb13u1","trixie-security":"145.0.7632.159-1~deb13u1"},"fixed_version":"108.0.5359.71-1","urgency":"not yet assigned"}}},"CVE-2022-4182":{"description":"Inappropriate implementation in Fenced Frames in Google Chrome prior to 108.0.5359.71 allowed a remote attacker to bypass fenced frame restrictions via a crafted HTML page. (Chromium security severity: Medium)","scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"143.0.7499.169-1~deb12u1","bookworm-security":"145.0.7632.159-1~deb12u1"},"fixed_version":"108.0.5359.71-1","urgency":"not yet assigned"},"bullseye":{"status":"resolved","repositories":{"bullseye":"120.0.6099.224-1~deb11u1","bullseye-security":"120.0.6099.224-1~deb11u1"},"fixed_version":"108.0.5359.71-2~deb11u1","urgency":"not yet assigned"},"forky":{"status":"resolved","repositories":{"forky":"145.0.7632.159-1"},"fixed_version":"108.0.5359.71-1","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"146.0.7680.71-1"},"fixed_version":"108.0.5359.71-1","urgency":"not yet assigned"},"trixie":{"status":"resolved","repositories":{"trixie":"143.0.7499.169-1~deb13u1","trixie-security":"145.0.7632.159-1~deb13u1"},"fixed_version":"108.0.5359.71-1","urgency":"not yet assigned"}}},"CVE-2022-4183":{"description":"Insufficient policy enforcement in Popup Blocker in Google Chrome prior to 108.0.5359.71 allowed a remote attacker to bypass navigation restrictions via a crafted HTML page. (Chromium security severity: Medium)","scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"143.0.7499.169-1~deb12u1","bookworm-security":"145.0.7632.159-1~deb12u1"},"fixed_version":"108.0.5359.71-1","urgency":"not yet assigned"},"bullseye":{"status":"resolved","repositories":{"bullseye":"120.0.6099.224-1~deb11u1","bullseye-security":"120.0.6099.224-1~deb11u1"},"fixed_version":"108.0.5359.71-2~deb11u1","urgency":"not yet assigned"},"forky":{"status":"resolved","repositories":{"forky":"145.0.7632.159-1"},"fixed_version":"108.0.5359.71-1","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"146.0.7680.71-1"},"fixed_version":"108.0.5359.71-1","urgency":"not yet assigned"},"trixie":{"status":"resolved","repositories":{"trixie":"143.0.7499.169-1~deb13u1","trixie-security":"145.0.7632.159-1~deb13u1"},"fixed_version":"108.0.5359.71-1","urgency":"not yet assigned"}}},"CVE-2022-4184":{"description":"Insufficient policy enforcement in Autofill in Google Chrome prior to 108.0.5359.71 allowed a remote attacker to bypass autofill restrictions via a crafted HTML page. (Chromium security severity: Medium)","scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"143.0.7499.169-1~deb12u1","bookworm-security":"145.0.7632.159-1~deb12u1"},"fixed_version":"108.0.5359.71-1","urgency":"not yet assigned"},"bullseye":{"status":"resolved","repositories":{"bullseye":"120.0.6099.224-1~deb11u1","bullseye-security":"120.0.6099.224-1~deb11u1"},"fixed_version":"108.0.5359.71-2~deb11u1","urgency":"not yet assigned"},"forky":{"status":"resolved","repositories":{"forky":"145.0.7632.159-1"},"fixed_version":"108.0.5359.71-1","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"146.0.7680.71-1"},"fixed_version":"108.0.5359.71-1","urgency":"not yet assigned"},"trixie":{"status":"resolved","repositories":{"trixie":"143.0.7499.169-1~deb13u1","trixie-security":"145.0.7632.159-1~deb13u1"},"fixed_version":"108.0.5359.71-1","urgency":"not yet assigned"}}},"CVE-2022-4185":{"description":"Inappropriate implementation in Navigation in Google Chrome on iOS prior to 108.0.5359.71 allowed a remote attacker to spoof the contents of the modal dialogue via a crafted HTML page. (Chromium security severity: Medium)","scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"143.0.7499.169-1~deb12u1","bookworm-security":"145.0.7632.159-1~deb12u1"},"fixed_version":"108.0.5359.71-1","urgency":"not yet assigned"},"bullseye":{"status":"resolved","repositories":{"bullseye":"120.0.6099.224-1~deb11u1","bullseye-security":"120.0.6099.224-1~deb11u1"},"fixed_version":"108.0.5359.71-2~deb11u1","urgency":"not yet assigned"},"forky":{"status":"resolved","repositories":{"forky":"145.0.7632.159-1"},"fixed_version":"108.0.5359.71-1","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"146.0.7680.71-1"},"fixed_version":"108.0.5359.71-1","urgency":"not yet assigned"},"trixie":{"status":"resolved","repositories":{"trixie":"143.0.7499.169-1~deb13u1","trixie-security":"145.0.7632.159-1~deb13u1"},"fixed_version":"108.0.5359.71-1","urgency":"not yet assigned"}}},"CVE-2022-4186":{"description":"Insufficient validation of untrusted input in Downloads in Google Chrome prior to 108.0.5359.71 allowed an attacker who convinced a user to install a malicious extension to bypass Downloads restrictions via a crafted HTML page. (Chromium security severity: Medium)","scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"143.0.7499.169-1~deb12u1","bookworm-security":"145.0.7632.159-1~deb12u1"},"fixed_version":"108.0.5359.71-1","urgency":"not yet assigned"},"bullseye":{"status":"resolved","repositories":{"bullseye":"120.0.6099.224-1~deb11u1","bullseye-security":"120.0.6099.224-1~deb11u1"},"fixed_version":"108.0.5359.71-2~deb11u1","urgency":"not yet assigned"},"forky":{"status":"resolved","repositories":{"forky":"145.0.7632.159-1"},"fixed_version":"108.0.5359.71-1","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"146.0.7680.71-1"},"fixed_version":"108.0.5359.71-1","urgency":"not yet assigned"},"trixie":{"status":"resolved","repositories":{"trixie":"143.0.7499.169-1~deb13u1","trixie-security":"145.0.7632.159-1~deb13u1"},"fixed_version":"108.0.5359.71-1","urgency":"not yet assigned"}}},"CVE-2022-4187":{"description":"Insufficient policy enforcement in DevTools in Google Chrome on Windows prior to 108.0.5359.71 allowed a remote attacker to bypass filesystem restrictions via a crafted HTML page. (Chromium security severity: Medium)","scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"143.0.7499.169-1~deb12u1","bookworm-security":"145.0.7632.159-1~deb12u1"},"fixed_version":"108.0.5359.71-1","urgency":"not yet assigned"},"bullseye":{"status":"resolved","repositories":{"bullseye":"120.0.6099.224-1~deb11u1","bullseye-security":"120.0.6099.224-1~deb11u1"},"fixed_version":"108.0.5359.71-2~deb11u1","urgency":"not yet assigned"},"forky":{"status":"resolved","repositories":{"forky":"145.0.7632.159-1"},"fixed_version":"108.0.5359.71-1","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"146.0.7680.71-1"},"fixed_version":"108.0.5359.71-1","urgency":"not yet assigned"},"trixie":{"status":"resolved","repositories":{"trixie":"143.0.7499.169-1~deb13u1","trixie-security":"145.0.7632.159-1~deb13u1"},"fixed_version":"108.0.5359.71-1","urgency":"not yet assigned"}}},"CVE-2022-4188":{"description":"Insufficient validation of untrusted input in CORS in Google Chrome on Android prior to 108.0.5359.71 allowed a remote attacker to bypass same origin policy via a crafted HTML page. (Chromium security severity: Medium)","scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"143.0.7499.169-1~deb12u1","bookworm-security":"145.0.7632.159-1~deb12u1"},"fixed_version":"108.0.5359.71-1","urgency":"not yet assigned"},"bullseye":{"status":"resolved","repositories":{"bullseye":"120.0.6099.224-1~deb11u1","bullseye-security":"120.0.6099.224-1~deb11u1"},"fixed_version":"108.0.5359.71-2~deb11u1","urgency":"not yet assigned"},"forky":{"status":"resolved","repositories":{"forky":"145.0.7632.159-1"},"fixed_version":"108.0.5359.71-1","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"146.0.7680.71-1"},"fixed_version":"108.0.5359.71-1","urgency":"not yet assigned"},"trixie":{"status":"resolved","repositories":{"trixie":"143.0.7499.169-1~deb13u1","trixie-security":"145.0.7632.159-1~deb13u1"},"fixed_version":"108.0.5359.71-1","urgency":"not yet assigned"}}},"CVE-2022-4189":{"description":"Insufficient policy enforcement in DevTools in Google Chrome prior to 108.0.5359.71 allowed an attacker who convinced a user to install a malicious extension to bypass navigation restrictions via a crafted Chrome Extension. (Chromium security severity: Medium)","scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"143.0.7499.169-1~deb12u1","bookworm-security":"145.0.7632.159-1~deb12u1"},"fixed_version":"108.0.5359.71-1","urgency":"not yet assigned"},"bullseye":{"status":"resolved","repositories":{"bullseye":"120.0.6099.224-1~deb11u1","bullseye-security":"120.0.6099.224-1~deb11u1"},"fixed_version":"108.0.5359.71-2~deb11u1","urgency":"not yet assigned"},"forky":{"status":"resolved","repositories":{"forky":"145.0.7632.159-1"},"fixed_version":"108.0.5359.71-1","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"146.0.7680.71-1"},"fixed_version":"108.0.5359.71-1","urgency":"not yet assigned"},"trixie":{"status":"resolved","repositories":{"trixie":"143.0.7499.169-1~deb13u1","trixie-security":"145.0.7632.159-1~deb13u1"},"fixed_version":"108.0.5359.71-1","urgency":"not yet assigned"}}},"CVE-2022-4190":{"description":"Insufficient data validation in Directory in Google Chrome prior to 108.0.5359.71 allowed a remote attacker to bypass file system restrictions via a crafted HTML page. (Chromium security severity: Medium)","scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"143.0.7499.169-1~deb12u1","bookworm-security":"145.0.7632.159-1~deb12u1"},"fixed_version":"108.0.5359.71-1","urgency":"not yet assigned"},"bullseye":{"status":"resolved","repositories":{"bullseye":"120.0.6099.224-1~deb11u1","bullseye-security":"120.0.6099.224-1~deb11u1"},"fixed_version":"108.0.5359.71-2~deb11u1","urgency":"not yet assigned"},"forky":{"status":"resolved","repositories":{"forky":"145.0.7632.159-1"},"fixed_version":"108.0.5359.71-1","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"146.0.7680.71-1"},"fixed_version":"108.0.5359.71-1","urgency":"not yet assigned"},"trixie":{"status":"resolved","repositories":{"trixie":"143.0.7499.169-1~deb13u1","trixie-security":"145.0.7632.159-1~deb13u1"},"fixed_version":"108.0.5359.71-1","urgency":"not yet assigned"}}},"CVE-2022-4191":{"description":"Use after free in Sign-In in Google Chrome prior to 108.0.5359.71 allowed a remote attacker who convinced a user to engage in specific UI interaction to potentially exploit heap corruption via profile destruction. (Chromium security severity: Medium)","scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"143.0.7499.169-1~deb12u1","bookworm-security":"145.0.7632.159-1~deb12u1"},"fixed_version":"108.0.5359.71-1","urgency":"not yet assigned"},"bullseye":{"status":"resolved","repositories":{"bullseye":"120.0.6099.224-1~deb11u1","bullseye-security":"120.0.6099.224-1~deb11u1"},"fixed_version":"108.0.5359.71-2~deb11u1","urgency":"not yet assigned"},"forky":{"status":"resolved","repositories":{"forky":"145.0.7632.159-1"},"fixed_version":"108.0.5359.71-1","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"146.0.7680.71-1"},"fixed_version":"108.0.5359.71-1","urgency":"not yet assigned"},"trixie":{"status":"resolved","repositories":{"trixie":"143.0.7499.169-1~deb13u1","trixie-security":"145.0.7632.159-1~deb13u1"},"fixed_version":"108.0.5359.71-1","urgency":"not yet assigned"}}},"CVE-2022-4192":{"description":"Use after free in Live Caption in Google Chrome prior to 108.0.5359.71 allowed a remote attacker who convinced a user to engage in specific UI interaction to potentially exploit heap corruption via UI interaction. (Chromium security severity: Medium)","scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"143.0.7499.169-1~deb12u1","bookworm-security":"145.0.7632.159-1~deb12u1"},"fixed_version":"108.0.5359.71-1","urgency":"not yet assigned"},"bullseye":{"status":"resolved","repositories":{"bullseye":"120.0.6099.224-1~deb11u1","bullseye-security":"120.0.6099.224-1~deb11u1"},"fixed_version":"108.0.5359.71-2~deb11u1","urgency":"not yet assigned"},"forky":{"status":"resolved","repositories":{"forky":"145.0.7632.159-1"},"fixed_version":"108.0.5359.71-1","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"146.0.7680.71-1"},"fixed_version":"108.0.5359.71-1","urgency":"not yet assigned"},"trixie":{"status":"resolved","repositories":{"trixie":"143.0.7499.169-1~deb13u1","trixie-security":"145.0.7632.159-1~deb13u1"},"fixed_version":"108.0.5359.71-1","urgency":"not yet assigned"}}},"CVE-2022-4193":{"description":"Insufficient policy enforcement in File System API in Google Chrome prior to 108.0.5359.71 allowed a remote attacker to bypass file system restrictions via a crafted HTML page. (Chromium security severity: Medium)","scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"143.0.7499.169-1~deb12u1","bookworm-security":"145.0.7632.159-1~deb12u1"},"fixed_version":"108.0.5359.71-1","urgency":"not yet assigned"},"bullseye":{"status":"resolved","repositories":{"bullseye":"120.0.6099.224-1~deb11u1","bullseye-security":"120.0.6099.224-1~deb11u1"},"fixed_version":"108.0.5359.71-2~deb11u1","urgency":"not yet assigned"},"forky":{"status":"resolved","repositories":{"forky":"145.0.7632.159-1"},"fixed_version":"108.0.5359.71-1","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"146.0.7680.71-1"},"fixed_version":"108.0.5359.71-1","urgency":"not yet assigned"},"trixie":{"status":"resolved","repositories":{"trixie":"143.0.7499.169-1~deb13u1","trixie-security":"145.0.7632.159-1~deb13u1"},"fixed_version":"108.0.5359.71-1","urgency":"not yet assigned"}}},"CVE-2022-4194":{"description":"Use after free in Accessibility in Google Chrome prior to 108.0.5359.71 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. (Chromium security severity: Medium)","scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"143.0.7499.169-1~deb12u1","bookworm-security":"145.0.7632.159-1~deb12u1"},"fixed_version":"108.0.5359.71-1","urgency":"not yet assigned"},"bullseye":{"status":"resolved","repositories":{"bullseye":"120.0.6099.224-1~deb11u1","bullseye-security":"120.0.6099.224-1~deb11u1"},"fixed_version":"108.0.5359.71-2~deb11u1","urgency":"not yet assigned"},"forky":{"status":"resolved","repositories":{"forky":"145.0.7632.159-1"},"fixed_version":"108.0.5359.71-1","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"146.0.7680.71-1"},"fixed_version":"108.0.5359.71-1","urgency":"not yet assigned"},"trixie":{"status":"resolved","repositories":{"trixie":"143.0.7499.169-1~deb13u1","trixie-security":"145.0.7632.159-1~deb13u1"},"fixed_version":"108.0.5359.71-1","urgency":"not yet assigned"}}},"CVE-2022-4195":{"description":"Insufficient policy enforcement in Safe Browsing in Google Chrome prior to 108.0.5359.71 allowed a remote attacker to bypass Safe Browsing warnings via a malicious file. (Chromium security severity: Medium)","scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"143.0.7499.169-1~deb12u1","bookworm-security":"145.0.7632.159-1~deb12u1"},"fixed_version":"108.0.5359.71-1","urgency":"not yet assigned"},"bullseye":{"status":"resolved","repositories":{"bullseye":"120.0.6099.224-1~deb11u1","bullseye-security":"120.0.6099.224-1~deb11u1"},"fixed_version":"108.0.5359.71-2~deb11u1","urgency":"not yet assigned"},"forky":{"status":"resolved","repositories":{"forky":"145.0.7632.159-1"},"fixed_version":"108.0.5359.71-1","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"146.0.7680.71-1"},"fixed_version":"108.0.5359.71-1","urgency":"not yet assigned"},"trixie":{"status":"resolved","repositories":{"trixie":"143.0.7499.169-1~deb13u1","trixie-security":"145.0.7632.159-1~deb13u1"},"fixed_version":"108.0.5359.71-1","urgency":"not yet assigned"}}},"CVE-2022-4262":{"description":"Type confusion in V8 in Google Chrome prior to 108.0.5359.94 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. (Chromium security severity: High)","scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"143.0.7499.169-1~deb12u1","bookworm-security":"145.0.7632.159-1~deb12u1"},"fixed_version":"108.0.5359.94-1","urgency":"not yet assigned"},"bullseye":{"status":"resolved","repositories":{"bullseye":"120.0.6099.224-1~deb11u1","bullseye-security":"120.0.6099.224-1~deb11u1"},"fixed_version":"108.0.5359.94-1~deb11u1","urgency":"not yet assigned"},"forky":{"status":"resolved","repositories":{"forky":"145.0.7632.159-1"},"fixed_version":"108.0.5359.94-1","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"146.0.7680.71-1"},"fixed_version":"108.0.5359.94-1","urgency":"not yet assigned"},"trixie":{"status":"resolved","repositories":{"trixie":"143.0.7499.169-1~deb13u1","trixie-security":"145.0.7632.159-1~deb13u1"},"fixed_version":"108.0.5359.94-1","urgency":"not yet assigned"}}},"CVE-2022-4436":{"description":"Use after free in Blink Media in Google Chrome prior to 108.0.5359.124 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. (Chromium security severity: High)","scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"143.0.7499.169-1~deb12u1","bookworm-security":"145.0.7632.159-1~deb12u1"},"fixed_version":"108.0.5359.124-1","urgency":"not yet assigned"},"bullseye":{"status":"resolved","repositories":{"bullseye":"120.0.6099.224-1~deb11u1","bullseye-security":"120.0.6099.224-1~deb11u1"},"fixed_version":"108.0.5359.124-1~deb11u1","urgency":"not yet assigned"},"forky":{"status":"resolved","repositories":{"forky":"145.0.7632.159-1"},"fixed_version":"108.0.5359.124-1","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"146.0.7680.71-1"},"fixed_version":"108.0.5359.124-1","urgency":"not yet assigned"},"trixie":{"status":"resolved","repositories":{"trixie":"143.0.7499.169-1~deb13u1","trixie-security":"145.0.7632.159-1~deb13u1"},"fixed_version":"108.0.5359.124-1","urgency":"not yet assigned"}}},"CVE-2022-4437":{"description":"Use after free in Mojo IPC in Google Chrome prior to 108.0.5359.124 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. (Chromium security severity: High)","scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"143.0.7499.169-1~deb12u1","bookworm-security":"145.0.7632.159-1~deb12u1"},"fixed_version":"108.0.5359.124-1","urgency":"not yet assigned"},"bullseye":{"status":"resolved","repositories":{"bullseye":"120.0.6099.224-1~deb11u1","bullseye-security":"120.0.6099.224-1~deb11u1"},"fixed_version":"108.0.5359.124-1~deb11u1","urgency":"not yet assigned"},"forky":{"status":"resolved","repositories":{"forky":"145.0.7632.159-1"},"fixed_version":"108.0.5359.124-1","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"146.0.7680.71-1"},"fixed_version":"108.0.5359.124-1","urgency":"not yet assigned"},"trixie":{"status":"resolved","repositories":{"trixie":"143.0.7499.169-1~deb13u1","trixie-security":"145.0.7632.159-1~deb13u1"},"fixed_version":"108.0.5359.124-1","urgency":"not yet assigned"}}},"CVE-2022-4438":{"description":"Use after free in Blink Frames in Google Chrome prior to 108.0.5359.124 allowed a remote attacker who convinced the user to engage in specific UI interactions to potentially exploit heap corruption via a crafted HTML page. (Chromium security severity: High)","scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"143.0.7499.169-1~deb12u1","bookworm-security":"145.0.7632.159-1~deb12u1"},"fixed_version":"108.0.5359.124-1","urgency":"not yet assigned"},"bullseye":{"status":"resolved","repositories":{"bullseye":"120.0.6099.224-1~deb11u1","bullseye-security":"120.0.6099.224-1~deb11u1"},"fixed_version":"108.0.5359.124-1~deb11u1","urgency":"not yet assigned"},"forky":{"status":"resolved","repositories":{"forky":"145.0.7632.159-1"},"fixed_version":"108.0.5359.124-1","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"146.0.7680.71-1"},"fixed_version":"108.0.5359.124-1","urgency":"not yet assigned"},"trixie":{"status":"resolved","repositories":{"trixie":"143.0.7499.169-1~deb13u1","trixie-security":"145.0.7632.159-1~deb13u1"},"fixed_version":"108.0.5359.124-1","urgency":"not yet assigned"}}},"CVE-2022-4439":{"description":"Use after free in Aura in Google Chrome on Windows prior to 108.0.5359.124 allowed a remote attacker who convinced the user to engage in specific UI interactions to potentially exploit heap corruption via specific UI interactions. (Chromium security severity: High)","scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"143.0.7499.169-1~deb12u1","bookworm-security":"145.0.7632.159-1~deb12u1"},"fixed_version":"108.0.5359.124-1","urgency":"not yet assigned"},"bullseye":{"status":"resolved","repositories":{"bullseye":"120.0.6099.224-1~deb11u1","bullseye-security":"120.0.6099.224-1~deb11u1"},"fixed_version":"108.0.5359.124-1~deb11u1","urgency":"not yet assigned"},"forky":{"status":"resolved","repositories":{"forky":"145.0.7632.159-1"},"fixed_version":"108.0.5359.124-1","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"146.0.7680.71-1"},"fixed_version":"108.0.5359.124-1","urgency":"not yet assigned"},"trixie":{"status":"resolved","repositories":{"trixie":"143.0.7499.169-1~deb13u1","trixie-security":"145.0.7632.159-1~deb13u1"},"fixed_version":"108.0.5359.124-1","urgency":"not yet assigned"}}},"CVE-2022-4440":{"description":"Use after free in Profiles in Google Chrome prior to 108.0.5359.124 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. (Chromium security severity: Medium)","scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"143.0.7499.169-1~deb12u1","bookworm-security":"145.0.7632.159-1~deb12u1"},"fixed_version":"108.0.5359.124-1","urgency":"not yet assigned"},"bullseye":{"status":"resolved","repositories":{"bullseye":"120.0.6099.224-1~deb11u1","bullseye-security":"120.0.6099.224-1~deb11u1"},"fixed_version":"108.0.5359.124-1~deb11u1","urgency":"not yet assigned"},"forky":{"status":"resolved","repositories":{"forky":"145.0.7632.159-1"},"fixed_version":"108.0.5359.124-1","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"146.0.7680.71-1"},"fixed_version":"108.0.5359.124-1","urgency":"not yet assigned"},"trixie":{"status":"resolved","repositories":{"trixie":"143.0.7499.169-1~deb13u1","trixie-security":"145.0.7632.159-1~deb13u1"},"fixed_version":"108.0.5359.124-1","urgency":"not yet assigned"}}},"CVE-2022-4906":{"description":"Inappropriate implementation in Blink in Google Chrome prior to 108.0.5359.71 allowed a remote attacker to perform arbitrary read/write via a crafted HTML page. (Chromium security severity: High)","scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"143.0.7499.169-1~deb12u1","bookworm-security":"145.0.7632.159-1~deb12u1"},"fixed_version":"108.0.5359.71-1","urgency":"not yet assigned"},"bullseye":{"status":"resolved","repositories":{"bullseye":"120.0.6099.224-1~deb11u1","bullseye-security":"120.0.6099.224-1~deb11u1"},"fixed_version":"108.0.5359.71-2~deb11u1","urgency":"not yet assigned"},"forky":{"status":"resolved","repositories":{"forky":"145.0.7632.159-1"},"fixed_version":"108.0.5359.71-1","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"146.0.7680.71-1"},"fixed_version":"108.0.5359.71-1","urgency":"not yet assigned"},"trixie":{"status":"resolved","repositories":{"trixie":"143.0.7499.169-1~deb13u1","trixie-security":"145.0.7632.159-1~deb13u1"},"fixed_version":"108.0.5359.71-1","urgency":"not yet assigned"}}},"CVE-2022-4907":{"description":"Uninitialized Use in FFmpeg in Google Chrome prior to 108.0.5359.71 allowed a remote attacker to execute arbitrary code inside a sandbox via a crafted HTML page. (Chromium security severity: Medium)","scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"143.0.7499.169-1~deb12u1","bookworm-security":"145.0.7632.159-1~deb12u1"},"fixed_version":"108.0.5359.71-1","urgency":"not yet assigned"},"bullseye":{"status":"resolved","repositories":{"bullseye":"120.0.6099.224-1~deb11u1","bullseye-security":"120.0.6099.224-1~deb11u1"},"fixed_version":"108.0.5359.71-2~deb11u1","urgency":"not yet assigned"},"forky":{"status":"resolved","repositories":{"forky":"145.0.7632.159-1"},"fixed_version":"108.0.5359.71-1","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"146.0.7680.71-1"},"fixed_version":"108.0.5359.71-1","urgency":"not yet assigned"},"trixie":{"status":"resolved","repositories":{"trixie":"143.0.7499.169-1~deb13u1","trixie-security":"145.0.7632.159-1~deb13u1"},"fixed_version":"108.0.5359.71-1","urgency":"not yet assigned"}}},"CVE-2022-4908":{"description":"Inappropriate implementation in iFrame Sandbox in Google Chrome prior to 107.0.5304.62 allowed a remote attacker to leak cross-origin data via a crafted HTML page. (Chromium security severity: Medium)","scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"143.0.7499.169-1~deb12u1","bookworm-security":"145.0.7632.159-1~deb12u1"},"fixed_version":"107.0.5304.68-1","urgency":"not yet assigned"},"bullseye":{"status":"resolved","repositories":{"bullseye":"120.0.6099.224-1~deb11u1","bullseye-security":"120.0.6099.224-1~deb11u1"},"fixed_version":"107.0.5304.68-1~deb11u1","urgency":"not yet assigned"},"forky":{"status":"resolved","repositories":{"forky":"145.0.7632.159-1"},"fixed_version":"107.0.5304.68-1","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"146.0.7680.71-1"},"fixed_version":"107.0.5304.68-1","urgency":"not yet assigned"},"trixie":{"status":"resolved","repositories":{"trixie":"143.0.7499.169-1~deb13u1","trixie-security":"145.0.7632.159-1~deb13u1"},"fixed_version":"107.0.5304.68-1","urgency":"not yet assigned"}}},"CVE-2022-4909":{"description":"Inappropriate implementation in XML in Google Chrome prior to 107.0.5304.62 allowed a remote attacker to potentially perform an ASLR bypass via a crafted HTML page. (Chromium security severity: Low)","scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"143.0.7499.169-1~deb12u1","bookworm-security":"145.0.7632.159-1~deb12u1"},"fixed_version":"107.0.5304.68-1","urgency":"not yet assigned"},"bullseye":{"status":"resolved","repositories":{"bullseye":"120.0.6099.224-1~deb11u1","bullseye-security":"120.0.6099.224-1~deb11u1"},"fixed_version":"107.0.5304.68-1~deb11u1","urgency":"not yet assigned"},"forky":{"status":"resolved","repositories":{"forky":"145.0.7632.159-1"},"fixed_version":"107.0.5304.68-1","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"146.0.7680.71-1"},"fixed_version":"107.0.5304.68-1","urgency":"not yet assigned"},"trixie":{"status":"resolved","repositories":{"trixie":"143.0.7499.169-1~deb13u1","trixie-security":"145.0.7632.159-1~deb13u1"},"fixed_version":"107.0.5304.68-1","urgency":"not yet assigned"}}},"CVE-2022-4910":{"description":"Inappropriate implementation in Autofill in Google Chrome prior to 107.0.5304.62 allowed a remote attacker to bypass navigation restrictions via a crafted HTML page. (Chromium security severity: Medium)","scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"143.0.7499.169-1~deb12u1","bookworm-security":"145.0.7632.159-1~deb12u1"},"fixed_version":"107.0.5304.68-1","urgency":"not yet assigned"},"bullseye":{"status":"resolved","repositories":{"bullseye":"120.0.6099.224-1~deb11u1","bullseye-security":"120.0.6099.224-1~deb11u1"},"fixed_version":"107.0.5304.68-1~deb11u1","urgency":"not yet assigned"},"forky":{"status":"resolved","repositories":{"forky":"145.0.7632.159-1"},"fixed_version":"107.0.5304.68-1","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"146.0.7680.71-1"},"fixed_version":"107.0.5304.68-1","urgency":"not yet assigned"},"trixie":{"status":"resolved","repositories":{"trixie":"143.0.7499.169-1~deb13u1","trixie-security":"145.0.7632.159-1~deb13u1"},"fixed_version":"107.0.5304.68-1","urgency":"not yet assigned"}}},"CVE-2022-4911":{"description":"Insufficient data validation in DevTools in Google Chrome prior to 106.0.5249.62 allowed a remote attacker to bypass content security policy via a crafted HTML page. (Chromium security severity: Low)","scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"143.0.7499.169-1~deb12u1","bookworm-security":"145.0.7632.159-1~deb12u1"},"fixed_version":"106.0.5249.61-1","urgency":"not yet assigned"},"bullseye":{"status":"resolved","repositories":{"bullseye":"120.0.6099.224-1~deb11u1","bullseye-security":"120.0.6099.224-1~deb11u1"},"fixed_version":"106.0.5249.61-1~deb11u1","urgency":"not yet assigned"},"forky":{"status":"resolved","repositories":{"forky":"145.0.7632.159-1"},"fixed_version":"106.0.5249.61-1","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"146.0.7680.71-1"},"fixed_version":"106.0.5249.61-1","urgency":"not yet assigned"},"trixie":{"status":"resolved","repositories":{"trixie":"143.0.7499.169-1~deb13u1","trixie-security":"145.0.7632.159-1~deb13u1"},"fixed_version":"106.0.5249.61-1","urgency":"not yet assigned"}}},"CVE-2022-4912":{"description":"Type Confusion in MathML in Google Chrome prior to 105.0.5195.52 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. (Chromium security severity: High)","scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"143.0.7499.169-1~deb12u1","bookworm-security":"145.0.7632.159-1~deb12u1"},"fixed_version":"105.0.5195.52-1","urgency":"not yet assigned"},"bullseye":{"status":"resolved","repositories":{"bullseye":"120.0.6099.224-1~deb11u1","bullseye-security":"120.0.6099.224-1~deb11u1"},"fixed_version":"105.0.5195.52-1~deb11u1","urgency":"not yet assigned"},"forky":{"status":"resolved","repositories":{"forky":"145.0.7632.159-1"},"fixed_version":"105.0.5195.52-1","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"146.0.7680.71-1"},"fixed_version":"105.0.5195.52-1","urgency":"not yet assigned"},"trixie":{"status":"resolved","repositories":{"trixie":"143.0.7499.169-1~deb13u1","trixie-security":"145.0.7632.159-1~deb13u1"},"fixed_version":"105.0.5195.52-1","urgency":"not yet assigned"}}},"CVE-2022-4913":{"description":"Inappropriate implementation in Extensions in Google Chrome prior to 105.0.5195.52 allowed a remote attacker who had compromised the renderer process to spoof extension storage via a crafted HTML page. (Chromium security severity: High)","scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"143.0.7499.169-1~deb12u1","bookworm-security":"145.0.7632.159-1~deb12u1"},"fixed_version":"105.0.5195.52-1","urgency":"not yet assigned"},"bullseye":{"status":"resolved","repositories":{"bullseye":"120.0.6099.224-1~deb11u1","bullseye-security":"120.0.6099.224-1~deb11u1"},"fixed_version":"105.0.5195.52-1~deb11u1","urgency":"not yet assigned"},"forky":{"status":"resolved","repositories":{"forky":"145.0.7632.159-1"},"fixed_version":"105.0.5195.52-1","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"146.0.7680.71-1"},"fixed_version":"105.0.5195.52-1","urgency":"not yet assigned"},"trixie":{"status":"resolved","repositories":{"trixie":"143.0.7499.169-1~deb13u1","trixie-security":"145.0.7632.159-1~deb13u1"},"fixed_version":"105.0.5195.52-1","urgency":"not yet assigned"}}},"CVE-2022-4914":{"description":"Heap buffer overflow in PrintPreview in Google Chrome prior to 104.0.5112.79 allowed an attacker who convinced a user to install a malicious extension to potentially exploit heap corruption via a crafted HTML page. (Chromium security severity: Medium)","scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"143.0.7499.169-1~deb12u1","bookworm-security":"145.0.7632.159-1~deb12u1"},"fixed_version":"104.0.5112.79-1","urgency":"not yet assigned"},"bullseye":{"status":"resolved","repositories":{"bullseye":"120.0.6099.224-1~deb11u1","bullseye-security":"120.0.6099.224-1~deb11u1"},"fixed_version":"104.0.5112.79-1~deb11u1","urgency":"not yet assigned"},"forky":{"status":"resolved","repositories":{"forky":"145.0.7632.159-1"},"fixed_version":"104.0.5112.79-1","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"146.0.7680.71-1"},"fixed_version":"104.0.5112.79-1","urgency":"not yet assigned"},"trixie":{"status":"resolved","repositories":{"trixie":"143.0.7499.169-1~deb13u1","trixie-security":"145.0.7632.159-1~deb13u1"},"fixed_version":"104.0.5112.79-1","urgency":"not yet assigned"}}},"CVE-2022-4915":{"description":"Inappropriate implementation in URL Formatting in Google Chrome prior to 103.0.5060.134 allowed a remote attacker to perform domain spoofing via a crafted HTML page. (Chromium security severity: Medium)","scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"143.0.7499.169-1~deb12u1","bookworm-security":"145.0.7632.159-1~deb12u1"},"fixed_version":"103.0.5060.134-1","urgency":"not yet assigned"},"bullseye":{"status":"resolved","repositories":{"bullseye":"120.0.6099.224-1~deb11u1","bullseye-security":"120.0.6099.224-1~deb11u1"},"fixed_version":"103.0.5060.134-1~deb11u1","urgency":"not yet assigned"},"forky":{"status":"resolved","repositories":{"forky":"145.0.7632.159-1"},"fixed_version":"103.0.5060.134-1","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"146.0.7680.71-1"},"fixed_version":"103.0.5060.134-1","urgency":"not yet assigned"},"trixie":{"status":"resolved","repositories":{"trixie":"143.0.7499.169-1~deb13u1","trixie-security":"145.0.7632.159-1~deb13u1"},"fixed_version":"103.0.5060.134-1","urgency":"not yet assigned"}}},"CVE-2022-4916":{"description":"Use after free in Media in Google Chrome prior to 103.0.5060.53 allowed a remote attacker to perform arbitrary read/write via a crafted HTML page. (Chromium security severity: High)","scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"143.0.7499.169-1~deb12u1","bookworm-security":"145.0.7632.159-1~deb12u1"},"fixed_version":"103.0.5060.53-1","urgency":"not yet assigned"},"bullseye":{"status":"resolved","repositories":{"bullseye":"120.0.6099.224-1~deb11u1","bullseye-security":"120.0.6099.224-1~deb11u1"},"fixed_version":"103.0.5060.53-1~deb11u1","urgency":"not yet assigned"},"forky":{"status":"resolved","repositories":{"forky":"145.0.7632.159-1"},"fixed_version":"103.0.5060.53-1","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"146.0.7680.71-1"},"fixed_version":"103.0.5060.53-1","urgency":"not yet assigned"},"trixie":{"status":"resolved","repositories":{"trixie":"143.0.7499.169-1~deb13u1","trixie-security":"145.0.7632.159-1~deb13u1"},"fixed_version":"103.0.5060.53-1","urgency":"not yet assigned"}}},"CVE-2022-4917":{"description":"Incorrect security UI in Notifications in Google Chrome on Android prior to 103.0.5060.53 allowed a remote attacker to obscure the full screen notification via a crafted HTML page. (Chromium security severity: Low)","scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"143.0.7499.169-1~deb12u1","bookworm-security":"145.0.7632.159-1~deb12u1"},"fixed_version":"103.0.5060.53-1","urgency":"not yet assigned"},"bullseye":{"status":"resolved","repositories":{"bullseye":"120.0.6099.224-1~deb11u1","bullseye-security":"120.0.6099.224-1~deb11u1"},"fixed_version":"103.0.5060.53-1~deb11u1","urgency":"not yet assigned"},"forky":{"status":"resolved","repositories":{"forky":"145.0.7632.159-1"},"fixed_version":"103.0.5060.53-1","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"146.0.7680.71-1"},"fixed_version":"103.0.5060.53-1","urgency":"not yet assigned"},"trixie":{"status":"resolved","repositories":{"trixie":"143.0.7499.169-1~deb13u1","trixie-security":"145.0.7632.159-1~deb13u1"},"fixed_version":"103.0.5060.53-1","urgency":"not yet assigned"}}},"CVE-2022-4918":{"description":"Use after free in UI in Google Chrome prior to 102.0.5005.61 allowed a remote attacker to perform arbitrary read/write via a crafted HTML page. (Chromium security severity: Medium)","scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"143.0.7499.169-1~deb12u1","bookworm-security":"145.0.7632.159-1~deb12u1"},"fixed_version":"102.0.5005.61-1","urgency":"not yet assigned"},"bullseye":{"status":"resolved","repositories":{"bullseye":"120.0.6099.224-1~deb11u1","bullseye-security":"120.0.6099.224-1~deb11u1"},"fixed_version":"102.0.5005.61-1~deb11u1","urgency":"not yet assigned"},"forky":{"status":"resolved","repositories":{"forky":"145.0.7632.159-1"},"fixed_version":"102.0.5005.61-1","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"146.0.7680.71-1"},"fixed_version":"102.0.5005.61-1","urgency":"not yet assigned"},"trixie":{"status":"resolved","repositories":{"trixie":"143.0.7499.169-1~deb13u1","trixie-security":"145.0.7632.159-1~deb13u1"},"fixed_version":"102.0.5005.61-1","urgency":"not yet assigned"}}},"CVE-2022-4919":{"description":"Use after free in Base Internals in Google Chrome prior to 101.0.4951.41 allowed a remote attacker to perform arbitrary read/write via a crafted HTML page. (Chromium security severity: High)","scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"143.0.7499.169-1~deb12u1","bookworm-security":"145.0.7632.159-1~deb12u1"},"fixed_version":"101.0.4951.41-1","urgency":"not yet assigned"},"bullseye":{"status":"resolved","repositories":{"bullseye":"120.0.6099.224-1~deb11u1","bullseye-security":"120.0.6099.224-1~deb11u1"},"fixed_version":"101.0.4951.41-1~deb11u1","urgency":"not yet assigned"},"forky":{"status":"resolved","repositories":{"forky":"145.0.7632.159-1"},"fixed_version":"101.0.4951.41-1","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"146.0.7680.71-1"},"fixed_version":"101.0.4951.41-1","urgency":"not yet assigned"},"trixie":{"status":"resolved","repositories":{"trixie":"143.0.7499.169-1~deb13u1","trixie-security":"145.0.7632.159-1~deb13u1"},"fixed_version":"101.0.4951.41-1","urgency":"not yet assigned"}}},"CVE-2022-4920":{"description":"Heap buffer overflow in Blink in Google Chrome prior to 101.0.4951.41 allowed a remote attacker who convinced a user to engage in specific UI gestures to potentially perform a sandbox escape via a crafted HTML page. (Chromium security severity: High)","scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"143.0.7499.169-1~deb12u1","bookworm-security":"145.0.7632.159-1~deb12u1"},"fixed_version":"101.0.4951.41-1","urgency":"not yet assigned"},"bullseye":{"status":"resolved","repositories":{"bullseye":"120.0.6099.224-1~deb11u1","bullseye-security":"120.0.6099.224-1~deb11u1"},"fixed_version":"101.0.4951.41-1~deb11u1","urgency":"not yet assigned"},"forky":{"status":"resolved","repositories":{"forky":"145.0.7632.159-1"},"fixed_version":"101.0.4951.41-1","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"146.0.7680.71-1"},"fixed_version":"101.0.4951.41-1","urgency":"not yet assigned"},"trixie":{"status":"resolved","repositories":{"trixie":"143.0.7499.169-1~deb13u1","trixie-security":"145.0.7632.159-1~deb13u1"},"fixed_version":"101.0.4951.41-1","urgency":"not yet assigned"}}},"CVE-2022-4921":{"description":"Use after free in Accessibility in Google Chrome prior to 99.0.4844.51 allowed a remote attacker who convinced a user to engage in specific UI gestures to perform arbitrary read/write via a crafted HTML page. (Chromium security severity: Low)","scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"143.0.7499.169-1~deb12u1","bookworm-security":"145.0.7632.159-1~deb12u1"},"fixed_version":"99.0.4844.51-1","urgency":"not yet assigned"},"bullseye":{"status":"resolved","repositories":{"bullseye":"120.0.6099.224-1~deb11u1","bullseye-security":"120.0.6099.224-1~deb11u1"},"fixed_version":"99.0.4844.51-1~deb11u1","urgency":"not yet assigned"},"forky":{"status":"resolved","repositories":{"forky":"145.0.7632.159-1"},"fixed_version":"99.0.4844.51-1","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"146.0.7680.71-1"},"fixed_version":"99.0.4844.51-1","urgency":"not yet assigned"},"trixie":{"status":"resolved","repositories":{"trixie":"143.0.7499.169-1~deb13u1","trixie-security":"145.0.7632.159-1~deb13u1"},"fixed_version":"99.0.4844.51-1","urgency":"not yet assigned"}}},"CVE-2022-4922":{"description":"Inappropriate implementation in Blink in Google Chrome prior to 99.0.4844.51 allowed a remote attacker to perform UI spoofing via a crafted HTML page. (Chromium security severity: Medium)","scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"143.0.7499.169-1~deb12u1","bookworm-security":"145.0.7632.159-1~deb12u1"},"fixed_version":"99.0.4844.51-1","urgency":"not yet assigned"},"bullseye":{"status":"resolved","repositories":{"bullseye":"120.0.6099.224-1~deb11u1","bullseye-security":"120.0.6099.224-1~deb11u1"},"fixed_version":"99.0.4844.51-1~deb11u1","urgency":"not yet assigned"},"forky":{"status":"resolved","repositories":{"forky":"145.0.7632.159-1"},"fixed_version":"99.0.4844.51-1","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"146.0.7680.71-1"},"fixed_version":"99.0.4844.51-1","urgency":"not yet assigned"},"trixie":{"status":"resolved","repositories":{"trixie":"143.0.7499.169-1~deb13u1","trixie-security":"145.0.7632.159-1~deb13u1"},"fixed_version":"99.0.4844.51-1","urgency":"not yet assigned"}}},"CVE-2022-4923":{"description":"Inappropriate implementation in Omnibox in Google Chrome prior to 99.0.4844.51 allowed an attacker in a privileged network position to perform a man-in-the-middle attack via malicious network traffic. (Chromium security severity: Low)","scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"143.0.7499.169-1~deb12u1","bookworm-security":"145.0.7632.159-1~deb12u1"},"fixed_version":"99.0.4844.51-1","urgency":"not yet assigned"},"bullseye":{"status":"resolved","repositories":{"bullseye":"120.0.6099.224-1~deb11u1","bullseye-security":"120.0.6099.224-1~deb11u1"},"fixed_version":"99.0.4844.51-1~deb11u1","urgency":"not yet assigned"},"forky":{"status":"resolved","repositories":{"forky":"145.0.7632.159-1"},"fixed_version":"99.0.4844.51-1","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"146.0.7680.71-1"},"fixed_version":"99.0.4844.51-1","urgency":"not yet assigned"},"trixie":{"status":"resolved","repositories":{"trixie":"143.0.7499.169-1~deb13u1","trixie-security":"145.0.7632.159-1~deb13u1"},"fixed_version":"99.0.4844.51-1","urgency":"not yet assigned"}}},"CVE-2022-4924":{"description":"Use after free in WebRTC in Google Chrome prior to 97.0.4692.71 allowed a remote attacker who had compromised the renderer process to potentially perform a sandbox escape via a crafted HTML page. (Chromium security severity: High)","scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"143.0.7499.169-1~deb12u1","bookworm-security":"145.0.7632.159-1~deb12u1"},"fixed_version":"97.0.4692.71-0.1","urgency":"not yet assigned"},"bullseye":{"status":"resolved","repositories":{"bullseye":"120.0.6099.224-1~deb11u1","bullseye-security":"120.0.6099.224-1~deb11u1"},"fixed_version":"97.0.4692.71-0.1~deb11u1","urgency":"not yet assigned"},"forky":{"status":"resolved","repositories":{"forky":"145.0.7632.159-1"},"fixed_version":"97.0.4692.71-0.1","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"146.0.7680.71-1"},"fixed_version":"97.0.4692.71-0.1","urgency":"not yet assigned"},"trixie":{"status":"resolved","repositories":{"trixie":"143.0.7499.169-1~deb13u1","trixie-security":"145.0.7632.159-1~deb13u1"},"fixed_version":"97.0.4692.71-0.1","urgency":"not yet assigned"}}},"CVE-2022-4925":{"description":"Insufficient validation of untrusted input in QUIC in Google Chrome prior to 97.0.4692.71 allowed a remote attacker to perform header splitting via malicious network traffic. (Chromium security severity: Low)","scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"143.0.7499.169-1~deb12u1","bookworm-security":"145.0.7632.159-1~deb12u1"},"fixed_version":"97.0.4692.71-0.1","urgency":"not yet assigned"},"bullseye":{"status":"resolved","repositories":{"bullseye":"120.0.6099.224-1~deb11u1","bullseye-security":"120.0.6099.224-1~deb11u1"},"fixed_version":"97.0.4692.71-0.1~deb11u1","urgency":"not yet assigned"},"forky":{"status":"resolved","repositories":{"forky":"145.0.7632.159-1"},"fixed_version":"97.0.4692.71-0.1","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"146.0.7680.71-1"},"fixed_version":"97.0.4692.71-0.1","urgency":"not yet assigned"},"trixie":{"status":"resolved","repositories":{"trixie":"143.0.7499.169-1~deb13u1","trixie-security":"145.0.7632.159-1~deb13u1"},"fixed_version":"97.0.4692.71-0.1","urgency":"not yet assigned"}}},"CVE-2022-4926":{"description":"Insufficient policy enforcement in Intents in Google Chrome on Android prior to 109.0.5414.119 allowed a remote attacker to bypass same origin policy via a crafted HTML page. (Chromium security severity: Medium)","scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"143.0.7499.169-1~deb12u1","bookworm-security":"145.0.7632.159-1~deb12u1"},"fixed_version":"109.0.5414.119-1","urgency":"not yet assigned"},"bullseye":{"status":"resolved","repositories":{"bullseye":"120.0.6099.224-1~deb11u1","bullseye-security":"120.0.6099.224-1~deb11u1"},"fixed_version":"109.0.5414.119-1~deb11u1","urgency":"not yet assigned"},"forky":{"status":"resolved","repositories":{"forky":"145.0.7632.159-1"},"fixed_version":"109.0.5414.119-1","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"146.0.7680.71-1"},"fixed_version":"109.0.5414.119-1","urgency":"not yet assigned"},"trixie":{"status":"resolved","repositories":{"trixie":"143.0.7499.169-1~deb13u1","trixie-security":"145.0.7632.159-1~deb13u1"},"fixed_version":"109.0.5414.119-1","urgency":"not yet assigned"}}},"CVE-2022-4955":{"description":"Inappropriate implementation in DevTools in Google Chrome prior to 108.0.5359.71 allowed an attacker who convinced a user to install a malicious extension to bypass file access restrictions via a crafted HTML page. (Chromium security severity: Medium)","scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"143.0.7499.169-1~deb12u1","bookworm-security":"145.0.7632.159-1~deb12u1"},"fixed_version":"108.0.5359.71-1","urgency":"not yet assigned"},"bullseye":{"status":"resolved","repositories":{"bullseye":"120.0.6099.224-1~deb11u1","bullseye-security":"120.0.6099.224-1~deb11u1"},"fixed_version":"108.0.5359.71-2~deb11u1","urgency":"not yet assigned"},"forky":{"status":"resolved","repositories":{"forky":"145.0.7632.159-1"},"fixed_version":"108.0.5359.71-1","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"146.0.7680.71-1"},"fixed_version":"108.0.5359.71-1","urgency":"not yet assigned"},"trixie":{"status":"resolved","repositories":{"trixie":"143.0.7499.169-1~deb13u1","trixie-security":"145.0.7632.159-1~deb13u1"},"fixed_version":"108.0.5359.71-1","urgency":"not yet assigned"}}},"CVE-2023-0128":{"description":"Use after free in Overview Mode in Google Chrome on Chrome OS prior to 109.0.5414.74 allowed a remote attacker who convinced a user to engage in specific UI interactions to potentially exploit heap corruption via a crafted HTML page. (Chromium security severity: High)","scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"143.0.7499.169-1~deb12u1","bookworm-security":"145.0.7632.159-1~deb12u1"},"fixed_version":"109.0.5414.74-1","urgency":"not yet assigned"},"bullseye":{"status":"resolved","repositories":{"bullseye":"120.0.6099.224-1~deb11u1","bullseye-security":"120.0.6099.224-1~deb11u1"},"fixed_version":"109.0.5414.74-2~deb11u1","urgency":"not yet assigned"},"forky":{"status":"resolved","repositories":{"forky":"145.0.7632.159-1"},"fixed_version":"109.0.5414.74-1","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"146.0.7680.71-1"},"fixed_version":"109.0.5414.74-1","urgency":"not yet assigned"},"trixie":{"status":"resolved","repositories":{"trixie":"143.0.7499.169-1~deb13u1","trixie-security":"145.0.7632.159-1~deb13u1"},"fixed_version":"109.0.5414.74-1","urgency":"not yet assigned"}}},"CVE-2023-0129":{"description":"Heap buffer overflow in Network Service in Google Chrome prior to 109.0.5414.74 allowed an attacker who convinced a user to install a malicious extension to potentially exploit heap corruption via a crafted HTML page and specific interactions. (Chromium security severity: High)","scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"143.0.7499.169-1~deb12u1","bookworm-security":"145.0.7632.159-1~deb12u1"},"fixed_version":"109.0.5414.74-1","urgency":"not yet assigned"},"bullseye":{"status":"resolved","repositories":{"bullseye":"120.0.6099.224-1~deb11u1","bullseye-security":"120.0.6099.224-1~deb11u1"},"fixed_version":"109.0.5414.74-2~deb11u1","urgency":"not yet assigned"},"forky":{"status":"resolved","repositories":{"forky":"145.0.7632.159-1"},"fixed_version":"109.0.5414.74-1","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"146.0.7680.71-1"},"fixed_version":"109.0.5414.74-1","urgency":"not yet assigned"},"trixie":{"status":"resolved","repositories":{"trixie":"143.0.7499.169-1~deb13u1","trixie-security":"145.0.7632.159-1~deb13u1"},"fixed_version":"109.0.5414.74-1","urgency":"not yet assigned"}}},"CVE-2023-0130":{"description":"Inappropriate implementation in in Fullscreen API in Google Chrome on Android prior to 109.0.5414.74 allowed a remote attacker to spoof the contents of the Omnibox (URL bar) via a crafted HTML page. (Chromium security severity: Medium)","scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"143.0.7499.169-1~deb12u1","bookworm-security":"145.0.7632.159-1~deb12u1"},"fixed_version":"109.0.5414.74-1","urgency":"not yet assigned"},"bullseye":{"status":"resolved","repositories":{"bullseye":"120.0.6099.224-1~deb11u1","bullseye-security":"120.0.6099.224-1~deb11u1"},"fixed_version":"109.0.5414.74-2~deb11u1","urgency":"not yet assigned"},"forky":{"status":"resolved","repositories":{"forky":"145.0.7632.159-1"},"fixed_version":"109.0.5414.74-1","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"146.0.7680.71-1"},"fixed_version":"109.0.5414.74-1","urgency":"not yet assigned"},"trixie":{"status":"resolved","repositories":{"trixie":"143.0.7499.169-1~deb13u1","trixie-security":"145.0.7632.159-1~deb13u1"},"fixed_version":"109.0.5414.74-1","urgency":"not yet assigned"}}},"CVE-2023-0131":{"description":"Inappropriate implementation in in iframe Sandbox in Google Chrome prior to 109.0.5414.74 allowed a remote attacker to bypass file download restrictions via a crafted HTML page. (Chromium security severity: Medium)","scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"143.0.7499.169-1~deb12u1","bookworm-security":"145.0.7632.159-1~deb12u1"},"fixed_version":"109.0.5414.74-1","urgency":"not yet assigned"},"bullseye":{"status":"resolved","repositories":{"bullseye":"120.0.6099.224-1~deb11u1","bullseye-security":"120.0.6099.224-1~deb11u1"},"fixed_version":"109.0.5414.74-2~deb11u1","urgency":"not yet assigned"},"forky":{"status":"resolved","repositories":{"forky":"145.0.7632.159-1"},"fixed_version":"109.0.5414.74-1","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"146.0.7680.71-1"},"fixed_version":"109.0.5414.74-1","urgency":"not yet assigned"},"trixie":{"status":"resolved","repositories":{"trixie":"143.0.7499.169-1~deb13u1","trixie-security":"145.0.7632.159-1~deb13u1"},"fixed_version":"109.0.5414.74-1","urgency":"not yet assigned"}}},"CVE-2023-0132":{"description":"Inappropriate implementation in in Permission prompts in Google Chrome on Windows prior to 109.0.5414.74 allowed a remote attacker to force acceptance of a permission prompt via a crafted HTML page. (Chromium security severity: Medium)","scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"143.0.7499.169-1~deb12u1","bookworm-security":"145.0.7632.159-1~deb12u1"},"fixed_version":"109.0.5414.74-1","urgency":"not yet assigned"},"bullseye":{"status":"resolved","repositories":{"bullseye":"120.0.6099.224-1~deb11u1","bullseye-security":"120.0.6099.224-1~deb11u1"},"fixed_version":"109.0.5414.74-2~deb11u1","urgency":"not yet assigned"},"forky":{"status":"resolved","repositories":{"forky":"145.0.7632.159-1"},"fixed_version":"109.0.5414.74-1","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"146.0.7680.71-1"},"fixed_version":"109.0.5414.74-1","urgency":"not yet assigned"},"trixie":{"status":"resolved","repositories":{"trixie":"143.0.7499.169-1~deb13u1","trixie-security":"145.0.7632.159-1~deb13u1"},"fixed_version":"109.0.5414.74-1","urgency":"not yet assigned"}}},"CVE-2023-0133":{"description":"Inappropriate implementation in in Permission prompts in Google Chrome on Android prior to 109.0.5414.74 allowed a remote attacker to bypass main origin permission delegation via a crafted HTML page. (Chromium security severity: Medium)","scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"143.0.7499.169-1~deb12u1","bookworm-security":"145.0.7632.159-1~deb12u1"},"fixed_version":"109.0.5414.74-1","urgency":"not yet assigned"},"bullseye":{"status":"resolved","repositories":{"bullseye":"120.0.6099.224-1~deb11u1","bullseye-security":"120.0.6099.224-1~deb11u1"},"fixed_version":"109.0.5414.74-2~deb11u1","urgency":"not yet assigned"},"forky":{"status":"resolved","repositories":{"forky":"145.0.7632.159-1"},"fixed_version":"109.0.5414.74-1","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"146.0.7680.71-1"},"fixed_version":"109.0.5414.74-1","urgency":"not yet assigned"},"trixie":{"status":"resolved","repositories":{"trixie":"143.0.7499.169-1~deb13u1","trixie-security":"145.0.7632.159-1~deb13u1"},"fixed_version":"109.0.5414.74-1","urgency":"not yet assigned"}}},"CVE-2023-0134":{"description":"Use after free in Cart in Google Chrome prior to 109.0.5414.74 allowed an attacker who convinced a user to install a malicious extension to potentially exploit heap corruption via database corruption and a crafted HTML page. (Chromium security severity: Medium)","scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"143.0.7499.169-1~deb12u1","bookworm-security":"145.0.7632.159-1~deb12u1"},"fixed_version":"109.0.5414.74-1","urgency":"not yet assigned"},"bullseye":{"status":"resolved","repositories":{"bullseye":"120.0.6099.224-1~deb11u1","bullseye-security":"120.0.6099.224-1~deb11u1"},"fixed_version":"109.0.5414.74-2~deb11u1","urgency":"not yet assigned"},"forky":{"status":"resolved","repositories":{"forky":"145.0.7632.159-1"},"fixed_version":"109.0.5414.74-1","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"146.0.7680.71-1"},"fixed_version":"109.0.5414.74-1","urgency":"not yet assigned"},"trixie":{"status":"resolved","repositories":{"trixie":"143.0.7499.169-1~deb13u1","trixie-security":"145.0.7632.159-1~deb13u1"},"fixed_version":"109.0.5414.74-1","urgency":"not yet assigned"}}},"CVE-2023-0135":{"description":"Use after free in Cart in Google Chrome prior to 109.0.5414.74 allowed an attacker who convinced a user to install a malicious extension to potentially exploit heap corruption via database corruption and a crafted HTML page. (Chromium security severity: Medium)","scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"143.0.7499.169-1~deb12u1","bookworm-security":"145.0.7632.159-1~deb12u1"},"fixed_version":"109.0.5414.74-1","urgency":"not yet assigned"},"bullseye":{"status":"resolved","repositories":{"bullseye":"120.0.6099.224-1~deb11u1","bullseye-security":"120.0.6099.224-1~deb11u1"},"fixed_version":"109.0.5414.74-2~deb11u1","urgency":"not yet assigned"},"forky":{"status":"resolved","repositories":{"forky":"145.0.7632.159-1"},"fixed_version":"109.0.5414.74-1","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"146.0.7680.71-1"},"fixed_version":"109.0.5414.74-1","urgency":"not yet assigned"},"trixie":{"status":"resolved","repositories":{"trixie":"143.0.7499.169-1~deb13u1","trixie-security":"145.0.7632.159-1~deb13u1"},"fixed_version":"109.0.5414.74-1","urgency":"not yet assigned"}}},"CVE-2023-0136":{"description":"Inappropriate implementation in in Fullscreen API in Google Chrome on Android prior to 109.0.5414.74 allowed a remote attacker to execute incorrect security UI via a crafted HTML page. (Chromium security severity: Medium)","scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"143.0.7499.169-1~deb12u1","bookworm-security":"145.0.7632.159-1~deb12u1"},"fixed_version":"109.0.5414.74-1","urgency":"not yet assigned"},"bullseye":{"status":"resolved","repositories":{"bullseye":"120.0.6099.224-1~deb11u1","bullseye-security":"120.0.6099.224-1~deb11u1"},"fixed_version":"109.0.5414.74-2~deb11u1","urgency":"not yet assigned"},"forky":{"status":"resolved","repositories":{"forky":"145.0.7632.159-1"},"fixed_version":"109.0.5414.74-1","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"146.0.7680.71-1"},"fixed_version":"109.0.5414.74-1","urgency":"not yet assigned"},"trixie":{"status":"resolved","repositories":{"trixie":"143.0.7499.169-1~deb13u1","trixie-security":"145.0.7632.159-1~deb13u1"},"fixed_version":"109.0.5414.74-1","urgency":"not yet assigned"}}},"CVE-2023-0137":{"description":"Heap buffer overflow in Platform Apps in Google Chrome on Chrome OS prior to 109.0.5414.74 allowed an attacker who convinced a user to install a malicious extension to potentially exploit heap corruption via a crafted HTML page. (Chromium security severity: Medium)","scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"143.0.7499.169-1~deb12u1","bookworm-security":"145.0.7632.159-1~deb12u1"},"fixed_version":"109.0.5414.74-1","urgency":"not yet assigned"},"bullseye":{"status":"resolved","repositories":{"bullseye":"120.0.6099.224-1~deb11u1","bullseye-security":"120.0.6099.224-1~deb11u1"},"fixed_version":"109.0.5414.74-2~deb11u1","urgency":"not yet assigned"},"forky":{"status":"resolved","repositories":{"forky":"145.0.7632.159-1"},"fixed_version":"109.0.5414.74-1","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"146.0.7680.71-1"},"fixed_version":"109.0.5414.74-1","urgency":"not yet assigned"},"trixie":{"status":"resolved","repositories":{"trixie":"143.0.7499.169-1~deb13u1","trixie-security":"145.0.7632.159-1~deb13u1"},"fixed_version":"109.0.5414.74-1","urgency":"not yet assigned"}}},"CVE-2023-0138":{"description":"Heap buffer overflow in libphonenumber in Google Chrome prior to 109.0.5414.74 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. (Chromium security severity: Low)","scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"143.0.7499.169-1~deb12u1","bookworm-security":"145.0.7632.159-1~deb12u1"},"fixed_version":"109.0.5414.74-1","urgency":"not yet assigned"},"bullseye":{"status":"resolved","repositories":{"bullseye":"120.0.6099.224-1~deb11u1","bullseye-security":"120.0.6099.224-1~deb11u1"},"fixed_version":"109.0.5414.74-2~deb11u1","urgency":"not yet assigned"},"forky":{"status":"resolved","repositories":{"forky":"145.0.7632.159-1"},"fixed_version":"109.0.5414.74-1","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"146.0.7680.71-1"},"fixed_version":"109.0.5414.74-1","urgency":"not yet assigned"},"trixie":{"status":"resolved","repositories":{"trixie":"143.0.7499.169-1~deb13u1","trixie-security":"145.0.7632.159-1~deb13u1"},"fixed_version":"109.0.5414.74-1","urgency":"not yet assigned"}}},"CVE-2023-0139":{"description":"Insufficient validation of untrusted input in Downloads in Google Chrome on Windows prior to 109.0.5414.74 allowed a remote attacker to bypass download restrictions via a crafted HTML page. (Chromium security severity: Low)","scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"143.0.7499.169-1~deb12u1","bookworm-security":"145.0.7632.159-1~deb12u1"},"fixed_version":"109.0.5414.74-1","urgency":"not yet assigned"},"bullseye":{"status":"resolved","repositories":{"bullseye":"120.0.6099.224-1~deb11u1","bullseye-security":"120.0.6099.224-1~deb11u1"},"fixed_version":"109.0.5414.74-2~deb11u1","urgency":"not yet assigned"},"forky":{"status":"resolved","repositories":{"forky":"145.0.7632.159-1"},"fixed_version":"109.0.5414.74-1","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"146.0.7680.71-1"},"fixed_version":"109.0.5414.74-1","urgency":"not yet assigned"},"trixie":{"status":"resolved","repositories":{"trixie":"143.0.7499.169-1~deb13u1","trixie-security":"145.0.7632.159-1~deb13u1"},"fixed_version":"109.0.5414.74-1","urgency":"not yet assigned"}}},"CVE-2023-0140":{"description":"Inappropriate implementation in in File System API in Google Chrome on Windows prior to 109.0.5414.74 allowed a remote attacker to bypass file system restrictions via a crafted HTML page. (Chromium security severity: Low)","scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"143.0.7499.169-1~deb12u1","bookworm-security":"145.0.7632.159-1~deb12u1"},"fixed_version":"109.0.5414.74-1","urgency":"not yet assigned"},"bullseye":{"status":"resolved","repositories":{"bullseye":"120.0.6099.224-1~deb11u1","bullseye-security":"120.0.6099.224-1~deb11u1"},"fixed_version":"109.0.5414.74-2~deb11u1","urgency":"not yet assigned"},"forky":{"status":"resolved","repositories":{"forky":"145.0.7632.159-1"},"fixed_version":"109.0.5414.74-1","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"146.0.7680.71-1"},"fixed_version":"109.0.5414.74-1","urgency":"not yet assigned"},"trixie":{"status":"resolved","repositories":{"trixie":"143.0.7499.169-1~deb13u1","trixie-security":"145.0.7632.159-1~deb13u1"},"fixed_version":"109.0.5414.74-1","urgency":"not yet assigned"}}},"CVE-2023-0141":{"description":"Insufficient policy enforcement in CORS in Google Chrome prior to 109.0.5414.74 allowed a remote attacker to leak cross-origin data via a crafted HTML page. (Chromium security severity: Low)","scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"143.0.7499.169-1~deb12u1","bookworm-security":"145.0.7632.159-1~deb12u1"},"fixed_version":"109.0.5414.74-1","urgency":"not yet assigned"},"bullseye":{"status":"resolved","repositories":{"bullseye":"120.0.6099.224-1~deb11u1","bullseye-security":"120.0.6099.224-1~deb11u1"},"fixed_version":"109.0.5414.74-2~deb11u1","urgency":"not yet assigned"},"forky":{"status":"resolved","repositories":{"forky":"145.0.7632.159-1"},"fixed_version":"109.0.5414.74-1","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"146.0.7680.71-1"},"fixed_version":"109.0.5414.74-1","urgency":"not yet assigned"},"trixie":{"status":"resolved","repositories":{"trixie":"143.0.7499.169-1~deb13u1","trixie-security":"145.0.7632.159-1~deb13u1"},"fixed_version":"109.0.5414.74-1","urgency":"not yet assigned"}}},"CVE-2023-0471":{"description":"Use after free in WebTransport in Google Chrome prior to 109.0.5414.119 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. (Chromium security severity: High)","scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"143.0.7499.169-1~deb12u1","bookworm-security":"145.0.7632.159-1~deb12u1"},"fixed_version":"109.0.5414.119-1","urgency":"not yet assigned"},"bullseye":{"status":"resolved","repositories":{"bullseye":"120.0.6099.224-1~deb11u1","bullseye-security":"120.0.6099.224-1~deb11u1"},"fixed_version":"109.0.5414.119-1~deb11u1","urgency":"not yet assigned"},"forky":{"status":"resolved","repositories":{"forky":"145.0.7632.159-1"},"fixed_version":"109.0.5414.119-1","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"146.0.7680.71-1"},"fixed_version":"109.0.5414.119-1","urgency":"not yet assigned"},"trixie":{"status":"resolved","repositories":{"trixie":"143.0.7499.169-1~deb13u1","trixie-security":"145.0.7632.159-1~deb13u1"},"fixed_version":"109.0.5414.119-1","urgency":"not yet assigned"}}},"CVE-2023-0472":{"description":"Use after free in WebRTC in Google Chrome prior to 109.0.5414.119 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. (Chromium security severity: High)","scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"143.0.7499.169-1~deb12u1","bookworm-security":"145.0.7632.159-1~deb12u1"},"fixed_version":"109.0.5414.119-1","urgency":"not yet assigned"},"bullseye":{"status":"resolved","repositories":{"bullseye":"120.0.6099.224-1~deb11u1","bullseye-security":"120.0.6099.224-1~deb11u1"},"fixed_version":"109.0.5414.119-1~deb11u1","urgency":"not yet assigned"},"forky":{"status":"resolved","repositories":{"forky":"145.0.7632.159-1"},"fixed_version":"109.0.5414.119-1","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"146.0.7680.71-1"},"fixed_version":"109.0.5414.119-1","urgency":"not yet assigned"},"trixie":{"status":"resolved","repositories":{"trixie":"143.0.7499.169-1~deb13u1","trixie-security":"145.0.7632.159-1~deb13u1"},"fixed_version":"109.0.5414.119-1","urgency":"not yet assigned"}}},"CVE-2023-0473":{"description":"Type Confusion in ServiceWorker API in Google Chrome prior to 109.0.5414.119 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. (Chromium security severity: Medium)","scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"143.0.7499.169-1~deb12u1","bookworm-security":"145.0.7632.159-1~deb12u1"},"fixed_version":"109.0.5414.119-1","urgency":"not yet assigned"},"bullseye":{"status":"resolved","repositories":{"bullseye":"120.0.6099.224-1~deb11u1","bullseye-security":"120.0.6099.224-1~deb11u1"},"fixed_version":"109.0.5414.119-1~deb11u1","urgency":"not yet assigned"},"forky":{"status":"resolved","repositories":{"forky":"145.0.7632.159-1"},"fixed_version":"109.0.5414.119-1","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"146.0.7680.71-1"},"fixed_version":"109.0.5414.119-1","urgency":"not yet assigned"},"trixie":{"status":"resolved","repositories":{"trixie":"143.0.7499.169-1~deb13u1","trixie-security":"145.0.7632.159-1~deb13u1"},"fixed_version":"109.0.5414.119-1","urgency":"not yet assigned"}}},"CVE-2023-0474":{"description":"Use after free in GuestView in Google Chrome prior to 109.0.5414.119 allowed an attacker who convinced a user to install a malicious extension to potentially exploit heap corruption via a Chrome web app. (Chromium security severity: Medium)","scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"143.0.7499.169-1~deb12u1","bookworm-security":"145.0.7632.159-1~deb12u1"},"fixed_version":"109.0.5414.119-1","urgency":"not yet assigned"},"bullseye":{"status":"resolved","repositories":{"bullseye":"120.0.6099.224-1~deb11u1","bullseye-security":"120.0.6099.224-1~deb11u1"},"fixed_version":"109.0.5414.119-1~deb11u1","urgency":"not yet assigned"},"forky":{"status":"resolved","repositories":{"forky":"145.0.7632.159-1"},"fixed_version":"109.0.5414.119-1","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"146.0.7680.71-1"},"fixed_version":"109.0.5414.119-1","urgency":"not yet assigned"},"trixie":{"status":"resolved","repositories":{"trixie":"143.0.7499.169-1~deb13u1","trixie-security":"145.0.7632.159-1~deb13u1"},"fixed_version":"109.0.5414.119-1","urgency":"not yet assigned"}}},"CVE-2023-0696":{"description":"Type confusion in V8 in Google Chrome prior to 110.0.5481.77 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. (Chromium security severity: High)","scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"143.0.7499.169-1~deb12u1","bookworm-security":"145.0.7632.159-1~deb12u1"},"fixed_version":"110.0.5481.77-1","urgency":"not yet assigned"},"bullseye":{"status":"resolved","repositories":{"bullseye":"120.0.6099.224-1~deb11u1","bullseye-security":"120.0.6099.224-1~deb11u1"},"fixed_version":"110.0.5481.77-1~deb11u1","urgency":"not yet assigned"},"forky":{"status":"resolved","repositories":{"forky":"145.0.7632.159-1"},"fixed_version":"110.0.5481.77-1","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"146.0.7680.71-1"},"fixed_version":"110.0.5481.77-1","urgency":"not yet assigned"},"trixie":{"status":"resolved","repositories":{"trixie":"143.0.7499.169-1~deb13u1","trixie-security":"145.0.7632.159-1~deb13u1"},"fixed_version":"110.0.5481.77-1","urgency":"not yet assigned"}}},"CVE-2023-0697":{"description":"Inappropriate implementation in Full screen mode in Google Chrome on Android prior to 110.0.5481.77 allowed a remote attacker to spoof the contents of the security UI via a crafted HTML page. (Chromium security severity: High)","scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"143.0.7499.169-1~deb12u1","bookworm-security":"145.0.7632.159-1~deb12u1"},"fixed_version":"110.0.5481.77-1","urgency":"not yet assigned"},"bullseye":{"status":"resolved","repositories":{"bullseye":"120.0.6099.224-1~deb11u1","bullseye-security":"120.0.6099.224-1~deb11u1"},"fixed_version":"110.0.5481.77-1~deb11u1","urgency":"not yet assigned"},"forky":{"status":"resolved","repositories":{"forky":"145.0.7632.159-1"},"fixed_version":"110.0.5481.77-1","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"146.0.7680.71-1"},"fixed_version":"110.0.5481.77-1","urgency":"not yet assigned"},"trixie":{"status":"resolved","repositories":{"trixie":"143.0.7499.169-1~deb13u1","trixie-security":"145.0.7632.159-1~deb13u1"},"fixed_version":"110.0.5481.77-1","urgency":"not yet assigned"}}},"CVE-2023-0698":{"description":"Out of bounds read in WebRTC in Google Chrome prior to 110.0.5481.77 allowed a remote attacker to perform an out of bounds memory read via a crafted HTML page. (Chromium security severity: High)","scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"143.0.7499.169-1~deb12u1","bookworm-security":"145.0.7632.159-1~deb12u1"},"fixed_version":"110.0.5481.77-1","urgency":"not yet assigned"},"bullseye":{"status":"resolved","repositories":{"bullseye":"120.0.6099.224-1~deb11u1","bullseye-security":"120.0.6099.224-1~deb11u1"},"fixed_version":"110.0.5481.77-1~deb11u1","urgency":"not yet assigned"},"forky":{"status":"resolved","repositories":{"forky":"145.0.7632.159-1"},"fixed_version":"110.0.5481.77-1","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"146.0.7680.71-1"},"fixed_version":"110.0.5481.77-1","urgency":"not yet assigned"},"trixie":{"status":"resolved","repositories":{"trixie":"143.0.7499.169-1~deb13u1","trixie-security":"145.0.7632.159-1~deb13u1"},"fixed_version":"110.0.5481.77-1","urgency":"not yet assigned"}}},"CVE-2023-0699":{"description":"Use after free in GPU in Google Chrome prior to 110.0.5481.77 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page and browser shutdown. (Chromium security severity: Medium)","scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"143.0.7499.169-1~deb12u1","bookworm-security":"145.0.7632.159-1~deb12u1"},"fixed_version":"110.0.5481.77-1","urgency":"not yet assigned"},"bullseye":{"status":"resolved","repositories":{"bullseye":"120.0.6099.224-1~deb11u1","bullseye-security":"120.0.6099.224-1~deb11u1"},"fixed_version":"110.0.5481.77-1~deb11u1","urgency":"not yet assigned"},"forky":{"status":"resolved","repositories":{"forky":"145.0.7632.159-1"},"fixed_version":"110.0.5481.77-1","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"146.0.7680.71-1"},"fixed_version":"110.0.5481.77-1","urgency":"not yet assigned"},"trixie":{"status":"resolved","repositories":{"trixie":"143.0.7499.169-1~deb13u1","trixie-security":"145.0.7632.159-1~deb13u1"},"fixed_version":"110.0.5481.77-1","urgency":"not yet assigned"}}},"CVE-2023-0700":{"description":"Inappropriate implementation in Download in Google Chrome prior to 110.0.5481.77 allowed a remote attacker to potentially spoof the contents of the Omnibox (URL bar) via a crafted HTML page. (Chromium security severity: Medium)","scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"143.0.7499.169-1~deb12u1","bookworm-security":"145.0.7632.159-1~deb12u1"},"fixed_version":"110.0.5481.77-1","urgency":"not yet assigned"},"bullseye":{"status":"resolved","repositories":{"bullseye":"120.0.6099.224-1~deb11u1","bullseye-security":"120.0.6099.224-1~deb11u1"},"fixed_version":"110.0.5481.77-1~deb11u1","urgency":"not yet assigned"},"forky":{"status":"resolved","repositories":{"forky":"145.0.7632.159-1"},"fixed_version":"110.0.5481.77-1","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"146.0.7680.71-1"},"fixed_version":"110.0.5481.77-1","urgency":"not yet assigned"},"trixie":{"status":"resolved","repositories":{"trixie":"143.0.7499.169-1~deb13u1","trixie-security":"145.0.7632.159-1~deb13u1"},"fixed_version":"110.0.5481.77-1","urgency":"not yet assigned"}}},"CVE-2023-0701":{"description":"Heap buffer overflow in WebUI in Google Chrome prior to 110.0.5481.77 allowed a remote attacker who convinced a user to engage in specific UI interactions to potentially exploit heap corruption via UI interaction . (Chromium security severity: Medium)","scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"143.0.7499.169-1~deb12u1","bookworm-security":"145.0.7632.159-1~deb12u1"},"fixed_version":"110.0.5481.77-1","urgency":"not yet assigned"},"bullseye":{"status":"resolved","repositories":{"bullseye":"120.0.6099.224-1~deb11u1","bullseye-security":"120.0.6099.224-1~deb11u1"},"fixed_version":"110.0.5481.77-1~deb11u1","urgency":"not yet assigned"},"forky":{"status":"resolved","repositories":{"forky":"145.0.7632.159-1"},"fixed_version":"110.0.5481.77-1","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"146.0.7680.71-1"},"fixed_version":"110.0.5481.77-1","urgency":"not yet assigned"},"trixie":{"status":"resolved","repositories":{"trixie":"143.0.7499.169-1~deb13u1","trixie-security":"145.0.7632.159-1~deb13u1"},"fixed_version":"110.0.5481.77-1","urgency":"not yet assigned"}}},"CVE-2023-0702":{"description":"Type confusion in Data Transfer in Google Chrome prior to 110.0.5481.77 allowed a remote attacker who convinced a user to engage in specific UI interactions to potentially exploit heap corruption via a crafted HTML page. (Chromium security severity: Medium)","scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"143.0.7499.169-1~deb12u1","bookworm-security":"145.0.7632.159-1~deb12u1"},"fixed_version":"110.0.5481.77-1","urgency":"not yet assigned"},"bullseye":{"status":"resolved","repositories":{"bullseye":"120.0.6099.224-1~deb11u1","bullseye-security":"120.0.6099.224-1~deb11u1"},"fixed_version":"110.0.5481.77-1~deb11u1","urgency":"not yet assigned"},"forky":{"status":"resolved","repositories":{"forky":"145.0.7632.159-1"},"fixed_version":"110.0.5481.77-1","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"146.0.7680.71-1"},"fixed_version":"110.0.5481.77-1","urgency":"not yet assigned"},"trixie":{"status":"resolved","repositories":{"trixie":"143.0.7499.169-1~deb13u1","trixie-security":"145.0.7632.159-1~deb13u1"},"fixed_version":"110.0.5481.77-1","urgency":"not yet assigned"}}},"CVE-2023-0703":{"description":"Type confusion in DevTools in Google Chrome prior to 110.0.5481.77 allowed a remote attacker who convinced a user to engage in specific UI interactions to potentially exploit heap corruption via UI interactions. (Chromium security severity: Medium)","scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"143.0.7499.169-1~deb12u1","bookworm-security":"145.0.7632.159-1~deb12u1"},"fixed_version":"110.0.5481.77-1","urgency":"not yet assigned"},"bullseye":{"status":"resolved","repositories":{"bullseye":"120.0.6099.224-1~deb11u1","bullseye-security":"120.0.6099.224-1~deb11u1"},"fixed_version":"110.0.5481.77-1~deb11u1","urgency":"not yet assigned"},"forky":{"status":"resolved","repositories":{"forky":"145.0.7632.159-1"},"fixed_version":"110.0.5481.77-1","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"146.0.7680.71-1"},"fixed_version":"110.0.5481.77-1","urgency":"not yet assigned"},"trixie":{"status":"resolved","repositories":{"trixie":"143.0.7499.169-1~deb13u1","trixie-security":"145.0.7632.159-1~deb13u1"},"fixed_version":"110.0.5481.77-1","urgency":"not yet assigned"}}},"CVE-2023-0704":{"description":"Insufficient policy enforcement in DevTools in Google Chrome prior to 110.0.5481.77 allowed a remote attacker to bypass same origin policy and proxy settings via a crafted HTML page. (Chromium security severity: Low)","scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"143.0.7499.169-1~deb12u1","bookworm-security":"145.0.7632.159-1~deb12u1"},"fixed_version":"110.0.5481.77-1","urgency":"not yet assigned"},"bullseye":{"status":"resolved","repositories":{"bullseye":"120.0.6099.224-1~deb11u1","bullseye-security":"120.0.6099.224-1~deb11u1"},"fixed_version":"110.0.5481.77-1~deb11u1","urgency":"not yet assigned"},"forky":{"status":"resolved","repositories":{"forky":"145.0.7632.159-1"},"fixed_version":"110.0.5481.77-1","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"146.0.7680.71-1"},"fixed_version":"110.0.5481.77-1","urgency":"not yet assigned"},"trixie":{"status":"resolved","repositories":{"trixie":"143.0.7499.169-1~deb13u1","trixie-security":"145.0.7632.159-1~deb13u1"},"fixed_version":"110.0.5481.77-1","urgency":"not yet assigned"}}},"CVE-2023-0705":{"description":"Integer overflow in Core in Google Chrome prior to 110.0.5481.77 allowed a remote attacker who had one a race condition to potentially exploit heap corruption via a crafted HTML page. (Chromium security severity: Low)","scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"143.0.7499.169-1~deb12u1","bookworm-security":"145.0.7632.159-1~deb12u1"},"fixed_version":"110.0.5481.77-1","urgency":"not yet assigned"},"bullseye":{"status":"resolved","repositories":{"bullseye":"120.0.6099.224-1~deb11u1","bullseye-security":"120.0.6099.224-1~deb11u1"},"fixed_version":"110.0.5481.77-1~deb11u1","urgency":"not yet assigned"},"forky":{"status":"resolved","repositories":{"forky":"145.0.7632.159-1"},"fixed_version":"110.0.5481.77-1","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"146.0.7680.71-1"},"fixed_version":"110.0.5481.77-1","urgency":"not yet assigned"},"trixie":{"status":"resolved","repositories":{"trixie":"143.0.7499.169-1~deb13u1","trixie-security":"145.0.7632.159-1~deb13u1"},"fixed_version":"110.0.5481.77-1","urgency":"not yet assigned"}}},"CVE-2023-0927":{"description":"Use after free in Web Payments API in Google Chrome on Android prior to 110.0.5481.177 allowed a remote attacker who had compromised the renderer process to potentially exploit heap corruption via a crafted HTML page. (Chromium security severity: High)","scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"143.0.7499.169-1~deb12u1","bookworm-security":"145.0.7632.159-1~deb12u1"},"fixed_version":"110.0.5481.177-1","urgency":"not yet assigned"},"bullseye":{"status":"resolved","repositories":{"bullseye":"120.0.6099.224-1~deb11u1","bullseye-security":"120.0.6099.224-1~deb11u1"},"fixed_version":"110.0.5481.177-1~deb11u1","urgency":"not yet assigned"},"forky":{"status":"resolved","repositories":{"forky":"145.0.7632.159-1"},"fixed_version":"110.0.5481.177-1","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"146.0.7680.71-1"},"fixed_version":"110.0.5481.177-1","urgency":"not yet assigned"},"trixie":{"status":"resolved","repositories":{"trixie":"143.0.7499.169-1~deb13u1","trixie-security":"145.0.7632.159-1~deb13u1"},"fixed_version":"110.0.5481.177-1","urgency":"not yet assigned"}}},"CVE-2023-0928":{"description":"Use after free in SwiftShader in Google Chrome prior to 110.0.5481.177 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. (Chromium security severity: High)","scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"143.0.7499.169-1~deb12u1","bookworm-security":"145.0.7632.159-1~deb12u1"},"fixed_version":"110.0.5481.177-1","urgency":"not yet assigned"},"bullseye":{"status":"resolved","repositories":{"bullseye":"120.0.6099.224-1~deb11u1","bullseye-security":"120.0.6099.224-1~deb11u1"},"fixed_version":"110.0.5481.177-1~deb11u1","urgency":"not yet assigned"},"forky":{"status":"resolved","repositories":{"forky":"145.0.7632.159-1"},"fixed_version":"110.0.5481.177-1","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"146.0.7680.71-1"},"fixed_version":"110.0.5481.177-1","urgency":"not yet assigned"},"trixie":{"status":"resolved","repositories":{"trixie":"143.0.7499.169-1~deb13u1","trixie-security":"145.0.7632.159-1~deb13u1"},"fixed_version":"110.0.5481.177-1","urgency":"not yet assigned"}}},"CVE-2023-0929":{"description":"Use after free in Vulkan in Google Chrome prior to 110.0.5481.177 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. (Chromium security severity: High)","scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"143.0.7499.169-1~deb12u1","bookworm-security":"145.0.7632.159-1~deb12u1"},"fixed_version":"110.0.5481.177-1","urgency":"not yet assigned"},"bullseye":{"status":"resolved","repositories":{"bullseye":"120.0.6099.224-1~deb11u1","bullseye-security":"120.0.6099.224-1~deb11u1"},"fixed_version":"110.0.5481.177-1~deb11u1","urgency":"not yet assigned"},"forky":{"status":"resolved","repositories":{"forky":"145.0.7632.159-1"},"fixed_version":"110.0.5481.177-1","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"146.0.7680.71-1"},"fixed_version":"110.0.5481.177-1","urgency":"not yet assigned"},"trixie":{"status":"resolved","repositories":{"trixie":"143.0.7499.169-1~deb13u1","trixie-security":"145.0.7632.159-1~deb13u1"},"fixed_version":"110.0.5481.177-1","urgency":"not yet assigned"}}},"CVE-2023-0930":{"description":"Heap buffer overflow in Video in Google Chrome prior to 110.0.5481.177 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. (Chromium security severity: High)","scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"143.0.7499.169-1~deb12u1","bookworm-security":"145.0.7632.159-1~deb12u1"},"fixed_version":"110.0.5481.177-1","urgency":"not yet assigned"},"bullseye":{"status":"resolved","repositories":{"bullseye":"120.0.6099.224-1~deb11u1","bullseye-security":"120.0.6099.224-1~deb11u1"},"fixed_version":"110.0.5481.177-1~deb11u1","urgency":"not yet assigned"},"forky":{"status":"resolved","repositories":{"forky":"145.0.7632.159-1"},"fixed_version":"110.0.5481.177-1","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"146.0.7680.71-1"},"fixed_version":"110.0.5481.177-1","urgency":"not yet assigned"},"trixie":{"status":"resolved","repositories":{"trixie":"143.0.7499.169-1~deb13u1","trixie-security":"145.0.7632.159-1~deb13u1"},"fixed_version":"110.0.5481.177-1","urgency":"not yet assigned"}}},"CVE-2023-0931":{"description":"Use after free in Video in Google Chrome prior to 110.0.5481.177 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. (Chromium security severity: High)","scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"143.0.7499.169-1~deb12u1","bookworm-security":"145.0.7632.159-1~deb12u1"},"fixed_version":"110.0.5481.177-1","urgency":"not yet assigned"},"bullseye":{"status":"resolved","repositories":{"bullseye":"120.0.6099.224-1~deb11u1","bullseye-security":"120.0.6099.224-1~deb11u1"},"fixed_version":"110.0.5481.177-1~deb11u1","urgency":"not yet assigned"},"forky":{"status":"resolved","repositories":{"forky":"145.0.7632.159-1"},"fixed_version":"110.0.5481.177-1","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"146.0.7680.71-1"},"fixed_version":"110.0.5481.177-1","urgency":"not yet assigned"},"trixie":{"status":"resolved","repositories":{"trixie":"143.0.7499.169-1~deb13u1","trixie-security":"145.0.7632.159-1~deb13u1"},"fixed_version":"110.0.5481.177-1","urgency":"not yet assigned"}}},"CVE-2023-0932":{"description":"Use after free in WebRTC in Google Chrome on Windows prior to 110.0.5481.177 allowed a remote attacker who convinced the user to engage in specific UI interactions to potentially exploit heap corruption via a crafted HTML page. (Chromium security severity: High)","scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"143.0.7499.169-1~deb12u1","bookworm-security":"145.0.7632.159-1~deb12u1"},"fixed_version":"110.0.5481.177-1","urgency":"not yet assigned"},"bullseye":{"status":"resolved","repositories":{"bullseye":"120.0.6099.224-1~deb11u1","bullseye-security":"120.0.6099.224-1~deb11u1"},"fixed_version":"110.0.5481.177-1~deb11u1","urgency":"not yet assigned"},"forky":{"status":"resolved","repositories":{"forky":"145.0.7632.159-1"},"fixed_version":"110.0.5481.177-1","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"146.0.7680.71-1"},"fixed_version":"110.0.5481.177-1","urgency":"not yet assigned"},"trixie":{"status":"resolved","repositories":{"trixie":"143.0.7499.169-1~deb13u1","trixie-security":"145.0.7632.159-1~deb13u1"},"fixed_version":"110.0.5481.177-1","urgency":"not yet assigned"}}},"CVE-2023-0933":{"description":"Integer overflow in PDF in Google Chrome prior to 110.0.5481.177 allowed a remote attacker to potentially exploit heap corruption via a crafted PDF file. (Chromium security severity: Medium)","scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"143.0.7499.169-1~deb12u1","bookworm-security":"145.0.7632.159-1~deb12u1"},"fixed_version":"110.0.5481.177-1","urgency":"not yet assigned"},"bullseye":{"status":"resolved","repositories":{"bullseye":"120.0.6099.224-1~deb11u1","bullseye-security":"120.0.6099.224-1~deb11u1"},"fixed_version":"110.0.5481.177-1~deb11u1","urgency":"not yet assigned"},"forky":{"status":"resolved","repositories":{"forky":"145.0.7632.159-1"},"fixed_version":"110.0.5481.177-1","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"146.0.7680.71-1"},"fixed_version":"110.0.5481.177-1","urgency":"not yet assigned"},"trixie":{"status":"resolved","repositories":{"trixie":"143.0.7499.169-1~deb13u1","trixie-security":"145.0.7632.159-1~deb13u1"},"fixed_version":"110.0.5481.177-1","urgency":"not yet assigned"}}},"CVE-2023-0941":{"description":"Use after free in Prompts in Google Chrome prior to 110.0.5481.177 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. (Chromium security severity: Critical)","scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"143.0.7499.169-1~deb12u1","bookworm-security":"145.0.7632.159-1~deb12u1"},"fixed_version":"110.0.5481.177-1","urgency":"not yet assigned"},"bullseye":{"status":"resolved","repositories":{"bullseye":"120.0.6099.224-1~deb11u1","bullseye-security":"120.0.6099.224-1~deb11u1"},"fixed_version":"110.0.5481.177-1~deb11u1","urgency":"not yet assigned"},"forky":{"status":"resolved","repositories":{"forky":"145.0.7632.159-1"},"fixed_version":"110.0.5481.177-1","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"146.0.7680.71-1"},"fixed_version":"110.0.5481.177-1","urgency":"not yet assigned"},"trixie":{"status":"resolved","repositories":{"trixie":"143.0.7499.169-1~deb13u1","trixie-security":"145.0.7632.159-1~deb13u1"},"fixed_version":"110.0.5481.177-1","urgency":"not yet assigned"}}},"CVE-2023-1213":{"description":"Use after free in Swiftshader in Google Chrome prior to 111.0.5563.64 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. (Chromium security severity: High)","scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"143.0.7499.169-1~deb12u1","bookworm-security":"145.0.7632.159-1~deb12u1"},"fixed_version":"111.0.5563.64-1","urgency":"not yet assigned"},"bullseye":{"status":"resolved","repositories":{"bullseye":"120.0.6099.224-1~deb11u1","bullseye-security":"120.0.6099.224-1~deb11u1"},"fixed_version":"111.0.5563.64-1~deb11u1","urgency":"not yet assigned"},"forky":{"status":"resolved","repositories":{"forky":"145.0.7632.159-1"},"fixed_version":"111.0.5563.64-1","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"146.0.7680.71-1"},"fixed_version":"111.0.5563.64-1","urgency":"not yet assigned"},"trixie":{"status":"resolved","repositories":{"trixie":"143.0.7499.169-1~deb13u1","trixie-security":"145.0.7632.159-1~deb13u1"},"fixed_version":"111.0.5563.64-1","urgency":"not yet assigned"}}},"CVE-2023-1214":{"description":"Type confusion in V8 in Google Chrome prior to 111.0.5563.64 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. (Chromium security severity: High)","scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"143.0.7499.169-1~deb12u1","bookworm-security":"145.0.7632.159-1~deb12u1"},"fixed_version":"111.0.5563.64-1","urgency":"not yet assigned"},"bullseye":{"status":"resolved","repositories":{"bullseye":"120.0.6099.224-1~deb11u1","bullseye-security":"120.0.6099.224-1~deb11u1"},"fixed_version":"111.0.5563.64-1~deb11u1","urgency":"not yet assigned"},"forky":{"status":"resolved","repositories":{"forky":"145.0.7632.159-1"},"fixed_version":"111.0.5563.64-1","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"146.0.7680.71-1"},"fixed_version":"111.0.5563.64-1","urgency":"not yet assigned"},"trixie":{"status":"resolved","repositories":{"trixie":"143.0.7499.169-1~deb13u1","trixie-security":"145.0.7632.159-1~deb13u1"},"fixed_version":"111.0.5563.64-1","urgency":"not yet assigned"}}},"CVE-2023-1215":{"description":"Type confusion in CSS in Google Chrome prior to 111.0.5563.64 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. (Chromium security severity: High)","scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"143.0.7499.169-1~deb12u1","bookworm-security":"145.0.7632.159-1~deb12u1"},"fixed_version":"111.0.5563.64-1","urgency":"not yet assigned"},"bullseye":{"status":"resolved","repositories":{"bullseye":"120.0.6099.224-1~deb11u1","bullseye-security":"120.0.6099.224-1~deb11u1"},"fixed_version":"111.0.5563.64-1~deb11u1","urgency":"not yet assigned"},"forky":{"status":"resolved","repositories":{"forky":"145.0.7632.159-1"},"fixed_version":"111.0.5563.64-1","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"146.0.7680.71-1"},"fixed_version":"111.0.5563.64-1","urgency":"not yet assigned"},"trixie":{"status":"resolved","repositories":{"trixie":"143.0.7499.169-1~deb13u1","trixie-security":"145.0.7632.159-1~deb13u1"},"fixed_version":"111.0.5563.64-1","urgency":"not yet assigned"}}},"CVE-2023-1216":{"description":"Use after free in DevTools in Google Chrome prior to 111.0.5563.64 allowed a remote attacker who had convienced the user to engage in direct UI interaction to potentially exploit heap corruption via a crafted HTML page. (Chromium security severity: High)","scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"143.0.7499.169-1~deb12u1","bookworm-security":"145.0.7632.159-1~deb12u1"},"fixed_version":"111.0.5563.64-1","urgency":"not yet assigned"},"bullseye":{"status":"resolved","repositories":{"bullseye":"120.0.6099.224-1~deb11u1","bullseye-security":"120.0.6099.224-1~deb11u1"},"fixed_version":"111.0.5563.64-1~deb11u1","urgency":"not yet assigned"},"forky":{"status":"resolved","repositories":{"forky":"145.0.7632.159-1"},"fixed_version":"111.0.5563.64-1","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"146.0.7680.71-1"},"fixed_version":"111.0.5563.64-1","urgency":"not yet assigned"},"trixie":{"status":"resolved","repositories":{"trixie":"143.0.7499.169-1~deb13u1","trixie-security":"145.0.7632.159-1~deb13u1"},"fixed_version":"111.0.5563.64-1","urgency":"not yet assigned"}}},"CVE-2023-1217":{"description":"Stack buffer overflow in Crash reporting in Google Chrome on Windows prior to 111.0.5563.64 allowed a remote attacker who had compromised the renderer process to obtain potentially sensitive information from process memory via a crafted HTML page. (Chromium security severity: High)","scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"143.0.7499.169-1~deb12u1","bookworm-security":"145.0.7632.159-1~deb12u1"},"fixed_version":"111.0.5563.64-1","urgency":"not yet assigned"},"bullseye":{"status":"resolved","repositories":{"bullseye":"120.0.6099.224-1~deb11u1","bullseye-security":"120.0.6099.224-1~deb11u1"},"fixed_version":"111.0.5563.64-1~deb11u1","urgency":"not yet assigned"},"forky":{"status":"resolved","repositories":{"forky":"145.0.7632.159-1"},"fixed_version":"111.0.5563.64-1","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"146.0.7680.71-1"},"fixed_version":"111.0.5563.64-1","urgency":"not yet assigned"},"trixie":{"status":"resolved","repositories":{"trixie":"143.0.7499.169-1~deb13u1","trixie-security":"145.0.7632.159-1~deb13u1"},"fixed_version":"111.0.5563.64-1","urgency":"not yet assigned"}}},"CVE-2023-1218":{"description":"Use after free in WebRTC in Google Chrome prior to 111.0.5563.64 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. (Chromium security severity: High)","scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"143.0.7499.169-1~deb12u1","bookworm-security":"145.0.7632.159-1~deb12u1"},"fixed_version":"111.0.5563.64-1","urgency":"not yet assigned"},"bullseye":{"status":"resolved","repositories":{"bullseye":"120.0.6099.224-1~deb11u1","bullseye-security":"120.0.6099.224-1~deb11u1"},"fixed_version":"111.0.5563.64-1~deb11u1","urgency":"not yet assigned"},"forky":{"status":"resolved","repositories":{"forky":"145.0.7632.159-1"},"fixed_version":"111.0.5563.64-1","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"146.0.7680.71-1"},"fixed_version":"111.0.5563.64-1","urgency":"not yet assigned"},"trixie":{"status":"resolved","repositories":{"trixie":"143.0.7499.169-1~deb13u1","trixie-security":"145.0.7632.159-1~deb13u1"},"fixed_version":"111.0.5563.64-1","urgency":"not yet assigned"}}},"CVE-2023-1219":{"description":"Heap buffer overflow in Metrics in Google Chrome prior to 111.0.5563.64 allowed a remote attacker who had compromised the renderer process to potentially exploit heap corruption via a crafted HTML page. (Chromium security severity: High)","scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"143.0.7499.169-1~deb12u1","bookworm-security":"145.0.7632.159-1~deb12u1"},"fixed_version":"111.0.5563.64-1","urgency":"not yet assigned"},"bullseye":{"status":"resolved","repositories":{"bullseye":"120.0.6099.224-1~deb11u1","bullseye-security":"120.0.6099.224-1~deb11u1"},"fixed_version":"111.0.5563.64-1~deb11u1","urgency":"not yet assigned"},"forky":{"status":"resolved","repositories":{"forky":"145.0.7632.159-1"},"fixed_version":"111.0.5563.64-1","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"146.0.7680.71-1"},"fixed_version":"111.0.5563.64-1","urgency":"not yet assigned"},"trixie":{"status":"resolved","repositories":{"trixie":"143.0.7499.169-1~deb13u1","trixie-security":"145.0.7632.159-1~deb13u1"},"fixed_version":"111.0.5563.64-1","urgency":"not yet assigned"}}},"CVE-2023-1220":{"description":"Heap buffer overflow in UMA in Google Chrome prior to 111.0.5563.64 allowed a remote attacker who had compromised the renderer process to potentially exploit heap corruption via a crafted HTML page. (Chromium security severity: High)","scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"143.0.7499.169-1~deb12u1","bookworm-security":"145.0.7632.159-1~deb12u1"},"fixed_version":"111.0.5563.64-1","urgency":"not yet assigned"},"bullseye":{"status":"resolved","repositories":{"bullseye":"120.0.6099.224-1~deb11u1","bullseye-security":"120.0.6099.224-1~deb11u1"},"fixed_version":"111.0.5563.64-1~deb11u1","urgency":"not yet assigned"},"forky":{"status":"resolved","repositories":{"forky":"145.0.7632.159-1"},"fixed_version":"111.0.5563.64-1","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"146.0.7680.71-1"},"fixed_version":"111.0.5563.64-1","urgency":"not yet assigned"},"trixie":{"status":"resolved","repositories":{"trixie":"143.0.7499.169-1~deb13u1","trixie-security":"145.0.7632.159-1~deb13u1"},"fixed_version":"111.0.5563.64-1","urgency":"not yet assigned"}}},"CVE-2023-1221":{"description":"Insufficient policy enforcement in Extensions API in Google Chrome prior to 111.0.5563.64 allowed an attacker who convinced a user to install a malicious extension to bypass navigation restrictions via a crafted Chrome Extension. (Chromium security severity: Medium)","scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"143.0.7499.169-1~deb12u1","bookworm-security":"145.0.7632.159-1~deb12u1"},"fixed_version":"111.0.5563.64-1","urgency":"not yet assigned"},"bullseye":{"status":"resolved","repositories":{"bullseye":"120.0.6099.224-1~deb11u1","bullseye-security":"120.0.6099.224-1~deb11u1"},"fixed_version":"111.0.5563.64-1~deb11u1","urgency":"not yet assigned"},"forky":{"status":"resolved","repositories":{"forky":"145.0.7632.159-1"},"fixed_version":"111.0.5563.64-1","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"146.0.7680.71-1"},"fixed_version":"111.0.5563.64-1","urgency":"not yet assigned"},"trixie":{"status":"resolved","repositories":{"trixie":"143.0.7499.169-1~deb13u1","trixie-security":"145.0.7632.159-1~deb13u1"},"fixed_version":"111.0.5563.64-1","urgency":"not yet assigned"}}},"CVE-2023-1222":{"description":"Heap buffer overflow in Web Audio API in Google Chrome prior to 111.0.5563.64 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. (Chromium security severity: Medium)","scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"143.0.7499.169-1~deb12u1","bookworm-security":"145.0.7632.159-1~deb12u1"},"fixed_version":"111.0.5563.64-1","urgency":"not yet assigned"},"bullseye":{"status":"resolved","repositories":{"bullseye":"120.0.6099.224-1~deb11u1","bullseye-security":"120.0.6099.224-1~deb11u1"},"fixed_version":"111.0.5563.64-1~deb11u1","urgency":"not yet assigned"},"forky":{"status":"resolved","repositories":{"forky":"145.0.7632.159-1"},"fixed_version":"111.0.5563.64-1","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"146.0.7680.71-1"},"fixed_version":"111.0.5563.64-1","urgency":"not yet assigned"},"trixie":{"status":"resolved","repositories":{"trixie":"143.0.7499.169-1~deb13u1","trixie-security":"145.0.7632.159-1~deb13u1"},"fixed_version":"111.0.5563.64-1","urgency":"not yet assigned"}}},"CVE-2023-1223":{"description":"Insufficient policy enforcement in Autofill in Google Chrome on Android prior to 111.0.5563.64 allowed a remote attacker to leak cross-origin data via a crafted HTML page. (Chromium security severity: Medium)","scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"143.0.7499.169-1~deb12u1","bookworm-security":"145.0.7632.159-1~deb12u1"},"fixed_version":"111.0.5563.64-1","urgency":"not yet assigned"},"bullseye":{"status":"resolved","repositories":{"bullseye":"120.0.6099.224-1~deb11u1","bullseye-security":"120.0.6099.224-1~deb11u1"},"fixed_version":"111.0.5563.64-1~deb11u1","urgency":"not yet assigned"},"forky":{"status":"resolved","repositories":{"forky":"145.0.7632.159-1"},"fixed_version":"111.0.5563.64-1","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"146.0.7680.71-1"},"fixed_version":"111.0.5563.64-1","urgency":"not yet assigned"},"trixie":{"status":"resolved","repositories":{"trixie":"143.0.7499.169-1~deb13u1","trixie-security":"145.0.7632.159-1~deb13u1"},"fixed_version":"111.0.5563.64-1","urgency":"not yet assigned"}}},"CVE-2023-1224":{"description":"Insufficient policy enforcement in Web Payments API in Google Chrome prior to 111.0.5563.64 allowed a remote attacker to bypass navigation restrictions via a crafted HTML page. (Chromium security severity: Medium)","scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"143.0.7499.169-1~deb12u1","bookworm-security":"145.0.7632.159-1~deb12u1"},"fixed_version":"111.0.5563.64-1","urgency":"not yet assigned"},"bullseye":{"status":"resolved","repositories":{"bullseye":"120.0.6099.224-1~deb11u1","bullseye-security":"120.0.6099.224-1~deb11u1"},"fixed_version":"111.0.5563.64-1~deb11u1","urgency":"not yet assigned"},"forky":{"status":"resolved","repositories":{"forky":"145.0.7632.159-1"},"fixed_version":"111.0.5563.64-1","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"146.0.7680.71-1"},"fixed_version":"111.0.5563.64-1","urgency":"not yet assigned"},"trixie":{"status":"resolved","repositories":{"trixie":"143.0.7499.169-1~deb13u1","trixie-security":"145.0.7632.159-1~deb13u1"},"fixed_version":"111.0.5563.64-1","urgency":"not yet assigned"}}},"CVE-2023-1225":{"description":"Insufficient policy enforcement in Navigation in Google Chrome on iOS prior to 111.0.5563.64 allowed a remote attacker to bypass same origin policy via a crafted HTML page. (Chromium security severity: Medium)","scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"143.0.7499.169-1~deb12u1","bookworm-security":"145.0.7632.159-1~deb12u1"},"fixed_version":"111.0.5563.64-1","urgency":"not yet assigned"},"bullseye":{"status":"resolved","repositories":{"bullseye":"120.0.6099.224-1~deb11u1","bullseye-security":"120.0.6099.224-1~deb11u1"},"fixed_version":"111.0.5563.64-1~deb11u1","urgency":"not yet assigned"},"forky":{"status":"resolved","repositories":{"forky":"145.0.7632.159-1"},"fixed_version":"111.0.5563.64-1","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"146.0.7680.71-1"},"fixed_version":"111.0.5563.64-1","urgency":"not yet assigned"},"trixie":{"status":"resolved","repositories":{"trixie":"143.0.7499.169-1~deb13u1","trixie-security":"145.0.7632.159-1~deb13u1"},"fixed_version":"111.0.5563.64-1","urgency":"not yet assigned"}}},"CVE-2023-1226":{"description":"Insufficient policy enforcement in Web Payments API in Google Chrome prior to 111.0.5563.64 allowed a remote attacker to bypass content security policy via a crafted HTML page. (Chromium security severity: Medium)","scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"143.0.7499.169-1~deb12u1","bookworm-security":"145.0.7632.159-1~deb12u1"},"fixed_version":"111.0.5563.64-1","urgency":"not yet assigned"},"bullseye":{"status":"resolved","repositories":{"bullseye":"120.0.6099.224-1~deb11u1","bullseye-security":"120.0.6099.224-1~deb11u1"},"fixed_version":"111.0.5563.64-1~deb11u1","urgency":"not yet assigned"},"forky":{"status":"resolved","repositories":{"forky":"145.0.7632.159-1"},"fixed_version":"111.0.5563.64-1","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"146.0.7680.71-1"},"fixed_version":"111.0.5563.64-1","urgency":"not yet assigned"},"trixie":{"status":"resolved","repositories":{"trixie":"143.0.7499.169-1~deb13u1","trixie-security":"145.0.7632.159-1~deb13u1"},"fixed_version":"111.0.5563.64-1","urgency":"not yet assigned"}}},"CVE-2023-1227":{"description":"Use after free in Core in Google Chrome on Lacros prior to 111.0.5563.64 allowed a remote attacker who convinced a user to engage in specific UI interaction to potentially exploit heap corruption via crafted UI interaction. (Chromium security severity: Medium)","scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"143.0.7499.169-1~deb12u1","bookworm-security":"145.0.7632.159-1~deb12u1"},"fixed_version":"111.0.5563.64-1","urgency":"not yet assigned"},"bullseye":{"status":"resolved","repositories":{"bullseye":"120.0.6099.224-1~deb11u1","bullseye-security":"120.0.6099.224-1~deb11u1"},"fixed_version":"111.0.5563.64-1~deb11u1","urgency":"not yet assigned"},"forky":{"status":"resolved","repositories":{"forky":"145.0.7632.159-1"},"fixed_version":"111.0.5563.64-1","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"146.0.7680.71-1"},"fixed_version":"111.0.5563.64-1","urgency":"not yet assigned"},"trixie":{"status":"resolved","repositories":{"trixie":"143.0.7499.169-1~deb13u1","trixie-security":"145.0.7632.159-1~deb13u1"},"fixed_version":"111.0.5563.64-1","urgency":"not yet assigned"}}},"CVE-2023-1228":{"description":"Insufficient policy enforcement in Intents in Google Chrome on Android prior to 111.0.5563.64 allowed a remote attacker to bypass navigation restrictions via a crafted HTML page. (Chromium security severity: Medium)","scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"143.0.7499.169-1~deb12u1","bookworm-security":"145.0.7632.159-1~deb12u1"},"fixed_version":"111.0.5563.64-1","urgency":"not yet assigned"},"bullseye":{"status":"resolved","repositories":{"bullseye":"120.0.6099.224-1~deb11u1","bullseye-security":"120.0.6099.224-1~deb11u1"},"fixed_version":"111.0.5563.64-1~deb11u1","urgency":"not yet assigned"},"forky":{"status":"resolved","repositories":{"forky":"145.0.7632.159-1"},"fixed_version":"111.0.5563.64-1","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"146.0.7680.71-1"},"fixed_version":"111.0.5563.64-1","urgency":"not yet assigned"},"trixie":{"status":"resolved","repositories":{"trixie":"143.0.7499.169-1~deb13u1","trixie-security":"145.0.7632.159-1~deb13u1"},"fixed_version":"111.0.5563.64-1","urgency":"not yet assigned"}}},"CVE-2023-1229":{"description":"Inappropriate implementation in Permission prompts in Google Chrome prior to 111.0.5563.64 allowed a remote attacker to bypass navigation restrictions via a crafted HTML page. (Chromium security severity: Medium)","scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"143.0.7499.169-1~deb12u1","bookworm-security":"145.0.7632.159-1~deb12u1"},"fixed_version":"111.0.5563.64-1","urgency":"not yet assigned"},"bullseye":{"status":"resolved","repositories":{"bullseye":"120.0.6099.224-1~deb11u1","bullseye-security":"120.0.6099.224-1~deb11u1"},"fixed_version":"111.0.5563.64-1~deb11u1","urgency":"not yet assigned"},"forky":{"status":"resolved","repositories":{"forky":"145.0.7632.159-1"},"fixed_version":"111.0.5563.64-1","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"146.0.7680.71-1"},"fixed_version":"111.0.5563.64-1","urgency":"not yet assigned"},"trixie":{"status":"resolved","repositories":{"trixie":"143.0.7499.169-1~deb13u1","trixie-security":"145.0.7632.159-1~deb13u1"},"fixed_version":"111.0.5563.64-1","urgency":"not yet assigned"}}},"CVE-2023-1230":{"description":"Inappropriate implementation in WebApp Installs in Google Chrome on Android prior to 111.0.5563.64 allowed an attacker who convinced a user to install a malicious WebApp to spoof the contents of the PWA installer via a crafted HTML page. (Chromium security severity: Medium)","scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"143.0.7499.169-1~deb12u1","bookworm-security":"145.0.7632.159-1~deb12u1"},"fixed_version":"111.0.5563.64-1","urgency":"not yet assigned"},"bullseye":{"status":"resolved","repositories":{"bullseye":"120.0.6099.224-1~deb11u1","bullseye-security":"120.0.6099.224-1~deb11u1"},"fixed_version":"111.0.5563.64-1~deb11u1","urgency":"not yet assigned"},"forky":{"status":"resolved","repositories":{"forky":"145.0.7632.159-1"},"fixed_version":"111.0.5563.64-1","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"146.0.7680.71-1"},"fixed_version":"111.0.5563.64-1","urgency":"not yet assigned"},"trixie":{"status":"resolved","repositories":{"trixie":"143.0.7499.169-1~deb13u1","trixie-security":"145.0.7632.159-1~deb13u1"},"fixed_version":"111.0.5563.64-1","urgency":"not yet assigned"}}},"CVE-2023-1231":{"description":"Inappropriate implementation in Autofill in Google Chrome on Android prior to 111.0.5563.64 allowed a remote attacker to potentially spoof the contents of the omnibox via a crafted HTML page. (Chromium security severity: Medium)","scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"143.0.7499.169-1~deb12u1","bookworm-security":"145.0.7632.159-1~deb12u1"},"fixed_version":"111.0.5563.64-1","urgency":"not yet assigned"},"bullseye":{"status":"resolved","repositories":{"bullseye":"120.0.6099.224-1~deb11u1","bullseye-security":"120.0.6099.224-1~deb11u1"},"fixed_version":"111.0.5563.64-1~deb11u1","urgency":"not yet assigned"},"forky":{"status":"resolved","repositories":{"forky":"145.0.7632.159-1"},"fixed_version":"111.0.5563.64-1","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"146.0.7680.71-1"},"fixed_version":"111.0.5563.64-1","urgency":"not yet assigned"},"trixie":{"status":"resolved","repositories":{"trixie":"143.0.7499.169-1~deb13u1","trixie-security":"145.0.7632.159-1~deb13u1"},"fixed_version":"111.0.5563.64-1","urgency":"not yet assigned"}}},"CVE-2023-1232":{"description":"Insufficient policy enforcement in Resource Timing in Google Chrome prior to 111.0.5563.64 allowed a remote attacker to obtain potentially sensitive information from API via a crafted HTML page. (Chromium security severity: Low)","scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"143.0.7499.169-1~deb12u1","bookworm-security":"145.0.7632.159-1~deb12u1"},"fixed_version":"111.0.5563.64-1","urgency":"not yet assigned"},"bullseye":{"status":"resolved","repositories":{"bullseye":"120.0.6099.224-1~deb11u1","bullseye-security":"120.0.6099.224-1~deb11u1"},"fixed_version":"111.0.5563.64-1~deb11u1","urgency":"not yet assigned"},"forky":{"status":"resolved","repositories":{"forky":"145.0.7632.159-1"},"fixed_version":"111.0.5563.64-1","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"146.0.7680.71-1"},"fixed_version":"111.0.5563.64-1","urgency":"not yet assigned"},"trixie":{"status":"resolved","repositories":{"trixie":"143.0.7499.169-1~deb13u1","trixie-security":"145.0.7632.159-1~deb13u1"},"fixed_version":"111.0.5563.64-1","urgency":"not yet assigned"}}},"CVE-2023-1233":{"description":"Insufficient policy enforcement in Resource Timing in Google Chrome prior to 111.0.5563.64 allowed an attacker who convinced a user to install a malicious extension to obtain potentially sensitive information from API via a crafted Chrome Extension. (Chromium security severity: Low)","scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"143.0.7499.169-1~deb12u1","bookworm-security":"145.0.7632.159-1~deb12u1"},"fixed_version":"111.0.5563.64-1","urgency":"not yet assigned"},"bullseye":{"status":"resolved","repositories":{"bullseye":"120.0.6099.224-1~deb11u1","bullseye-security":"120.0.6099.224-1~deb11u1"},"fixed_version":"111.0.5563.64-1~deb11u1","urgency":"not yet assigned"},"forky":{"status":"resolved","repositories":{"forky":"145.0.7632.159-1"},"fixed_version":"111.0.5563.64-1","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"146.0.7680.71-1"},"fixed_version":"111.0.5563.64-1","urgency":"not yet assigned"},"trixie":{"status":"resolved","repositories":{"trixie":"143.0.7499.169-1~deb13u1","trixie-security":"145.0.7632.159-1~deb13u1"},"fixed_version":"111.0.5563.64-1","urgency":"not yet assigned"}}},"CVE-2023-1234":{"description":"Inappropriate implementation in Intents in Google Chrome on Android prior to 111.0.5563.64 allowed a remote attacker to perform domain spoofing via a crafted HTML page. (Chromium security severity: Low)","scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"143.0.7499.169-1~deb12u1","bookworm-security":"145.0.7632.159-1~deb12u1"},"fixed_version":"111.0.5563.64-1","urgency":"not yet assigned"},"bullseye":{"status":"resolved","repositories":{"bullseye":"120.0.6099.224-1~deb11u1","bullseye-security":"120.0.6099.224-1~deb11u1"},"fixed_version":"111.0.5563.64-1~deb11u1","urgency":"not yet assigned"},"forky":{"status":"resolved","repositories":{"forky":"145.0.7632.159-1"},"fixed_version":"111.0.5563.64-1","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"146.0.7680.71-1"},"fixed_version":"111.0.5563.64-1","urgency":"not yet assigned"},"trixie":{"status":"resolved","repositories":{"trixie":"143.0.7499.169-1~deb13u1","trixie-security":"145.0.7632.159-1~deb13u1"},"fixed_version":"111.0.5563.64-1","urgency":"not yet assigned"}}},"CVE-2023-1235":{"description":"Type confusion in DevTools in Google Chrome prior to 111.0.5563.64 allowed a remote attacker who had compromised the renderer process to potentially exploit heap corruption via a crafted UI interaction. (Chromium security severity: Low)","scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"143.0.7499.169-1~deb12u1","bookworm-security":"145.0.7632.159-1~deb12u1"},"fixed_version":"111.0.5563.64-1","urgency":"not yet assigned"},"bullseye":{"status":"resolved","repositories":{"bullseye":"120.0.6099.224-1~deb11u1","bullseye-security":"120.0.6099.224-1~deb11u1"},"fixed_version":"111.0.5563.64-1~deb11u1","urgency":"not yet assigned"},"forky":{"status":"resolved","repositories":{"forky":"145.0.7632.159-1"},"fixed_version":"111.0.5563.64-1","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"146.0.7680.71-1"},"fixed_version":"111.0.5563.64-1","urgency":"not yet assigned"},"trixie":{"status":"resolved","repositories":{"trixie":"143.0.7499.169-1~deb13u1","trixie-security":"145.0.7632.159-1~deb13u1"},"fixed_version":"111.0.5563.64-1","urgency":"not yet assigned"}}},"CVE-2023-1236":{"description":"Inappropriate implementation in Internals in Google Chrome prior to 111.0.5563.64 allowed a remote attacker to spoof the origin of an iframe via a crafted HTML page. (Chromium security severity: Low)","scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"143.0.7499.169-1~deb12u1","bookworm-security":"145.0.7632.159-1~deb12u1"},"fixed_version":"111.0.5563.64-1","urgency":"not yet assigned"},"bullseye":{"status":"resolved","repositories":{"bullseye":"120.0.6099.224-1~deb11u1","bullseye-security":"120.0.6099.224-1~deb11u1"},"fixed_version":"111.0.5563.64-1~deb11u1","urgency":"not yet assigned"},"forky":{"status":"resolved","repositories":{"forky":"145.0.7632.159-1"},"fixed_version":"111.0.5563.64-1","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"146.0.7680.71-1"},"fixed_version":"111.0.5563.64-1","urgency":"not yet assigned"},"trixie":{"status":"resolved","repositories":{"trixie":"143.0.7499.169-1~deb13u1","trixie-security":"145.0.7632.159-1~deb13u1"},"fixed_version":"111.0.5563.64-1","urgency":"not yet assigned"}}},"CVE-2023-1528":{"description":"Use after free in Passwords in Google Chrome prior to 111.0.5563.110 allowed a remote attacker who had compromised the renderer process to potentially exploit heap corruption via a crafted HTML page. (Chromium security severity: High)","scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"143.0.7499.169-1~deb12u1","bookworm-security":"145.0.7632.159-1~deb12u1"},"fixed_version":"111.0.5563.110-1","urgency":"not yet assigned"},"bullseye":{"status":"resolved","repositories":{"bullseye":"120.0.6099.224-1~deb11u1","bullseye-security":"120.0.6099.224-1~deb11u1"},"fixed_version":"111.0.5563.110-1~deb11u1","urgency":"not yet assigned"},"forky":{"status":"resolved","repositories":{"forky":"145.0.7632.159-1"},"fixed_version":"111.0.5563.110-1","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"146.0.7680.71-1"},"fixed_version":"111.0.5563.110-1","urgency":"not yet assigned"},"trixie":{"status":"resolved","repositories":{"trixie":"143.0.7499.169-1~deb13u1","trixie-security":"145.0.7632.159-1~deb13u1"},"fixed_version":"111.0.5563.110-1","urgency":"not yet assigned"}}},"CVE-2023-1529":{"description":"Out of bounds memory access in WebHID in Google Chrome prior to 111.0.5563.110 allowed a remote attacker to potentially exploit heap corruption via a malicious HID device. (Chromium security severity: High)","scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"143.0.7499.169-1~deb12u1","bookworm-security":"145.0.7632.159-1~deb12u1"},"fixed_version":"111.0.5563.110-1","urgency":"not yet assigned"},"bullseye":{"status":"resolved","repositories":{"bullseye":"120.0.6099.224-1~deb11u1","bullseye-security":"120.0.6099.224-1~deb11u1"},"fixed_version":"111.0.5563.110-1~deb11u1","urgency":"not yet assigned"},"forky":{"status":"resolved","repositories":{"forky":"145.0.7632.159-1"},"fixed_version":"111.0.5563.110-1","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"146.0.7680.71-1"},"fixed_version":"111.0.5563.110-1","urgency":"not yet assigned"},"trixie":{"status":"resolved","repositories":{"trixie":"143.0.7499.169-1~deb13u1","trixie-security":"145.0.7632.159-1~deb13u1"},"fixed_version":"111.0.5563.110-1","urgency":"not yet assigned"}}},"CVE-2023-1530":{"description":"Use after free in PDF in Google Chrome prior to 111.0.5563.110 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. (Chromium security severity: High)","scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"143.0.7499.169-1~deb12u1","bookworm-security":"145.0.7632.159-1~deb12u1"},"fixed_version":"111.0.5563.110-1","urgency":"not yet assigned"},"bullseye":{"status":"resolved","repositories":{"bullseye":"120.0.6099.224-1~deb11u1","bullseye-security":"120.0.6099.224-1~deb11u1"},"fixed_version":"111.0.5563.110-1~deb11u1","urgency":"not yet assigned"},"forky":{"status":"resolved","repositories":{"forky":"145.0.7632.159-1"},"fixed_version":"111.0.5563.110-1","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"146.0.7680.71-1"},"fixed_version":"111.0.5563.110-1","urgency":"not yet assigned"},"trixie":{"status":"resolved","repositories":{"trixie":"143.0.7499.169-1~deb13u1","trixie-security":"145.0.7632.159-1~deb13u1"},"fixed_version":"111.0.5563.110-1","urgency":"not yet assigned"}}},"CVE-2023-1531":{"description":"Use after free in ANGLE in Google Chrome prior to 111.0.5563.110 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. (Chromium security severity: High)","scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"143.0.7499.169-1~deb12u1","bookworm-security":"145.0.7632.159-1~deb12u1"},"fixed_version":"111.0.5563.110-1","urgency":"not yet assigned"},"bullseye":{"status":"resolved","repositories":{"bullseye":"120.0.6099.224-1~deb11u1","bullseye-security":"120.0.6099.224-1~deb11u1"},"fixed_version":"111.0.5563.110-1~deb11u1","urgency":"not yet assigned"},"forky":{"status":"resolved","repositories":{"forky":"145.0.7632.159-1"},"fixed_version":"111.0.5563.110-1","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"146.0.7680.71-1"},"fixed_version":"111.0.5563.110-1","urgency":"not yet assigned"},"trixie":{"status":"resolved","repositories":{"trixie":"143.0.7499.169-1~deb13u1","trixie-security":"145.0.7632.159-1~deb13u1"},"fixed_version":"111.0.5563.110-1","urgency":"not yet assigned"}}},"CVE-2023-1532":{"description":"Out of bounds read in GPU Video in Google Chrome prior to 111.0.5563.110 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. (Chromium security severity: High)","scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"143.0.7499.169-1~deb12u1","bookworm-security":"145.0.7632.159-1~deb12u1"},"fixed_version":"111.0.5563.110-1","urgency":"not yet assigned"},"bullseye":{"status":"resolved","repositories":{"bullseye":"120.0.6099.224-1~deb11u1","bullseye-security":"120.0.6099.224-1~deb11u1"},"fixed_version":"111.0.5563.110-1~deb11u1","urgency":"not yet assigned"},"forky":{"status":"resolved","repositories":{"forky":"145.0.7632.159-1"},"fixed_version":"111.0.5563.110-1","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"146.0.7680.71-1"},"fixed_version":"111.0.5563.110-1","urgency":"not yet assigned"},"trixie":{"status":"resolved","repositories":{"trixie":"143.0.7499.169-1~deb13u1","trixie-security":"145.0.7632.159-1~deb13u1"},"fixed_version":"111.0.5563.110-1","urgency":"not yet assigned"}}},"CVE-2023-1533":{"description":"Use after free in WebProtect in Google Chrome prior to 111.0.5563.110 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. (Chromium security severity: High)","scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"143.0.7499.169-1~deb12u1","bookworm-security":"145.0.7632.159-1~deb12u1"},"fixed_version":"111.0.5563.110-1","urgency":"not yet assigned"},"bullseye":{"status":"resolved","repositories":{"bullseye":"120.0.6099.224-1~deb11u1","bullseye-security":"120.0.6099.224-1~deb11u1"},"fixed_version":"111.0.5563.110-1~deb11u1","urgency":"not yet assigned"},"forky":{"status":"resolved","repositories":{"forky":"145.0.7632.159-1"},"fixed_version":"111.0.5563.110-1","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"146.0.7680.71-1"},"fixed_version":"111.0.5563.110-1","urgency":"not yet assigned"},"trixie":{"status":"resolved","repositories":{"trixie":"143.0.7499.169-1~deb13u1","trixie-security":"145.0.7632.159-1~deb13u1"},"fixed_version":"111.0.5563.110-1","urgency":"not yet assigned"}}},"CVE-2023-1534":{"description":"Out of bounds read in ANGLE in Google Chrome prior to 111.0.5563.110 allowed a remote attacker who had compromised the renderer process to potentially exploit heap corruption via a crafted HTML page. (Chromium security severity: High)","scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"143.0.7499.169-1~deb12u1","bookworm-security":"145.0.7632.159-1~deb12u1"},"fixed_version":"111.0.5563.110-1","urgency":"not yet assigned"},"bullseye":{"status":"resolved","repositories":{"bullseye":"120.0.6099.224-1~deb11u1","bullseye-security":"120.0.6099.224-1~deb11u1"},"fixed_version":"111.0.5563.110-1~deb11u1","urgency":"not yet assigned"},"forky":{"status":"resolved","repositories":{"forky":"145.0.7632.159-1"},"fixed_version":"111.0.5563.110-1","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"146.0.7680.71-1"},"fixed_version":"111.0.5563.110-1","urgency":"not yet assigned"},"trixie":{"status":"resolved","repositories":{"trixie":"143.0.7499.169-1~deb13u1","trixie-security":"145.0.7632.159-1~deb13u1"},"fixed_version":"111.0.5563.110-1","urgency":"not yet assigned"}}},"CVE-2023-1810":{"description":"Heap buffer overflow in Visuals in Google Chrome prior to 112.0.5615.49 allowed a remote attacker who had compromised the renderer process to potentially exploit heap corruption via a crafted HTML page. (Chromium security severity: High)","scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"143.0.7499.169-1~deb12u1","bookworm-security":"145.0.7632.159-1~deb12u1"},"fixed_version":"112.0.5615.49-1","urgency":"not yet assigned"},"bullseye":{"status":"resolved","repositories":{"bullseye":"120.0.6099.224-1~deb11u1","bullseye-security":"120.0.6099.224-1~deb11u1"},"fixed_version":"112.0.5615.49-2~deb11u2","urgency":"not yet assigned"},"forky":{"status":"resolved","repositories":{"forky":"145.0.7632.159-1"},"fixed_version":"112.0.5615.49-1","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"146.0.7680.71-1"},"fixed_version":"112.0.5615.49-1","urgency":"not yet assigned"},"trixie":{"status":"resolved","repositories":{"trixie":"143.0.7499.169-1~deb13u1","trixie-security":"145.0.7632.159-1~deb13u1"},"fixed_version":"112.0.5615.49-1","urgency":"not yet assigned"}}},"CVE-2023-1811":{"description":"Use after free in Frames in Google Chrome prior to 112.0.5615.49 allowed a remote attacker who convinced a user to engage in specific UI interaction to potentially exploit heap corruption via a crafted HTML page. (Chromium security severity: High)","scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"143.0.7499.169-1~deb12u1","bookworm-security":"145.0.7632.159-1~deb12u1"},"fixed_version":"112.0.5615.49-1","urgency":"not yet assigned"},"bullseye":{"status":"resolved","repositories":{"bullseye":"120.0.6099.224-1~deb11u1","bullseye-security":"120.0.6099.224-1~deb11u1"},"fixed_version":"112.0.5615.49-2~deb11u2","urgency":"not yet assigned"},"forky":{"status":"resolved","repositories":{"forky":"145.0.7632.159-1"},"fixed_version":"112.0.5615.49-1","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"146.0.7680.71-1"},"fixed_version":"112.0.5615.49-1","urgency":"not yet assigned"},"trixie":{"status":"resolved","repositories":{"trixie":"143.0.7499.169-1~deb13u1","trixie-security":"145.0.7632.159-1~deb13u1"},"fixed_version":"112.0.5615.49-1","urgency":"not yet assigned"}}},"CVE-2023-1812":{"description":"Out of bounds memory access in DOM Bindings in Google Chrome prior to 112.0.5615.49 allowed a remote attacker to perform out of bounds memory access via a crafted HTML page. (Chromium security severity: Medium)","scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"143.0.7499.169-1~deb12u1","bookworm-security":"145.0.7632.159-1~deb12u1"},"fixed_version":"112.0.5615.49-1","urgency":"not yet assigned"},"bullseye":{"status":"resolved","repositories":{"bullseye":"120.0.6099.224-1~deb11u1","bullseye-security":"120.0.6099.224-1~deb11u1"},"fixed_version":"112.0.5615.49-2~deb11u2","urgency":"not yet assigned"},"forky":{"status":"resolved","repositories":{"forky":"145.0.7632.159-1"},"fixed_version":"112.0.5615.49-1","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"146.0.7680.71-1"},"fixed_version":"112.0.5615.49-1","urgency":"not yet assigned"},"trixie":{"status":"resolved","repositories":{"trixie":"143.0.7499.169-1~deb13u1","trixie-security":"145.0.7632.159-1~deb13u1"},"fixed_version":"112.0.5615.49-1","urgency":"not yet assigned"}}},"CVE-2023-1813":{"description":"Inappropriate implementation in Extensions in Google Chrome prior to 112.0.5615.49 allowed an attacker who convinced a user to install a malicious extension to bypass file access restrictions via a crafted HTML page. (Chromium security severity: Medium)","scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"143.0.7499.169-1~deb12u1","bookworm-security":"145.0.7632.159-1~deb12u1"},"fixed_version":"112.0.5615.49-1","urgency":"not yet assigned"},"bullseye":{"status":"resolved","repositories":{"bullseye":"120.0.6099.224-1~deb11u1","bullseye-security":"120.0.6099.224-1~deb11u1"},"fixed_version":"112.0.5615.49-2~deb11u2","urgency":"not yet assigned"},"forky":{"status":"resolved","repositories":{"forky":"145.0.7632.159-1"},"fixed_version":"112.0.5615.49-1","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"146.0.7680.71-1"},"fixed_version":"112.0.5615.49-1","urgency":"not yet assigned"},"trixie":{"status":"resolved","repositories":{"trixie":"143.0.7499.169-1~deb13u1","trixie-security":"145.0.7632.159-1~deb13u1"},"fixed_version":"112.0.5615.49-1","urgency":"not yet assigned"}}},"CVE-2023-1814":{"description":"Insufficient validation of untrusted input in Safe Browsing in Google Chrome prior to 112.0.5615.49 allowed a remote attacker to bypass download checking via a crafted HTML page. (Chromium security severity: Medium)","scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"143.0.7499.169-1~deb12u1","bookworm-security":"145.0.7632.159-1~deb12u1"},"fixed_version":"112.0.5615.49-1","urgency":"not yet assigned"},"bullseye":{"status":"resolved","repositories":{"bullseye":"120.0.6099.224-1~deb11u1","bullseye-security":"120.0.6099.224-1~deb11u1"},"fixed_version":"112.0.5615.49-2~deb11u2","urgency":"not yet assigned"},"forky":{"status":"resolved","repositories":{"forky":"145.0.7632.159-1"},"fixed_version":"112.0.5615.49-1","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"146.0.7680.71-1"},"fixed_version":"112.0.5615.49-1","urgency":"not yet assigned"},"trixie":{"status":"resolved","repositories":{"trixie":"143.0.7499.169-1~deb13u1","trixie-security":"145.0.7632.159-1~deb13u1"},"fixed_version":"112.0.5615.49-1","urgency":"not yet assigned"}}},"CVE-2023-1815":{"description":"Use after free in Networking APIs in Google Chrome prior to 112.0.5615.49 allowed a remote attacker who convinced a user to engage in specific UI interaction to potentially exploit heap corruption via a crafted HTML page. (Chromium security severity: Medium)","scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"143.0.7499.169-1~deb12u1","bookworm-security":"145.0.7632.159-1~deb12u1"},"fixed_version":"112.0.5615.49-1","urgency":"not yet assigned"},"bullseye":{"status":"resolved","repositories":{"bullseye":"120.0.6099.224-1~deb11u1","bullseye-security":"120.0.6099.224-1~deb11u1"},"fixed_version":"112.0.5615.49-2~deb11u2","urgency":"not yet assigned"},"forky":{"status":"resolved","repositories":{"forky":"145.0.7632.159-1"},"fixed_version":"112.0.5615.49-1","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"146.0.7680.71-1"},"fixed_version":"112.0.5615.49-1","urgency":"not yet assigned"},"trixie":{"status":"resolved","repositories":{"trixie":"143.0.7499.169-1~deb13u1","trixie-security":"145.0.7632.159-1~deb13u1"},"fixed_version":"112.0.5615.49-1","urgency":"not yet assigned"}}},"CVE-2023-1816":{"description":"Incorrect security UI in Picture In Picture in Google Chrome prior to 112.0.5615.49 allowed a remote attacker to potentially perform navigation spoofing via a crafted HTML page. (Chromium security severity: Medium)","scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"143.0.7499.169-1~deb12u1","bookworm-security":"145.0.7632.159-1~deb12u1"},"fixed_version":"112.0.5615.49-1","urgency":"not yet assigned"},"bullseye":{"status":"resolved","repositories":{"bullseye":"120.0.6099.224-1~deb11u1","bullseye-security":"120.0.6099.224-1~deb11u1"},"fixed_version":"112.0.5615.49-2~deb11u2","urgency":"not yet assigned"},"forky":{"status":"resolved","repositories":{"forky":"145.0.7632.159-1"},"fixed_version":"112.0.5615.49-1","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"146.0.7680.71-1"},"fixed_version":"112.0.5615.49-1","urgency":"not yet assigned"},"trixie":{"status":"resolved","repositories":{"trixie":"143.0.7499.169-1~deb13u1","trixie-security":"145.0.7632.159-1~deb13u1"},"fixed_version":"112.0.5615.49-1","urgency":"not yet assigned"}}},"CVE-2023-1817":{"description":"Insufficient policy enforcement in Intents in Google Chrome on Android prior to 112.0.5615.49 allowed a remote attacker to bypass navigation restrictions via a crafted HTML page. (Chromium security severity: Medium)","scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"143.0.7499.169-1~deb12u1","bookworm-security":"145.0.7632.159-1~deb12u1"},"fixed_version":"112.0.5615.49-1","urgency":"not yet assigned"},"bullseye":{"status":"resolved","repositories":{"bullseye":"120.0.6099.224-1~deb11u1","bullseye-security":"120.0.6099.224-1~deb11u1"},"fixed_version":"112.0.5615.49-2~deb11u2","urgency":"not yet assigned"},"forky":{"status":"resolved","repositories":{"forky":"145.0.7632.159-1"},"fixed_version":"112.0.5615.49-1","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"146.0.7680.71-1"},"fixed_version":"112.0.5615.49-1","urgency":"not yet assigned"},"trixie":{"status":"resolved","repositories":{"trixie":"143.0.7499.169-1~deb13u1","trixie-security":"145.0.7632.159-1~deb13u1"},"fixed_version":"112.0.5615.49-1","urgency":"not yet assigned"}}},"CVE-2023-1818":{"description":"Use after free in Vulkan in Google Chrome prior to 112.0.5615.49 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. (Chromium security severity: Medium)","scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"143.0.7499.169-1~deb12u1","bookworm-security":"145.0.7632.159-1~deb12u1"},"fixed_version":"112.0.5615.49-1","urgency":"not yet assigned"},"bullseye":{"status":"resolved","repositories":{"bullseye":"120.0.6099.224-1~deb11u1","bullseye-security":"120.0.6099.224-1~deb11u1"},"fixed_version":"112.0.5615.49-2~deb11u2","urgency":"not yet assigned"},"forky":{"status":"resolved","repositories":{"forky":"145.0.7632.159-1"},"fixed_version":"112.0.5615.49-1","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"146.0.7680.71-1"},"fixed_version":"112.0.5615.49-1","urgency":"not yet assigned"},"trixie":{"status":"resolved","repositories":{"trixie":"143.0.7499.169-1~deb13u1","trixie-security":"145.0.7632.159-1~deb13u1"},"fixed_version":"112.0.5615.49-1","urgency":"not yet assigned"}}},"CVE-2023-1819":{"description":"Out of bounds read in Accessibility in Google Chrome prior to 112.0.5615.49 allowed a remote attacker to perform an out of bounds memory read via a crafted HTML page. (Chromium security severity: Medium)","scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"143.0.7499.169-1~deb12u1","bookworm-security":"145.0.7632.159-1~deb12u1"},"fixed_version":"112.0.5615.49-1","urgency":"not yet assigned"},"bullseye":{"status":"resolved","repositories":{"bullseye":"120.0.6099.224-1~deb11u1","bullseye-security":"120.0.6099.224-1~deb11u1"},"fixed_version":"112.0.5615.49-2~deb11u2","urgency":"not yet assigned"},"forky":{"status":"resolved","repositories":{"forky":"145.0.7632.159-1"},"fixed_version":"112.0.5615.49-1","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"146.0.7680.71-1"},"fixed_version":"112.0.5615.49-1","urgency":"not yet assigned"},"trixie":{"status":"resolved","repositories":{"trixie":"143.0.7499.169-1~deb13u1","trixie-security":"145.0.7632.159-1~deb13u1"},"fixed_version":"112.0.5615.49-1","urgency":"not yet assigned"}}},"CVE-2023-1820":{"description":"Heap buffer overflow in Browser History in Google Chrome prior to 112.0.5615.49 allowed a remote attacker who convinced a user to engage in specific UI interaction to potentially exploit heap corruption via a crafted HTML page. (Chromium security severity: Medium)","scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"143.0.7499.169-1~deb12u1","bookworm-security":"145.0.7632.159-1~deb12u1"},"fixed_version":"112.0.5615.49-1","urgency":"not yet assigned"},"bullseye":{"status":"resolved","repositories":{"bullseye":"120.0.6099.224-1~deb11u1","bullseye-security":"120.0.6099.224-1~deb11u1"},"fixed_version":"112.0.5615.49-2~deb11u2","urgency":"not yet assigned"},"forky":{"status":"resolved","repositories":{"forky":"145.0.7632.159-1"},"fixed_version":"112.0.5615.49-1","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"146.0.7680.71-1"},"fixed_version":"112.0.5615.49-1","urgency":"not yet assigned"},"trixie":{"status":"resolved","repositories":{"trixie":"143.0.7499.169-1~deb13u1","trixie-security":"145.0.7632.159-1~deb13u1"},"fixed_version":"112.0.5615.49-1","urgency":"not yet assigned"}}},"CVE-2023-1821":{"description":"Inappropriate implementation in WebShare in Google Chrome prior to 112.0.5615.49 allowed a remote attacker to potentially hide the contents of the Omnibox (URL bar) via a crafted HTML page. (Chromium security severity: Low)","scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"143.0.7499.169-1~deb12u1","bookworm-security":"145.0.7632.159-1~deb12u1"},"fixed_version":"112.0.5615.49-1","urgency":"not yet assigned"},"bullseye":{"status":"resolved","repositories":{"bullseye":"120.0.6099.224-1~deb11u1","bullseye-security":"120.0.6099.224-1~deb11u1"},"fixed_version":"112.0.5615.49-2~deb11u2","urgency":"not yet assigned"},"forky":{"status":"resolved","repositories":{"forky":"145.0.7632.159-1"},"fixed_version":"112.0.5615.49-1","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"146.0.7680.71-1"},"fixed_version":"112.0.5615.49-1","urgency":"not yet assigned"},"trixie":{"status":"resolved","repositories":{"trixie":"143.0.7499.169-1~deb13u1","trixie-security":"145.0.7632.159-1~deb13u1"},"fixed_version":"112.0.5615.49-1","urgency":"not yet assigned"}}},"CVE-2023-1822":{"description":"Incorrect security UI in Navigation in Google Chrome prior to 112.0.5615.49 allowed a remote attacker to perform domain spoofing via a crafted HTML page. (Chromium security severity: Low)","scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"143.0.7499.169-1~deb12u1","bookworm-security":"145.0.7632.159-1~deb12u1"},"fixed_version":"112.0.5615.49-1","urgency":"not yet assigned"},"bullseye":{"status":"resolved","repositories":{"bullseye":"120.0.6099.224-1~deb11u1","bullseye-security":"120.0.6099.224-1~deb11u1"},"fixed_version":"112.0.5615.49-2~deb11u2","urgency":"not yet assigned"},"forky":{"status":"resolved","repositories":{"forky":"145.0.7632.159-1"},"fixed_version":"112.0.5615.49-1","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"146.0.7680.71-1"},"fixed_version":"112.0.5615.49-1","urgency":"not yet assigned"},"trixie":{"status":"resolved","repositories":{"trixie":"143.0.7499.169-1~deb13u1","trixie-security":"145.0.7632.159-1~deb13u1"},"fixed_version":"112.0.5615.49-1","urgency":"not yet assigned"}}},"CVE-2023-1823":{"description":"Inappropriate implementation in FedCM in Google Chrome prior to 112.0.5615.49 allowed a remote attacker to bypass navigation restrictions via a crafted HTML page. (Chromium security severity: Low)","scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"143.0.7499.169-1~deb12u1","bookworm-security":"145.0.7632.159-1~deb12u1"},"fixed_version":"112.0.5615.49-1","urgency":"not yet assigned"},"bullseye":{"status":"resolved","repositories":{"bullseye":"120.0.6099.224-1~deb11u1","bullseye-security":"120.0.6099.224-1~deb11u1"},"fixed_version":"112.0.5615.49-2~deb11u2","urgency":"not yet assigned"},"forky":{"status":"resolved","repositories":{"forky":"145.0.7632.159-1"},"fixed_version":"112.0.5615.49-1","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"146.0.7680.71-1"},"fixed_version":"112.0.5615.49-1","urgency":"not yet assigned"},"trixie":{"status":"resolved","repositories":{"trixie":"143.0.7499.169-1~deb13u1","trixie-security":"145.0.7632.159-1~deb13u1"},"fixed_version":"112.0.5615.49-1","urgency":"not yet assigned"}}},"CVE-2023-2033":{"description":"Type confusion in V8 in Google Chrome prior to 112.0.5615.121 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. (Chromium security severity: High)","scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"143.0.7499.169-1~deb12u1","bookworm-security":"145.0.7632.159-1~deb12u1"},"fixed_version":"112.0.5615.121-1","urgency":"not yet assigned"},"bullseye":{"status":"resolved","repositories":{"bullseye":"120.0.6099.224-1~deb11u1","bullseye-security":"120.0.6099.224-1~deb11u1"},"fixed_version":"112.0.5615.121-1~deb11u1","urgency":"not yet assigned"},"forky":{"status":"resolved","repositories":{"forky":"145.0.7632.159-1"},"fixed_version":"112.0.5615.121-1","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"146.0.7680.71-1"},"fixed_version":"112.0.5615.121-1","urgency":"not yet assigned"},"trixie":{"status":"resolved","repositories":{"trixie":"143.0.7499.169-1~deb13u1","trixie-security":"145.0.7632.159-1~deb13u1"},"fixed_version":"112.0.5615.121-1","urgency":"not yet assigned"}}},"CVE-2023-2133":{"description":"Out of bounds memory access in Service Worker API in Google Chrome prior to 112.0.5615.137 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. (Chromium security severity: High)","scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"143.0.7499.169-1~deb12u1","bookworm-security":"145.0.7632.159-1~deb12u1"},"fixed_version":"112.0.5615.138-1","urgency":"not yet assigned"},"bullseye":{"status":"resolved","repositories":{"bullseye":"120.0.6099.224-1~deb11u1","bullseye-security":"120.0.6099.224-1~deb11u1"},"fixed_version":"112.0.5615.138-1~deb11u1","urgency":"not yet assigned"},"forky":{"status":"resolved","repositories":{"forky":"145.0.7632.159-1"},"fixed_version":"112.0.5615.138-1","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"146.0.7680.71-1"},"fixed_version":"112.0.5615.138-1","urgency":"not yet assigned"},"trixie":{"status":"resolved","repositories":{"trixie":"143.0.7499.169-1~deb13u1","trixie-security":"145.0.7632.159-1~deb13u1"},"fixed_version":"112.0.5615.138-1","urgency":"not yet assigned"}}},"CVE-2023-2134":{"description":"Out of bounds memory access in Service Worker API in Google Chrome prior to 112.0.5615.137 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. (Chromium security severity: High)","scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"143.0.7499.169-1~deb12u1","bookworm-security":"145.0.7632.159-1~deb12u1"},"fixed_version":"112.0.5615.138-1","urgency":"not yet assigned"},"bullseye":{"status":"resolved","repositories":{"bullseye":"120.0.6099.224-1~deb11u1","bullseye-security":"120.0.6099.224-1~deb11u1"},"fixed_version":"112.0.5615.138-1~deb11u1","urgency":"not yet assigned"},"forky":{"status":"resolved","repositories":{"forky":"145.0.7632.159-1"},"fixed_version":"112.0.5615.138-1","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"146.0.7680.71-1"},"fixed_version":"112.0.5615.138-1","urgency":"not yet assigned"},"trixie":{"status":"resolved","repositories":{"trixie":"143.0.7499.169-1~deb13u1","trixie-security":"145.0.7632.159-1~deb13u1"},"fixed_version":"112.0.5615.138-1","urgency":"not yet assigned"}}},"CVE-2023-2135":{"description":"Use after free in DevTools in Google Chrome prior to 112.0.5615.137 allowed a remote attacker who convinced a user to enable specific preconditions to potentially exploit heap corruption via a crafted HTML page. (Chromium security severity: High)","scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"143.0.7499.169-1~deb12u1","bookworm-security":"145.0.7632.159-1~deb12u1"},"fixed_version":"112.0.5615.138-1","urgency":"not yet assigned"},"bullseye":{"status":"resolved","repositories":{"bullseye":"120.0.6099.224-1~deb11u1","bullseye-security":"120.0.6099.224-1~deb11u1"},"fixed_version":"112.0.5615.138-1~deb11u1","urgency":"not yet assigned"},"forky":{"status":"resolved","repositories":{"forky":"145.0.7632.159-1"},"fixed_version":"112.0.5615.138-1","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"146.0.7680.71-1"},"fixed_version":"112.0.5615.138-1","urgency":"not yet assigned"},"trixie":{"status":"resolved","repositories":{"trixie":"143.0.7499.169-1~deb13u1","trixie-security":"145.0.7632.159-1~deb13u1"},"fixed_version":"112.0.5615.138-1","urgency":"not yet assigned"}}},"CVE-2023-2136":{"description":"Integer overflow in Skia in Google Chrome prior to 112.0.5615.137 allowed a remote attacker who had compromised the renderer process to potentially perform a sandbox escape via a crafted HTML page. (Chromium security severity: High)","scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"143.0.7499.169-1~deb12u1","bookworm-security":"145.0.7632.159-1~deb12u1"},"fixed_version":"112.0.5615.138-1","urgency":"not yet assigned"},"bullseye":{"status":"resolved","repositories":{"bullseye":"120.0.6099.224-1~deb11u1","bullseye-security":"120.0.6099.224-1~deb11u1"},"fixed_version":"112.0.5615.138-1~deb11u1","urgency":"not yet assigned"},"forky":{"status":"resolved","repositories":{"forky":"145.0.7632.159-1"},"fixed_version":"112.0.5615.138-1","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"146.0.7680.71-1"},"fixed_version":"112.0.5615.138-1","urgency":"not yet assigned"},"trixie":{"status":"resolved","repositories":{"trixie":"143.0.7499.169-1~deb13u1","trixie-security":"145.0.7632.159-1~deb13u1"},"fixed_version":"112.0.5615.138-1","urgency":"not yet assigned"}}},"CVE-2023-2137":{"description":"Heap buffer overflow in sqlite in Google Chrome prior to 112.0.5615.137 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. (Chromium security severity: Medium)","scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"143.0.7499.169-1~deb12u1","bookworm-security":"145.0.7632.159-1~deb12u1"},"fixed_version":"112.0.5615.138-1","urgency":"not yet assigned"},"bullseye":{"status":"resolved","repositories":{"bullseye":"120.0.6099.224-1~deb11u1","bullseye-security":"120.0.6099.224-1~deb11u1"},"fixed_version":"112.0.5615.138-1~deb11u1","urgency":"not yet assigned"},"forky":{"status":"resolved","repositories":{"forky":"145.0.7632.159-1"},"fixed_version":"112.0.5615.138-1","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"146.0.7680.71-1"},"fixed_version":"112.0.5615.138-1","urgency":"not yet assigned"},"trixie":{"status":"resolved","repositories":{"trixie":"143.0.7499.169-1~deb13u1","trixie-security":"145.0.7632.159-1~deb13u1"},"fixed_version":"112.0.5615.138-1","urgency":"not yet assigned"}}},"CVE-2023-2311":{"description":"Insufficient policy enforcement in File System API in Google Chrome prior to 112.0.5615.49 allowed a remote attacker to bypass filesystem restrictions via a crafted HTML page. (Chromium security severity: Medium)","scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"143.0.7499.169-1~deb12u1","bookworm-security":"145.0.7632.159-1~deb12u1"},"fixed_version":"112.0.5615.49-1","urgency":"not yet assigned"},"bullseye":{"status":"resolved","repositories":{"bullseye":"120.0.6099.224-1~deb11u1","bullseye-security":"120.0.6099.224-1~deb11u1"},"fixed_version":"112.0.5615.49-2~deb11u2","urgency":"not yet assigned"},"forky":{"status":"resolved","repositories":{"forky":"145.0.7632.159-1"},"fixed_version":"112.0.5615.49-1","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"146.0.7680.71-1"},"fixed_version":"112.0.5615.49-1","urgency":"not yet assigned"},"trixie":{"status":"resolved","repositories":{"trixie":"143.0.7499.169-1~deb13u1","trixie-security":"145.0.7632.159-1~deb13u1"},"fixed_version":"112.0.5615.49-1","urgency":"not yet assigned"}}},"CVE-2023-2312":{"description":"Use after free in Offline in Google Chrome on Android prior to 116.0.5845.96 allowed a remote attacker who had compromised the renderer process to potentially exploit heap corruption via a crafted HTML page. (Chromium security severity: High)","scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"143.0.7499.169-1~deb12u1","bookworm-security":"145.0.7632.159-1~deb12u1"},"fixed_version":"116.0.5845.96-1~deb12u1","urgency":"not yet assigned"},"bullseye":{"status":"resolved","repositories":{"bullseye":"120.0.6099.224-1~deb11u1","bullseye-security":"120.0.6099.224-1~deb11u1"},"fixed_version":"116.0.5845.96-1~deb11u1","urgency":"not yet assigned"},"forky":{"status":"resolved","repositories":{"forky":"145.0.7632.159-1"},"fixed_version":"116.0.5845.96-1","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"146.0.7680.71-1"},"fixed_version":"116.0.5845.96-1","urgency":"not yet assigned"},"trixie":{"status":"resolved","repositories":{"trixie":"143.0.7499.169-1~deb13u1","trixie-security":"145.0.7632.159-1~deb13u1"},"fixed_version":"116.0.5845.96-1","urgency":"not yet assigned"}}},"CVE-2023-2313":{"description":"Inappropriate implementation in Sandbox in Google Chrome on Windows prior to 112.0.5615.49 allowed a remote attacker who had compromised the renderer process to perform arbitrary read/write via a malicious file. (Chromium security severity: High)","scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"143.0.7499.169-1~deb12u1","bookworm-security":"145.0.7632.159-1~deb12u1"},"fixed_version":"112.0.5615.49-1","urgency":"not yet assigned"},"bullseye":{"status":"resolved","repositories":{"bullseye":"120.0.6099.224-1~deb11u1","bullseye-security":"120.0.6099.224-1~deb11u1"},"fixed_version":"112.0.5615.49-2~deb11u2","urgency":"not yet assigned"},"forky":{"status":"resolved","repositories":{"forky":"145.0.7632.159-1"},"fixed_version":"112.0.5615.49-1","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"146.0.7680.71-1"},"fixed_version":"112.0.5615.49-1","urgency":"not yet assigned"},"trixie":{"status":"resolved","repositories":{"trixie":"143.0.7499.169-1~deb13u1","trixie-security":"145.0.7632.159-1~deb13u1"},"fixed_version":"112.0.5615.49-1","urgency":"not yet assigned"}}},"CVE-2023-2314":{"description":"Insufficient data validation in DevTools in Google Chrome prior to 111.0.5563.64 allowed a remote attacker to bypass navigation restrictions via a crafted HTML page. (Chromium security severity: Low)","scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"143.0.7499.169-1~deb12u1","bookworm-security":"145.0.7632.159-1~deb12u1"},"fixed_version":"111.0.5563.64-1","urgency":"not yet assigned"},"bullseye":{"status":"resolved","repositories":{"bullseye":"120.0.6099.224-1~deb11u1","bullseye-security":"120.0.6099.224-1~deb11u1"},"fixed_version":"111.0.5563.64-1~deb11u1","urgency":"not yet assigned"},"forky":{"status":"resolved","repositories":{"forky":"145.0.7632.159-1"},"fixed_version":"111.0.5563.64-1","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"146.0.7680.71-1"},"fixed_version":"111.0.5563.64-1","urgency":"not yet assigned"},"trixie":{"status":"resolved","repositories":{"trixie":"143.0.7499.169-1~deb13u1","trixie-security":"145.0.7632.159-1~deb13u1"},"fixed_version":"111.0.5563.64-1","urgency":"not yet assigned"}}},"CVE-2023-2459":{"description":"Inappropriate implementation in Prompts in Google Chrome prior to 113.0.5672.63 allowed a remote attacker to bypass permission restrictions via a crafted HTML page. (Chromium security severity: Medium)","scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"143.0.7499.169-1~deb12u1","bookworm-security":"145.0.7632.159-1~deb12u1"},"fixed_version":"113.0.5672.63-1","urgency":"not yet assigned"},"bullseye":{"status":"resolved","repositories":{"bullseye":"120.0.6099.224-1~deb11u1","bullseye-security":"120.0.6099.224-1~deb11u1"},"fixed_version":"113.0.5672.63-1~deb11u1","urgency":"not yet assigned"},"forky":{"status":"resolved","repositories":{"forky":"145.0.7632.159-1"},"fixed_version":"113.0.5672.63-1","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"146.0.7680.71-1"},"fixed_version":"113.0.5672.63-1","urgency":"not yet assigned"},"trixie":{"status":"resolved","repositories":{"trixie":"143.0.7499.169-1~deb13u1","trixie-security":"145.0.7632.159-1~deb13u1"},"fixed_version":"113.0.5672.63-1","urgency":"not yet assigned"}}},"CVE-2023-2460":{"description":"Insufficient validation of untrusted input in Extensions in Google Chrome prior to 113.0.5672.63 allowed an attacker who convinced a user to install a malicious extension to bypass file access checks via a crafted HTML page. (Chromium security severity: Medium)","scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"143.0.7499.169-1~deb12u1","bookworm-security":"145.0.7632.159-1~deb12u1"},"fixed_version":"113.0.5672.63-1","urgency":"not yet assigned"},"bullseye":{"status":"resolved","repositories":{"bullseye":"120.0.6099.224-1~deb11u1","bullseye-security":"120.0.6099.224-1~deb11u1"},"fixed_version":"113.0.5672.63-1~deb11u1","urgency":"not yet assigned"},"forky":{"status":"resolved","repositories":{"forky":"145.0.7632.159-1"},"fixed_version":"113.0.5672.63-1","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"146.0.7680.71-1"},"fixed_version":"113.0.5672.63-1","urgency":"not yet assigned"},"trixie":{"status":"resolved","repositories":{"trixie":"143.0.7499.169-1~deb13u1","trixie-security":"145.0.7632.159-1~deb13u1"},"fixed_version":"113.0.5672.63-1","urgency":"not yet assigned"}}},"CVE-2023-2461":{"description":"Use after free in OS Inputs in Google Chrome on ChromeOS prior to 113.0.5672.63 allowed a remote attacker who convinced a user to enage in specific UI interaction to potentially exploit heap corruption via crafted UI interaction. (Chromium security severity: Medium)","scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"143.0.7499.169-1~deb12u1","bookworm-security":"145.0.7632.159-1~deb12u1"},"fixed_version":"113.0.5672.63-1","urgency":"not yet assigned"},"bullseye":{"status":"resolved","repositories":{"bullseye":"120.0.6099.224-1~deb11u1","bullseye-security":"120.0.6099.224-1~deb11u1"},"fixed_version":"113.0.5672.63-1~deb11u1","urgency":"not yet assigned"},"forky":{"status":"resolved","repositories":{"forky":"145.0.7632.159-1"},"fixed_version":"113.0.5672.63-1","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"146.0.7680.71-1"},"fixed_version":"113.0.5672.63-1","urgency":"not yet assigned"},"trixie":{"status":"resolved","repositories":{"trixie":"143.0.7499.169-1~deb13u1","trixie-security":"145.0.7632.159-1~deb13u1"},"fixed_version":"113.0.5672.63-1","urgency":"not yet assigned"}}},"CVE-2023-2462":{"description":"Inappropriate implementation in Prompts in Google Chrome prior to 113.0.5672.63 allowed a remote attacker to obfuscate main origin data via a crafted HTML page. (Chromium security severity: Medium)","scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"143.0.7499.169-1~deb12u1","bookworm-security":"145.0.7632.159-1~deb12u1"},"fixed_version":"113.0.5672.63-1","urgency":"not yet assigned"},"bullseye":{"status":"resolved","repositories":{"bullseye":"120.0.6099.224-1~deb11u1","bullseye-security":"120.0.6099.224-1~deb11u1"},"fixed_version":"113.0.5672.63-1~deb11u1","urgency":"not yet assigned"},"forky":{"status":"resolved","repositories":{"forky":"145.0.7632.159-1"},"fixed_version":"113.0.5672.63-1","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"146.0.7680.71-1"},"fixed_version":"113.0.5672.63-1","urgency":"not yet assigned"},"trixie":{"status":"resolved","repositories":{"trixie":"143.0.7499.169-1~deb13u1","trixie-security":"145.0.7632.159-1~deb13u1"},"fixed_version":"113.0.5672.63-1","urgency":"not yet assigned"}}},"CVE-2023-2463":{"description":"Inappropriate implementation in Full Screen Mode in Google Chrome on Android prior to 113.0.5672.63 allowed a remote attacker to hide the contents of the Omnibox (URL bar) via a crafted HTML page. (Chromium security severity: Medium)","scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"143.0.7499.169-1~deb12u1","bookworm-security":"145.0.7632.159-1~deb12u1"},"fixed_version":"113.0.5672.63-1","urgency":"not yet assigned"},"bullseye":{"status":"resolved","repositories":{"bullseye":"120.0.6099.224-1~deb11u1","bullseye-security":"120.0.6099.224-1~deb11u1"},"fixed_version":"113.0.5672.63-1~deb11u1","urgency":"not yet assigned"},"forky":{"status":"resolved","repositories":{"forky":"145.0.7632.159-1"},"fixed_version":"113.0.5672.63-1","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"146.0.7680.71-1"},"fixed_version":"113.0.5672.63-1","urgency":"not yet assigned"},"trixie":{"status":"resolved","repositories":{"trixie":"143.0.7499.169-1~deb13u1","trixie-security":"145.0.7632.159-1~deb13u1"},"fixed_version":"113.0.5672.63-1","urgency":"not yet assigned"}}},"CVE-2023-2464":{"description":"Inappropriate implementation in PictureInPicture in Google Chrome prior to 113.0.5672.63 allowed an attacker who convinced a user to install a malicious extension to perform an origin spoof in the security UI via a crafted HTML page. (Chromium security severity: Medium)","scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"143.0.7499.169-1~deb12u1","bookworm-security":"145.0.7632.159-1~deb12u1"},"fixed_version":"113.0.5672.63-1","urgency":"not yet assigned"},"bullseye":{"status":"resolved","repositories":{"bullseye":"120.0.6099.224-1~deb11u1","bullseye-security":"120.0.6099.224-1~deb11u1"},"fixed_version":"113.0.5672.63-1~deb11u1","urgency":"not yet assigned"},"forky":{"status":"resolved","repositories":{"forky":"145.0.7632.159-1"},"fixed_version":"113.0.5672.63-1","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"146.0.7680.71-1"},"fixed_version":"113.0.5672.63-1","urgency":"not yet assigned"},"trixie":{"status":"resolved","repositories":{"trixie":"143.0.7499.169-1~deb13u1","trixie-security":"145.0.7632.159-1~deb13u1"},"fixed_version":"113.0.5672.63-1","urgency":"not yet assigned"}}},"CVE-2023-2465":{"description":"Inappropriate implementation in CORS in Google Chrome prior to 113.0.5672.63 allowed a remote attacker to leak cross-origin data via a crafted HTML page. (Chromium security severity: Medium)","scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"143.0.7499.169-1~deb12u1","bookworm-security":"145.0.7632.159-1~deb12u1"},"fixed_version":"113.0.5672.63-1","urgency":"not yet assigned"},"bullseye":{"status":"resolved","repositories":{"bullseye":"120.0.6099.224-1~deb11u1","bullseye-security":"120.0.6099.224-1~deb11u1"},"fixed_version":"113.0.5672.63-1~deb11u1","urgency":"not yet assigned"},"forky":{"status":"resolved","repositories":{"forky":"145.0.7632.159-1"},"fixed_version":"113.0.5672.63-1","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"146.0.7680.71-1"},"fixed_version":"113.0.5672.63-1","urgency":"not yet assigned"},"trixie":{"status":"resolved","repositories":{"trixie":"143.0.7499.169-1~deb13u1","trixie-security":"145.0.7632.159-1~deb13u1"},"fixed_version":"113.0.5672.63-1","urgency":"not yet assigned"}}},"CVE-2023-2466":{"description":"Inappropriate implementation in Prompts in Google Chrome prior to 113.0.5672.63 allowed a remote attacker to spoof the contents of the security UI via a crafted HTML page. (Chromium security severity: Low)","scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"143.0.7499.169-1~deb12u1","bookworm-security":"145.0.7632.159-1~deb12u1"},"fixed_version":"113.0.5672.63-1","urgency":"not yet assigned"},"bullseye":{"status":"resolved","repositories":{"bullseye":"120.0.6099.224-1~deb11u1","bullseye-security":"120.0.6099.224-1~deb11u1"},"fixed_version":"113.0.5672.63-1~deb11u1","urgency":"not yet assigned"},"forky":{"status":"resolved","repositories":{"forky":"145.0.7632.159-1"},"fixed_version":"113.0.5672.63-1","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"146.0.7680.71-1"},"fixed_version":"113.0.5672.63-1","urgency":"not yet assigned"},"trixie":{"status":"resolved","repositories":{"trixie":"143.0.7499.169-1~deb13u1","trixie-security":"145.0.7632.159-1~deb13u1"},"fixed_version":"113.0.5672.63-1","urgency":"not yet assigned"}}},"CVE-2023-2467":{"description":"Inappropriate implementation in Prompts in Google Chrome on Android prior to 113.0.5672.63 allowed a remote attacker to bypass permissions restrictions via a crafted HTML page. (Chromium security severity: Low)","scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"143.0.7499.169-1~deb12u1","bookworm-security":"145.0.7632.159-1~deb12u1"},"fixed_version":"113.0.5672.63-1","urgency":"not yet assigned"},"bullseye":{"status":"resolved","repositories":{"bullseye":"120.0.6099.224-1~deb11u1","bullseye-security":"120.0.6099.224-1~deb11u1"},"fixed_version":"113.0.5672.63-1~deb11u1","urgency":"not yet assigned"},"forky":{"status":"resolved","repositories":{"forky":"145.0.7632.159-1"},"fixed_version":"113.0.5672.63-1","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"146.0.7680.71-1"},"fixed_version":"113.0.5672.63-1","urgency":"not yet assigned"},"trixie":{"status":"resolved","repositories":{"trixie":"143.0.7499.169-1~deb13u1","trixie-security":"145.0.7632.159-1~deb13u1"},"fixed_version":"113.0.5672.63-1","urgency":"not yet assigned"}}},"CVE-2023-2468":{"description":"Inappropriate implementation in PictureInPicture in Google Chrome prior to 113.0.5672.63 allowed a remote attacker who had compromised the renderer process to obfuscate the security UI via a crafted HTML page. (Chromium security severity: Low)","scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"143.0.7499.169-1~deb12u1","bookworm-security":"145.0.7632.159-1~deb12u1"},"fixed_version":"113.0.5672.63-1","urgency":"not yet assigned"},"bullseye":{"status":"resolved","repositories":{"bullseye":"120.0.6099.224-1~deb11u1","bullseye-security":"120.0.6099.224-1~deb11u1"},"fixed_version":"113.0.5672.63-1~deb11u1","urgency":"not yet assigned"},"forky":{"status":"resolved","repositories":{"forky":"145.0.7632.159-1"},"fixed_version":"113.0.5672.63-1","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"146.0.7680.71-1"},"fixed_version":"113.0.5672.63-1","urgency":"not yet assigned"},"trixie":{"status":"resolved","repositories":{"trixie":"143.0.7499.169-1~deb13u1","trixie-security":"145.0.7632.159-1~deb13u1"},"fixed_version":"113.0.5672.63-1","urgency":"not yet assigned"}}},"CVE-2023-2721":{"description":"Use after free in Navigation in Google Chrome prior to 113.0.5672.126 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. (Chromium security severity: Critical)","scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"143.0.7499.169-1~deb12u1","bookworm-security":"145.0.7632.159-1~deb12u1"},"fixed_version":"113.0.5672.126-1","urgency":"not yet assigned"},"bullseye":{"status":"resolved","repositories":{"bullseye":"120.0.6099.224-1~deb11u1","bullseye-security":"120.0.6099.224-1~deb11u1"},"fixed_version":"113.0.5672.126-1~deb11u1","urgency":"not yet assigned"},"forky":{"status":"resolved","repositories":{"forky":"145.0.7632.159-1"},"fixed_version":"113.0.5672.126-1","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"146.0.7680.71-1"},"fixed_version":"113.0.5672.126-1","urgency":"not yet assigned"},"trixie":{"status":"resolved","repositories":{"trixie":"143.0.7499.169-1~deb13u1","trixie-security":"145.0.7632.159-1~deb13u1"},"fixed_version":"113.0.5672.126-1","urgency":"not yet assigned"}}},"CVE-2023-2722":{"description":"Use after free in Autofill UI in Google Chrome on Android prior to 113.0.5672.126 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. (Chromium security severity: High)","scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"143.0.7499.169-1~deb12u1","bookworm-security":"145.0.7632.159-1~deb12u1"},"fixed_version":"113.0.5672.126-1","urgency":"not yet assigned"},"bullseye":{"status":"resolved","repositories":{"bullseye":"120.0.6099.224-1~deb11u1","bullseye-security":"120.0.6099.224-1~deb11u1"},"fixed_version":"113.0.5672.126-1~deb11u1","urgency":"not yet assigned"},"forky":{"status":"resolved","repositories":{"forky":"145.0.7632.159-1"},"fixed_version":"113.0.5672.126-1","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"146.0.7680.71-1"},"fixed_version":"113.0.5672.126-1","urgency":"not yet assigned"},"trixie":{"status":"resolved","repositories":{"trixie":"143.0.7499.169-1~deb13u1","trixie-security":"145.0.7632.159-1~deb13u1"},"fixed_version":"113.0.5672.126-1","urgency":"not yet assigned"}}},"CVE-2023-2723":{"description":"Use after free in DevTools in Google Chrome prior to 113.0.5672.126 allowed a remote attacker who had compromised the renderer process to potentially exploit heap corruption via a crafted HTML page. (Chromium security severity: High)","scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"143.0.7499.169-1~deb12u1","bookworm-security":"145.0.7632.159-1~deb12u1"},"fixed_version":"113.0.5672.126-1","urgency":"not yet assigned"},"bullseye":{"status":"resolved","repositories":{"bullseye":"120.0.6099.224-1~deb11u1","bullseye-security":"120.0.6099.224-1~deb11u1"},"fixed_version":"113.0.5672.126-1~deb11u1","urgency":"not yet assigned"},"forky":{"status":"resolved","repositories":{"forky":"145.0.7632.159-1"},"fixed_version":"113.0.5672.126-1","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"146.0.7680.71-1"},"fixed_version":"113.0.5672.126-1","urgency":"not yet assigned"},"trixie":{"status":"resolved","repositories":{"trixie":"143.0.7499.169-1~deb13u1","trixie-security":"145.0.7632.159-1~deb13u1"},"fixed_version":"113.0.5672.126-1","urgency":"not yet assigned"}}},"CVE-2023-2724":{"description":"Type confusion in V8 in Google Chrome prior to 113.0.5672.126 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. (Chromium security severity: High)","scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"143.0.7499.169-1~deb12u1","bookworm-security":"145.0.7632.159-1~deb12u1"},"fixed_version":"113.0.5672.126-1","urgency":"not yet assigned"},"bullseye":{"status":"resolved","repositories":{"bullseye":"120.0.6099.224-1~deb11u1","bullseye-security":"120.0.6099.224-1~deb11u1"},"fixed_version":"113.0.5672.126-1~deb11u1","urgency":"not yet assigned"},"forky":{"status":"resolved","repositories":{"forky":"145.0.7632.159-1"},"fixed_version":"113.0.5672.126-1","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"146.0.7680.71-1"},"fixed_version":"113.0.5672.126-1","urgency":"not yet assigned"},"trixie":{"status":"resolved","repositories":{"trixie":"143.0.7499.169-1~deb13u1","trixie-security":"145.0.7632.159-1~deb13u1"},"fixed_version":"113.0.5672.126-1","urgency":"not yet assigned"}}},"CVE-2023-2725":{"description":"Use after free in Guest View in Google Chrome prior to 113.0.5672.126 allowed an attacker who convinced a user to install a malicious extension to potentially exploit heap corruption via a crafted HTML page. (Chromium security severity: High)","scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"143.0.7499.169-1~deb12u1","bookworm-security":"145.0.7632.159-1~deb12u1"},"fixed_version":"113.0.5672.126-1","urgency":"not yet assigned"},"bullseye":{"status":"resolved","repositories":{"bullseye":"120.0.6099.224-1~deb11u1","bullseye-security":"120.0.6099.224-1~deb11u1"},"fixed_version":"113.0.5672.126-1~deb11u1","urgency":"not yet assigned"},"forky":{"status":"resolved","repositories":{"forky":"145.0.7632.159-1"},"fixed_version":"113.0.5672.126-1","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"146.0.7680.71-1"},"fixed_version":"113.0.5672.126-1","urgency":"not yet assigned"},"trixie":{"status":"resolved","repositories":{"trixie":"143.0.7499.169-1~deb13u1","trixie-security":"145.0.7632.159-1~deb13u1"},"fixed_version":"113.0.5672.126-1","urgency":"not yet assigned"}}},"CVE-2023-2726":{"description":"Inappropriate implementation in WebApp Installs in Google Chrome prior to 113.0.5672.126 allowed an attacker who convinced a user to install a malicious web app to bypass install dialog via a crafted HTML page. (Chromium security severity: Medium)","scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"143.0.7499.169-1~deb12u1","bookworm-security":"145.0.7632.159-1~deb12u1"},"fixed_version":"113.0.5672.126-1","urgency":"not yet assigned"},"bullseye":{"status":"resolved","repositories":{"bullseye":"120.0.6099.224-1~deb11u1","bullseye-security":"120.0.6099.224-1~deb11u1"},"fixed_version":"113.0.5672.126-1~deb11u1","urgency":"not yet assigned"},"forky":{"status":"resolved","repositories":{"forky":"145.0.7632.159-1"},"fixed_version":"113.0.5672.126-1","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"146.0.7680.71-1"},"fixed_version":"113.0.5672.126-1","urgency":"not yet assigned"},"trixie":{"status":"resolved","repositories":{"trixie":"143.0.7499.169-1~deb13u1","trixie-security":"145.0.7632.159-1~deb13u1"},"fixed_version":"113.0.5672.126-1","urgency":"not yet assigned"}}},"CVE-2023-2929":{"description":"Out of bounds write in Swiftshader in Google Chrome prior to 114.0.5735.90 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. (Chromium security severity: High)","scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"143.0.7499.169-1~deb12u1","bookworm-security":"145.0.7632.159-1~deb12u1"},"fixed_version":"114.0.5735.90-2~deb12u1","urgency":"not yet assigned"},"bullseye":{"status":"resolved","repositories":{"bullseye":"120.0.6099.224-1~deb11u1","bullseye-security":"120.0.6099.224-1~deb11u1"},"fixed_version":"114.0.5735.90-2~deb11u1","urgency":"not yet assigned"},"forky":{"status":"resolved","repositories":{"forky":"145.0.7632.159-1"},"fixed_version":"114.0.5735.90-1","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"146.0.7680.71-1"},"fixed_version":"114.0.5735.90-1","urgency":"not yet assigned"},"trixie":{"status":"resolved","repositories":{"trixie":"143.0.7499.169-1~deb13u1","trixie-security":"145.0.7632.159-1~deb13u1"},"fixed_version":"114.0.5735.90-1","urgency":"not yet assigned"}}},"CVE-2023-2930":{"description":"Use after free in Extensions in Google Chrome prior to 114.0.5735.90 allowed an attacker who convinced a user to install a malicious extension to potentially exploit heap corruption via a crafted HTML page. (Chromium security severity: High)","scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"143.0.7499.169-1~deb12u1","bookworm-security":"145.0.7632.159-1~deb12u1"},"fixed_version":"114.0.5735.90-2~deb12u1","urgency":"not yet assigned"},"bullseye":{"status":"resolved","repositories":{"bullseye":"120.0.6099.224-1~deb11u1","bullseye-security":"120.0.6099.224-1~deb11u1"},"fixed_version":"114.0.5735.90-2~deb11u1","urgency":"not yet assigned"},"forky":{"status":"resolved","repositories":{"forky":"145.0.7632.159-1"},"fixed_version":"114.0.5735.90-1","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"146.0.7680.71-1"},"fixed_version":"114.0.5735.90-1","urgency":"not yet assigned"},"trixie":{"status":"resolved","repositories":{"trixie":"143.0.7499.169-1~deb13u1","trixie-security":"145.0.7632.159-1~deb13u1"},"fixed_version":"114.0.5735.90-1","urgency":"not yet assigned"}}},"CVE-2023-2931":{"description":"Use after free in PDF in Google Chrome prior to 114.0.5735.90 allowed a remote attacker to potentially exploit heap corruption via a crafted PDF file. (Chromium security severity: High)","scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"143.0.7499.169-1~deb12u1","bookworm-security":"145.0.7632.159-1~deb12u1"},"fixed_version":"114.0.5735.90-2~deb12u1","urgency":"not yet assigned"},"bullseye":{"status":"resolved","repositories":{"bullseye":"120.0.6099.224-1~deb11u1","bullseye-security":"120.0.6099.224-1~deb11u1"},"fixed_version":"114.0.5735.90-2~deb11u1","urgency":"not yet assigned"},"forky":{"status":"resolved","repositories":{"forky":"145.0.7632.159-1"},"fixed_version":"114.0.5735.90-1","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"146.0.7680.71-1"},"fixed_version":"114.0.5735.90-1","urgency":"not yet assigned"},"trixie":{"status":"resolved","repositories":{"trixie":"143.0.7499.169-1~deb13u1","trixie-security":"145.0.7632.159-1~deb13u1"},"fixed_version":"114.0.5735.90-1","urgency":"not yet assigned"}}},"CVE-2023-2932":{"description":"Use after free in PDF in Google Chrome prior to 114.0.5735.90 allowed a remote attacker to potentially exploit heap corruption via a crafted PDF file. (Chromium security severity: High)","scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"143.0.7499.169-1~deb12u1","bookworm-security":"145.0.7632.159-1~deb12u1"},"fixed_version":"114.0.5735.90-2~deb12u1","urgency":"not yet assigned"},"bullseye":{"status":"resolved","repositories":{"bullseye":"120.0.6099.224-1~deb11u1","bullseye-security":"120.0.6099.224-1~deb11u1"},"fixed_version":"114.0.5735.90-2~deb11u1","urgency":"not yet assigned"},"forky":{"status":"resolved","repositories":{"forky":"145.0.7632.159-1"},"fixed_version":"114.0.5735.90-1","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"146.0.7680.71-1"},"fixed_version":"114.0.5735.90-1","urgency":"not yet assigned"},"trixie":{"status":"resolved","repositories":{"trixie":"143.0.7499.169-1~deb13u1","trixie-security":"145.0.7632.159-1~deb13u1"},"fixed_version":"114.0.5735.90-1","urgency":"not yet assigned"}}},"CVE-2023-2933":{"description":"Use after free in PDF in Google Chrome prior to 114.0.5735.90 allowed a remote attacker to potentially exploit heap corruption via a crafted PDF file. (Chromium security severity: High)","scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"143.0.7499.169-1~deb12u1","bookworm-security":"145.0.7632.159-1~deb12u1"},"fixed_version":"114.0.5735.90-2~deb12u1","urgency":"not yet assigned"},"bullseye":{"status":"resolved","repositories":{"bullseye":"120.0.6099.224-1~deb11u1","bullseye-security":"120.0.6099.224-1~deb11u1"},"fixed_version":"114.0.5735.90-2~deb11u1","urgency":"not yet assigned"},"forky":{"status":"resolved","repositories":{"forky":"145.0.7632.159-1"},"fixed_version":"114.0.5735.90-1","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"146.0.7680.71-1"},"fixed_version":"114.0.5735.90-1","urgency":"not yet assigned"},"trixie":{"status":"resolved","repositories":{"trixie":"143.0.7499.169-1~deb13u1","trixie-security":"145.0.7632.159-1~deb13u1"},"fixed_version":"114.0.5735.90-1","urgency":"not yet assigned"}}},"CVE-2023-2934":{"description":"Out of bounds memory access in Mojo in Google Chrome prior to 114.0.5735.90 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. (Chromium security severity: High)","scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"143.0.7499.169-1~deb12u1","bookworm-security":"145.0.7632.159-1~deb12u1"},"fixed_version":"114.0.5735.90-2~deb12u1","urgency":"not yet assigned"},"bullseye":{"status":"resolved","repositories":{"bullseye":"120.0.6099.224-1~deb11u1","bullseye-security":"120.0.6099.224-1~deb11u1"},"fixed_version":"114.0.5735.90-2~deb11u1","urgency":"not yet assigned"},"forky":{"status":"resolved","repositories":{"forky":"145.0.7632.159-1"},"fixed_version":"114.0.5735.90-1","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"146.0.7680.71-1"},"fixed_version":"114.0.5735.90-1","urgency":"not yet assigned"},"trixie":{"status":"resolved","repositories":{"trixie":"143.0.7499.169-1~deb13u1","trixie-security":"145.0.7632.159-1~deb13u1"},"fixed_version":"114.0.5735.90-1","urgency":"not yet assigned"}}},"CVE-2023-2935":{"description":"Type Confusion in V8 in Google Chrome prior to 114.0.5735.90 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. (Chromium security severity: High)","scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"143.0.7499.169-1~deb12u1","bookworm-security":"145.0.7632.159-1~deb12u1"},"fixed_version":"114.0.5735.90-2~deb12u1","urgency":"not yet assigned"},"bullseye":{"status":"resolved","repositories":{"bullseye":"120.0.6099.224-1~deb11u1","bullseye-security":"120.0.6099.224-1~deb11u1"},"fixed_version":"114.0.5735.90-2~deb11u1","urgency":"not yet assigned"},"forky":{"status":"resolved","repositories":{"forky":"145.0.7632.159-1"},"fixed_version":"114.0.5735.90-1","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"146.0.7680.71-1"},"fixed_version":"114.0.5735.90-1","urgency":"not yet assigned"},"trixie":{"status":"resolved","repositories":{"trixie":"143.0.7499.169-1~deb13u1","trixie-security":"145.0.7632.159-1~deb13u1"},"fixed_version":"114.0.5735.90-1","urgency":"not yet assigned"}}},"CVE-2023-2936":{"description":"Type Confusion in V8 in Google Chrome prior to 114.0.5735.90 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. (Chromium security severity: High)","scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"143.0.7499.169-1~deb12u1","bookworm-security":"145.0.7632.159-1~deb12u1"},"fixed_version":"114.0.5735.90-2~deb12u1","urgency":"not yet assigned"},"bullseye":{"status":"resolved","repositories":{"bullseye":"120.0.6099.224-1~deb11u1","bullseye-security":"120.0.6099.224-1~deb11u1"},"fixed_version":"114.0.5735.90-2~deb11u1","urgency":"not yet assigned"},"forky":{"status":"resolved","repositories":{"forky":"145.0.7632.159-1"},"fixed_version":"114.0.5735.90-1","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"146.0.7680.71-1"},"fixed_version":"114.0.5735.90-1","urgency":"not yet assigned"},"trixie":{"status":"resolved","repositories":{"trixie":"143.0.7499.169-1~deb13u1","trixie-security":"145.0.7632.159-1~deb13u1"},"fixed_version":"114.0.5735.90-1","urgency":"not yet assigned"}}},"CVE-2023-2937":{"description":"Inappropriate implementation in Picture In Picture in Google Chrome prior to 114.0.5735.90 allowed a remote attacker who had compromised the renderer process to spoof the contents of the Omnibox (URL bar) via a crafted HTML page. (Chromium security severity: Medium)","scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"143.0.7499.169-1~deb12u1","bookworm-security":"145.0.7632.159-1~deb12u1"},"fixed_version":"114.0.5735.90-2~deb12u1","urgency":"not yet assigned"},"bullseye":{"status":"resolved","repositories":{"bullseye":"120.0.6099.224-1~deb11u1","bullseye-security":"120.0.6099.224-1~deb11u1"},"fixed_version":"114.0.5735.90-2~deb11u1","urgency":"not yet assigned"},"forky":{"status":"resolved","repositories":{"forky":"145.0.7632.159-1"},"fixed_version":"114.0.5735.90-1","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"146.0.7680.71-1"},"fixed_version":"114.0.5735.90-1","urgency":"not yet assigned"},"trixie":{"status":"resolved","repositories":{"trixie":"143.0.7499.169-1~deb13u1","trixie-security":"145.0.7632.159-1~deb13u1"},"fixed_version":"114.0.5735.90-1","urgency":"not yet assigned"}}},"CVE-2023-2938":{"description":"Inappropriate implementation in Picture In Picture in Google Chrome prior to 114.0.5735.90 allowed a remote attacker who had compromised the renderer process to spoof the contents of the Omnibox (URL bar) via a crafted HTML page. (Chromium security severity: Medium)","scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"143.0.7499.169-1~deb12u1","bookworm-security":"145.0.7632.159-1~deb12u1"},"fixed_version":"114.0.5735.90-2~deb12u1","urgency":"not yet assigned"},"bullseye":{"status":"resolved","repositories":{"bullseye":"120.0.6099.224-1~deb11u1","bullseye-security":"120.0.6099.224-1~deb11u1"},"fixed_version":"114.0.5735.90-2~deb11u1","urgency":"not yet assigned"},"forky":{"status":"resolved","repositories":{"forky":"145.0.7632.159-1"},"fixed_version":"114.0.5735.90-1","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"146.0.7680.71-1"},"fixed_version":"114.0.5735.90-1","urgency":"not yet assigned"},"trixie":{"status":"resolved","repositories":{"trixie":"143.0.7499.169-1~deb13u1","trixie-security":"145.0.7632.159-1~deb13u1"},"fixed_version":"114.0.5735.90-1","urgency":"not yet assigned"}}},"CVE-2023-2939":{"description":"Insufficient data validation in Installer in Google Chrome on Windows prior to 114.0.5735.90 allowed a local attacker to perform privilege escalation via crafted symbolic link. (Chromium security severity: Medium)","scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"143.0.7499.169-1~deb12u1","bookworm-security":"145.0.7632.159-1~deb12u1"},"fixed_version":"114.0.5735.90-2~deb12u1","urgency":"not yet assigned"},"bullseye":{"status":"resolved","repositories":{"bullseye":"120.0.6099.224-1~deb11u1","bullseye-security":"120.0.6099.224-1~deb11u1"},"fixed_version":"114.0.5735.90-2~deb11u1","urgency":"not yet assigned"},"forky":{"status":"resolved","repositories":{"forky":"145.0.7632.159-1"},"fixed_version":"114.0.5735.90-1","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"146.0.7680.71-1"},"fixed_version":"114.0.5735.90-1","urgency":"not yet assigned"},"trixie":{"status":"resolved","repositories":{"trixie":"143.0.7499.169-1~deb13u1","trixie-security":"145.0.7632.159-1~deb13u1"},"fixed_version":"114.0.5735.90-1","urgency":"not yet assigned"}}},"CVE-2023-2940":{"description":"Inappropriate implementation in Downloads in Google Chrome prior to 114.0.5735.90 allowed an attacker who convinced a user to install a malicious extension to bypass file access restrictions via a crafted HTML page. (Chromium security severity: Medium)","scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"143.0.7499.169-1~deb12u1","bookworm-security":"145.0.7632.159-1~deb12u1"},"fixed_version":"114.0.5735.90-2~deb12u1","urgency":"not yet assigned"},"bullseye":{"status":"resolved","repositories":{"bullseye":"120.0.6099.224-1~deb11u1","bullseye-security":"120.0.6099.224-1~deb11u1"},"fixed_version":"114.0.5735.90-2~deb11u1","urgency":"not yet assigned"},"forky":{"status":"resolved","repositories":{"forky":"145.0.7632.159-1"},"fixed_version":"114.0.5735.90-1","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"146.0.7680.71-1"},"fixed_version":"114.0.5735.90-1","urgency":"not yet assigned"},"trixie":{"status":"resolved","repositories":{"trixie":"143.0.7499.169-1~deb13u1","trixie-security":"145.0.7632.159-1~deb13u1"},"fixed_version":"114.0.5735.90-1","urgency":"not yet assigned"}}},"CVE-2023-2941":{"description":"Inappropriate implementation in Extensions API in Google Chrome prior to 114.0.5735.90 allowed an attacker who convinced a user to install a malicious extension to spoof the contents of the UI via a crafted Chrome Extension. (Chromium security severity: Low)","scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"143.0.7499.169-1~deb12u1","bookworm-security":"145.0.7632.159-1~deb12u1"},"fixed_version":"114.0.5735.90-2~deb12u1","urgency":"not yet assigned"},"bullseye":{"status":"resolved","repositories":{"bullseye":"120.0.6099.224-1~deb11u1","bullseye-security":"120.0.6099.224-1~deb11u1"},"fixed_version":"114.0.5735.90-2~deb11u1","urgency":"not yet assigned"},"forky":{"status":"resolved","repositories":{"forky":"145.0.7632.159-1"},"fixed_version":"114.0.5735.90-1","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"146.0.7680.71-1"},"fixed_version":"114.0.5735.90-1","urgency":"not yet assigned"},"trixie":{"status":"resolved","repositories":{"trixie":"143.0.7499.169-1~deb13u1","trixie-security":"145.0.7632.159-1~deb13u1"},"fixed_version":"114.0.5735.90-1","urgency":"not yet assigned"}}},"CVE-2023-3079":{"description":"Type confusion in V8 in Google Chrome prior to 114.0.5735.110 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. (Chromium security severity: High)","scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"143.0.7499.169-1~deb12u1","bookworm-security":"145.0.7632.159-1~deb12u1"},"fixed_version":"114.0.5735.106-1~deb12u1","urgency":"not yet assigned"},"bullseye":{"status":"resolved","repositories":{"bullseye":"120.0.6099.224-1~deb11u1","bullseye-security":"120.0.6099.224-1~deb11u1"},"fixed_version":"114.0.5735.106-1~deb11u1","urgency":"not yet assigned"},"forky":{"status":"resolved","repositories":{"forky":"145.0.7632.159-1"},"fixed_version":"114.0.5735.106-1","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"146.0.7680.71-1"},"fixed_version":"114.0.5735.106-1","urgency":"not yet assigned"},"trixie":{"status":"resolved","repositories":{"trixie":"143.0.7499.169-1~deb13u1","trixie-security":"145.0.7632.159-1~deb13u1"},"fixed_version":"114.0.5735.106-1","urgency":"not yet assigned"}}},"CVE-2023-3214":{"description":"Use after free in Autofill payments in Google Chrome prior to 114.0.5735.133 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. (Chromium security severity: Critical)","scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"143.0.7499.169-1~deb12u1","bookworm-security":"145.0.7632.159-1~deb12u1"},"fixed_version":"114.0.5735.133-1~deb12u1","urgency":"not yet assigned"},"bullseye":{"status":"resolved","repositories":{"bullseye":"120.0.6099.224-1~deb11u1","bullseye-security":"120.0.6099.224-1~deb11u1"},"fixed_version":"114.0.5735.133-1~deb11u1","urgency":"not yet assigned"},"forky":{"status":"resolved","repositories":{"forky":"145.0.7632.159-1"},"fixed_version":"114.0.5735.133-1","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"146.0.7680.71-1"},"fixed_version":"114.0.5735.133-1","urgency":"not yet assigned"},"trixie":{"status":"resolved","repositories":{"trixie":"143.0.7499.169-1~deb13u1","trixie-security":"145.0.7632.159-1~deb13u1"},"fixed_version":"114.0.5735.133-1","urgency":"not yet assigned"}}},"CVE-2023-3215":{"description":"Use after free in WebRTC in Google Chrome prior to 114.0.5735.133 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. (Chromium security severity: High)","scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"143.0.7499.169-1~deb12u1","bookworm-security":"145.0.7632.159-1~deb12u1"},"fixed_version":"114.0.5735.133-1~deb12u1","urgency":"not yet assigned"},"bullseye":{"status":"resolved","repositories":{"bullseye":"120.0.6099.224-1~deb11u1","bullseye-security":"120.0.6099.224-1~deb11u1"},"fixed_version":"114.0.5735.133-1~deb11u1","urgency":"not yet assigned"},"forky":{"status":"resolved","repositories":{"forky":"145.0.7632.159-1"},"fixed_version":"114.0.5735.133-1","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"146.0.7680.71-1"},"fixed_version":"114.0.5735.133-1","urgency":"not yet assigned"},"trixie":{"status":"resolved","repositories":{"trixie":"143.0.7499.169-1~deb13u1","trixie-security":"145.0.7632.159-1~deb13u1"},"fixed_version":"114.0.5735.133-1","urgency":"not yet assigned"}}},"CVE-2023-3216":{"description":"Type confusion in V8 in Google Chrome prior to 114.0.5735.133 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. (Chromium security severity: High)","scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"143.0.7499.169-1~deb12u1","bookworm-security":"145.0.7632.159-1~deb12u1"},"fixed_version":"114.0.5735.133-1~deb12u1","urgency":"not yet assigned"},"bullseye":{"status":"resolved","repositories":{"bullseye":"120.0.6099.224-1~deb11u1","bullseye-security":"120.0.6099.224-1~deb11u1"},"fixed_version":"114.0.5735.133-1~deb11u1","urgency":"not yet assigned"},"forky":{"status":"resolved","repositories":{"forky":"145.0.7632.159-1"},"fixed_version":"114.0.5735.133-1","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"146.0.7680.71-1"},"fixed_version":"114.0.5735.133-1","urgency":"not yet assigned"},"trixie":{"status":"resolved","repositories":{"trixie":"143.0.7499.169-1~deb13u1","trixie-security":"145.0.7632.159-1~deb13u1"},"fixed_version":"114.0.5735.133-1","urgency":"not yet assigned"}}},"CVE-2023-3217":{"description":"Use after free in WebXR in Google Chrome prior to 114.0.5735.133 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. (Chromium security severity: High)","scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"143.0.7499.169-1~deb12u1","bookworm-security":"145.0.7632.159-1~deb12u1"},"fixed_version":"114.0.5735.133-1~deb12u1","urgency":"not yet assigned"},"bullseye":{"status":"resolved","repositories":{"bullseye":"120.0.6099.224-1~deb11u1","bullseye-security":"120.0.6099.224-1~deb11u1"},"fixed_version":"114.0.5735.133-1~deb11u1","urgency":"not yet assigned"},"forky":{"status":"resolved","repositories":{"forky":"145.0.7632.159-1"},"fixed_version":"114.0.5735.133-1","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"146.0.7680.71-1"},"fixed_version":"114.0.5735.133-1","urgency":"not yet assigned"},"trixie":{"status":"resolved","repositories":{"trixie":"143.0.7499.169-1~deb13u1","trixie-security":"145.0.7632.159-1~deb13u1"},"fixed_version":"114.0.5735.133-1","urgency":"not yet assigned"}}},"CVE-2023-3420":{"description":"Type Confusion in V8 in Google Chrome prior to 114.0.5735.198 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. (Chromium security severity: High)","scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"143.0.7499.169-1~deb12u1","bookworm-security":"145.0.7632.159-1~deb12u1"},"fixed_version":"114.0.5735.198-1~deb12u1","urgency":"not yet assigned"},"bullseye":{"status":"resolved","repositories":{"bullseye":"120.0.6099.224-1~deb11u1","bullseye-security":"120.0.6099.224-1~deb11u1"},"fixed_version":"114.0.5735.198-1~deb11u1","urgency":"not yet assigned"},"forky":{"status":"resolved","repositories":{"forky":"145.0.7632.159-1"},"fixed_version":"114.0.5735.198-1","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"146.0.7680.71-1"},"fixed_version":"114.0.5735.198-1","urgency":"not yet assigned"},"trixie":{"status":"resolved","repositories":{"trixie":"143.0.7499.169-1~deb13u1","trixie-security":"145.0.7632.159-1~deb13u1"},"fixed_version":"114.0.5735.198-1","urgency":"not yet assigned"}}},"CVE-2023-3421":{"description":"Use after free in Media in Google Chrome prior to 114.0.5735.198 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. (Chromium security severity: High)","scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"143.0.7499.169-1~deb12u1","bookworm-security":"145.0.7632.159-1~deb12u1"},"fixed_version":"114.0.5735.198-1~deb12u1","urgency":"not yet assigned"},"bullseye":{"status":"resolved","repositories":{"bullseye":"120.0.6099.224-1~deb11u1","bullseye-security":"120.0.6099.224-1~deb11u1"},"fixed_version":"114.0.5735.198-1~deb11u1","urgency":"not yet assigned"},"forky":{"status":"resolved","repositories":{"forky":"145.0.7632.159-1"},"fixed_version":"114.0.5735.198-1","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"146.0.7680.71-1"},"fixed_version":"114.0.5735.198-1","urgency":"not yet assigned"},"trixie":{"status":"resolved","repositories":{"trixie":"143.0.7499.169-1~deb13u1","trixie-security":"145.0.7632.159-1~deb13u1"},"fixed_version":"114.0.5735.198-1","urgency":"not yet assigned"}}},"CVE-2023-3422":{"description":"Use after free in Guest View in Google Chrome prior to 114.0.5735.198 allowed an attacker who convinced a user to install a malicious extension to potentially exploit heap corruption via a crafted HTML page. (Chromium security severity: High)","scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"143.0.7499.169-1~deb12u1","bookworm-security":"145.0.7632.159-1~deb12u1"},"fixed_version":"114.0.5735.198-1~deb12u1","urgency":"not yet assigned"},"bullseye":{"status":"resolved","repositories":{"bullseye":"120.0.6099.224-1~deb11u1","bullseye-security":"120.0.6099.224-1~deb11u1"},"fixed_version":"114.0.5735.198-1~deb11u1","urgency":"not yet assigned"},"forky":{"status":"resolved","repositories":{"forky":"145.0.7632.159-1"},"fixed_version":"114.0.5735.198-1","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"146.0.7680.71-1"},"fixed_version":"114.0.5735.198-1","urgency":"not yet assigned"},"trixie":{"status":"resolved","repositories":{"trixie":"143.0.7499.169-1~deb13u1","trixie-security":"145.0.7632.159-1~deb13u1"},"fixed_version":"114.0.5735.198-1","urgency":"not yet assigned"}}},"CVE-2023-3598":{"description":"Out of bounds read and write in ANGLE in Google Chrome prior to 114.0.5735.90 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. (Chromium security severity: High)","scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"143.0.7499.169-1~deb12u1","bookworm-security":"145.0.7632.159-1~deb12u1"},"fixed_version":"114.0.5735.90-2~deb12u1","urgency":"not yet assigned"},"bullseye":{"status":"resolved","repositories":{"bullseye":"120.0.6099.224-1~deb11u1","bullseye-security":"120.0.6099.224-1~deb11u1"},"fixed_version":"114.0.5735.90-2~deb11u1","urgency":"not yet assigned"},"forky":{"status":"resolved","repositories":{"forky":"145.0.7632.159-1"},"fixed_version":"114.0.5735.90-1","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"146.0.7680.71-1"},"fixed_version":"114.0.5735.90-1","urgency":"not yet assigned"},"trixie":{"status":"resolved","repositories":{"trixie":"143.0.7499.169-1~deb13u1","trixie-security":"145.0.7632.159-1~deb13u1"},"fixed_version":"114.0.5735.90-1","urgency":"not yet assigned"}}},"CVE-2023-3727":{"description":"Use after free in WebRTC in Google Chrome prior to 115.0.5790.98 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. (Chromium security severity: High)","scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"143.0.7499.169-1~deb12u1","bookworm-security":"145.0.7632.159-1~deb12u1"},"fixed_version":"115.0.5790.98-1~deb12u1","urgency":"not yet assigned"},"bullseye":{"status":"resolved","repositories":{"bullseye":"120.0.6099.224-1~deb11u1","bullseye-security":"120.0.6099.224-1~deb11u1"},"fixed_version":"115.0.5790.98-1~deb11u1","urgency":"not yet assigned"},"forky":{"status":"resolved","repositories":{"forky":"145.0.7632.159-1"},"fixed_version":"115.0.5790.98-1","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"146.0.7680.71-1"},"fixed_version":"115.0.5790.98-1","urgency":"not yet assigned"},"trixie":{"status":"resolved","repositories":{"trixie":"143.0.7499.169-1~deb13u1","trixie-security":"145.0.7632.159-1~deb13u1"},"fixed_version":"115.0.5790.98-1","urgency":"not yet assigned"}}},"CVE-2023-3728":{"description":"Use after free in WebRTC in Google Chrome prior to 115.0.5790.98 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. (Chromium security severity: High)","scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"143.0.7499.169-1~deb12u1","bookworm-security":"145.0.7632.159-1~deb12u1"},"fixed_version":"115.0.5790.98-1~deb12u1","urgency":"not yet assigned"},"bullseye":{"status":"resolved","repositories":{"bullseye":"120.0.6099.224-1~deb11u1","bullseye-security":"120.0.6099.224-1~deb11u1"},"fixed_version":"115.0.5790.98-1~deb11u1","urgency":"not yet assigned"},"forky":{"status":"resolved","repositories":{"forky":"145.0.7632.159-1"},"fixed_version":"115.0.5790.98-1","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"146.0.7680.71-1"},"fixed_version":"115.0.5790.98-1","urgency":"not yet assigned"},"trixie":{"status":"resolved","repositories":{"trixie":"143.0.7499.169-1~deb13u1","trixie-security":"145.0.7632.159-1~deb13u1"},"fixed_version":"115.0.5790.98-1","urgency":"not yet assigned"}}},"CVE-2023-3730":{"description":"Use after free in Tab Groups in Google Chrome prior to 115.0.5790.98 allowed a remote attacker who convinced a user to engage in specific UI interactions to potentially exploit heap corruption via a crafted HTML page. (Chromium security severity: High)","scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"143.0.7499.169-1~deb12u1","bookworm-security":"145.0.7632.159-1~deb12u1"},"fixed_version":"115.0.5790.98-1~deb12u1","urgency":"not yet assigned"},"bullseye":{"status":"resolved","repositories":{"bullseye":"120.0.6099.224-1~deb11u1","bullseye-security":"120.0.6099.224-1~deb11u1"},"fixed_version":"115.0.5790.98-1~deb11u1","urgency":"not yet assigned"},"forky":{"status":"resolved","repositories":{"forky":"145.0.7632.159-1"},"fixed_version":"115.0.5790.98-1","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"146.0.7680.71-1"},"fixed_version":"115.0.5790.98-1","urgency":"not yet assigned"},"trixie":{"status":"resolved","repositories":{"trixie":"143.0.7499.169-1~deb13u1","trixie-security":"145.0.7632.159-1~deb13u1"},"fixed_version":"115.0.5790.98-1","urgency":"not yet assigned"}}},"CVE-2023-3732":{"description":"Out of bounds memory access in Mojo in Google Chrome prior to 115.0.5790.98 allowed a remote attacker who had compromised the renderer process to potentially exploit heap corruption via a crafted HTML page. (Chromium security severity: High)","scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"143.0.7499.169-1~deb12u1","bookworm-security":"145.0.7632.159-1~deb12u1"},"fixed_version":"115.0.5790.98-1~deb12u1","urgency":"not yet assigned"},"bullseye":{"status":"resolved","repositories":{"bullseye":"120.0.6099.224-1~deb11u1","bullseye-security":"120.0.6099.224-1~deb11u1"},"fixed_version":"115.0.5790.98-1~deb11u1","urgency":"not yet assigned"},"forky":{"status":"resolved","repositories":{"forky":"145.0.7632.159-1"},"fixed_version":"115.0.5790.98-1","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"146.0.7680.71-1"},"fixed_version":"115.0.5790.98-1","urgency":"not yet assigned"},"trixie":{"status":"resolved","repositories":{"trixie":"143.0.7499.169-1~deb13u1","trixie-security":"145.0.7632.159-1~deb13u1"},"fixed_version":"115.0.5790.98-1","urgency":"not yet assigned"}}},"CVE-2023-3733":{"description":"Inappropriate implementation in WebApp Installs in Google Chrome prior to 115.0.5790.98 allowed a remote attacker to potentially spoof the contents of the Omnibox (URL bar) via a crafted HTML page. (Chromium security severity: Medium)","scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"143.0.7499.169-1~deb12u1","bookworm-security":"145.0.7632.159-1~deb12u1"},"fixed_version":"115.0.5790.98-1~deb12u1","urgency":"not yet assigned"},"bullseye":{"status":"resolved","repositories":{"bullseye":"120.0.6099.224-1~deb11u1","bullseye-security":"120.0.6099.224-1~deb11u1"},"fixed_version":"115.0.5790.98-1~deb11u1","urgency":"not yet assigned"},"forky":{"status":"resolved","repositories":{"forky":"145.0.7632.159-1"},"fixed_version":"115.0.5790.98-1","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"146.0.7680.71-1"},"fixed_version":"115.0.5790.98-1","urgency":"not yet assigned"},"trixie":{"status":"resolved","repositories":{"trixie":"143.0.7499.169-1~deb13u1","trixie-security":"145.0.7632.159-1~deb13u1"},"fixed_version":"115.0.5790.98-1","urgency":"not yet assigned"}}},"CVE-2023-3734":{"description":"Inappropriate implementation in Picture In Picture in Google Chrome prior to 115.0.5790.98 allowed a remote attacker to potentially spoof the contents of the Omnibox (URL bar) via a crafted HTML page. (Chromium security severity: Medium)","scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"143.0.7499.169-1~deb12u1","bookworm-security":"145.0.7632.159-1~deb12u1"},"fixed_version":"115.0.5790.98-1~deb12u1","urgency":"not yet assigned"},"bullseye":{"status":"resolved","repositories":{"bullseye":"120.0.6099.224-1~deb11u1","bullseye-security":"120.0.6099.224-1~deb11u1"},"fixed_version":"115.0.5790.98-1~deb11u1","urgency":"not yet assigned"},"forky":{"status":"resolved","repositories":{"forky":"145.0.7632.159-1"},"fixed_version":"115.0.5790.98-1","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"146.0.7680.71-1"},"fixed_version":"115.0.5790.98-1","urgency":"not yet assigned"},"trixie":{"status":"resolved","repositories":{"trixie":"143.0.7499.169-1~deb13u1","trixie-security":"145.0.7632.159-1~deb13u1"},"fixed_version":"115.0.5790.98-1","urgency":"not yet assigned"}}},"CVE-2023-3735":{"description":"Inappropriate implementation in Web API Permission Prompts in Google Chrome prior to 115.0.5790.98 allowed a remote attacker to obfuscate security UI via a crafted HTML page. (Chromium security severity: Medium)","scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"143.0.7499.169-1~deb12u1","bookworm-security":"145.0.7632.159-1~deb12u1"},"fixed_version":"115.0.5790.98-1~deb12u1","urgency":"not yet assigned"},"bullseye":{"status":"resolved","repositories":{"bullseye":"120.0.6099.224-1~deb11u1","bullseye-security":"120.0.6099.224-1~deb11u1"},"fixed_version":"115.0.5790.98-1~deb11u1","urgency":"not yet assigned"},"forky":{"status":"resolved","repositories":{"forky":"145.0.7632.159-1"},"fixed_version":"115.0.5790.98-1","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"146.0.7680.71-1"},"fixed_version":"115.0.5790.98-1","urgency":"not yet assigned"},"trixie":{"status":"resolved","repositories":{"trixie":"143.0.7499.169-1~deb13u1","trixie-security":"145.0.7632.159-1~deb13u1"},"fixed_version":"115.0.5790.98-1","urgency":"not yet assigned"}}},"CVE-2023-3736":{"description":"Inappropriate implementation in Custom Tabs in Google Chrome on Android prior to 115.0.5790.98 allowed a remote attacker to leak cross-origin data via a crafted HTML page. (Chromium security severity: Medium)","scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"143.0.7499.169-1~deb12u1","bookworm-security":"145.0.7632.159-1~deb12u1"},"fixed_version":"115.0.5790.98-1~deb12u1","urgency":"not yet assigned"},"bullseye":{"status":"resolved","repositories":{"bullseye":"120.0.6099.224-1~deb11u1","bullseye-security":"120.0.6099.224-1~deb11u1"},"fixed_version":"115.0.5790.98-1~deb11u1","urgency":"not yet assigned"},"forky":{"status":"resolved","repositories":{"forky":"145.0.7632.159-1"},"fixed_version":"115.0.5790.98-1","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"146.0.7680.71-1"},"fixed_version":"115.0.5790.98-1","urgency":"not yet assigned"},"trixie":{"status":"resolved","repositories":{"trixie":"143.0.7499.169-1~deb13u1","trixie-security":"145.0.7632.159-1~deb13u1"},"fixed_version":"115.0.5790.98-1","urgency":"not yet assigned"}}},"CVE-2023-3737":{"description":"Inappropriate implementation in Notifications in Google Chrome prior to 115.0.5790.98 allowed a remote attacker to spoof the contents of media notifications via a crafted HTML page. (Chromium security severity: Medium)","scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"143.0.7499.169-1~deb12u1","bookworm-security":"145.0.7632.159-1~deb12u1"},"fixed_version":"115.0.5790.98-1~deb12u1","urgency":"not yet assigned"},"bullseye":{"status":"resolved","repositories":{"bullseye":"120.0.6099.224-1~deb11u1","bullseye-security":"120.0.6099.224-1~deb11u1"},"fixed_version":"115.0.5790.98-1~deb11u1","urgency":"not yet assigned"},"forky":{"status":"resolved","repositories":{"forky":"145.0.7632.159-1"},"fixed_version":"115.0.5790.98-1","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"146.0.7680.71-1"},"fixed_version":"115.0.5790.98-1","urgency":"not yet assigned"},"trixie":{"status":"resolved","repositories":{"trixie":"143.0.7499.169-1~deb13u1","trixie-security":"145.0.7632.159-1~deb13u1"},"fixed_version":"115.0.5790.98-1","urgency":"not yet assigned"}}},"CVE-2023-3738":{"description":"Inappropriate implementation in Autofill in Google Chrome prior to 115.0.5790.98 allowed a remote attacker to obfuscate security UI via a crafted HTML page. (Chromium security severity: Medium)","scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"143.0.7499.169-1~deb12u1","bookworm-security":"145.0.7632.159-1~deb12u1"},"fixed_version":"115.0.5790.98-1~deb12u1","urgency":"not yet assigned"},"bullseye":{"status":"resolved","repositories":{"bullseye":"120.0.6099.224-1~deb11u1","bullseye-security":"120.0.6099.224-1~deb11u1"},"fixed_version":"115.0.5790.98-1~deb11u1","urgency":"not yet assigned"},"forky":{"status":"resolved","repositories":{"forky":"145.0.7632.159-1"},"fixed_version":"115.0.5790.98-1","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"146.0.7680.71-1"},"fixed_version":"115.0.5790.98-1","urgency":"not yet assigned"},"trixie":{"status":"resolved","repositories":{"trixie":"143.0.7499.169-1~deb13u1","trixie-security":"145.0.7632.159-1~deb13u1"},"fixed_version":"115.0.5790.98-1","urgency":"not yet assigned"}}},"CVE-2023-3739":{"description":"Insufficient validation of untrusted input in Chromad in Google Chrome on ChromeOS prior to 115.0.5790.131 allowed a remote attacker to execute arbitrary code via a crafted shell script. (Chromium security severity: Low)","scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"143.0.7499.169-1~deb12u1","bookworm-security":"145.0.7632.159-1~deb12u1"},"fixed_version":"115.0.5790.98-1~deb12u1","urgency":"not yet assigned"},"bullseye":{"status":"resolved","repositories":{"bullseye":"120.0.6099.224-1~deb11u1","bullseye-security":"120.0.6099.224-1~deb11u1"},"fixed_version":"115.0.5790.98-1~deb11u1","urgency":"not yet assigned"},"forky":{"status":"resolved","repositories":{"forky":"145.0.7632.159-1"},"fixed_version":"115.0.5790.98-1","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"146.0.7680.71-1"},"fixed_version":"115.0.5790.98-1","urgency":"not yet assigned"},"trixie":{"status":"resolved","repositories":{"trixie":"143.0.7499.169-1~deb13u1","trixie-security":"145.0.7632.159-1~deb13u1"},"fixed_version":"115.0.5790.98-1","urgency":"not yet assigned"}}},"CVE-2023-3740":{"description":"Insufficient validation of untrusted input in Themes in Google Chrome prior to 115.0.5790.98 allowed a remote attacker to potentially serve malicious content to a user via a crafted background URL. (Chromium security severity: Low)","scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"143.0.7499.169-1~deb12u1","bookworm-security":"145.0.7632.159-1~deb12u1"},"fixed_version":"115.0.5790.98-1~deb12u1","urgency":"not yet assigned"},"bullseye":{"status":"resolved","repositories":{"bullseye":"120.0.6099.224-1~deb11u1","bullseye-security":"120.0.6099.224-1~deb11u1"},"fixed_version":"115.0.5790.98-1~deb11u1","urgency":"not yet assigned"},"forky":{"status":"resolved","repositories":{"forky":"145.0.7632.159-1"},"fixed_version":"115.0.5790.98-1","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"146.0.7680.71-1"},"fixed_version":"115.0.5790.98-1","urgency":"not yet assigned"},"trixie":{"status":"resolved","repositories":{"trixie":"143.0.7499.169-1~deb13u1","trixie-security":"145.0.7632.159-1~deb13u1"},"fixed_version":"115.0.5790.98-1","urgency":"not yet assigned"}}},"CVE-2023-4068":{"description":"Type Confusion in V8 in Google Chrome prior to 115.0.5790.170 allowed a remote attacker to perform arbitrary read/write via a crafted HTML page. (Chromium security severity: High)","scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"143.0.7499.169-1~deb12u1","bookworm-security":"145.0.7632.159-1~deb12u1"},"fixed_version":"115.0.5790.170-1~deb12u1","urgency":"not yet assigned"},"bullseye":{"status":"resolved","repositories":{"bullseye":"120.0.6099.224-1~deb11u1","bullseye-security":"120.0.6099.224-1~deb11u1"},"fixed_version":"115.0.5790.170-1~deb11u1","urgency":"not yet assigned"},"forky":{"status":"resolved","repositories":{"forky":"145.0.7632.159-1"},"fixed_version":"115.0.5790.170-1","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"146.0.7680.71-1"},"fixed_version":"115.0.5790.170-1","urgency":"not yet assigned"},"trixie":{"status":"resolved","repositories":{"trixie":"143.0.7499.169-1~deb13u1","trixie-security":"145.0.7632.159-1~deb13u1"},"fixed_version":"115.0.5790.170-1","urgency":"not yet assigned"}}},"CVE-2023-4069":{"description":"Type Confusion in V8 in Google Chrome prior to 115.0.5790.170 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. (Chromium security severity: High)","scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"143.0.7499.169-1~deb12u1","bookworm-security":"145.0.7632.159-1~deb12u1"},"fixed_version":"115.0.5790.170-1~deb12u1","urgency":"not yet assigned"},"bullseye":{"status":"resolved","repositories":{"bullseye":"120.0.6099.224-1~deb11u1","bullseye-security":"120.0.6099.224-1~deb11u1"},"fixed_version":"115.0.5790.170-1~deb11u1","urgency":"not yet assigned"},"forky":{"status":"resolved","repositories":{"forky":"145.0.7632.159-1"},"fixed_version":"115.0.5790.170-1","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"146.0.7680.71-1"},"fixed_version":"115.0.5790.170-1","urgency":"not yet assigned"},"trixie":{"status":"resolved","repositories":{"trixie":"143.0.7499.169-1~deb13u1","trixie-security":"145.0.7632.159-1~deb13u1"},"fixed_version":"115.0.5790.170-1","urgency":"not yet assigned"}}},"CVE-2023-4070":{"description":"Type Confusion in V8 in Google Chrome prior to 115.0.5790.170 allowed a remote attacker to perform arbitrary read/write via a crafted HTML page. (Chromium security severity: High)","scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"143.0.7499.169-1~deb12u1","bookworm-security":"145.0.7632.159-1~deb12u1"},"fixed_version":"115.0.5790.170-1~deb12u1","urgency":"not yet assigned"},"bullseye":{"status":"resolved","repositories":{"bullseye":"120.0.6099.224-1~deb11u1","bullseye-security":"120.0.6099.224-1~deb11u1"},"fixed_version":"115.0.5790.170-1~deb11u1","urgency":"not yet assigned"},"forky":{"status":"resolved","repositories":{"forky":"145.0.7632.159-1"},"fixed_version":"115.0.5790.170-1","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"146.0.7680.71-1"},"fixed_version":"115.0.5790.170-1","urgency":"not yet assigned"},"trixie":{"status":"resolved","repositories":{"trixie":"143.0.7499.169-1~deb13u1","trixie-security":"145.0.7632.159-1~deb13u1"},"fixed_version":"115.0.5790.170-1","urgency":"not yet assigned"}}},"CVE-2023-4071":{"description":"Heap buffer overflow in Visuals in Google Chrome prior to 115.0.5790.170 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. (Chromium security severity: High)","scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"143.0.7499.169-1~deb12u1","bookworm-security":"145.0.7632.159-1~deb12u1"},"fixed_version":"115.0.5790.170-1~deb12u1","urgency":"not yet assigned"},"bullseye":{"status":"resolved","repositories":{"bullseye":"120.0.6099.224-1~deb11u1","bullseye-security":"120.0.6099.224-1~deb11u1"},"fixed_version":"115.0.5790.170-1~deb11u1","urgency":"not yet assigned"},"forky":{"status":"resolved","repositories":{"forky":"145.0.7632.159-1"},"fixed_version":"115.0.5790.170-1","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"146.0.7680.71-1"},"fixed_version":"115.0.5790.170-1","urgency":"not yet assigned"},"trixie":{"status":"resolved","repositories":{"trixie":"143.0.7499.169-1~deb13u1","trixie-security":"145.0.7632.159-1~deb13u1"},"fixed_version":"115.0.5790.170-1","urgency":"not yet assigned"}}},"CVE-2023-4072":{"description":"Out of bounds read and write in WebGL in Google Chrome prior to 115.0.5790.170 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. (Chromium security severity: High)","scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"143.0.7499.169-1~deb12u1","bookworm-security":"145.0.7632.159-1~deb12u1"},"fixed_version":"115.0.5790.170-1~deb12u1","urgency":"not yet assigned"},"bullseye":{"status":"resolved","repositories":{"bullseye":"120.0.6099.224-1~deb11u1","bullseye-security":"120.0.6099.224-1~deb11u1"},"fixed_version":"115.0.5790.170-1~deb11u1","urgency":"not yet assigned"},"forky":{"status":"resolved","repositories":{"forky":"145.0.7632.159-1"},"fixed_version":"115.0.5790.170-1","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"146.0.7680.71-1"},"fixed_version":"115.0.5790.170-1","urgency":"not yet assigned"},"trixie":{"status":"resolved","repositories":{"trixie":"143.0.7499.169-1~deb13u1","trixie-security":"145.0.7632.159-1~deb13u1"},"fixed_version":"115.0.5790.170-1","urgency":"not yet assigned"}}},"CVE-2023-4073":{"description":"Out of bounds memory access in ANGLE in Google Chrome on Mac prior to 115.0.5790.170 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. (Chromium security severity: High)","scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"143.0.7499.169-1~deb12u1","bookworm-security":"145.0.7632.159-1~deb12u1"},"fixed_version":"115.0.5790.170-1~deb12u1","urgency":"not yet assigned"},"bullseye":{"status":"resolved","repositories":{"bullseye":"120.0.6099.224-1~deb11u1","bullseye-security":"120.0.6099.224-1~deb11u1"},"fixed_version":"115.0.5790.170-1~deb11u1","urgency":"not yet assigned"},"forky":{"status":"resolved","repositories":{"forky":"145.0.7632.159-1"},"fixed_version":"115.0.5790.170-1","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"146.0.7680.71-1"},"fixed_version":"115.0.5790.170-1","urgency":"not yet assigned"},"trixie":{"status":"resolved","repositories":{"trixie":"143.0.7499.169-1~deb13u1","trixie-security":"145.0.7632.159-1~deb13u1"},"fixed_version":"115.0.5790.170-1","urgency":"not yet assigned"}}},"CVE-2023-4074":{"description":"Use after free in Blink Task Scheduling in Google Chrome prior to 115.0.5790.170 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. (Chromium security severity: High)","scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"143.0.7499.169-1~deb12u1","bookworm-security":"145.0.7632.159-1~deb12u1"},"fixed_version":"115.0.5790.170-1~deb12u1","urgency":"not yet assigned"},"bullseye":{"status":"resolved","repositories":{"bullseye":"120.0.6099.224-1~deb11u1","bullseye-security":"120.0.6099.224-1~deb11u1"},"fixed_version":"115.0.5790.170-1~deb11u1","urgency":"not yet assigned"},"forky":{"status":"resolved","repositories":{"forky":"145.0.7632.159-1"},"fixed_version":"115.0.5790.170-1","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"146.0.7680.71-1"},"fixed_version":"115.0.5790.170-1","urgency":"not yet assigned"},"trixie":{"status":"resolved","repositories":{"trixie":"143.0.7499.169-1~deb13u1","trixie-security":"145.0.7632.159-1~deb13u1"},"fixed_version":"115.0.5790.170-1","urgency":"not yet assigned"}}},"CVE-2023-4075":{"description":"Use after free in Cast in Google Chrome prior to 115.0.5790.170 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. (Chromium security severity: High)","scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"143.0.7499.169-1~deb12u1","bookworm-security":"145.0.7632.159-1~deb12u1"},"fixed_version":"115.0.5790.170-1~deb12u1","urgency":"not yet assigned"},"bullseye":{"status":"resolved","repositories":{"bullseye":"120.0.6099.224-1~deb11u1","bullseye-security":"120.0.6099.224-1~deb11u1"},"fixed_version":"115.0.5790.170-1~deb11u1","urgency":"not yet assigned"},"forky":{"status":"resolved","repositories":{"forky":"145.0.7632.159-1"},"fixed_version":"115.0.5790.170-1","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"146.0.7680.71-1"},"fixed_version":"115.0.5790.170-1","urgency":"not yet assigned"},"trixie":{"status":"resolved","repositories":{"trixie":"143.0.7499.169-1~deb13u1","trixie-security":"145.0.7632.159-1~deb13u1"},"fixed_version":"115.0.5790.170-1","urgency":"not yet assigned"}}},"CVE-2023-4076":{"description":"Use after free in WebRTC in Google Chrome prior to 115.0.5790.170 allowed a remote attacker to potentially exploit heap corruption via a crafted WebRTC session. (Chromium security severity: High)","scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"143.0.7499.169-1~deb12u1","bookworm-security":"145.0.7632.159-1~deb12u1"},"fixed_version":"115.0.5790.170-1~deb12u1","urgency":"not yet assigned"},"bullseye":{"status":"resolved","repositories":{"bullseye":"120.0.6099.224-1~deb11u1","bullseye-security":"120.0.6099.224-1~deb11u1"},"fixed_version":"115.0.5790.170-1~deb11u1","urgency":"not yet assigned"},"forky":{"status":"resolved","repositories":{"forky":"145.0.7632.159-1"},"fixed_version":"115.0.5790.170-1","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"146.0.7680.71-1"},"fixed_version":"115.0.5790.170-1","urgency":"not yet assigned"},"trixie":{"status":"resolved","repositories":{"trixie":"143.0.7499.169-1~deb13u1","trixie-security":"145.0.7632.159-1~deb13u1"},"fixed_version":"115.0.5790.170-1","urgency":"not yet assigned"}}},"CVE-2023-4077":{"description":"Insufficient data validation in Extensions in Google Chrome prior to 115.0.5790.170 allowed an attacker who convinced a user to install a malicious extension to inject scripts or HTML into a privileged page via a crafted Chrome Extension. (Chromium security severity: Medium)","scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"143.0.7499.169-1~deb12u1","bookworm-security":"145.0.7632.159-1~deb12u1"},"fixed_version":"115.0.5790.170-1~deb12u1","urgency":"not yet assigned"},"bullseye":{"status":"resolved","repositories":{"bullseye":"120.0.6099.224-1~deb11u1","bullseye-security":"120.0.6099.224-1~deb11u1"},"fixed_version":"115.0.5790.170-1~deb11u1","urgency":"not yet assigned"},"forky":{"status":"resolved","repositories":{"forky":"145.0.7632.159-1"},"fixed_version":"115.0.5790.170-1","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"146.0.7680.71-1"},"fixed_version":"115.0.5790.170-1","urgency":"not yet assigned"},"trixie":{"status":"resolved","repositories":{"trixie":"143.0.7499.169-1~deb13u1","trixie-security":"145.0.7632.159-1~deb13u1"},"fixed_version":"115.0.5790.170-1","urgency":"not yet assigned"}}},"CVE-2023-4078":{"description":"Inappropriate implementation in Extensions in Google Chrome prior to 115.0.5790.170 allowed an attacker who convinced a user to install a malicious extension to inject scripts or HTML into a privileged page via a crafted Chrome Extension. (Chromium security severity: Medium)","scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"143.0.7499.169-1~deb12u1","bookworm-security":"145.0.7632.159-1~deb12u1"},"fixed_version":"115.0.5790.170-1~deb12u1","urgency":"not yet assigned"},"bullseye":{"status":"resolved","repositories":{"bullseye":"120.0.6099.224-1~deb11u1","bullseye-security":"120.0.6099.224-1~deb11u1"},"fixed_version":"115.0.5790.170-1~deb11u1","urgency":"not yet assigned"},"forky":{"status":"resolved","repositories":{"forky":"145.0.7632.159-1"},"fixed_version":"115.0.5790.170-1","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"146.0.7680.71-1"},"fixed_version":"115.0.5790.170-1","urgency":"not yet assigned"},"trixie":{"status":"resolved","repositories":{"trixie":"143.0.7499.169-1~deb13u1","trixie-security":"145.0.7632.159-1~deb13u1"},"fixed_version":"115.0.5790.170-1","urgency":"not yet assigned"}}},"CVE-2023-4349":{"description":"Use after free in Device Trust Connectors in Google Chrome prior to 116.0.5845.96 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. (Chromium security severity: High)","scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"143.0.7499.169-1~deb12u1","bookworm-security":"145.0.7632.159-1~deb12u1"},"fixed_version":"116.0.5845.96-1~deb12u1","urgency":"not yet assigned"},"bullseye":{"status":"resolved","repositories":{"bullseye":"120.0.6099.224-1~deb11u1","bullseye-security":"120.0.6099.224-1~deb11u1"},"fixed_version":"116.0.5845.96-1~deb11u1","urgency":"not yet assigned"},"forky":{"status":"resolved","repositories":{"forky":"145.0.7632.159-1"},"fixed_version":"116.0.5845.96-1","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"146.0.7680.71-1"},"fixed_version":"116.0.5845.96-1","urgency":"not yet assigned"},"trixie":{"status":"resolved","repositories":{"trixie":"143.0.7499.169-1~deb13u1","trixie-security":"145.0.7632.159-1~deb13u1"},"fixed_version":"116.0.5845.96-1","urgency":"not yet assigned"}}},"CVE-2023-4350":{"description":"Inappropriate implementation in Fullscreen in Google Chrome on Android prior to 116.0.5845.96 allowed a remote attacker to potentially spoof the contents of the Omnibox (URL bar) via a crafted HTML page. (Chromium security severity: High)","scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"143.0.7499.169-1~deb12u1","bookworm-security":"145.0.7632.159-1~deb12u1"},"fixed_version":"116.0.5845.96-1~deb12u1","urgency":"not yet assigned"},"bullseye":{"status":"resolved","repositories":{"bullseye":"120.0.6099.224-1~deb11u1","bullseye-security":"120.0.6099.224-1~deb11u1"},"fixed_version":"116.0.5845.96-1~deb11u1","urgency":"not yet assigned"},"forky":{"status":"resolved","repositories":{"forky":"145.0.7632.159-1"},"fixed_version":"116.0.5845.96-1","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"146.0.7680.71-1"},"fixed_version":"116.0.5845.96-1","urgency":"not yet assigned"},"trixie":{"status":"resolved","repositories":{"trixie":"143.0.7499.169-1~deb13u1","trixie-security":"145.0.7632.159-1~deb13u1"},"fixed_version":"116.0.5845.96-1","urgency":"not yet assigned"}}},"CVE-2023-4351":{"description":"Use after free in Network in Google Chrome prior to 116.0.5845.96 allowed a remote attacker who has elicited a browser shutdown to potentially exploit heap corruption via a crafted HTML page. (Chromium security severity: High)","scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"143.0.7499.169-1~deb12u1","bookworm-security":"145.0.7632.159-1~deb12u1"},"fixed_version":"116.0.5845.96-1~deb12u1","urgency":"not yet assigned"},"bullseye":{"status":"resolved","repositories":{"bullseye":"120.0.6099.224-1~deb11u1","bullseye-security":"120.0.6099.224-1~deb11u1"},"fixed_version":"116.0.5845.96-1~deb11u1","urgency":"not yet assigned"},"forky":{"status":"resolved","repositories":{"forky":"145.0.7632.159-1"},"fixed_version":"116.0.5845.96-1","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"146.0.7680.71-1"},"fixed_version":"116.0.5845.96-1","urgency":"not yet assigned"},"trixie":{"status":"resolved","repositories":{"trixie":"143.0.7499.169-1~deb13u1","trixie-security":"145.0.7632.159-1~deb13u1"},"fixed_version":"116.0.5845.96-1","urgency":"not yet assigned"}}},"CVE-2023-4352":{"description":"Type confusion in V8 in Google Chrome prior to 116.0.5845.96 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. (Chromium security severity: High)","scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"143.0.7499.169-1~deb12u1","bookworm-security":"145.0.7632.159-1~deb12u1"},"fixed_version":"116.0.5845.96-1~deb12u1","urgency":"not yet assigned"},"bullseye":{"status":"resolved","repositories":{"bullseye":"120.0.6099.224-1~deb11u1","bullseye-security":"120.0.6099.224-1~deb11u1"},"fixed_version":"116.0.5845.96-1~deb11u1","urgency":"not yet assigned"},"forky":{"status":"resolved","repositories":{"forky":"145.0.7632.159-1"},"fixed_version":"116.0.5845.96-1","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"146.0.7680.71-1"},"fixed_version":"116.0.5845.96-1","urgency":"not yet assigned"},"trixie":{"status":"resolved","repositories":{"trixie":"143.0.7499.169-1~deb13u1","trixie-security":"145.0.7632.159-1~deb13u1"},"fixed_version":"116.0.5845.96-1","urgency":"not yet assigned"}}},"CVE-2023-4353":{"description":"Heap buffer overflow in ANGLE in Google Chrome prior to 116.0.5845.96 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. (Chromium security severity: High)","scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"143.0.7499.169-1~deb12u1","bookworm-security":"145.0.7632.159-1~deb12u1"},"fixed_version":"116.0.5845.96-1~deb12u1","urgency":"not yet assigned"},"bullseye":{"status":"resolved","repositories":{"bullseye":"120.0.6099.224-1~deb11u1","bullseye-security":"120.0.6099.224-1~deb11u1"},"fixed_version":"116.0.5845.96-1~deb11u1","urgency":"not yet assigned"},"forky":{"status":"resolved","repositories":{"forky":"145.0.7632.159-1"},"fixed_version":"116.0.5845.96-1","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"146.0.7680.71-1"},"fixed_version":"116.0.5845.96-1","urgency":"not yet assigned"},"trixie":{"status":"resolved","repositories":{"trixie":"143.0.7499.169-1~deb13u1","trixie-security":"145.0.7632.159-1~deb13u1"},"fixed_version":"116.0.5845.96-1","urgency":"not yet assigned"}}},"CVE-2023-4354":{"description":"Heap buffer overflow in Skia in Google Chrome prior to 116.0.5845.96 allowed a remote attacker who had compromised the renderer process to potentially exploit heap corruption via a crafted HTML page. (Chromium security severity: High)","scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"143.0.7499.169-1~deb12u1","bookworm-security":"145.0.7632.159-1~deb12u1"},"fixed_version":"116.0.5845.96-1~deb12u1","urgency":"not yet assigned"},"bullseye":{"status":"resolved","repositories":{"bullseye":"120.0.6099.224-1~deb11u1","bullseye-security":"120.0.6099.224-1~deb11u1"},"fixed_version":"116.0.5845.96-1~deb11u1","urgency":"not yet assigned"},"forky":{"status":"resolved","repositories":{"forky":"145.0.7632.159-1"},"fixed_version":"116.0.5845.96-1","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"146.0.7680.71-1"},"fixed_version":"116.0.5845.96-1","urgency":"not yet assigned"},"trixie":{"status":"resolved","repositories":{"trixie":"143.0.7499.169-1~deb13u1","trixie-security":"145.0.7632.159-1~deb13u1"},"fixed_version":"116.0.5845.96-1","urgency":"not yet assigned"}}},"CVE-2023-4355":{"description":"Out of bounds memory access in V8 in Google Chrome prior to 116.0.5845.96 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. (Chromium security severity: High)","scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"143.0.7499.169-1~deb12u1","bookworm-security":"145.0.7632.159-1~deb12u1"},"fixed_version":"116.0.5845.96-1~deb12u1","urgency":"not yet assigned"},"bullseye":{"status":"resolved","repositories":{"bullseye":"120.0.6099.224-1~deb11u1","bullseye-security":"120.0.6099.224-1~deb11u1"},"fixed_version":"116.0.5845.96-1~deb11u1","urgency":"not yet assigned"},"forky":{"status":"resolved","repositories":{"forky":"145.0.7632.159-1"},"fixed_version":"116.0.5845.96-1","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"146.0.7680.71-1"},"fixed_version":"116.0.5845.96-1","urgency":"not yet assigned"},"trixie":{"status":"resolved","repositories":{"trixie":"143.0.7499.169-1~deb13u1","trixie-security":"145.0.7632.159-1~deb13u1"},"fixed_version":"116.0.5845.96-1","urgency":"not yet assigned"}}},"CVE-2023-4356":{"description":"Use after free in Audio in Google Chrome prior to 116.0.5845.96 allowed a remote attacker who has convinced a user to engage in specific UI interaction to potentially exploit heap corruption via a crafted HTML page. (Chromium security severity: Medium)","scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"143.0.7499.169-1~deb12u1","bookworm-security":"145.0.7632.159-1~deb12u1"},"fixed_version":"116.0.5845.96-1~deb12u1","urgency":"not yet assigned"},"bullseye":{"status":"resolved","repositories":{"bullseye":"120.0.6099.224-1~deb11u1","bullseye-security":"120.0.6099.224-1~deb11u1"},"fixed_version":"116.0.5845.96-1~deb11u1","urgency":"not yet assigned"},"forky":{"status":"resolved","repositories":{"forky":"145.0.7632.159-1"},"fixed_version":"116.0.5845.96-1","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"146.0.7680.71-1"},"fixed_version":"116.0.5845.96-1","urgency":"not yet assigned"},"trixie":{"status":"resolved","repositories":{"trixie":"143.0.7499.169-1~deb13u1","trixie-security":"145.0.7632.159-1~deb13u1"},"fixed_version":"116.0.5845.96-1","urgency":"not yet assigned"}}},"CVE-2023-4357":{"description":"Insufficient validation of untrusted input in XML in Google Chrome prior to 116.0.5845.96 allowed a remote attacker to bypass file access restrictions via a crafted HTML page. (Chromium security severity: Medium)","scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"143.0.7499.169-1~deb12u1","bookworm-security":"145.0.7632.159-1~deb12u1"},"fixed_version":"116.0.5845.96-1~deb12u1","urgency":"not yet assigned"},"bullseye":{"status":"resolved","repositories":{"bullseye":"120.0.6099.224-1~deb11u1","bullseye-security":"120.0.6099.224-1~deb11u1"},"fixed_version":"116.0.5845.96-1~deb11u1","urgency":"not yet assigned"},"forky":{"status":"resolved","repositories":{"forky":"145.0.7632.159-1"},"fixed_version":"116.0.5845.96-1","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"146.0.7680.71-1"},"fixed_version":"116.0.5845.96-1","urgency":"not yet assigned"},"trixie":{"status":"resolved","repositories":{"trixie":"143.0.7499.169-1~deb13u1","trixie-security":"145.0.7632.159-1~deb13u1"},"fixed_version":"116.0.5845.96-1","urgency":"not yet assigned"}}},"CVE-2023-4358":{"description":"Use after free in DNS in Google Chrome prior to 116.0.5845.96 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. (Chromium security severity: Medium)","scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"143.0.7499.169-1~deb12u1","bookworm-security":"145.0.7632.159-1~deb12u1"},"fixed_version":"116.0.5845.96-1~deb12u1","urgency":"not yet assigned"},"bullseye":{"status":"resolved","repositories":{"bullseye":"120.0.6099.224-1~deb11u1","bullseye-security":"120.0.6099.224-1~deb11u1"},"fixed_version":"116.0.5845.96-1~deb11u1","urgency":"not yet assigned"},"forky":{"status":"resolved","repositories":{"forky":"145.0.7632.159-1"},"fixed_version":"116.0.5845.96-1","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"146.0.7680.71-1"},"fixed_version":"116.0.5845.96-1","urgency":"not yet assigned"},"trixie":{"status":"resolved","repositories":{"trixie":"143.0.7499.169-1~deb13u1","trixie-security":"145.0.7632.159-1~deb13u1"},"fixed_version":"116.0.5845.96-1","urgency":"not yet assigned"}}},"CVE-2023-4359":{"description":"Inappropriate implementation in App Launcher in Google Chrome on iOS prior to 116.0.5845.96 allowed a remote attacker to potentially spoof elements of the security UI via a crafted HTML page. (Chromium security severity: Medium)","scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"143.0.7499.169-1~deb12u1","bookworm-security":"145.0.7632.159-1~deb12u1"},"fixed_version":"116.0.5845.96-1~deb12u1","urgency":"not yet assigned"},"bullseye":{"status":"resolved","repositories":{"bullseye":"120.0.6099.224-1~deb11u1","bullseye-security":"120.0.6099.224-1~deb11u1"},"fixed_version":"116.0.5845.96-1~deb11u1","urgency":"not yet assigned"},"forky":{"status":"resolved","repositories":{"forky":"145.0.7632.159-1"},"fixed_version":"116.0.5845.96-1","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"146.0.7680.71-1"},"fixed_version":"116.0.5845.96-1","urgency":"not yet assigned"},"trixie":{"status":"resolved","repositories":{"trixie":"143.0.7499.169-1~deb13u1","trixie-security":"145.0.7632.159-1~deb13u1"},"fixed_version":"116.0.5845.96-1","urgency":"not yet assigned"}}},"CVE-2023-4360":{"description":"Inappropriate implementation in Color in Google Chrome prior to 116.0.5845.96 allowed a remote attacker to obfuscate security UI via a crafted HTML page. (Chromium security severity: Medium)","scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"143.0.7499.169-1~deb12u1","bookworm-security":"145.0.7632.159-1~deb12u1"},"fixed_version":"116.0.5845.96-1~deb12u1","urgency":"not yet assigned"},"bullseye":{"status":"resolved","repositories":{"bullseye":"120.0.6099.224-1~deb11u1","bullseye-security":"120.0.6099.224-1~deb11u1"},"fixed_version":"116.0.5845.96-1~deb11u1","urgency":"not yet assigned"},"forky":{"status":"resolved","repositories":{"forky":"145.0.7632.159-1"},"fixed_version":"116.0.5845.96-1","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"146.0.7680.71-1"},"fixed_version":"116.0.5845.96-1","urgency":"not yet assigned"},"trixie":{"status":"resolved","repositories":{"trixie":"143.0.7499.169-1~deb13u1","trixie-security":"145.0.7632.159-1~deb13u1"},"fixed_version":"116.0.5845.96-1","urgency":"not yet assigned"}}},"CVE-2023-4361":{"description":"Inappropriate implementation in Autofill in Google Chrome on Android prior to 116.0.5845.96 allowed a remote attacker to bypass Autofill restrictions via a crafted HTML page. (Chromium security severity: Medium)","scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"143.0.7499.169-1~deb12u1","bookworm-security":"145.0.7632.159-1~deb12u1"},"fixed_version":"116.0.5845.96-1~deb12u1","urgency":"not yet assigned"},"bullseye":{"status":"resolved","repositories":{"bullseye":"120.0.6099.224-1~deb11u1","bullseye-security":"120.0.6099.224-1~deb11u1"},"fixed_version":"116.0.5845.96-1~deb11u1","urgency":"not yet assigned"},"forky":{"status":"resolved","repositories":{"forky":"145.0.7632.159-1"},"fixed_version":"116.0.5845.96-1","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"146.0.7680.71-1"},"fixed_version":"116.0.5845.96-1","urgency":"not yet assigned"},"trixie":{"status":"resolved","repositories":{"trixie":"143.0.7499.169-1~deb13u1","trixie-security":"145.0.7632.159-1~deb13u1"},"fixed_version":"116.0.5845.96-1","urgency":"not yet assigned"}}},"CVE-2023-4362":{"description":"Heap buffer overflow in Mojom IDL in Google Chrome prior to 116.0.5845.96 allowed a remote attacker who had compromised the renderer process and gained control of a WebUI process to potentially exploit heap corruption via a crafted HTML page. (Chromium security severity: Medium)","scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"143.0.7499.169-1~deb12u1","bookworm-security":"145.0.7632.159-1~deb12u1"},"fixed_version":"116.0.5845.96-1~deb12u1","urgency":"not yet assigned"},"bullseye":{"status":"resolved","repositories":{"bullseye":"120.0.6099.224-1~deb11u1","bullseye-security":"120.0.6099.224-1~deb11u1"},"fixed_version":"116.0.5845.96-1~deb11u1","urgency":"not yet assigned"},"forky":{"status":"resolved","repositories":{"forky":"145.0.7632.159-1"},"fixed_version":"116.0.5845.96-1","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"146.0.7680.71-1"},"fixed_version":"116.0.5845.96-1","urgency":"not yet assigned"},"trixie":{"status":"resolved","repositories":{"trixie":"143.0.7499.169-1~deb13u1","trixie-security":"145.0.7632.159-1~deb13u1"},"fixed_version":"116.0.5845.96-1","urgency":"not yet assigned"}}},"CVE-2023-4363":{"description":"Inappropriate implementation in WebShare in Google Chrome on Android prior to 116.0.5845.96 allowed a remote attacker to spoof the contents of a dialog URL via a crafted HTML page. (Chromium security severity: Medium)","scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"143.0.7499.169-1~deb12u1","bookworm-security":"145.0.7632.159-1~deb12u1"},"fixed_version":"116.0.5845.96-1~deb12u1","urgency":"not yet assigned"},"bullseye":{"status":"resolved","repositories":{"bullseye":"120.0.6099.224-1~deb11u1","bullseye-security":"120.0.6099.224-1~deb11u1"},"fixed_version":"116.0.5845.96-1~deb11u1","urgency":"not yet assigned"},"forky":{"status":"resolved","repositories":{"forky":"145.0.7632.159-1"},"fixed_version":"116.0.5845.96-1","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"146.0.7680.71-1"},"fixed_version":"116.0.5845.96-1","urgency":"not yet assigned"},"trixie":{"status":"resolved","repositories":{"trixie":"143.0.7499.169-1~deb13u1","trixie-security":"145.0.7632.159-1~deb13u1"},"fixed_version":"116.0.5845.96-1","urgency":"not yet assigned"}}},"CVE-2023-4364":{"description":"Inappropriate implementation in Permission Prompts in Google Chrome prior to 116.0.5845.96 allowed a remote attacker to obfuscate security UI via a crafted HTML page. (Chromium security severity: Medium)","scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"143.0.7499.169-1~deb12u1","bookworm-security":"145.0.7632.159-1~deb12u1"},"fixed_version":"116.0.5845.96-1~deb12u1","urgency":"not yet assigned"},"bullseye":{"status":"resolved","repositories":{"bullseye":"120.0.6099.224-1~deb11u1","bullseye-security":"120.0.6099.224-1~deb11u1"},"fixed_version":"116.0.5845.96-1~deb11u1","urgency":"not yet assigned"},"forky":{"status":"resolved","repositories":{"forky":"145.0.7632.159-1"},"fixed_version":"116.0.5845.96-1","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"146.0.7680.71-1"},"fixed_version":"116.0.5845.96-1","urgency":"not yet assigned"},"trixie":{"status":"resolved","repositories":{"trixie":"143.0.7499.169-1~deb13u1","trixie-security":"145.0.7632.159-1~deb13u1"},"fixed_version":"116.0.5845.96-1","urgency":"not yet assigned"}}},"CVE-2023-4365":{"description":"Inappropriate implementation in Fullscreen in Google Chrome prior to 116.0.5845.96 allowed a remote attacker to obfuscate security UI via a crafted HTML page. (Chromium security severity: Medium)","scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"143.0.7499.169-1~deb12u1","bookworm-security":"145.0.7632.159-1~deb12u1"},"fixed_version":"116.0.5845.96-1~deb12u1","urgency":"not yet assigned"},"bullseye":{"status":"resolved","repositories":{"bullseye":"120.0.6099.224-1~deb11u1","bullseye-security":"120.0.6099.224-1~deb11u1"},"fixed_version":"116.0.5845.96-1~deb11u1","urgency":"not yet assigned"},"forky":{"status":"resolved","repositories":{"forky":"145.0.7632.159-1"},"fixed_version":"116.0.5845.96-1","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"146.0.7680.71-1"},"fixed_version":"116.0.5845.96-1","urgency":"not yet assigned"},"trixie":{"status":"resolved","repositories":{"trixie":"143.0.7499.169-1~deb13u1","trixie-security":"145.0.7632.159-1~deb13u1"},"fixed_version":"116.0.5845.96-1","urgency":"not yet assigned"}}},"CVE-2023-4366":{"description":"Use after free in Extensions in Google Chrome prior to 116.0.5845.96 allowed an attacker who convinced a user to install a malicious extension to potentially exploit heap corruption via a crafted HTML page. (Chromium security severity: Medium)","scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"143.0.7499.169-1~deb12u1","bookworm-security":"145.0.7632.159-1~deb12u1"},"fixed_version":"116.0.5845.96-1~deb12u1","urgency":"not yet assigned"},"bullseye":{"status":"resolved","repositories":{"bullseye":"120.0.6099.224-1~deb11u1","bullseye-security":"120.0.6099.224-1~deb11u1"},"fixed_version":"116.0.5845.96-1~deb11u1","urgency":"not yet assigned"},"forky":{"status":"resolved","repositories":{"forky":"145.0.7632.159-1"},"fixed_version":"116.0.5845.96-1","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"146.0.7680.71-1"},"fixed_version":"116.0.5845.96-1","urgency":"not yet assigned"},"trixie":{"status":"resolved","repositories":{"trixie":"143.0.7499.169-1~deb13u1","trixie-security":"145.0.7632.159-1~deb13u1"},"fixed_version":"116.0.5845.96-1","urgency":"not yet assigned"}}},"CVE-2023-4367":{"description":"Insufficient policy enforcement in Extensions API in Google Chrome prior to 116.0.5845.96 allowed an attacker who convinced a user to install a malicious extension to bypass an enterprise policy via a crafted HTML page. (Chromium security severity: Medium)","scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"143.0.7499.169-1~deb12u1","bookworm-security":"145.0.7632.159-1~deb12u1"},"fixed_version":"116.0.5845.96-1~deb12u1","urgency":"not yet assigned"},"bullseye":{"status":"resolved","repositories":{"bullseye":"120.0.6099.224-1~deb11u1","bullseye-security":"120.0.6099.224-1~deb11u1"},"fixed_version":"116.0.5845.96-1~deb11u1","urgency":"not yet assigned"},"forky":{"status":"resolved","repositories":{"forky":"145.0.7632.159-1"},"fixed_version":"116.0.5845.96-1","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"146.0.7680.71-1"},"fixed_version":"116.0.5845.96-1","urgency":"not yet assigned"},"trixie":{"status":"resolved","repositories":{"trixie":"143.0.7499.169-1~deb13u1","trixie-security":"145.0.7632.159-1~deb13u1"},"fixed_version":"116.0.5845.96-1","urgency":"not yet assigned"}}},"CVE-2023-4368":{"description":"Insufficient policy enforcement in Extensions API in Google Chrome prior to 116.0.5845.96 allowed an attacker who convinced a user to install a malicious extension to bypass an enterprise policy via a crafted HTML page. (Chromium security severity: Medium)","scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"143.0.7499.169-1~deb12u1","bookworm-security":"145.0.7632.159-1~deb12u1"},"fixed_version":"116.0.5845.96-1~deb12u1","urgency":"not yet assigned"},"bullseye":{"status":"resolved","repositories":{"bullseye":"120.0.6099.224-1~deb11u1","bullseye-security":"120.0.6099.224-1~deb11u1"},"fixed_version":"116.0.5845.96-1~deb11u1","urgency":"not yet assigned"},"forky":{"status":"resolved","repositories":{"forky":"145.0.7632.159-1"},"fixed_version":"116.0.5845.96-1","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"146.0.7680.71-1"},"fixed_version":"116.0.5845.96-1","urgency":"not yet assigned"},"trixie":{"status":"resolved","repositories":{"trixie":"143.0.7499.169-1~deb13u1","trixie-security":"145.0.7632.159-1~deb13u1"},"fixed_version":"116.0.5845.96-1","urgency":"not yet assigned"}}},"CVE-2023-4427":{"description":"Out of bounds memory access in V8 in Google Chrome prior to 116.0.5845.110 allowed a remote attacker to perform an out of bounds memory read via a crafted HTML page. (Chromium security severity: High)","scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"143.0.7499.169-1~deb12u1","bookworm-security":"145.0.7632.159-1~deb12u1"},"fixed_version":"116.0.5845.110-1~deb12u1","urgency":"not yet assigned"},"bullseye":{"status":"resolved","repositories":{"bullseye":"120.0.6099.224-1~deb11u1","bullseye-security":"120.0.6099.224-1~deb11u1"},"fixed_version":"116.0.5845.110-1~deb11u1","urgency":"not yet assigned"},"forky":{"status":"resolved","repositories":{"forky":"145.0.7632.159-1"},"fixed_version":"116.0.5845.110-1","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"146.0.7680.71-1"},"fixed_version":"116.0.5845.110-1","urgency":"not yet assigned"},"trixie":{"status":"resolved","repositories":{"trixie":"143.0.7499.169-1~deb13u1","trixie-security":"145.0.7632.159-1~deb13u1"},"fixed_version":"116.0.5845.110-1","urgency":"not yet assigned"}}},"CVE-2023-4428":{"description":"Out of bounds memory access in CSS in Google Chrome prior to 116.0.5845.110 allowed a remote attacker to perform an out of bounds memory read via a crafted HTML page. (Chromium security severity: High)","scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"143.0.7499.169-1~deb12u1","bookworm-security":"145.0.7632.159-1~deb12u1"},"fixed_version":"116.0.5845.110-1~deb12u1","urgency":"not yet assigned"},"bullseye":{"status":"resolved","repositories":{"bullseye":"120.0.6099.224-1~deb11u1","bullseye-security":"120.0.6099.224-1~deb11u1"},"fixed_version":"116.0.5845.110-1~deb11u1","urgency":"not yet assigned"},"forky":{"status":"resolved","repositories":{"forky":"145.0.7632.159-1"},"fixed_version":"116.0.5845.110-1","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"146.0.7680.71-1"},"fixed_version":"116.0.5845.110-1","urgency":"not yet assigned"},"trixie":{"status":"resolved","repositories":{"trixie":"143.0.7499.169-1~deb13u1","trixie-security":"145.0.7632.159-1~deb13u1"},"fixed_version":"116.0.5845.110-1","urgency":"not yet assigned"}}},"CVE-2023-4429":{"description":"Use after free in Loader in Google Chrome prior to 116.0.5845.110 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. (Chromium security severity: High)","scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"143.0.7499.169-1~deb12u1","bookworm-security":"145.0.7632.159-1~deb12u1"},"fixed_version":"116.0.5845.110-1~deb12u1","urgency":"not yet assigned"},"bullseye":{"status":"resolved","repositories":{"bullseye":"120.0.6099.224-1~deb11u1","bullseye-security":"120.0.6099.224-1~deb11u1"},"fixed_version":"116.0.5845.110-1~deb11u1","urgency":"not yet assigned"},"forky":{"status":"resolved","repositories":{"forky":"145.0.7632.159-1"},"fixed_version":"116.0.5845.110-1","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"146.0.7680.71-1"},"fixed_version":"116.0.5845.110-1","urgency":"not yet assigned"},"trixie":{"status":"resolved","repositories":{"trixie":"143.0.7499.169-1~deb13u1","trixie-security":"145.0.7632.159-1~deb13u1"},"fixed_version":"116.0.5845.110-1","urgency":"not yet assigned"}}},"CVE-2023-4430":{"description":"Use after free in Vulkan in Google Chrome prior to 116.0.5845.110 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. (Chromium security severity: High)","scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"143.0.7499.169-1~deb12u1","bookworm-security":"145.0.7632.159-1~deb12u1"},"fixed_version":"116.0.5845.110-1~deb12u1","urgency":"not yet assigned"},"bullseye":{"status":"resolved","repositories":{"bullseye":"120.0.6099.224-1~deb11u1","bullseye-security":"120.0.6099.224-1~deb11u1"},"fixed_version":"116.0.5845.110-1~deb11u1","urgency":"not yet assigned"},"forky":{"status":"resolved","repositories":{"forky":"145.0.7632.159-1"},"fixed_version":"116.0.5845.110-1","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"146.0.7680.71-1"},"fixed_version":"116.0.5845.110-1","urgency":"not yet assigned"},"trixie":{"status":"resolved","repositories":{"trixie":"143.0.7499.169-1~deb13u1","trixie-security":"145.0.7632.159-1~deb13u1"},"fixed_version":"116.0.5845.110-1","urgency":"not yet assigned"}}},"CVE-2023-4431":{"description":"Out of bounds memory access in Fonts in Google Chrome prior to 116.0.5845.110 allowed a remote attacker to perform an out of bounds memory read via a crafted HTML page. (Chromium security severity: Medium)","scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"143.0.7499.169-1~deb12u1","bookworm-security":"145.0.7632.159-1~deb12u1"},"fixed_version":"116.0.5845.110-1~deb12u1","urgency":"not yet assigned"},"bullseye":{"status":"resolved","repositories":{"bullseye":"120.0.6099.224-1~deb11u1","bullseye-security":"120.0.6099.224-1~deb11u1"},"fixed_version":"116.0.5845.110-1~deb11u1","urgency":"not yet assigned"},"forky":{"status":"resolved","repositories":{"forky":"145.0.7632.159-1"},"fixed_version":"116.0.5845.110-1","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"146.0.7680.71-1"},"fixed_version":"116.0.5845.110-1","urgency":"not yet assigned"},"trixie":{"status":"resolved","repositories":{"trixie":"143.0.7499.169-1~deb13u1","trixie-security":"145.0.7632.159-1~deb13u1"},"fixed_version":"116.0.5845.110-1","urgency":"not yet assigned"}}},"CVE-2023-4572":{"description":"Use after free in MediaStream in Google Chrome prior to 116.0.5845.140 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. (Chromium security severity: High)","scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"143.0.7499.169-1~deb12u1","bookworm-security":"145.0.7632.159-1~deb12u1"},"fixed_version":"116.0.5845.140-1~deb12u1","urgency":"not yet assigned"},"bullseye":{"status":"resolved","repositories":{"bullseye":"120.0.6099.224-1~deb11u1","bullseye-security":"120.0.6099.224-1~deb11u1"},"fixed_version":"116.0.5845.140-1~deb11u1","urgency":"not yet assigned"},"forky":{"status":"resolved","repositories":{"forky":"145.0.7632.159-1"},"fixed_version":"116.0.5845.140-1","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"146.0.7680.71-1"},"fixed_version":"116.0.5845.140-1","urgency":"not yet assigned"},"trixie":{"status":"resolved","repositories":{"trixie":"143.0.7499.169-1~deb13u1","trixie-security":"145.0.7632.159-1~deb13u1"},"fixed_version":"116.0.5845.140-1","urgency":"not yet assigned"}}},"CVE-2023-4761":{"description":"Out of bounds memory access in FedCM in Google Chrome prior to 116.0.5845.179 allowed a remote attacker who had compromised the renderer process to perform an out of bounds memory read via a crafted HTML page. (Chromium security severity: High)","scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"143.0.7499.169-1~deb12u1","bookworm-security":"145.0.7632.159-1~deb12u1"},"fixed_version":"116.0.5845.180-1~deb12u1","urgency":"not yet assigned"},"bullseye":{"status":"resolved","repositories":{"bullseye":"120.0.6099.224-1~deb11u1","bullseye-security":"120.0.6099.224-1~deb11u1"},"fixed_version":"116.0.5845.180-1~deb11u1","urgency":"not yet assigned"},"forky":{"status":"resolved","repositories":{"forky":"145.0.7632.159-1"},"fixed_version":"116.0.5845.180-1","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"146.0.7680.71-1"},"fixed_version":"116.0.5845.180-1","urgency":"not yet assigned"},"trixie":{"status":"resolved","repositories":{"trixie":"143.0.7499.169-1~deb13u1","trixie-security":"145.0.7632.159-1~deb13u1"},"fixed_version":"116.0.5845.180-1","urgency":"not yet assigned"}}},"CVE-2023-4762":{"description":"Type Confusion in V8 in Google Chrome prior to 116.0.5845.179 allowed a remote attacker to execute arbitrary code via a crafted HTML page. (Chromium security severity: High)","scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"143.0.7499.169-1~deb12u1","bookworm-security":"145.0.7632.159-1~deb12u1"},"fixed_version":"116.0.5845.180-1~deb12u1","urgency":"not yet assigned"},"bullseye":{"status":"resolved","repositories":{"bullseye":"120.0.6099.224-1~deb11u1","bullseye-security":"120.0.6099.224-1~deb11u1"},"fixed_version":"116.0.5845.180-1~deb11u1","urgency":"not yet assigned"},"forky":{"status":"resolved","repositories":{"forky":"145.0.7632.159-1"},"fixed_version":"116.0.5845.180-1","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"146.0.7680.71-1"},"fixed_version":"116.0.5845.180-1","urgency":"not yet assigned"},"trixie":{"status":"resolved","repositories":{"trixie":"143.0.7499.169-1~deb13u1","trixie-security":"145.0.7632.159-1~deb13u1"},"fixed_version":"116.0.5845.180-1","urgency":"not yet assigned"}}},"CVE-2023-4763":{"description":"Use after free in Networks in Google Chrome prior to 116.0.5845.179 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. (Chromium security severity: High)","scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"143.0.7499.169-1~deb12u1","bookworm-security":"145.0.7632.159-1~deb12u1"},"fixed_version":"116.0.5845.180-1~deb12u1","urgency":"not yet assigned"},"bullseye":{"status":"resolved","repositories":{"bullseye":"120.0.6099.224-1~deb11u1","bullseye-security":"120.0.6099.224-1~deb11u1"},"fixed_version":"116.0.5845.180-1~deb11u1","urgency":"not yet assigned"},"forky":{"status":"resolved","repositories":{"forky":"145.0.7632.159-1"},"fixed_version":"116.0.5845.180-1","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"146.0.7680.71-1"},"fixed_version":"116.0.5845.180-1","urgency":"not yet assigned"},"trixie":{"status":"resolved","repositories":{"trixie":"143.0.7499.169-1~deb13u1","trixie-security":"145.0.7632.159-1~deb13u1"},"fixed_version":"116.0.5845.180-1","urgency":"not yet assigned"}}},"CVE-2023-4764":{"description":"Incorrect security UI in BFCache in Google Chrome prior to 116.0.5845.179 allowed a remote attacker to spoof the contents of the Omnibox (URL bar) via a crafted HTML page. (Chromium security severity: High)","scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"143.0.7499.169-1~deb12u1","bookworm-security":"145.0.7632.159-1~deb12u1"},"fixed_version":"116.0.5845.180-1~deb12u1","urgency":"not yet assigned"},"bullseye":{"status":"resolved","repositories":{"bullseye":"120.0.6099.224-1~deb11u1","bullseye-security":"120.0.6099.224-1~deb11u1"},"fixed_version":"116.0.5845.180-1~deb11u1","urgency":"not yet assigned"},"forky":{"status":"resolved","repositories":{"forky":"145.0.7632.159-1"},"fixed_version":"116.0.5845.180-1","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"146.0.7680.71-1"},"fixed_version":"116.0.5845.180-1","urgency":"not yet assigned"},"trixie":{"status":"resolved","repositories":{"trixie":"143.0.7499.169-1~deb13u1","trixie-security":"145.0.7632.159-1~deb13u1"},"fixed_version":"116.0.5845.180-1","urgency":"not yet assigned"}}},"CVE-2023-4860":{"description":"Inappropriate implementation in Skia in Google Chrome prior to 115.0.5790.98 allowed a remote attacker who had compromised the renderer process to potentially perform a sandbox escape via a crafted HTML page. (Chromium security severity: High)","scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"143.0.7499.169-1~deb12u1","bookworm-security":"145.0.7632.159-1~deb12u1"},"fixed_version":"115.0.5790.98-1~deb12u1","urgency":"not yet assigned"},"bullseye":{"status":"resolved","repositories":{"bullseye":"120.0.6099.224-1~deb11u1","bullseye-security":"120.0.6099.224-1~deb11u1"},"fixed_version":"115.0.5790.98-1~deb11u1","urgency":"not yet assigned"},"forky":{"status":"resolved","repositories":{"forky":"145.0.7632.159-1"},"fixed_version":"115.0.5790.98-1","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"146.0.7680.71-1"},"fixed_version":"115.0.5790.98-1","urgency":"not yet assigned"},"trixie":{"status":"resolved","repositories":{"trixie":"143.0.7499.169-1~deb13u1","trixie-security":"145.0.7632.159-1~deb13u1"},"fixed_version":"115.0.5790.98-1","urgency":"not yet assigned"}}},"CVE-2023-4863":{"description":"Heap buffer overflow in libwebp in Google Chrome prior to 116.0.5845.187 and libwebp 1.3.2 allowed a remote attacker to perform an out of bounds memory write via a crafted HTML page. (Chromium security severity: Critical)","scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"143.0.7499.169-1~deb12u1","bookworm-security":"145.0.7632.159-1~deb12u1"},"fixed_version":"117.0.5938.62-1","urgency":"unimportant"},"bullseye":{"status":"resolved","repositories":{"bullseye":"120.0.6099.224-1~deb11u1","bullseye-security":"120.0.6099.224-1~deb11u1"},"fixed_version":"117.0.5938.62-1","urgency":"unimportant"},"forky":{"status":"resolved","repositories":{"forky":"145.0.7632.159-1"},"fixed_version":"117.0.5938.62-1","urgency":"unimportant"},"sid":{"status":"resolved","repositories":{"sid":"146.0.7680.71-1"},"fixed_version":"117.0.5938.62-1","urgency":"unimportant"},"trixie":{"status":"resolved","repositories":{"trixie":"143.0.7499.169-1~deb13u1","trixie-security":"145.0.7632.159-1~deb13u1"},"fixed_version":"117.0.5938.62-1","urgency":"unimportant"}}},"CVE-2023-4900":{"description":"Inappropriate implementation in Custom Tabs in Google Chrome on Android prior to 117.0.5938.62 allowed a remote attacker to obfuscate a permission prompt via a crafted HTML page. (Chromium security severity: Medium)","scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"143.0.7499.169-1~deb12u1","bookworm-security":"145.0.7632.159-1~deb12u1"},"fixed_version":"117.0.5938.62-1~deb12u1","urgency":"not yet assigned"},"bullseye":{"status":"resolved","repositories":{"bullseye":"120.0.6099.224-1~deb11u1","bullseye-security":"120.0.6099.224-1~deb11u1"},"fixed_version":"117.0.5938.62-1~deb11u1","urgency":"not yet assigned"},"forky":{"status":"resolved","repositories":{"forky":"145.0.7632.159-1"},"fixed_version":"117.0.5938.62-1","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"146.0.7680.71-1"},"fixed_version":"117.0.5938.62-1","urgency":"not yet assigned"},"trixie":{"status":"resolved","repositories":{"trixie":"143.0.7499.169-1~deb13u1","trixie-security":"145.0.7632.159-1~deb13u1"},"fixed_version":"117.0.5938.62-1","urgency":"not yet assigned"}}},"CVE-2023-4901":{"description":"Inappropriate implementation in Prompts in Google Chrome prior to 117.0.5938.62 allowed a remote attacker to potentially spoof security UI via a crafted HTML page. (Chromium security severity: Medium)","scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"143.0.7499.169-1~deb12u1","bookworm-security":"145.0.7632.159-1~deb12u1"},"fixed_version":"117.0.5938.62-1~deb12u1","urgency":"not yet assigned"},"bullseye":{"status":"resolved","repositories":{"bullseye":"120.0.6099.224-1~deb11u1","bullseye-security":"120.0.6099.224-1~deb11u1"},"fixed_version":"117.0.5938.62-1~deb11u1","urgency":"not yet assigned"},"forky":{"status":"resolved","repositories":{"forky":"145.0.7632.159-1"},"fixed_version":"117.0.5938.62-1","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"146.0.7680.71-1"},"fixed_version":"117.0.5938.62-1","urgency":"not yet assigned"},"trixie":{"status":"resolved","repositories":{"trixie":"143.0.7499.169-1~deb13u1","trixie-security":"145.0.7632.159-1~deb13u1"},"fixed_version":"117.0.5938.62-1","urgency":"not yet assigned"}}},"CVE-2023-4902":{"description":"Inappropriate implementation in Input in Google Chrome prior to 117.0.5938.62 allowed a remote attacker to spoof security UI via a crafted HTML page. (Chromium security severity: Medium)","scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"143.0.7499.169-1~deb12u1","bookworm-security":"145.0.7632.159-1~deb12u1"},"fixed_version":"117.0.5938.62-1~deb12u1","urgency":"not yet assigned"},"bullseye":{"status":"resolved","repositories":{"bullseye":"120.0.6099.224-1~deb11u1","bullseye-security":"120.0.6099.224-1~deb11u1"},"fixed_version":"117.0.5938.62-1~deb11u1","urgency":"not yet assigned"},"forky":{"status":"resolved","repositories":{"forky":"145.0.7632.159-1"},"fixed_version":"117.0.5938.62-1","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"146.0.7680.71-1"},"fixed_version":"117.0.5938.62-1","urgency":"not yet assigned"},"trixie":{"status":"resolved","repositories":{"trixie":"143.0.7499.169-1~deb13u1","trixie-security":"145.0.7632.159-1~deb13u1"},"fixed_version":"117.0.5938.62-1","urgency":"not yet assigned"}}},"CVE-2023-4903":{"description":"Inappropriate implementation in Custom Mobile Tabs in Google Chrome on Android prior to 117.0.5938.62 allowed a remote attacker to spoof security UI via a crafted HTML page. (Chromium security severity: Medium)","scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"143.0.7499.169-1~deb12u1","bookworm-security":"145.0.7632.159-1~deb12u1"},"fixed_version":"117.0.5938.62-1~deb12u1","urgency":"not yet assigned"},"bullseye":{"status":"resolved","repositories":{"bullseye":"120.0.6099.224-1~deb11u1","bullseye-security":"120.0.6099.224-1~deb11u1"},"fixed_version":"117.0.5938.62-1~deb11u1","urgency":"not yet assigned"},"forky":{"status":"resolved","repositories":{"forky":"145.0.7632.159-1"},"fixed_version":"117.0.5938.62-1","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"146.0.7680.71-1"},"fixed_version":"117.0.5938.62-1","urgency":"not yet assigned"},"trixie":{"status":"resolved","repositories":{"trixie":"143.0.7499.169-1~deb13u1","trixie-security":"145.0.7632.159-1~deb13u1"},"fixed_version":"117.0.5938.62-1","urgency":"not yet assigned"}}},"CVE-2023-4904":{"description":"Insufficient policy enforcement in Downloads in Google Chrome prior to 117.0.5938.62 allowed a remote attacker to bypass Enterprise policy restrictions via a crafted download. (Chromium security severity: Medium)","scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"143.0.7499.169-1~deb12u1","bookworm-security":"145.0.7632.159-1~deb12u1"},"fixed_version":"117.0.5938.62-1~deb12u1","urgency":"not yet assigned"},"bullseye":{"status":"resolved","repositories":{"bullseye":"120.0.6099.224-1~deb11u1","bullseye-security":"120.0.6099.224-1~deb11u1"},"fixed_version":"117.0.5938.62-1~deb11u1","urgency":"not yet assigned"},"forky":{"status":"resolved","repositories":{"forky":"145.0.7632.159-1"},"fixed_version":"117.0.5938.62-1","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"146.0.7680.71-1"},"fixed_version":"117.0.5938.62-1","urgency":"not yet assigned"},"trixie":{"status":"resolved","repositories":{"trixie":"143.0.7499.169-1~deb13u1","trixie-security":"145.0.7632.159-1~deb13u1"},"fixed_version":"117.0.5938.62-1","urgency":"not yet assigned"}}},"CVE-2023-4905":{"description":"Inappropriate implementation in Prompts in Google Chrome prior to 117.0.5938.62 allowed a remote attacker to spoof security UI via a crafted HTML page. (Chromium security severity: Medium)","scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"143.0.7499.169-1~deb12u1","bookworm-security":"145.0.7632.159-1~deb12u1"},"fixed_version":"117.0.5938.62-1~deb12u1","urgency":"not yet assigned"},"bullseye":{"status":"resolved","repositories":{"bullseye":"120.0.6099.224-1~deb11u1","bullseye-security":"120.0.6099.224-1~deb11u1"},"fixed_version":"117.0.5938.62-1~deb11u1","urgency":"not yet assigned"},"forky":{"status":"resolved","repositories":{"forky":"145.0.7632.159-1"},"fixed_version":"117.0.5938.62-1","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"146.0.7680.71-1"},"fixed_version":"117.0.5938.62-1","urgency":"not yet assigned"},"trixie":{"status":"resolved","repositories":{"trixie":"143.0.7499.169-1~deb13u1","trixie-security":"145.0.7632.159-1~deb13u1"},"fixed_version":"117.0.5938.62-1","urgency":"not yet assigned"}}},"CVE-2023-4906":{"description":"Insufficient policy enforcement in Autofill in Google Chrome prior to 117.0.5938.62 allowed a remote attacker to bypass Autofill restrictions via a crafted HTML page. (Chromium security severity: Low)","scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"143.0.7499.169-1~deb12u1","bookworm-security":"145.0.7632.159-1~deb12u1"},"fixed_version":"117.0.5938.62-1~deb12u1","urgency":"not yet assigned"},"bullseye":{"status":"resolved","repositories":{"bullseye":"120.0.6099.224-1~deb11u1","bullseye-security":"120.0.6099.224-1~deb11u1"},"fixed_version":"117.0.5938.62-1~deb11u1","urgency":"not yet assigned"},"forky":{"status":"resolved","repositories":{"forky":"145.0.7632.159-1"},"fixed_version":"117.0.5938.62-1","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"146.0.7680.71-1"},"fixed_version":"117.0.5938.62-1","urgency":"not yet assigned"},"trixie":{"status":"resolved","repositories":{"trixie":"143.0.7499.169-1~deb13u1","trixie-security":"145.0.7632.159-1~deb13u1"},"fixed_version":"117.0.5938.62-1","urgency":"not yet assigned"}}},"CVE-2023-4907":{"description":"Inappropriate implementation in Intents in Google Chrome on Android prior to 117.0.5938.62 allowed a remote attacker to obfuscate security UI via a crafted HTML page. (Chromium security severity: Low)","scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"143.0.7499.169-1~deb12u1","bookworm-security":"145.0.7632.159-1~deb12u1"},"fixed_version":"117.0.5938.62-1~deb12u1","urgency":"not yet assigned"},"bullseye":{"status":"resolved","repositories":{"bullseye":"120.0.6099.224-1~deb11u1","bullseye-security":"120.0.6099.224-1~deb11u1"},"fixed_version":"117.0.5938.62-1~deb11u1","urgency":"not yet assigned"},"forky":{"status":"resolved","repositories":{"forky":"145.0.7632.159-1"},"fixed_version":"117.0.5938.62-1","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"146.0.7680.71-1"},"fixed_version":"117.0.5938.62-1","urgency":"not yet assigned"},"trixie":{"status":"resolved","repositories":{"trixie":"143.0.7499.169-1~deb13u1","trixie-security":"145.0.7632.159-1~deb13u1"},"fixed_version":"117.0.5938.62-1","urgency":"not yet assigned"}}},"CVE-2023-4908":{"description":"Inappropriate implementation in Picture in Picture in Google Chrome prior to 117.0.5938.62 allowed a remote attacker to spoof security UI via a crafted HTML page. (Chromium security severity: Low)","scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"143.0.7499.169-1~deb12u1","bookworm-security":"145.0.7632.159-1~deb12u1"},"fixed_version":"117.0.5938.62-1~deb12u1","urgency":"not yet assigned"},"bullseye":{"status":"resolved","repositories":{"bullseye":"120.0.6099.224-1~deb11u1","bullseye-security":"120.0.6099.224-1~deb11u1"},"fixed_version":"117.0.5938.62-1~deb11u1","urgency":"not yet assigned"},"forky":{"status":"resolved","repositories":{"forky":"145.0.7632.159-1"},"fixed_version":"117.0.5938.62-1","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"146.0.7680.71-1"},"fixed_version":"117.0.5938.62-1","urgency":"not yet assigned"},"trixie":{"status":"resolved","repositories":{"trixie":"143.0.7499.169-1~deb13u1","trixie-security":"145.0.7632.159-1~deb13u1"},"fixed_version":"117.0.5938.62-1","urgency":"not yet assigned"}}},"CVE-2023-4909":{"description":"Inappropriate implementation in Interstitials in Google Chrome prior to 117.0.5938.62 allowed a remote attacker to obfuscate security UI via a crafted HTML page. (Chromium security severity: Low)","scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"143.0.7499.169-1~deb12u1","bookworm-security":"145.0.7632.159-1~deb12u1"},"fixed_version":"117.0.5938.62-1~deb12u1","urgency":"not yet assigned"},"bullseye":{"status":"resolved","repositories":{"bullseye":"120.0.6099.224-1~deb11u1","bullseye-security":"120.0.6099.224-1~deb11u1"},"fixed_version":"117.0.5938.62-1~deb11u1","urgency":"not yet assigned"},"forky":{"status":"resolved","repositories":{"forky":"145.0.7632.159-1"},"fixed_version":"117.0.5938.62-1","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"146.0.7680.71-1"},"fixed_version":"117.0.5938.62-1","urgency":"not yet assigned"},"trixie":{"status":"resolved","repositories":{"trixie":"143.0.7499.169-1~deb13u1","trixie-security":"145.0.7632.159-1~deb13u1"},"fixed_version":"117.0.5938.62-1","urgency":"not yet assigned"}}},"CVE-2023-5186":{"description":"Use after free in Passwords in Google Chrome prior to 117.0.5938.132 allowed a remote attacker who convinced a user to engage in specific UI interaction to potentially exploit heap corruption via crafted UI interaction. (Chromium security severity: High)","scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"143.0.7499.169-1~deb12u1","bookworm-security":"145.0.7632.159-1~deb12u1"},"fixed_version":"117.0.5938.132-1~deb12u1","urgency":"not yet assigned"},"bullseye":{"status":"resolved","repositories":{"bullseye":"120.0.6099.224-1~deb11u1","bullseye-security":"120.0.6099.224-1~deb11u1"},"fixed_version":"117.0.5938.132-1~deb11u1","urgency":"not yet assigned"},"forky":{"status":"resolved","repositories":{"forky":"145.0.7632.159-1"},"fixed_version":"117.0.5938.132-1","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"146.0.7680.71-1"},"fixed_version":"117.0.5938.132-1","urgency":"not yet assigned"},"trixie":{"status":"resolved","repositories":{"trixie":"143.0.7499.169-1~deb13u1","trixie-security":"145.0.7632.159-1~deb13u1"},"fixed_version":"117.0.5938.132-1","urgency":"not yet assigned"}}},"CVE-2023-5187":{"description":"Use after free in Extensions in Google Chrome prior to 117.0.5938.132 allowed an attacker who convinced a user to install a malicious extension to potentially exploit heap corruption via a crafted HTML page. (Chromium security severity: High)","scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"143.0.7499.169-1~deb12u1","bookworm-security":"145.0.7632.159-1~deb12u1"},"fixed_version":"117.0.5938.132-1~deb12u1","urgency":"not yet assigned"},"bullseye":{"status":"resolved","repositories":{"bullseye":"120.0.6099.224-1~deb11u1","bullseye-security":"120.0.6099.224-1~deb11u1"},"fixed_version":"117.0.5938.132-1~deb11u1","urgency":"not yet assigned"},"forky":{"status":"resolved","repositories":{"forky":"145.0.7632.159-1"},"fixed_version":"117.0.5938.132-1","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"146.0.7680.71-1"},"fixed_version":"117.0.5938.132-1","urgency":"not yet assigned"},"trixie":{"status":"resolved","repositories":{"trixie":"143.0.7499.169-1~deb13u1","trixie-security":"145.0.7632.159-1~deb13u1"},"fixed_version":"117.0.5938.132-1","urgency":"not yet assigned"}}},"CVE-2023-5217":{"description":"Heap buffer overflow in vp8 encoding in libvpx in Google Chrome prior to 117.0.5938.132 and libvpx 1.13.1 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. (Chromium security severity: High)","scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"143.0.7499.169-1~deb12u1","bookworm-security":"145.0.7632.159-1~deb12u1"},"fixed_version":"117.0.5938.132-1~deb12u1","urgency":"not yet assigned"},"bullseye":{"status":"resolved","repositories":{"bullseye":"120.0.6099.224-1~deb11u1","bullseye-security":"120.0.6099.224-1~deb11u1"},"fixed_version":"117.0.5938.132-1~deb11u1","urgency":"not yet assigned"},"forky":{"status":"resolved","repositories":{"forky":"145.0.7632.159-1"},"fixed_version":"117.0.5938.132-1","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"146.0.7680.71-1"},"fixed_version":"117.0.5938.132-1","urgency":"not yet assigned"},"trixie":{"status":"resolved","repositories":{"trixie":"143.0.7499.169-1~deb13u1","trixie-security":"145.0.7632.159-1~deb13u1"},"fixed_version":"117.0.5938.132-1","urgency":"not yet assigned"}}},"CVE-2023-5218":{"description":"Use after free in Site Isolation in Google Chrome prior to 118.0.5993.70 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. (Chromium security severity: Critical)","scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"143.0.7499.169-1~deb12u1","bookworm-security":"145.0.7632.159-1~deb12u1"},"fixed_version":"118.0.5993.70-1~deb12u1","urgency":"not yet assigned"},"bullseye":{"status":"resolved","repositories":{"bullseye":"120.0.6099.224-1~deb11u1","bullseye-security":"120.0.6099.224-1~deb11u1"},"fixed_version":"118.0.5993.70-1~deb11u1","urgency":"not yet assigned"},"forky":{"status":"resolved","repositories":{"forky":"145.0.7632.159-1"},"fixed_version":"118.0.5993.70-1","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"146.0.7680.71-1"},"fixed_version":"118.0.5993.70-1","urgency":"not yet assigned"},"trixie":{"status":"resolved","repositories":{"trixie":"143.0.7499.169-1~deb13u1","trixie-security":"145.0.7632.159-1~deb13u1"},"fixed_version":"118.0.5993.70-1","urgency":"not yet assigned"}}},"CVE-2023-5346":{"description":"Type confusion in V8 in Google Chrome prior to 117.0.5938.149 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. (Chromium security severity: High)","scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"143.0.7499.169-1~deb12u1","bookworm-security":"145.0.7632.159-1~deb12u1"},"fixed_version":"117.0.5938.149-1~deb12u1","urgency":"not yet assigned"},"bullseye":{"status":"resolved","repositories":{"bullseye":"120.0.6099.224-1~deb11u1","bullseye-security":"120.0.6099.224-1~deb11u1"},"fixed_version":"117.0.5938.149-1~deb11u1","urgency":"not yet assigned"},"forky":{"status":"resolved","repositories":{"forky":"145.0.7632.159-1"},"fixed_version":"117.0.5938.149-1","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"146.0.7680.71-1"},"fixed_version":"117.0.5938.149-1","urgency":"not yet assigned"},"trixie":{"status":"resolved","repositories":{"trixie":"143.0.7499.169-1~deb13u1","trixie-security":"145.0.7632.159-1~deb13u1"},"fixed_version":"117.0.5938.149-1","urgency":"not yet assigned"}}},"CVE-2023-5472":{"description":"Use after free in Profiles in Google Chrome prior to 118.0.5993.117 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. (Chromium security severity: High)","scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"143.0.7499.169-1~deb12u1","bookworm-security":"145.0.7632.159-1~deb12u1"},"fixed_version":"118.0.5993.117-1~deb12u1","urgency":"not yet assigned"},"bullseye":{"status":"resolved","repositories":{"bullseye":"120.0.6099.224-1~deb11u1","bullseye-security":"120.0.6099.224-1~deb11u1"},"fixed_version":"118.0.5993.117-1~deb11u1","urgency":"not yet assigned"},"forky":{"status":"resolved","repositories":{"forky":"145.0.7632.159-1"},"fixed_version":"118.0.5993.117-1","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"146.0.7680.71-1"},"fixed_version":"118.0.5993.117-1","urgency":"not yet assigned"},"trixie":{"status":"resolved","repositories":{"trixie":"143.0.7499.169-1~deb13u1","trixie-security":"145.0.7632.159-1~deb13u1"},"fixed_version":"118.0.5993.117-1","urgency":"not yet assigned"}}},"CVE-2023-5473":{"description":"Use after free in Cast in Google Chrome prior to 118.0.5993.70 allowed a remote attacker who had compromised the renderer process to potentially exploit heap corruption via a crafted HTML page. (Chromium security severity: Low)","scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"143.0.7499.169-1~deb12u1","bookworm-security":"145.0.7632.159-1~deb12u1"},"fixed_version":"118.0.5993.70-1~deb12u1","urgency":"not yet assigned"},"bullseye":{"status":"resolved","repositories":{"bullseye":"120.0.6099.224-1~deb11u1","bullseye-security":"120.0.6099.224-1~deb11u1"},"fixed_version":"118.0.5993.70-1~deb11u1","urgency":"not yet assigned"},"forky":{"status":"resolved","repositories":{"forky":"145.0.7632.159-1"},"fixed_version":"118.0.5993.70-1","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"146.0.7680.71-1"},"fixed_version":"118.0.5993.70-1","urgency":"not yet assigned"},"trixie":{"status":"resolved","repositories":{"trixie":"143.0.7499.169-1~deb13u1","trixie-security":"145.0.7632.159-1~deb13u1"},"fixed_version":"118.0.5993.70-1","urgency":"not yet assigned"}}},"CVE-2023-5474":{"description":"Heap buffer overflow in PDF in Google Chrome prior to 118.0.5993.70 allowed a remote attacker who convinced a user to engage in specific user interactions to potentially exploit heap corruption via a crafted PDF file. (Chromium security severity: Medium)","scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"143.0.7499.169-1~deb12u1","bookworm-security":"145.0.7632.159-1~deb12u1"},"fixed_version":"118.0.5993.70-1~deb12u1","urgency":"not yet assigned"},"bullseye":{"status":"resolved","repositories":{"bullseye":"120.0.6099.224-1~deb11u1","bullseye-security":"120.0.6099.224-1~deb11u1"},"fixed_version":"118.0.5993.70-1~deb11u1","urgency":"not yet assigned"},"forky":{"status":"resolved","repositories":{"forky":"145.0.7632.159-1"},"fixed_version":"118.0.5993.70-1","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"146.0.7680.71-1"},"fixed_version":"118.0.5993.70-1","urgency":"not yet assigned"},"trixie":{"status":"resolved","repositories":{"trixie":"143.0.7499.169-1~deb13u1","trixie-security":"145.0.7632.159-1~deb13u1"},"fixed_version":"118.0.5993.70-1","urgency":"not yet assigned"}}},"CVE-2023-5475":{"description":"Inappropriate implementation in DevTools in Google Chrome prior to 118.0.5993.70 allowed an attacker who convinced a user to install a malicious extension to bypass discretionary access control via a crafted Chrome Extension. (Chromium security severity: Medium)","scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"143.0.7499.169-1~deb12u1","bookworm-security":"145.0.7632.159-1~deb12u1"},"fixed_version":"118.0.5993.70-1~deb12u1","urgency":"not yet assigned"},"bullseye":{"status":"resolved","repositories":{"bullseye":"120.0.6099.224-1~deb11u1","bullseye-security":"120.0.6099.224-1~deb11u1"},"fixed_version":"118.0.5993.70-1~deb11u1","urgency":"not yet assigned"},"forky":{"status":"resolved","repositories":{"forky":"145.0.7632.159-1"},"fixed_version":"118.0.5993.70-1","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"146.0.7680.71-1"},"fixed_version":"118.0.5993.70-1","urgency":"not yet assigned"},"trixie":{"status":"resolved","repositories":{"trixie":"143.0.7499.169-1~deb13u1","trixie-security":"145.0.7632.159-1~deb13u1"},"fixed_version":"118.0.5993.70-1","urgency":"not yet assigned"}}},"CVE-2023-5476":{"description":"Use after free in Blink History in Google Chrome prior to 118.0.5993.70 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. (Chromium security severity: Medium)","scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"143.0.7499.169-1~deb12u1","bookworm-security":"145.0.7632.159-1~deb12u1"},"fixed_version":"118.0.5993.70-1~deb12u1","urgency":"not yet assigned"},"bullseye":{"status":"resolved","repositories":{"bullseye":"120.0.6099.224-1~deb11u1","bullseye-security":"120.0.6099.224-1~deb11u1"},"fixed_version":"118.0.5993.70-1~deb11u1","urgency":"not yet assigned"},"forky":{"status":"resolved","repositories":{"forky":"145.0.7632.159-1"},"fixed_version":"118.0.5993.70-1","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"146.0.7680.71-1"},"fixed_version":"118.0.5993.70-1","urgency":"not yet assigned"},"trixie":{"status":"resolved","repositories":{"trixie":"143.0.7499.169-1~deb13u1","trixie-security":"145.0.7632.159-1~deb13u1"},"fixed_version":"118.0.5993.70-1","urgency":"not yet assigned"}}},"CVE-2023-5477":{"description":"Inappropriate implementation in Installer in Google Chrome prior to 118.0.5993.70 allowed a local attacker to bypass discretionary access control via a crafted command. (Chromium security severity: Low)","scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"143.0.7499.169-1~deb12u1","bookworm-security":"145.0.7632.159-1~deb12u1"},"fixed_version":"118.0.5993.70-1~deb12u1","urgency":"not yet assigned"},"bullseye":{"status":"resolved","repositories":{"bullseye":"120.0.6099.224-1~deb11u1","bullseye-security":"120.0.6099.224-1~deb11u1"},"fixed_version":"118.0.5993.70-1~deb11u1","urgency":"not yet assigned"},"forky":{"status":"resolved","repositories":{"forky":"145.0.7632.159-1"},"fixed_version":"118.0.5993.70-1","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"146.0.7680.71-1"},"fixed_version":"118.0.5993.70-1","urgency":"not yet assigned"},"trixie":{"status":"resolved","repositories":{"trixie":"143.0.7499.169-1~deb13u1","trixie-security":"145.0.7632.159-1~deb13u1"},"fixed_version":"118.0.5993.70-1","urgency":"not yet assigned"}}},"CVE-2023-5478":{"description":"Inappropriate implementation in Autofill in Google Chrome prior to 118.0.5993.70 allowed a remote attacker to leak cross-origin data via a crafted HTML page. (Chromium security severity: Low)","scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"143.0.7499.169-1~deb12u1","bookworm-security":"145.0.7632.159-1~deb12u1"},"fixed_version":"118.0.5993.70-1~deb12u1","urgency":"not yet assigned"},"bullseye":{"status":"resolved","repositories":{"bullseye":"120.0.6099.224-1~deb11u1","bullseye-security":"120.0.6099.224-1~deb11u1"},"fixed_version":"118.0.5993.70-1~deb11u1","urgency":"not yet assigned"},"forky":{"status":"resolved","repositories":{"forky":"145.0.7632.159-1"},"fixed_version":"118.0.5993.70-1","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"146.0.7680.71-1"},"fixed_version":"118.0.5993.70-1","urgency":"not yet assigned"},"trixie":{"status":"resolved","repositories":{"trixie":"143.0.7499.169-1~deb13u1","trixie-security":"145.0.7632.159-1~deb13u1"},"fixed_version":"118.0.5993.70-1","urgency":"not yet assigned"}}},"CVE-2023-5479":{"description":"Inappropriate implementation in Extensions API in Google Chrome prior to 118.0.5993.70 allowed an attacker who convinced a user to install a malicious extension to bypass an enterprise policy via a crafted HTML page. (Chromium security severity: Medium)","scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"143.0.7499.169-1~deb12u1","bookworm-security":"145.0.7632.159-1~deb12u1"},"fixed_version":"118.0.5993.70-1~deb12u1","urgency":"not yet assigned"},"bullseye":{"status":"resolved","repositories":{"bullseye":"120.0.6099.224-1~deb11u1","bullseye-security":"120.0.6099.224-1~deb11u1"},"fixed_version":"118.0.5993.70-1~deb11u1","urgency":"not yet assigned"},"forky":{"status":"resolved","repositories":{"forky":"145.0.7632.159-1"},"fixed_version":"118.0.5993.70-1","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"146.0.7680.71-1"},"fixed_version":"118.0.5993.70-1","urgency":"not yet assigned"},"trixie":{"status":"resolved","repositories":{"trixie":"143.0.7499.169-1~deb13u1","trixie-security":"145.0.7632.159-1~deb13u1"},"fixed_version":"118.0.5993.70-1","urgency":"not yet assigned"}}},"CVE-2023-5480":{"description":"Inappropriate implementation in Payments in Google Chrome prior to 119.0.6045.105 allowed a remote attacker to bypass XSS preventions via a malicious file. (Chromium security severity: High)","scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"143.0.7499.169-1~deb12u1","bookworm-security":"145.0.7632.159-1~deb12u1"},"fixed_version":"119.0.6045.105-1~deb12u1","urgency":"not yet assigned"},"bullseye":{"status":"resolved","repositories":{"bullseye":"120.0.6099.224-1~deb11u1","bullseye-security":"120.0.6099.224-1~deb11u1"},"fixed_version":"119.0.6045.105-1~deb11u1","urgency":"not yet assigned"},"forky":{"status":"resolved","repositories":{"forky":"145.0.7632.159-1"},"fixed_version":"119.0.6045.105-1","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"146.0.7680.71-1"},"fixed_version":"119.0.6045.105-1","urgency":"not yet assigned"},"trixie":{"status":"resolved","repositories":{"trixie":"143.0.7499.169-1~deb13u1","trixie-security":"145.0.7632.159-1~deb13u1"},"fixed_version":"119.0.6045.105-1","urgency":"not yet assigned"}}},"CVE-2023-5481":{"description":"Inappropriate implementation in Downloads in Google Chrome prior to 118.0.5993.70 allowed a remote attacker to spoof security UI via a crafted HTML page. (Chromium security severity: Medium)","scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"143.0.7499.169-1~deb12u1","bookworm-security":"145.0.7632.159-1~deb12u1"},"fixed_version":"118.0.5993.70-1~deb12u1","urgency":"not yet assigned"},"bullseye":{"status":"resolved","repositories":{"bullseye":"120.0.6099.224-1~deb11u1","bullseye-security":"120.0.6099.224-1~deb11u1"},"fixed_version":"118.0.5993.70-1~deb11u1","urgency":"not yet assigned"},"forky":{"status":"resolved","repositories":{"forky":"145.0.7632.159-1"},"fixed_version":"118.0.5993.70-1","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"146.0.7680.71-1"},"fixed_version":"118.0.5993.70-1","urgency":"not yet assigned"},"trixie":{"status":"resolved","repositories":{"trixie":"143.0.7499.169-1~deb13u1","trixie-security":"145.0.7632.159-1~deb13u1"},"fixed_version":"118.0.5993.70-1","urgency":"not yet assigned"}}},"CVE-2023-5482":{"description":"Insufficient data validation in USB in Google Chrome prior to 119.0.6045.105 allowed a remote attacker to perform out of bounds memory access via a crafted HTML page. (Chromium security severity: High)","scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"143.0.7499.169-1~deb12u1","bookworm-security":"145.0.7632.159-1~deb12u1"},"fixed_version":"119.0.6045.105-1~deb12u1","urgency":"not yet assigned"},"bullseye":{"status":"resolved","repositories":{"bullseye":"120.0.6099.224-1~deb11u1","bullseye-security":"120.0.6099.224-1~deb11u1"},"fixed_version":"119.0.6045.105-1~deb11u1","urgency":"not yet assigned"},"forky":{"status":"resolved","repositories":{"forky":"145.0.7632.159-1"},"fixed_version":"119.0.6045.105-1","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"146.0.7680.71-1"},"fixed_version":"119.0.6045.105-1","urgency":"not yet assigned"},"trixie":{"status":"resolved","repositories":{"trixie":"143.0.7499.169-1~deb13u1","trixie-security":"145.0.7632.159-1~deb13u1"},"fixed_version":"119.0.6045.105-1","urgency":"not yet assigned"}}},"CVE-2023-5483":{"description":"Inappropriate implementation in Intents in Google Chrome prior to 118.0.5993.70 allowed a remote attacker to bypass content security policy via a crafted HTML page. (Chromium security severity: Medium)","scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"143.0.7499.169-1~deb12u1","bookworm-security":"145.0.7632.159-1~deb12u1"},"fixed_version":"118.0.5993.70-1~deb12u1","urgency":"not yet assigned"},"bullseye":{"status":"resolved","repositories":{"bullseye":"120.0.6099.224-1~deb11u1","bullseye-security":"120.0.6099.224-1~deb11u1"},"fixed_version":"118.0.5993.70-1~deb11u1","urgency":"not yet assigned"},"forky":{"status":"resolved","repositories":{"forky":"145.0.7632.159-1"},"fixed_version":"118.0.5993.70-1","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"146.0.7680.71-1"},"fixed_version":"118.0.5993.70-1","urgency":"not yet assigned"},"trixie":{"status":"resolved","repositories":{"trixie":"143.0.7499.169-1~deb13u1","trixie-security":"145.0.7632.159-1~deb13u1"},"fixed_version":"118.0.5993.70-1","urgency":"not yet assigned"}}},"CVE-2023-5484":{"description":"Inappropriate implementation in Navigation in Google Chrome prior to 118.0.5993.70 allowed a remote attacker to spoof security UI via a crafted HTML page. (Chromium security severity: Medium)","scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"143.0.7499.169-1~deb12u1","bookworm-security":"145.0.7632.159-1~deb12u1"},"fixed_version":"118.0.5993.70-1~deb12u1","urgency":"not yet assigned"},"bullseye":{"status":"resolved","repositories":{"bullseye":"120.0.6099.224-1~deb11u1","bullseye-security":"120.0.6099.224-1~deb11u1"},"fixed_version":"118.0.5993.70-1~deb11u1","urgency":"not yet assigned"},"forky":{"status":"resolved","repositories":{"forky":"145.0.7632.159-1"},"fixed_version":"118.0.5993.70-1","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"146.0.7680.71-1"},"fixed_version":"118.0.5993.70-1","urgency":"not yet assigned"},"trixie":{"status":"resolved","repositories":{"trixie":"143.0.7499.169-1~deb13u1","trixie-security":"145.0.7632.159-1~deb13u1"},"fixed_version":"118.0.5993.70-1","urgency":"not yet assigned"}}},"CVE-2023-5485":{"description":"Inappropriate implementation in Autofill in Google Chrome prior to 118.0.5993.70 allowed a remote attacker to bypass autofill restrictions via a crafted HTML page. (Chromium security severity: Low)","scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"143.0.7499.169-1~deb12u1","bookworm-security":"145.0.7632.159-1~deb12u1"},"fixed_version":"118.0.5993.70-1~deb12u1","urgency":"not yet assigned"},"bullseye":{"status":"resolved","repositories":{"bullseye":"120.0.6099.224-1~deb11u1","bullseye-security":"120.0.6099.224-1~deb11u1"},"fixed_version":"118.0.5993.70-1~deb11u1","urgency":"not yet assigned"},"forky":{"status":"resolved","repositories":{"forky":"145.0.7632.159-1"},"fixed_version":"118.0.5993.70-1","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"146.0.7680.71-1"},"fixed_version":"118.0.5993.70-1","urgency":"not yet assigned"},"trixie":{"status":"resolved","repositories":{"trixie":"143.0.7499.169-1~deb13u1","trixie-security":"145.0.7632.159-1~deb13u1"},"fixed_version":"118.0.5993.70-1","urgency":"not yet assigned"}}},"CVE-2023-5486":{"description":"Inappropriate implementation in Input in Google Chrome prior to 118.0.5993.70 allowed a remote attacker to spoof security UI via a crafted HTML page. (Chromium security severity: Low)","scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"143.0.7499.169-1~deb12u1","bookworm-security":"145.0.7632.159-1~deb12u1"},"fixed_version":"118.0.5993.70-1~deb12u1","urgency":"not yet assigned"},"bullseye":{"status":"resolved","repositories":{"bullseye":"120.0.6099.224-1~deb11u1","bullseye-security":"120.0.6099.224-1~deb11u1"},"fixed_version":"118.0.5993.70-1~deb11u1","urgency":"not yet assigned"},"forky":{"status":"resolved","repositories":{"forky":"145.0.7632.159-1"},"fixed_version":"118.0.5993.70-1","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"146.0.7680.71-1"},"fixed_version":"118.0.5993.70-1","urgency":"not yet assigned"},"trixie":{"status":"resolved","repositories":{"trixie":"143.0.7499.169-1~deb13u1","trixie-security":"145.0.7632.159-1~deb13u1"},"fixed_version":"118.0.5993.70-1","urgency":"not yet assigned"}}},"CVE-2023-5487":{"description":"Inappropriate implementation in Fullscreen in Google Chrome prior to 118.0.5993.70 allowed an attacker who convinced a user to install a malicious extension to bypass navigation restrictions via a crafted Chrome Extension. (Chromium security severity: Medium)","scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"143.0.7499.169-1~deb12u1","bookworm-security":"145.0.7632.159-1~deb12u1"},"fixed_version":"118.0.5993.70-1~deb12u1","urgency":"not yet assigned"},"bullseye":{"status":"resolved","repositories":{"bullseye":"120.0.6099.224-1~deb11u1","bullseye-security":"120.0.6099.224-1~deb11u1"},"fixed_version":"118.0.5993.70-1~deb11u1","urgency":"not yet assigned"},"forky":{"status":"resolved","repositories":{"forky":"145.0.7632.159-1"},"fixed_version":"118.0.5993.70-1","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"146.0.7680.71-1"},"fixed_version":"118.0.5993.70-1","urgency":"not yet assigned"},"trixie":{"status":"resolved","repositories":{"trixie":"143.0.7499.169-1~deb13u1","trixie-security":"145.0.7632.159-1~deb13u1"},"fixed_version":"118.0.5993.70-1","urgency":"not yet assigned"}}},"CVE-2023-5849":{"description":"Integer overflow in USB in Google Chrome prior to 119.0.6045.105 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. (Chromium security severity: High)","scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"143.0.7499.169-1~deb12u1","bookworm-security":"145.0.7632.159-1~deb12u1"},"fixed_version":"119.0.6045.105-1~deb12u1","urgency":"not yet assigned"},"bullseye":{"status":"resolved","repositories":{"bullseye":"120.0.6099.224-1~deb11u1","bullseye-security":"120.0.6099.224-1~deb11u1"},"fixed_version":"119.0.6045.105-1~deb11u1","urgency":"not yet assigned"},"forky":{"status":"resolved","repositories":{"forky":"145.0.7632.159-1"},"fixed_version":"119.0.6045.105-1","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"146.0.7680.71-1"},"fixed_version":"119.0.6045.105-1","urgency":"not yet assigned"},"trixie":{"status":"resolved","repositories":{"trixie":"143.0.7499.169-1~deb13u1","trixie-security":"145.0.7632.159-1~deb13u1"},"fixed_version":"119.0.6045.105-1","urgency":"not yet assigned"}}},"CVE-2023-5850":{"description":"Incorrect security UI in Downloads in Google Chrome prior to 119.0.6045.105 allowed a remote attacker to perform domain spoofing via a crafted domain name. (Chromium security severity: Medium)","scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"143.0.7499.169-1~deb12u1","bookworm-security":"145.0.7632.159-1~deb12u1"},"fixed_version":"119.0.6045.105-1~deb12u1","urgency":"not yet assigned"},"bullseye":{"status":"resolved","repositories":{"bullseye":"120.0.6099.224-1~deb11u1","bullseye-security":"120.0.6099.224-1~deb11u1"},"fixed_version":"119.0.6045.105-1~deb11u1","urgency":"not yet assigned"},"forky":{"status":"resolved","repositories":{"forky":"145.0.7632.159-1"},"fixed_version":"119.0.6045.105-1","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"146.0.7680.71-1"},"fixed_version":"119.0.6045.105-1","urgency":"not yet assigned"},"trixie":{"status":"resolved","repositories":{"trixie":"143.0.7499.169-1~deb13u1","trixie-security":"145.0.7632.159-1~deb13u1"},"fixed_version":"119.0.6045.105-1","urgency":"not yet assigned"}}},"CVE-2023-5851":{"description":"Inappropriate implementation in Downloads in Google Chrome prior to 119.0.6045.105 allowed a remote attacker to obfuscate security UI via a crafted HTML page. (Chromium security severity: Medium)","scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"143.0.7499.169-1~deb12u1","bookworm-security":"145.0.7632.159-1~deb12u1"},"fixed_version":"119.0.6045.105-1~deb12u1","urgency":"not yet assigned"},"bullseye":{"status":"resolved","repositories":{"bullseye":"120.0.6099.224-1~deb11u1","bullseye-security":"120.0.6099.224-1~deb11u1"},"fixed_version":"119.0.6045.105-1~deb11u1","urgency":"not yet assigned"},"forky":{"status":"resolved","repositories":{"forky":"145.0.7632.159-1"},"fixed_version":"119.0.6045.105-1","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"146.0.7680.71-1"},"fixed_version":"119.0.6045.105-1","urgency":"not yet assigned"},"trixie":{"status":"resolved","repositories":{"trixie":"143.0.7499.169-1~deb13u1","trixie-security":"145.0.7632.159-1~deb13u1"},"fixed_version":"119.0.6045.105-1","urgency":"not yet assigned"}}},"CVE-2023-5852":{"description":"Use after free in Printing in Google Chrome prior to 119.0.6045.105 allowed a remote attacker who convinced a user to engage in specific UI gestures to potentially exploit heap corruption via specific UI gestures. (Chromium security severity: Medium)","scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"143.0.7499.169-1~deb12u1","bookworm-security":"145.0.7632.159-1~deb12u1"},"fixed_version":"119.0.6045.105-1~deb12u1","urgency":"not yet assigned"},"bullseye":{"status":"resolved","repositories":{"bullseye":"120.0.6099.224-1~deb11u1","bullseye-security":"120.0.6099.224-1~deb11u1"},"fixed_version":"119.0.6045.105-1~deb11u1","urgency":"not yet assigned"},"forky":{"status":"resolved","repositories":{"forky":"145.0.7632.159-1"},"fixed_version":"119.0.6045.105-1","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"146.0.7680.71-1"},"fixed_version":"119.0.6045.105-1","urgency":"not yet assigned"},"trixie":{"status":"resolved","repositories":{"trixie":"143.0.7499.169-1~deb13u1","trixie-security":"145.0.7632.159-1~deb13u1"},"fixed_version":"119.0.6045.105-1","urgency":"not yet assigned"}}},"CVE-2023-5853":{"description":"Incorrect security UI in Downloads in Google Chrome prior to 119.0.6045.105 allowed a remote attacker to obfuscate security UI via a crafted HTML page. (Chromium security severity: Medium)","scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"143.0.7499.169-1~deb12u1","bookworm-security":"145.0.7632.159-1~deb12u1"},"fixed_version":"119.0.6045.105-1~deb12u1","urgency":"not yet assigned"},"bullseye":{"status":"resolved","repositories":{"bullseye":"120.0.6099.224-1~deb11u1","bullseye-security":"120.0.6099.224-1~deb11u1"},"fixed_version":"119.0.6045.105-1~deb11u1","urgency":"not yet assigned"},"forky":{"status":"resolved","repositories":{"forky":"145.0.7632.159-1"},"fixed_version":"119.0.6045.105-1","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"146.0.7680.71-1"},"fixed_version":"119.0.6045.105-1","urgency":"not yet assigned"},"trixie":{"status":"resolved","repositories":{"trixie":"143.0.7499.169-1~deb13u1","trixie-security":"145.0.7632.159-1~deb13u1"},"fixed_version":"119.0.6045.105-1","urgency":"not yet assigned"}}},"CVE-2023-5854":{"description":"Use after free in Profiles in Google Chrome prior to 119.0.6045.105 allowed a remote attacker who convinced a user to engage in specific UI gestures to potentially exploit heap corruption via specific UI gestures. (Chromium security severity: Medium)","scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"143.0.7499.169-1~deb12u1","bookworm-security":"145.0.7632.159-1~deb12u1"},"fixed_version":"119.0.6045.105-1~deb12u1","urgency":"not yet assigned"},"bullseye":{"status":"resolved","repositories":{"bullseye":"120.0.6099.224-1~deb11u1","bullseye-security":"120.0.6099.224-1~deb11u1"},"fixed_version":"119.0.6045.105-1~deb11u1","urgency":"not yet assigned"},"forky":{"status":"resolved","repositories":{"forky":"145.0.7632.159-1"},"fixed_version":"119.0.6045.105-1","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"146.0.7680.71-1"},"fixed_version":"119.0.6045.105-1","urgency":"not yet assigned"},"trixie":{"status":"resolved","repositories":{"trixie":"143.0.7499.169-1~deb13u1","trixie-security":"145.0.7632.159-1~deb13u1"},"fixed_version":"119.0.6045.105-1","urgency":"not yet assigned"}}},"CVE-2023-5855":{"description":"Use after free in Reading Mode in Google Chrome prior to 119.0.6045.105 allowed a remote attacker who convinced a user to engage in specific UI gestures to potentially exploit heap corruption via specific UI gestures. (Chromium security severity: Medium)","scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"143.0.7499.169-1~deb12u1","bookworm-security":"145.0.7632.159-1~deb12u1"},"fixed_version":"119.0.6045.105-1~deb12u1","urgency":"not yet assigned"},"bullseye":{"status":"resolved","repositories":{"bullseye":"120.0.6099.224-1~deb11u1","bullseye-security":"120.0.6099.224-1~deb11u1"},"fixed_version":"119.0.6045.105-1~deb11u1","urgency":"not yet assigned"},"forky":{"status":"resolved","repositories":{"forky":"145.0.7632.159-1"},"fixed_version":"119.0.6045.105-1","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"146.0.7680.71-1"},"fixed_version":"119.0.6045.105-1","urgency":"not yet assigned"},"trixie":{"status":"resolved","repositories":{"trixie":"143.0.7499.169-1~deb13u1","trixie-security":"145.0.7632.159-1~deb13u1"},"fixed_version":"119.0.6045.105-1","urgency":"not yet assigned"}}},"CVE-2023-5856":{"description":"Use after free in Side Panel in Google Chrome prior to 119.0.6045.105 allowed a remote attacker who convinced a user to engage in specific UI gestures to potentially exploit heap corruption via a crafted HTML page. (Chromium security severity: Medium)","scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"143.0.7499.169-1~deb12u1","bookworm-security":"145.0.7632.159-1~deb12u1"},"fixed_version":"119.0.6045.105-1~deb12u1","urgency":"not yet assigned"},"bullseye":{"status":"resolved","repositories":{"bullseye":"120.0.6099.224-1~deb11u1","bullseye-security":"120.0.6099.224-1~deb11u1"},"fixed_version":"119.0.6045.105-1~deb11u1","urgency":"not yet assigned"},"forky":{"status":"resolved","repositories":{"forky":"145.0.7632.159-1"},"fixed_version":"119.0.6045.105-1","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"146.0.7680.71-1"},"fixed_version":"119.0.6045.105-1","urgency":"not yet assigned"},"trixie":{"status":"resolved","repositories":{"trixie":"143.0.7499.169-1~deb13u1","trixie-security":"145.0.7632.159-1~deb13u1"},"fixed_version":"119.0.6045.105-1","urgency":"not yet assigned"}}},"CVE-2023-5857":{"description":"Inappropriate implementation in Downloads in Google Chrome prior to 119.0.6045.105 allowed a remote attacker to potentially execute arbitrary code via a malicious file. (Chromium security severity: Medium)","scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"143.0.7499.169-1~deb12u1","bookworm-security":"145.0.7632.159-1~deb12u1"},"fixed_version":"119.0.6045.105-1~deb12u1","urgency":"not yet assigned"},"bullseye":{"status":"resolved","repositories":{"bullseye":"120.0.6099.224-1~deb11u1","bullseye-security":"120.0.6099.224-1~deb11u1"},"fixed_version":"119.0.6045.105-1~deb11u1","urgency":"not yet assigned"},"forky":{"status":"resolved","repositories":{"forky":"145.0.7632.159-1"},"fixed_version":"119.0.6045.105-1","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"146.0.7680.71-1"},"fixed_version":"119.0.6045.105-1","urgency":"not yet assigned"},"trixie":{"status":"resolved","repositories":{"trixie":"143.0.7499.169-1~deb13u1","trixie-security":"145.0.7632.159-1~deb13u1"},"fixed_version":"119.0.6045.105-1","urgency":"not yet assigned"}}},"CVE-2023-5858":{"description":"Inappropriate implementation in WebApp Provider in Google Chrome prior to 119.0.6045.105 allowed a remote attacker to obfuscate security UI via a crafted HTML page. (Chromium security severity: Low)","scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"143.0.7499.169-1~deb12u1","bookworm-security":"145.0.7632.159-1~deb12u1"},"fixed_version":"119.0.6045.105-1~deb12u1","urgency":"not yet assigned"},"bullseye":{"status":"resolved","repositories":{"bullseye":"120.0.6099.224-1~deb11u1","bullseye-security":"120.0.6099.224-1~deb11u1"},"fixed_version":"119.0.6045.105-1~deb11u1","urgency":"not yet assigned"},"forky":{"status":"resolved","repositories":{"forky":"145.0.7632.159-1"},"fixed_version":"119.0.6045.105-1","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"146.0.7680.71-1"},"fixed_version":"119.0.6045.105-1","urgency":"not yet assigned"},"trixie":{"status":"resolved","repositories":{"trixie":"143.0.7499.169-1~deb13u1","trixie-security":"145.0.7632.159-1~deb13u1"},"fixed_version":"119.0.6045.105-1","urgency":"not yet assigned"}}},"CVE-2023-5859":{"description":"Incorrect security UI in Picture In Picture in Google Chrome prior to 119.0.6045.105 allowed a remote attacker to perform domain spoofing via a crafted local HTML page. (Chromium security severity: Low)","scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"143.0.7499.169-1~deb12u1","bookworm-security":"145.0.7632.159-1~deb12u1"},"fixed_version":"119.0.6045.105-1~deb12u1","urgency":"not yet assigned"},"bullseye":{"status":"resolved","repositories":{"bullseye":"120.0.6099.224-1~deb11u1","bullseye-security":"120.0.6099.224-1~deb11u1"},"fixed_version":"119.0.6045.105-1~deb11u1","urgency":"not yet assigned"},"forky":{"status":"resolved","repositories":{"forky":"145.0.7632.159-1"},"fixed_version":"119.0.6045.105-1","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"146.0.7680.71-1"},"fixed_version":"119.0.6045.105-1","urgency":"not yet assigned"},"trixie":{"status":"resolved","repositories":{"trixie":"143.0.7499.169-1~deb13u1","trixie-security":"145.0.7632.159-1~deb13u1"},"fixed_version":"119.0.6045.105-1","urgency":"not yet assigned"}}},"CVE-2023-5996":{"description":"Use after free in WebAudio in Google Chrome prior to 119.0.6045.123 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. (Chromium security severity: High)","scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"143.0.7499.169-1~deb12u1","bookworm-security":"145.0.7632.159-1~deb12u1"},"fixed_version":"119.0.6045.123-1~deb12u1","urgency":"not yet assigned"},"bullseye":{"status":"resolved","repositories":{"bullseye":"120.0.6099.224-1~deb11u1","bullseye-security":"120.0.6099.224-1~deb11u1"},"fixed_version":"119.0.6045.123-1~deb11u1","urgency":"not yet assigned"},"forky":{"status":"resolved","repositories":{"forky":"145.0.7632.159-1"},"fixed_version":"119.0.6045.123-1","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"146.0.7680.71-1"},"fixed_version":"119.0.6045.123-1","urgency":"not yet assigned"},"trixie":{"status":"resolved","repositories":{"trixie":"143.0.7499.169-1~deb13u1","trixie-security":"145.0.7632.159-1~deb13u1"},"fixed_version":"119.0.6045.123-1","urgency":"not yet assigned"}}},"CVE-2023-5997":{"description":"Use after free in Garbage Collection in Google Chrome prior to 119.0.6045.159 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. (Chromium security severity: High)","scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"143.0.7499.169-1~deb12u1","bookworm-security":"145.0.7632.159-1~deb12u1"},"fixed_version":"119.0.6045.159-1~deb12u1","urgency":"not yet assigned"},"bullseye":{"status":"resolved","repositories":{"bullseye":"120.0.6099.224-1~deb11u1","bullseye-security":"120.0.6099.224-1~deb11u1"},"fixed_version":"119.0.6045.159-1~deb11u1","urgency":"not yet assigned"},"forky":{"status":"resolved","repositories":{"forky":"145.0.7632.159-1"},"fixed_version":"119.0.6045.159-1","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"146.0.7680.71-1"},"fixed_version":"119.0.6045.159-1","urgency":"not yet assigned"},"trixie":{"status":"resolved","repositories":{"trixie":"143.0.7499.169-1~deb13u1","trixie-security":"145.0.7632.159-1~deb13u1"},"fixed_version":"119.0.6045.159-1","urgency":"not yet assigned"}}},"CVE-2023-6112":{"description":"Use after free in Navigation in Google Chrome prior to 119.0.6045.159 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. (Chromium security severity: High)","scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"143.0.7499.169-1~deb12u1","bookworm-security":"145.0.7632.159-1~deb12u1"},"fixed_version":"119.0.6045.159-1~deb12u1","urgency":"not yet assigned"},"bullseye":{"status":"resolved","repositories":{"bullseye":"120.0.6099.224-1~deb11u1","bullseye-security":"120.0.6099.224-1~deb11u1"},"fixed_version":"119.0.6045.159-1~deb11u1","urgency":"not yet assigned"},"forky":{"status":"resolved","repositories":{"forky":"145.0.7632.159-1"},"fixed_version":"119.0.6045.159-1","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"146.0.7680.71-1"},"fixed_version":"119.0.6045.159-1","urgency":"not yet assigned"},"trixie":{"status":"resolved","repositories":{"trixie":"143.0.7499.169-1~deb13u1","trixie-security":"145.0.7632.159-1~deb13u1"},"fixed_version":"119.0.6045.159-1","urgency":"not yet assigned"}}},"CVE-2023-6345":{"description":"Integer overflow in Skia in Google Chrome prior to 119.0.6045.199 allowed a remote attacker who had compromised the renderer process to potentially perform a sandbox escape via a malicious file. (Chromium security severity: High)","scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"143.0.7499.169-1~deb12u1","bookworm-security":"145.0.7632.159-1~deb12u1"},"fixed_version":"119.0.6045.199-1~deb12u1","urgency":"not yet assigned"},"bullseye":{"status":"resolved","repositories":{"bullseye":"120.0.6099.224-1~deb11u1","bullseye-security":"120.0.6099.224-1~deb11u1"},"fixed_version":"119.0.6045.199-1~deb11u1","urgency":"not yet assigned"},"forky":{"status":"resolved","repositories":{"forky":"145.0.7632.159-1"},"fixed_version":"119.0.6045.199-1","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"146.0.7680.71-1"},"fixed_version":"119.0.6045.199-1","urgency":"not yet assigned"},"trixie":{"status":"resolved","repositories":{"trixie":"143.0.7499.169-1~deb13u1","trixie-security":"145.0.7632.159-1~deb13u1"},"fixed_version":"119.0.6045.199-1","urgency":"not yet assigned"}}},"CVE-2023-6346":{"description":"Use after free in WebAudio in Google Chrome prior to 119.0.6045.199 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. (Chromium security severity: High)","scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"143.0.7499.169-1~deb12u1","bookworm-security":"145.0.7632.159-1~deb12u1"},"fixed_version":"119.0.6045.199-1~deb12u1","urgency":"not yet assigned"},"bullseye":{"status":"resolved","repositories":{"bullseye":"120.0.6099.224-1~deb11u1","bullseye-security":"120.0.6099.224-1~deb11u1"},"fixed_version":"119.0.6045.199-1~deb11u1","urgency":"not yet assigned"},"forky":{"status":"resolved","repositories":{"forky":"145.0.7632.159-1"},"fixed_version":"119.0.6045.199-1","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"146.0.7680.71-1"},"fixed_version":"119.0.6045.199-1","urgency":"not yet assigned"},"trixie":{"status":"resolved","repositories":{"trixie":"143.0.7499.169-1~deb13u1","trixie-security":"145.0.7632.159-1~deb13u1"},"fixed_version":"119.0.6045.199-1","urgency":"not yet assigned"}}},"CVE-2023-6347":{"description":"Use after free in Mojo in Google Chrome prior to 119.0.6045.199 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. (Chromium security severity: High)","scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"143.0.7499.169-1~deb12u1","bookworm-security":"145.0.7632.159-1~deb12u1"},"fixed_version":"119.0.6045.199-1~deb12u1","urgency":"not yet assigned"},"bullseye":{"status":"resolved","repositories":{"bullseye":"120.0.6099.224-1~deb11u1","bullseye-security":"120.0.6099.224-1~deb11u1"},"fixed_version":"119.0.6045.199-1~deb11u1","urgency":"not yet assigned"},"forky":{"status":"resolved","repositories":{"forky":"145.0.7632.159-1"},"fixed_version":"119.0.6045.199-1","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"146.0.7680.71-1"},"fixed_version":"119.0.6045.199-1","urgency":"not yet assigned"},"trixie":{"status":"resolved","repositories":{"trixie":"143.0.7499.169-1~deb13u1","trixie-security":"145.0.7632.159-1~deb13u1"},"fixed_version":"119.0.6045.199-1","urgency":"not yet assigned"}}},"CVE-2023-6348":{"description":"Type Confusion in Spellcheck in Google Chrome prior to 119.0.6045.199 allowed a remote attacker who had compromised the renderer process to potentially exploit heap corruption via a crafted HTML page. (Chromium security severity: High)","scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"143.0.7499.169-1~deb12u1","bookworm-security":"145.0.7632.159-1~deb12u1"},"fixed_version":"119.0.6045.199-1~deb12u1","urgency":"not yet assigned"},"bullseye":{"status":"resolved","repositories":{"bullseye":"120.0.6099.224-1~deb11u1","bullseye-security":"120.0.6099.224-1~deb11u1"},"fixed_version":"119.0.6045.199-1~deb11u1","urgency":"not yet assigned"},"forky":{"status":"resolved","repositories":{"forky":"145.0.7632.159-1"},"fixed_version":"119.0.6045.199-1","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"146.0.7680.71-1"},"fixed_version":"119.0.6045.199-1","urgency":"not yet assigned"},"trixie":{"status":"resolved","repositories":{"trixie":"143.0.7499.169-1~deb13u1","trixie-security":"145.0.7632.159-1~deb13u1"},"fixed_version":"119.0.6045.199-1","urgency":"not yet assigned"}}},"CVE-2023-6350":{"description":"Use after free in libavif in Google Chrome prior to 119.0.6045.199 allowed a remote attacker to potentially exploit heap corruption via a crafted avif file. (Chromium security severity: High)","scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"143.0.7499.169-1~deb12u1","bookworm-security":"145.0.7632.159-1~deb12u1"},"fixed_version":"119.0.6045.199-1~deb12u1","urgency":"not yet assigned"},"bullseye":{"status":"resolved","repositories":{"bullseye":"120.0.6099.224-1~deb11u1","bullseye-security":"120.0.6099.224-1~deb11u1"},"fixed_version":"119.0.6045.199-1~deb11u1","urgency":"not yet assigned"},"forky":{"status":"resolved","repositories":{"forky":"145.0.7632.159-1"},"fixed_version":"119.0.6045.199-1","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"146.0.7680.71-1"},"fixed_version":"119.0.6045.199-1","urgency":"not yet assigned"},"trixie":{"status":"resolved","repositories":{"trixie":"143.0.7499.169-1~deb13u1","trixie-security":"145.0.7632.159-1~deb13u1"},"fixed_version":"119.0.6045.199-1","urgency":"not yet assigned"}}},"CVE-2023-6351":{"description":"Use after free in libavif in Google Chrome prior to 119.0.6045.199 allowed a remote attacker to potentially exploit heap corruption via a crafted avif file. (Chromium security severity: High)","scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"143.0.7499.169-1~deb12u1","bookworm-security":"145.0.7632.159-1~deb12u1"},"fixed_version":"119.0.6045.199-1~deb12u1","urgency":"not yet assigned"},"bullseye":{"status":"resolved","repositories":{"bullseye":"120.0.6099.224-1~deb11u1","bullseye-security":"120.0.6099.224-1~deb11u1"},"fixed_version":"119.0.6045.199-1~deb11u1","urgency":"not yet assigned"},"forky":{"status":"resolved","repositories":{"forky":"145.0.7632.159-1"},"fixed_version":"119.0.6045.199-1","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"146.0.7680.71-1"},"fixed_version":"119.0.6045.199-1","urgency":"not yet assigned"},"trixie":{"status":"resolved","repositories":{"trixie":"143.0.7499.169-1~deb13u1","trixie-security":"145.0.7632.159-1~deb13u1"},"fixed_version":"119.0.6045.199-1","urgency":"not yet assigned"}}},"CVE-2023-6508":{"description":"Use after free in Media Stream in Google Chrome prior to 120.0.6099.62 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. (Chromium security severity: High)","scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"143.0.7499.169-1~deb12u1","bookworm-security":"145.0.7632.159-1~deb12u1"},"fixed_version":"120.0.6099.71-1~deb12u1","urgency":"not yet assigned"},"bullseye":{"status":"resolved","repositories":{"bullseye":"120.0.6099.224-1~deb11u1","bullseye-security":"120.0.6099.224-1~deb11u1"},"fixed_version":"120.0.6099.71-1~deb11u1","urgency":"not yet assigned"},"forky":{"status":"resolved","repositories":{"forky":"145.0.7632.159-1"},"fixed_version":"120.0.6099.71-1","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"146.0.7680.71-1"},"fixed_version":"120.0.6099.71-1","urgency":"not yet assigned"},"trixie":{"status":"resolved","repositories":{"trixie":"143.0.7499.169-1~deb13u1","trixie-security":"145.0.7632.159-1~deb13u1"},"fixed_version":"120.0.6099.71-1","urgency":"not yet assigned"}}},"CVE-2023-6509":{"description":"Use after free in Side Panel Search in Google Chrome prior to 120.0.6099.62 allowed a remote attacker who convinced a user to engage in specific UI interaction to potentially exploit heap corruption via specific UI interaction. (Chromium security severity: High)","scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"143.0.7499.169-1~deb12u1","bookworm-security":"145.0.7632.159-1~deb12u1"},"fixed_version":"120.0.6099.71-1~deb12u1","urgency":"not yet assigned"},"bullseye":{"status":"resolved","repositories":{"bullseye":"120.0.6099.224-1~deb11u1","bullseye-security":"120.0.6099.224-1~deb11u1"},"fixed_version":"120.0.6099.71-1~deb11u1","urgency":"not yet assigned"},"forky":{"status":"resolved","repositories":{"forky":"145.0.7632.159-1"},"fixed_version":"120.0.6099.71-1","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"146.0.7680.71-1"},"fixed_version":"120.0.6099.71-1","urgency":"not yet assigned"},"trixie":{"status":"resolved","repositories":{"trixie":"143.0.7499.169-1~deb13u1","trixie-security":"145.0.7632.159-1~deb13u1"},"fixed_version":"120.0.6099.71-1","urgency":"not yet assigned"}}},"CVE-2023-6510":{"description":"Use after free in Media Capture in Google Chrome prior to 120.0.6099.62 allowed a remote attacker who convinced a user to engage in specific UI interaction to potentially exploit heap corruption via specific UI interaction. (Chromium security severity: Medium)","scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"143.0.7499.169-1~deb12u1","bookworm-security":"145.0.7632.159-1~deb12u1"},"fixed_version":"120.0.6099.71-1~deb12u1","urgency":"not yet assigned"},"bullseye":{"status":"resolved","repositories":{"bullseye":"120.0.6099.224-1~deb11u1","bullseye-security":"120.0.6099.224-1~deb11u1"},"fixed_version":"120.0.6099.71-1~deb11u1","urgency":"not yet assigned"},"forky":{"status":"resolved","repositories":{"forky":"145.0.7632.159-1"},"fixed_version":"120.0.6099.71-1","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"146.0.7680.71-1"},"fixed_version":"120.0.6099.71-1","urgency":"not yet assigned"},"trixie":{"status":"resolved","repositories":{"trixie":"143.0.7499.169-1~deb13u1","trixie-security":"145.0.7632.159-1~deb13u1"},"fixed_version":"120.0.6099.71-1","urgency":"not yet assigned"}}},"CVE-2023-6511":{"description":"Inappropriate implementation in Autofill in Google Chrome prior to 120.0.6099.62 allowed a remote attacker to bypass Autofill restrictions via a crafted HTML page. (Chromium security severity: Low)","scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"143.0.7499.169-1~deb12u1","bookworm-security":"145.0.7632.159-1~deb12u1"},"fixed_version":"120.0.6099.71-1~deb12u1","urgency":"not yet assigned"},"bullseye":{"status":"resolved","repositories":{"bullseye":"120.0.6099.224-1~deb11u1","bullseye-security":"120.0.6099.224-1~deb11u1"},"fixed_version":"120.0.6099.71-1~deb11u1","urgency":"not yet assigned"},"forky":{"status":"resolved","repositories":{"forky":"145.0.7632.159-1"},"fixed_version":"120.0.6099.71-1","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"146.0.7680.71-1"},"fixed_version":"120.0.6099.71-1","urgency":"not yet assigned"},"trixie":{"status":"resolved","repositories":{"trixie":"143.0.7499.169-1~deb13u1","trixie-security":"145.0.7632.159-1~deb13u1"},"fixed_version":"120.0.6099.71-1","urgency":"not yet assigned"}}},"CVE-2023-6512":{"description":"Inappropriate implementation in Web Browser UI in Google Chrome prior to 120.0.6099.62 allowed a remote attacker to potentially spoof the contents of an iframe dialog context menu via a crafted HTML page. (Chromium security severity: Low)","scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"143.0.7499.169-1~deb12u1","bookworm-security":"145.0.7632.159-1~deb12u1"},"fixed_version":"120.0.6099.71-1~deb12u1","urgency":"not yet assigned"},"bullseye":{"status":"resolved","repositories":{"bullseye":"120.0.6099.224-1~deb11u1","bullseye-security":"120.0.6099.224-1~deb11u1"},"fixed_version":"120.0.6099.71-1~deb11u1","urgency":"not yet assigned"},"forky":{"status":"resolved","repositories":{"forky":"145.0.7632.159-1"},"fixed_version":"120.0.6099.71-1","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"146.0.7680.71-1"},"fixed_version":"120.0.6099.71-1","urgency":"not yet assigned"},"trixie":{"status":"resolved","repositories":{"trixie":"143.0.7499.169-1~deb13u1","trixie-security":"145.0.7632.159-1~deb13u1"},"fixed_version":"120.0.6099.71-1","urgency":"not yet assigned"}}},"CVE-2023-6702":{"description":"Type confusion in V8 in Google Chrome prior to 120.0.6099.109 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. (Chromium security severity: High)","scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"143.0.7499.169-1~deb12u1","bookworm-security":"145.0.7632.159-1~deb12u1"},"fixed_version":"120.0.6099.109-1~deb12u1","urgency":"not yet assigned"},"bullseye":{"status":"resolved","repositories":{"bullseye":"120.0.6099.224-1~deb11u1","bullseye-security":"120.0.6099.224-1~deb11u1"},"fixed_version":"120.0.6099.109-1~deb11u1","urgency":"not yet assigned"},"forky":{"status":"resolved","repositories":{"forky":"145.0.7632.159-1"},"fixed_version":"120.0.6099.109-1","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"146.0.7680.71-1"},"fixed_version":"120.0.6099.109-1","urgency":"not yet assigned"},"trixie":{"status":"resolved","repositories":{"trixie":"143.0.7499.169-1~deb13u1","trixie-security":"145.0.7632.159-1~deb13u1"},"fixed_version":"120.0.6099.109-1","urgency":"not yet assigned"}}},"CVE-2023-6703":{"description":"Use after free in Blink in Google Chrome prior to 120.0.6099.109 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. (Chromium security severity: High)","scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"143.0.7499.169-1~deb12u1","bookworm-security":"145.0.7632.159-1~deb12u1"},"fixed_version":"120.0.6099.109-1~deb12u1","urgency":"not yet assigned"},"bullseye":{"status":"resolved","repositories":{"bullseye":"120.0.6099.224-1~deb11u1","bullseye-security":"120.0.6099.224-1~deb11u1"},"fixed_version":"120.0.6099.109-1~deb11u1","urgency":"not yet assigned"},"forky":{"status":"resolved","repositories":{"forky":"145.0.7632.159-1"},"fixed_version":"120.0.6099.109-1","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"146.0.7680.71-1"},"fixed_version":"120.0.6099.109-1","urgency":"not yet assigned"},"trixie":{"status":"resolved","repositories":{"trixie":"143.0.7499.169-1~deb13u1","trixie-security":"145.0.7632.159-1~deb13u1"},"fixed_version":"120.0.6099.109-1","urgency":"not yet assigned"}}},"CVE-2023-6704":{"description":"Use after free in libavif in Google Chrome prior to 120.0.6099.109 allowed a remote attacker to potentially exploit heap corruption via a crafted image file. (Chromium security severity: High)","scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"143.0.7499.169-1~deb12u1","bookworm-security":"145.0.7632.159-1~deb12u1"},"fixed_version":"120.0.6099.109-1~deb12u1","urgency":"not yet assigned"},"bullseye":{"status":"resolved","repositories":{"bullseye":"120.0.6099.224-1~deb11u1","bullseye-security":"120.0.6099.224-1~deb11u1"},"fixed_version":"120.0.6099.109-1~deb11u1","urgency":"not yet assigned"},"forky":{"status":"resolved","repositories":{"forky":"145.0.7632.159-1"},"fixed_version":"120.0.6099.109-1","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"146.0.7680.71-1"},"fixed_version":"120.0.6099.109-1","urgency":"not yet assigned"},"trixie":{"status":"resolved","repositories":{"trixie":"143.0.7499.169-1~deb13u1","trixie-security":"145.0.7632.159-1~deb13u1"},"fixed_version":"120.0.6099.109-1","urgency":"not yet assigned"}}},"CVE-2023-6705":{"description":"Use after free in WebRTC in Google Chrome prior to 120.0.6099.109 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. (Chromium security severity: High)","scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"143.0.7499.169-1~deb12u1","bookworm-security":"145.0.7632.159-1~deb12u1"},"fixed_version":"120.0.6099.109-1~deb12u1","urgency":"not yet assigned"},"bullseye":{"status":"resolved","repositories":{"bullseye":"120.0.6099.224-1~deb11u1","bullseye-security":"120.0.6099.224-1~deb11u1"},"fixed_version":"120.0.6099.109-1~deb11u1","urgency":"not yet assigned"},"forky":{"status":"resolved","repositories":{"forky":"145.0.7632.159-1"},"fixed_version":"120.0.6099.109-1","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"146.0.7680.71-1"},"fixed_version":"120.0.6099.109-1","urgency":"not yet assigned"},"trixie":{"status":"resolved","repositories":{"trixie":"143.0.7499.169-1~deb13u1","trixie-security":"145.0.7632.159-1~deb13u1"},"fixed_version":"120.0.6099.109-1","urgency":"not yet assigned"}}},"CVE-2023-6706":{"description":"Use after free in FedCM in Google Chrome prior to 120.0.6099.109 allowed a remote attacker who convinced a user to engage in specific UI interaction to potentially exploit heap corruption via a crafted HTML page. (Chromium security severity: High)","scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"143.0.7499.169-1~deb12u1","bookworm-security":"145.0.7632.159-1~deb12u1"},"fixed_version":"120.0.6099.109-1~deb12u1","urgency":"not yet assigned"},"bullseye":{"status":"resolved","repositories":{"bullseye":"120.0.6099.224-1~deb11u1","bullseye-security":"120.0.6099.224-1~deb11u1"},"fixed_version":"120.0.6099.109-1~deb11u1","urgency":"not yet assigned"},"forky":{"status":"resolved","repositories":{"forky":"145.0.7632.159-1"},"fixed_version":"120.0.6099.109-1","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"146.0.7680.71-1"},"fixed_version":"120.0.6099.109-1","urgency":"not yet assigned"},"trixie":{"status":"resolved","repositories":{"trixie":"143.0.7499.169-1~deb13u1","trixie-security":"145.0.7632.159-1~deb13u1"},"fixed_version":"120.0.6099.109-1","urgency":"not yet assigned"}}},"CVE-2023-6707":{"description":"Use after free in CSS in Google Chrome prior to 120.0.6099.109 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. (Chromium security severity: Medium)","scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"143.0.7499.169-1~deb12u1","bookworm-security":"145.0.7632.159-1~deb12u1"},"fixed_version":"120.0.6099.109-1~deb12u1","urgency":"not yet assigned"},"bullseye":{"status":"resolved","repositories":{"bullseye":"120.0.6099.224-1~deb11u1","bullseye-security":"120.0.6099.224-1~deb11u1"},"fixed_version":"120.0.6099.109-1~deb11u1","urgency":"not yet assigned"},"forky":{"status":"resolved","repositories":{"forky":"145.0.7632.159-1"},"fixed_version":"120.0.6099.109-1","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"146.0.7680.71-1"},"fixed_version":"120.0.6099.109-1","urgency":"not yet assigned"},"trixie":{"status":"resolved","repositories":{"trixie":"143.0.7499.169-1~deb13u1","trixie-security":"145.0.7632.159-1~deb13u1"},"fixed_version":"120.0.6099.109-1","urgency":"not yet assigned"}}},"CVE-2023-7010":{"description":"Use after free in WebRTC in Google Chrome prior to 117.0.5938.62 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. (Chromium security severity: High)","scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"143.0.7499.169-1~deb12u1","bookworm-security":"145.0.7632.159-1~deb12u1"},"fixed_version":"117.0.5938.62-1~deb12u1","urgency":"not yet assigned"},"bullseye":{"status":"resolved","repositories":{"bullseye":"120.0.6099.224-1~deb11u1","bullseye-security":"120.0.6099.224-1~deb11u1"},"fixed_version":"117.0.5938.62-1~deb11u1","urgency":"not yet assigned"},"forky":{"status":"resolved","repositories":{"forky":"145.0.7632.159-1"},"fixed_version":"117.0.5938.62-1","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"146.0.7680.71-1"},"fixed_version":"117.0.5938.62-1","urgency":"not yet assigned"},"trixie":{"status":"resolved","repositories":{"trixie":"143.0.7499.169-1~deb13u1","trixie-security":"145.0.7632.159-1~deb13u1"},"fixed_version":"117.0.5938.62-1","urgency":"not yet assigned"}}},"CVE-2023-7011":{"description":"Inappropriate implementation in Picture in Picture in Google Chrome prior to 119.0.6045.105 allowed a remote attacker to spoof the contents of the Omnibox (URL bar) via a crafted HTML page. (Chromium security severity: Medium)","scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"143.0.7499.169-1~deb12u1","bookworm-security":"145.0.7632.159-1~deb12u1"},"fixed_version":"119.0.6045.105-1~deb12u1","urgency":"not yet assigned"},"bullseye":{"status":"resolved","repositories":{"bullseye":"120.0.6099.224-1~deb11u1","bullseye-security":"120.0.6099.224-1~deb11u1"},"fixed_version":"119.0.6045.105-1~deb11u1","urgency":"not yet assigned"},"forky":{"status":"resolved","repositories":{"forky":"145.0.7632.159-1"},"fixed_version":"119.0.6045.105-1","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"146.0.7680.71-1"},"fixed_version":"119.0.6045.105-1","urgency":"not yet assigned"},"trixie":{"status":"resolved","repositories":{"trixie":"143.0.7499.169-1~deb13u1","trixie-security":"145.0.7632.159-1~deb13u1"},"fixed_version":"119.0.6045.105-1","urgency":"not yet assigned"}}},"CVE-2023-7012":{"description":"Insufficient data validation in Permission Prompts in Google Chrome prior to 117.0.5938.62 allowed an attacker who convinced a user to install a malicious app to potentially perform a sandbox escape via a malicious file. (Chromium security severity: Medium)","scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"143.0.7499.169-1~deb12u1","bookworm-security":"145.0.7632.159-1~deb12u1"},"fixed_version":"117.0.5938.62-1~deb12u1","urgency":"not yet assigned"},"bullseye":{"status":"resolved","repositories":{"bullseye":"120.0.6099.224-1~deb11u1","bullseye-security":"120.0.6099.224-1~deb11u1"},"fixed_version":"117.0.5938.62-1~deb11u1","urgency":"not yet assigned"},"forky":{"status":"resolved","repositories":{"forky":"145.0.7632.159-1"},"fixed_version":"117.0.5938.62-1","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"146.0.7680.71-1"},"fixed_version":"117.0.5938.62-1","urgency":"not yet assigned"},"trixie":{"status":"resolved","repositories":{"trixie":"143.0.7499.169-1~deb13u1","trixie-security":"145.0.7632.159-1~deb13u1"},"fixed_version":"117.0.5938.62-1","urgency":"not yet assigned"}}},"CVE-2023-7013":{"description":"Inappropriate implementation in Compositing in Google Chrome prior to 119.0.6045.105 allowed a remote attacker to potentially spoof security UI via a crafted HTML page. (Chromium security severity: Medium)","scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"143.0.7499.169-1~deb12u1","bookworm-security":"145.0.7632.159-1~deb12u1"},"fixed_version":"119.0.6045.105-1~deb12u1","urgency":"not yet assigned"},"bullseye":{"status":"resolved","repositories":{"bullseye":"120.0.6099.224-1~deb11u1","bullseye-security":"120.0.6099.224-1~deb11u1"},"fixed_version":"119.0.6045.105-1~deb11u1","urgency":"not yet assigned"},"forky":{"status":"resolved","repositories":{"forky":"145.0.7632.159-1"},"fixed_version":"119.0.6045.105-1","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"146.0.7680.71-1"},"fixed_version":"119.0.6045.105-1","urgency":"not yet assigned"},"trixie":{"status":"resolved","repositories":{"trixie":"143.0.7499.169-1~deb13u1","trixie-security":"145.0.7632.159-1~deb13u1"},"fixed_version":"119.0.6045.105-1","urgency":"not yet assigned"}}},"CVE-2023-7024":{"description":"Heap buffer overflow in WebRTC in Google Chrome prior to 120.0.6099.129 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. (Chromium security severity: High)","scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"143.0.7499.169-1~deb12u1","bookworm-security":"145.0.7632.159-1~deb12u1"},"fixed_version":"120.0.6099.129-1~deb12u1","urgency":"not yet assigned"},"bullseye":{"status":"resolved","repositories":{"bullseye":"120.0.6099.224-1~deb11u1","bullseye-security":"120.0.6099.224-1~deb11u1"},"fixed_version":"120.0.6099.129-1~deb11u1","urgency":"not yet assigned"},"forky":{"status":"resolved","repositories":{"forky":"145.0.7632.159-1"},"fixed_version":"120.0.6099.129-1","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"146.0.7680.71-1"},"fixed_version":"120.0.6099.129-1","urgency":"not yet assigned"},"trixie":{"status":"resolved","repositories":{"trixie":"143.0.7499.169-1~deb13u1","trixie-security":"145.0.7632.159-1~deb13u1"},"fixed_version":"120.0.6099.129-1","urgency":"not yet assigned"}}},"CVE-2023-7261":{"description":"Inappropriate implementation in Google Updator prior to 1.3.36.351 in Google Chrome allowed a local attacker to perform privilege escalation via a malicious file. (Chromium security severity: High)","scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"143.0.7499.169-1~deb12u1","bookworm-security":"145.0.7632.159-1~deb12u1"},"fixed_version":"0","urgency":"unimportant"},"bullseye":{"status":"resolved","repositories":{"bullseye":"120.0.6099.224-1~deb11u1","bullseye-security":"120.0.6099.224-1~deb11u1"},"fixed_version":"0","urgency":"unimportant"},"forky":{"status":"resolved","repositories":{"forky":"145.0.7632.159-1"},"fixed_version":"0","urgency":"unimportant"},"sid":{"status":"resolved","repositories":{"sid":"146.0.7680.71-1"},"fixed_version":"0","urgency":"unimportant"},"trixie":{"status":"resolved","repositories":{"trixie":"143.0.7499.169-1~deb13u1","trixie-security":"145.0.7632.159-1~deb13u1"},"fixed_version":"0","urgency":"unimportant"}}},"CVE-2023-7281":{"description":"Inappropriate implementation in Compositing in Google Chrome prior to 119.0.6045.105 allowed a remote attacker to perform UI spoofing via a crafted HTML page. (Chromium security severity: Medium)","scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"143.0.7499.169-1~deb12u1","bookworm-security":"145.0.7632.159-1~deb12u1"},"fixed_version":"119.0.6045.105-1~deb12u1","urgency":"not yet assigned"},"bullseye":{"status":"resolved","repositories":{"bullseye":"120.0.6099.224-1~deb11u1","bullseye-security":"120.0.6099.224-1~deb11u1"},"fixed_version":"119.0.6045.105-1~deb11u1","urgency":"not yet assigned"},"forky":{"status":"resolved","repositories":{"forky":"145.0.7632.159-1"},"fixed_version":"119.0.6045.105-1","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"146.0.7680.71-1"},"fixed_version":"119.0.6045.105-1","urgency":"not yet assigned"},"trixie":{"status":"resolved","repositories":{"trixie":"143.0.7499.169-1~deb13u1","trixie-security":"145.0.7632.159-1~deb13u1"},"fixed_version":"119.0.6045.105-1","urgency":"not yet assigned"}}},"CVE-2023-7282":{"description":"Inappropriate implementation in Navigation in Google Chrome prior to 113.0.5672.63 allowed a remote attacker who convinced a user to engage in specific UI gestures to perform domain spoofing via a crafted HTML page. (Chromium security severity: Low)","scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"143.0.7499.169-1~deb12u1","bookworm-security":"145.0.7632.159-1~deb12u1"},"fixed_version":"113.0.5672.63-1","urgency":"not yet assigned"},"bullseye":{"status":"resolved","repositories":{"bullseye":"120.0.6099.224-1~deb11u1","bullseye-security":"120.0.6099.224-1~deb11u1"},"fixed_version":"113.0.5672.63-1~deb11u1","urgency":"not yet assigned"},"forky":{"status":"resolved","repositories":{"forky":"145.0.7632.159-1"},"fixed_version":"113.0.5672.63-1","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"146.0.7680.71-1"},"fixed_version":"113.0.5672.63-1","urgency":"not yet assigned"},"trixie":{"status":"resolved","repositories":{"trixie":"143.0.7499.169-1~deb13u1","trixie-security":"145.0.7632.159-1~deb13u1"},"fixed_version":"113.0.5672.63-1","urgency":"not yet assigned"}}},"CVE-2024-0222":{"description":"Use after free in ANGLE in Google Chrome prior to 120.0.6099.199 allowed a remote attacker who had compromised the renderer process to potentially exploit heap corruption via a crafted HTML page. (Chromium security severity: High)","scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"143.0.7499.169-1~deb12u1","bookworm-security":"145.0.7632.159-1~deb12u1"},"fixed_version":"120.0.6099.199-1~deb12u1","urgency":"not yet assigned"},"bullseye":{"status":"resolved","repositories":{"bullseye":"120.0.6099.224-1~deb11u1","bullseye-security":"120.0.6099.224-1~deb11u1"},"fixed_version":"120.0.6099.199-1~deb11u1","urgency":"not yet assigned"},"forky":{"status":"resolved","repositories":{"forky":"145.0.7632.159-1"},"fixed_version":"120.0.6099.199-1","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"146.0.7680.71-1"},"fixed_version":"120.0.6099.199-1","urgency":"not yet assigned"},"trixie":{"status":"resolved","repositories":{"trixie":"143.0.7499.169-1~deb13u1","trixie-security":"145.0.7632.159-1~deb13u1"},"fixed_version":"120.0.6099.199-1","urgency":"not yet assigned"}}},"CVE-2024-0223":{"description":"Heap buffer overflow in ANGLE in Google Chrome prior to 120.0.6099.199 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. (Chromium security severity: High)","scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"143.0.7499.169-1~deb12u1","bookworm-security":"145.0.7632.159-1~deb12u1"},"fixed_version":"120.0.6099.199-1~deb12u1","urgency":"not yet assigned"},"bullseye":{"status":"resolved","repositories":{"bullseye":"120.0.6099.224-1~deb11u1","bullseye-security":"120.0.6099.224-1~deb11u1"},"fixed_version":"120.0.6099.199-1~deb11u1","urgency":"not yet assigned"},"forky":{"status":"resolved","repositories":{"forky":"145.0.7632.159-1"},"fixed_version":"120.0.6099.199-1","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"146.0.7680.71-1"},"fixed_version":"120.0.6099.199-1","urgency":"not yet assigned"},"trixie":{"status":"resolved","repositories":{"trixie":"143.0.7499.169-1~deb13u1","trixie-security":"145.0.7632.159-1~deb13u1"},"fixed_version":"120.0.6099.199-1","urgency":"not yet assigned"}}},"CVE-2024-0224":{"description":"Use after free in WebAudio in Google Chrome prior to 120.0.6099.199 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. (Chromium security severity: High)","scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"143.0.7499.169-1~deb12u1","bookworm-security":"145.0.7632.159-1~deb12u1"},"fixed_version":"120.0.6099.199-1~deb12u1","urgency":"not yet assigned"},"bullseye":{"status":"resolved","repositories":{"bullseye":"120.0.6099.224-1~deb11u1","bullseye-security":"120.0.6099.224-1~deb11u1"},"fixed_version":"120.0.6099.199-1~deb11u1","urgency":"not yet assigned"},"forky":{"status":"resolved","repositories":{"forky":"145.0.7632.159-1"},"fixed_version":"120.0.6099.199-1","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"146.0.7680.71-1"},"fixed_version":"120.0.6099.199-1","urgency":"not yet assigned"},"trixie":{"status":"resolved","repositories":{"trixie":"143.0.7499.169-1~deb13u1","trixie-security":"145.0.7632.159-1~deb13u1"},"fixed_version":"120.0.6099.199-1","urgency":"not yet assigned"}}},"CVE-2024-0225":{"description":"Use after free in WebGPU in Google Chrome prior to 120.0.6099.199 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. (Chromium security severity: High)","scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"143.0.7499.169-1~deb12u1","bookworm-security":"145.0.7632.159-1~deb12u1"},"fixed_version":"120.0.6099.199-1~deb12u1","urgency":"not yet assigned"},"bullseye":{"status":"resolved","repositories":{"bullseye":"120.0.6099.224-1~deb11u1","bullseye-security":"120.0.6099.224-1~deb11u1"},"fixed_version":"120.0.6099.199-1~deb11u1","urgency":"not yet assigned"},"forky":{"status":"resolved","repositories":{"forky":"145.0.7632.159-1"},"fixed_version":"120.0.6099.199-1","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"146.0.7680.71-1"},"fixed_version":"120.0.6099.199-1","urgency":"not yet assigned"},"trixie":{"status":"resolved","repositories":{"trixie":"143.0.7499.169-1~deb13u1","trixie-security":"145.0.7632.159-1~deb13u1"},"fixed_version":"120.0.6099.199-1","urgency":"not yet assigned"}}},"CVE-2024-0333":{"description":"Insufficient data validation in Extensions in Google Chrome prior to 120.0.6099.216 allowed an attacker in a privileged network position to install a malicious extension via a crafted HTML page. (Chromium security severity: High)","scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"143.0.7499.169-1~deb12u1","bookworm-security":"145.0.7632.159-1~deb12u1"},"fixed_version":"120.0.6099.216-1~deb12u1","urgency":"not yet assigned"},"bullseye":{"status":"resolved","repositories":{"bullseye":"120.0.6099.224-1~deb11u1","bullseye-security":"120.0.6099.224-1~deb11u1"},"fixed_version":"120.0.6099.216-1~deb11u1","urgency":"not yet assigned"},"forky":{"status":"resolved","repositories":{"forky":"145.0.7632.159-1"},"fixed_version":"120.0.6099.216-1","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"146.0.7680.71-1"},"fixed_version":"120.0.6099.216-1","urgency":"not yet assigned"},"trixie":{"status":"resolved","repositories":{"trixie":"143.0.7499.169-1~deb13u1","trixie-security":"145.0.7632.159-1~deb13u1"},"fixed_version":"120.0.6099.216-1","urgency":"not yet assigned"}}},"CVE-2024-0517":{"description":"Out of bounds write in V8 in Google Chrome prior to 120.0.6099.224 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. (Chromium security severity: High)","scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"143.0.7499.169-1~deb12u1","bookworm-security":"145.0.7632.159-1~deb12u1"},"fixed_version":"120.0.6099.224-1~deb12u1","urgency":"not yet assigned"},"bullseye":{"status":"resolved","repositories":{"bullseye":"120.0.6099.224-1~deb11u1","bullseye-security":"120.0.6099.224-1~deb11u1"},"fixed_version":"120.0.6099.224-1~deb11u1","urgency":"not yet assigned"},"forky":{"status":"resolved","repositories":{"forky":"145.0.7632.159-1"},"fixed_version":"120.0.6099.224-1","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"146.0.7680.71-1"},"fixed_version":"120.0.6099.224-1","urgency":"not yet assigned"},"trixie":{"status":"resolved","repositories":{"trixie":"143.0.7499.169-1~deb13u1","trixie-security":"145.0.7632.159-1~deb13u1"},"fixed_version":"120.0.6099.224-1","urgency":"not yet assigned"}}},"CVE-2024-0518":{"description":"Type confusion in V8 in Google Chrome prior to 120.0.6099.224 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. (Chromium security severity: High)","scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"143.0.7499.169-1~deb12u1","bookworm-security":"145.0.7632.159-1~deb12u1"},"fixed_version":"120.0.6099.224-1~deb12u1","urgency":"not yet assigned"},"bullseye":{"status":"resolved","repositories":{"bullseye":"120.0.6099.224-1~deb11u1","bullseye-security":"120.0.6099.224-1~deb11u1"},"fixed_version":"120.0.6099.224-1~deb11u1","urgency":"not yet assigned"},"forky":{"status":"resolved","repositories":{"forky":"145.0.7632.159-1"},"fixed_version":"120.0.6099.224-1","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"146.0.7680.71-1"},"fixed_version":"120.0.6099.224-1","urgency":"not yet assigned"},"trixie":{"status":"resolved","repositories":{"trixie":"143.0.7499.169-1~deb13u1","trixie-security":"145.0.7632.159-1~deb13u1"},"fixed_version":"120.0.6099.224-1","urgency":"not yet assigned"}}},"CVE-2024-0519":{"description":"Out of bounds memory access in V8 in Google Chrome prior to 120.0.6099.224 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. (Chromium security severity: High)","scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"143.0.7499.169-1~deb12u1","bookworm-security":"145.0.7632.159-1~deb12u1"},"fixed_version":"120.0.6099.224-1~deb12u1","urgency":"not yet assigned"},"bullseye":{"status":"resolved","repositories":{"bullseye":"120.0.6099.224-1~deb11u1","bullseye-security":"120.0.6099.224-1~deb11u1"},"fixed_version":"120.0.6099.224-1~deb11u1","urgency":"not yet assigned"},"forky":{"status":"resolved","repositories":{"forky":"145.0.7632.159-1"},"fixed_version":"120.0.6099.224-1","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"146.0.7680.71-1"},"fixed_version":"120.0.6099.224-1","urgency":"not yet assigned"},"trixie":{"status":"resolved","repositories":{"trixie":"143.0.7499.169-1~deb13u1","trixie-security":"145.0.7632.159-1~deb13u1"},"fixed_version":"120.0.6099.224-1","urgency":"not yet assigned"}}},"CVE-2024-0804":{"description":"Insufficient policy enforcement in iOS Security UI in Google Chrome prior to 121.0.6167.85 allowed a remote attacker to leak cross-origin data via a crafted HTML page. (Chromium security severity: Medium)","scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"143.0.7499.169-1~deb12u1","bookworm-security":"145.0.7632.159-1~deb12u1"},"fixed_version":"121.0.6167.85-1~deb12u1","urgency":"not yet assigned"},"bullseye":{"status":"open","repositories":{"bullseye":"120.0.6099.224-1~deb11u1","bullseye-security":"120.0.6099.224-1~deb11u1"},"urgency":"end-of-life"},"forky":{"status":"resolved","repositories":{"forky":"145.0.7632.159-1"},"fixed_version":"121.0.6167.85-1","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"146.0.7680.71-1"},"fixed_version":"121.0.6167.85-1","urgency":"not yet assigned"},"trixie":{"status":"resolved","repositories":{"trixie":"143.0.7499.169-1~deb13u1","trixie-security":"145.0.7632.159-1~deb13u1"},"fixed_version":"121.0.6167.85-1","urgency":"not yet assigned"}}},"CVE-2024-0805":{"description":"Inappropriate implementation in Downloads in Google Chrome prior to 121.0.6167.85 allowed a remote attacker to perform domain spoofing via a crafted domain name. (Chromium security severity: Medium)","scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"143.0.7499.169-1~deb12u1","bookworm-security":"145.0.7632.159-1~deb12u1"},"fixed_version":"121.0.6167.85-1~deb12u1","urgency":"not yet assigned"},"bullseye":{"status":"open","repositories":{"bullseye":"120.0.6099.224-1~deb11u1","bullseye-security":"120.0.6099.224-1~deb11u1"},"urgency":"end-of-life"},"forky":{"status":"resolved","repositories":{"forky":"145.0.7632.159-1"},"fixed_version":"121.0.6167.85-1","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"146.0.7680.71-1"},"fixed_version":"121.0.6167.85-1","urgency":"not yet assigned"},"trixie":{"status":"resolved","repositories":{"trixie":"143.0.7499.169-1~deb13u1","trixie-security":"145.0.7632.159-1~deb13u1"},"fixed_version":"121.0.6167.85-1","urgency":"not yet assigned"}}},"CVE-2024-0806":{"description":"Use after free in Passwords in Google Chrome prior to 121.0.6167.85 allowed a remote attacker to potentially exploit heap corruption via specific UI interaction. (Chromium security severity: Medium)","scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"143.0.7499.169-1~deb12u1","bookworm-security":"145.0.7632.159-1~deb12u1"},"fixed_version":"121.0.6167.85-1~deb12u1","urgency":"not yet assigned"},"bullseye":{"status":"open","repositories":{"bullseye":"120.0.6099.224-1~deb11u1","bullseye-security":"120.0.6099.224-1~deb11u1"},"urgency":"end-of-life"},"forky":{"status":"resolved","repositories":{"forky":"145.0.7632.159-1"},"fixed_version":"121.0.6167.85-1","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"146.0.7680.71-1"},"fixed_version":"121.0.6167.85-1","urgency":"not yet assigned"},"trixie":{"status":"resolved","repositories":{"trixie":"143.0.7499.169-1~deb13u1","trixie-security":"145.0.7632.159-1~deb13u1"},"fixed_version":"121.0.6167.85-1","urgency":"not yet assigned"}}},"CVE-2024-0807":{"description":"Use after free in Web Audio in Google Chrome prior to 121.0.6167.85 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. (Chromium security severity: High)","scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"143.0.7499.169-1~deb12u1","bookworm-security":"145.0.7632.159-1~deb12u1"},"fixed_version":"121.0.6167.85-1~deb12u1","urgency":"not yet assigned"},"bullseye":{"status":"open","repositories":{"bullseye":"120.0.6099.224-1~deb11u1","bullseye-security":"120.0.6099.224-1~deb11u1"},"urgency":"end-of-life"},"forky":{"status":"resolved","repositories":{"forky":"145.0.7632.159-1"},"fixed_version":"121.0.6167.85-1","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"146.0.7680.71-1"},"fixed_version":"121.0.6167.85-1","urgency":"not yet assigned"},"trixie":{"status":"resolved","repositories":{"trixie":"143.0.7499.169-1~deb13u1","trixie-security":"145.0.7632.159-1~deb13u1"},"fixed_version":"121.0.6167.85-1","urgency":"not yet assigned"}}},"CVE-2024-0808":{"description":"Integer underflow in WebUI in Google Chrome prior to 121.0.6167.85 allowed a remote attacker to potentially exploit heap corruption via a malicious file. (Chromium security severity: High)","scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"143.0.7499.169-1~deb12u1","bookworm-security":"145.0.7632.159-1~deb12u1"},"fixed_version":"121.0.6167.85-1~deb12u1","urgency":"not yet assigned"},"bullseye":{"status":"open","repositories":{"bullseye":"120.0.6099.224-1~deb11u1","bullseye-security":"120.0.6099.224-1~deb11u1"},"urgency":"end-of-life"},"forky":{"status":"resolved","repositories":{"forky":"145.0.7632.159-1"},"fixed_version":"121.0.6167.85-1","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"146.0.7680.71-1"},"fixed_version":"121.0.6167.85-1","urgency":"not yet assigned"},"trixie":{"status":"resolved","repositories":{"trixie":"143.0.7499.169-1~deb13u1","trixie-security":"145.0.7632.159-1~deb13u1"},"fixed_version":"121.0.6167.85-1","urgency":"not yet assigned"}}},"CVE-2024-0809":{"description":"Inappropriate implementation in Autofill in Google Chrome prior to 121.0.6167.85 allowed a remote attacker to bypass Autofill restrictions via a crafted HTML page. (Chromium security severity: Low)","scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"143.0.7499.169-1~deb12u1","bookworm-security":"145.0.7632.159-1~deb12u1"},"fixed_version":"121.0.6167.85-1~deb12u1","urgency":"not yet assigned"},"bullseye":{"status":"open","repositories":{"bullseye":"120.0.6099.224-1~deb11u1","bullseye-security":"120.0.6099.224-1~deb11u1"},"urgency":"end-of-life"},"forky":{"status":"resolved","repositories":{"forky":"145.0.7632.159-1"},"fixed_version":"121.0.6167.85-1","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"146.0.7680.71-1"},"fixed_version":"121.0.6167.85-1","urgency":"not yet assigned"},"trixie":{"status":"resolved","repositories":{"trixie":"143.0.7499.169-1~deb13u1","trixie-security":"145.0.7632.159-1~deb13u1"},"fixed_version":"121.0.6167.85-1","urgency":"not yet assigned"}}},"CVE-2024-0810":{"description":"Insufficient policy enforcement in DevTools in Google Chrome prior to 121.0.6167.85 allowed an attacker who convinced a user to install a malicious extension to leak cross-origin data via a crafted Chrome Extension. (Chromium security severity: Medium)","scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"143.0.7499.169-1~deb12u1","bookworm-security":"145.0.7632.159-1~deb12u1"},"fixed_version":"121.0.6167.85-1~deb12u1","urgency":"not yet assigned"},"bullseye":{"status":"open","repositories":{"bullseye":"120.0.6099.224-1~deb11u1","bullseye-security":"120.0.6099.224-1~deb11u1"},"urgency":"end-of-life"},"forky":{"status":"resolved","repositories":{"forky":"145.0.7632.159-1"},"fixed_version":"121.0.6167.85-1","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"146.0.7680.71-1"},"fixed_version":"121.0.6167.85-1","urgency":"not yet assigned"},"trixie":{"status":"resolved","repositories":{"trixie":"143.0.7499.169-1~deb13u1","trixie-security":"145.0.7632.159-1~deb13u1"},"fixed_version":"121.0.6167.85-1","urgency":"not yet assigned"}}},"CVE-2024-0811":{"description":"Inappropriate implementation in Extensions API in Google Chrome prior to 121.0.6167.85 allowed an attacker who convinced a user to install a malicious extension to leak cross-origin data via a crafted Chrome Extension. (Chromium security severity: Low)","scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"143.0.7499.169-1~deb12u1","bookworm-security":"145.0.7632.159-1~deb12u1"},"fixed_version":"121.0.6167.85-1~deb12u1","urgency":"not yet assigned"},"bullseye":{"status":"open","repositories":{"bullseye":"120.0.6099.224-1~deb11u1","bullseye-security":"120.0.6099.224-1~deb11u1"},"urgency":"end-of-life"},"forky":{"status":"resolved","repositories":{"forky":"145.0.7632.159-1"},"fixed_version":"121.0.6167.85-1","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"146.0.7680.71-1"},"fixed_version":"121.0.6167.85-1","urgency":"not yet assigned"},"trixie":{"status":"resolved","repositories":{"trixie":"143.0.7499.169-1~deb13u1","trixie-security":"145.0.7632.159-1~deb13u1"},"fixed_version":"121.0.6167.85-1","urgency":"not yet assigned"}}},"CVE-2024-0812":{"description":"Inappropriate implementation in Accessibility in Google Chrome prior to 121.0.6167.85 allowed a remote attacker to potentially exploit object corruption via a crafted HTML page. (Chromium security severity: High)","scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"143.0.7499.169-1~deb12u1","bookworm-security":"145.0.7632.159-1~deb12u1"},"fixed_version":"121.0.6167.85-1~deb12u1","urgency":"not yet assigned"},"bullseye":{"status":"open","repositories":{"bullseye":"120.0.6099.224-1~deb11u1","bullseye-security":"120.0.6099.224-1~deb11u1"},"urgency":"end-of-life"},"forky":{"status":"resolved","repositories":{"forky":"145.0.7632.159-1"},"fixed_version":"121.0.6167.85-1","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"146.0.7680.71-1"},"fixed_version":"121.0.6167.85-1","urgency":"not yet assigned"},"trixie":{"status":"resolved","repositories":{"trixie":"143.0.7499.169-1~deb13u1","trixie-security":"145.0.7632.159-1~deb13u1"},"fixed_version":"121.0.6167.85-1","urgency":"not yet assigned"}}},"CVE-2024-0813":{"description":"Use after free in Reading Mode in Google Chrome prior to 121.0.6167.85 allowed an attacker who convinced a user to install a malicious extension to potentially exploit heap corruption via specific UI interaction. (Chromium security severity: Medium)","scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"143.0.7499.169-1~deb12u1","bookworm-security":"145.0.7632.159-1~deb12u1"},"fixed_version":"121.0.6167.85-1~deb12u1","urgency":"not yet assigned"},"bullseye":{"status":"open","repositories":{"bullseye":"120.0.6099.224-1~deb11u1","bullseye-security":"120.0.6099.224-1~deb11u1"},"urgency":"end-of-life"},"forky":{"status":"resolved","repositories":{"forky":"145.0.7632.159-1"},"fixed_version":"121.0.6167.85-1","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"146.0.7680.71-1"},"fixed_version":"121.0.6167.85-1","urgency":"not yet assigned"},"trixie":{"status":"resolved","repositories":{"trixie":"143.0.7499.169-1~deb13u1","trixie-security":"145.0.7632.159-1~deb13u1"},"fixed_version":"121.0.6167.85-1","urgency":"not yet assigned"}}},"CVE-2024-0814":{"description":"Incorrect security UI in Payments in Google Chrome prior to 121.0.6167.85 allowed a remote attacker to potentially spoof security UI via a crafted HTML page. (Chromium security severity: Medium)","scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"143.0.7499.169-1~deb12u1","bookworm-security":"145.0.7632.159-1~deb12u1"},"fixed_version":"121.0.6167.85-1~deb12u1","urgency":"not yet assigned"},"bullseye":{"status":"open","repositories":{"bullseye":"120.0.6099.224-1~deb11u1","bullseye-security":"120.0.6099.224-1~deb11u1"},"urgency":"end-of-life"},"forky":{"status":"resolved","repositories":{"forky":"145.0.7632.159-1"},"fixed_version":"121.0.6167.85-1","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"146.0.7680.71-1"},"fixed_version":"121.0.6167.85-1","urgency":"not yet assigned"},"trixie":{"status":"resolved","repositories":{"trixie":"143.0.7499.169-1~deb13u1","trixie-security":"145.0.7632.159-1~deb13u1"},"fixed_version":"121.0.6167.85-1","urgency":"not yet assigned"}}},"CVE-2024-10229":{"description":"Inappropriate implementation in Extensions in Google Chrome prior to 130.0.6723.69 allowed a remote attacker to bypass site isolation via a crafted Chrome Extension. (Chromium security severity: High)","scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"143.0.7499.169-1~deb12u1","bookworm-security":"145.0.7632.159-1~deb12u1"},"fixed_version":"130.0.6723.69-1~deb12u1","urgency":"not yet assigned"},"bullseye":{"status":"open","repositories":{"bullseye":"120.0.6099.224-1~deb11u1","bullseye-security":"120.0.6099.224-1~deb11u1"},"urgency":"end-of-life"},"forky":{"status":"resolved","repositories":{"forky":"145.0.7632.159-1"},"fixed_version":"130.0.6723.69-1","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"146.0.7680.71-1"},"fixed_version":"130.0.6723.69-1","urgency":"not yet assigned"},"trixie":{"status":"resolved","repositories":{"trixie":"143.0.7499.169-1~deb13u1","trixie-security":"145.0.7632.159-1~deb13u1"},"fixed_version":"130.0.6723.69-1","urgency":"not yet assigned"}}},"CVE-2024-10230":{"description":"Type Confusion in V8 in Google Chrome prior to 130.0.6723.69 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. (Chromium security severity: High)","scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"143.0.7499.169-1~deb12u1","bookworm-security":"145.0.7632.159-1~deb12u1"},"fixed_version":"130.0.6723.69-1~deb12u1","urgency":"not yet assigned"},"bullseye":{"status":"open","repositories":{"bullseye":"120.0.6099.224-1~deb11u1","bullseye-security":"120.0.6099.224-1~deb11u1"},"urgency":"end-of-life"},"forky":{"status":"resolved","repositories":{"forky":"145.0.7632.159-1"},"fixed_version":"130.0.6723.69-1","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"146.0.7680.71-1"},"fixed_version":"130.0.6723.69-1","urgency":"not yet assigned"},"trixie":{"status":"resolved","repositories":{"trixie":"143.0.7499.169-1~deb13u1","trixie-security":"145.0.7632.159-1~deb13u1"},"fixed_version":"130.0.6723.69-1","urgency":"not yet assigned"}}},"CVE-2024-10231":{"description":"Type Confusion in V8 in Google Chrome prior to 130.0.6723.69 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. (Chromium security severity: High)","scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"143.0.7499.169-1~deb12u1","bookworm-security":"145.0.7632.159-1~deb12u1"},"fixed_version":"130.0.6723.69-1~deb12u1","urgency":"not yet assigned"},"bullseye":{"status":"open","repositories":{"bullseye":"120.0.6099.224-1~deb11u1","bullseye-security":"120.0.6099.224-1~deb11u1"},"urgency":"end-of-life"},"forky":{"status":"resolved","repositories":{"forky":"145.0.7632.159-1"},"fixed_version":"130.0.6723.69-1","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"146.0.7680.71-1"},"fixed_version":"130.0.6723.69-1","urgency":"not yet assigned"},"trixie":{"status":"resolved","repositories":{"trixie":"143.0.7499.169-1~deb13u1","trixie-security":"145.0.7632.159-1~deb13u1"},"fixed_version":"130.0.6723.69-1","urgency":"not yet assigned"}}},"CVE-2024-10487":{"description":"Out of bounds write in Dawn in Google Chrome prior to 130.0.6723.92 allowed a remote attacker to perform out of bounds memory access via a crafted HTML page. (Chromium security severity: Critical)","scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"143.0.7499.169-1~deb12u1","bookworm-security":"145.0.7632.159-1~deb12u1"},"fixed_version":"130.0.6723.91-1~deb12u1","urgency":"not yet assigned"},"bullseye":{"status":"open","repositories":{"bullseye":"120.0.6099.224-1~deb11u1","bullseye-security":"120.0.6099.224-1~deb11u1"},"urgency":"end-of-life"},"forky":{"status":"resolved","repositories":{"forky":"145.0.7632.159-1"},"fixed_version":"130.0.6723.91-1","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"146.0.7680.71-1"},"fixed_version":"130.0.6723.91-1","urgency":"not yet assigned"},"trixie":{"status":"resolved","repositories":{"trixie":"143.0.7499.169-1~deb13u1","trixie-security":"145.0.7632.159-1~deb13u1"},"fixed_version":"130.0.6723.91-1","urgency":"not yet assigned"}}},"CVE-2024-10488":{"description":"Use after free in WebRTC in Google Chrome prior to 130.0.6723.92 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. (Chromium security severity: High)","scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"143.0.7499.169-1~deb12u1","bookworm-security":"145.0.7632.159-1~deb12u1"},"fixed_version":"130.0.6723.91-1~deb12u1","urgency":"not yet assigned"},"bullseye":{"status":"open","repositories":{"bullseye":"120.0.6099.224-1~deb11u1","bullseye-security":"120.0.6099.224-1~deb11u1"},"urgency":"end-of-life"},"forky":{"status":"resolved","repositories":{"forky":"145.0.7632.159-1"},"fixed_version":"130.0.6723.91-1","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"146.0.7680.71-1"},"fixed_version":"130.0.6723.91-1","urgency":"not yet assigned"},"trixie":{"status":"resolved","repositories":{"trixie":"143.0.7499.169-1~deb13u1","trixie-security":"145.0.7632.159-1~deb13u1"},"fixed_version":"130.0.6723.91-1","urgency":"not yet assigned"}}},"CVE-2024-1059":{"description":"Use after free in Peer Connection in Google Chrome prior to 121.0.6167.139 allowed a remote attacker to potentially exploit stack corruption via a crafted HTML page. (Chromium security severity: High)","scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"143.0.7499.169-1~deb12u1","bookworm-security":"145.0.7632.159-1~deb12u1"},"fixed_version":"121.0.6167.139-1~deb12u1","urgency":"not yet assigned"},"bullseye":{"status":"open","repositories":{"bullseye":"120.0.6099.224-1~deb11u1","bullseye-security":"120.0.6099.224-1~deb11u1"},"urgency":"end-of-life"},"forky":{"status":"resolved","repositories":{"forky":"145.0.7632.159-1"},"fixed_version":"121.0.6167.139-1","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"146.0.7680.71-1"},"fixed_version":"121.0.6167.139-1","urgency":"not yet assigned"},"trixie":{"status":"resolved","repositories":{"trixie":"143.0.7499.169-1~deb13u1","trixie-security":"145.0.7632.159-1~deb13u1"},"fixed_version":"121.0.6167.139-1","urgency":"not yet assigned"}}},"CVE-2024-1060":{"description":"Use after free in Canvas in Google Chrome prior to 121.0.6167.139 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. (Chromium security severity: High)","scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"143.0.7499.169-1~deb12u1","bookworm-security":"145.0.7632.159-1~deb12u1"},"fixed_version":"121.0.6167.139-1~deb12u1","urgency":"not yet assigned"},"bullseye":{"status":"open","repositories":{"bullseye":"120.0.6099.224-1~deb11u1","bullseye-security":"120.0.6099.224-1~deb11u1"},"urgency":"end-of-life"},"forky":{"status":"resolved","repositories":{"forky":"145.0.7632.159-1"},"fixed_version":"121.0.6167.139-1","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"146.0.7680.71-1"},"fixed_version":"121.0.6167.139-1","urgency":"not yet assigned"},"trixie":{"status":"resolved","repositories":{"trixie":"143.0.7499.169-1~deb13u1","trixie-security":"145.0.7632.159-1~deb13u1"},"fixed_version":"121.0.6167.139-1","urgency":"not yet assigned"}}},"CVE-2024-1077":{"description":"Use after free in Network in Google Chrome prior to 121.0.6167.139 allowed a remote attacker to potentially exploit heap corruption via a malicious file. (Chromium security severity: High)","scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"143.0.7499.169-1~deb12u1","bookworm-security":"145.0.7632.159-1~deb12u1"},"fixed_version":"121.0.6167.139-1~deb12u1","urgency":"not yet assigned"},"bullseye":{"status":"open","repositories":{"bullseye":"120.0.6099.224-1~deb11u1","bullseye-security":"120.0.6099.224-1~deb11u1"},"urgency":"end-of-life"},"forky":{"status":"resolved","repositories":{"forky":"145.0.7632.159-1"},"fixed_version":"121.0.6167.139-1","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"146.0.7680.71-1"},"fixed_version":"121.0.6167.139-1","urgency":"not yet assigned"},"trixie":{"status":"resolved","repositories":{"trixie":"143.0.7499.169-1~deb13u1","trixie-security":"145.0.7632.159-1~deb13u1"},"fixed_version":"121.0.6167.139-1","urgency":"not yet assigned"}}},"CVE-2024-10826":{"description":"Use after free in Family Experiences in Google Chrome on Android prior to 130.0.6723.116 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. (Chromium security severity: High)","scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"143.0.7499.169-1~deb12u1","bookworm-security":"145.0.7632.159-1~deb12u1"},"fixed_version":"130.0.6723.116-1~deb12u1","urgency":"not yet assigned"},"bullseye":{"status":"open","repositories":{"bullseye":"120.0.6099.224-1~deb11u1","bullseye-security":"120.0.6099.224-1~deb11u1"},"urgency":"end-of-life"},"forky":{"status":"resolved","repositories":{"forky":"145.0.7632.159-1"},"fixed_version":"130.0.6723.116-1","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"146.0.7680.71-1"},"fixed_version":"130.0.6723.116-1","urgency":"not yet assigned"},"trixie":{"status":"resolved","repositories":{"trixie":"143.0.7499.169-1~deb13u1","trixie-security":"145.0.7632.159-1~deb13u1"},"fixed_version":"130.0.6723.116-1","urgency":"not yet assigned"}}},"CVE-2024-10827":{"description":"Use after free in Serial in Google Chrome prior to 130.0.6723.116 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. (Chromium security severity: High)","scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"143.0.7499.169-1~deb12u1","bookworm-security":"145.0.7632.159-1~deb12u1"},"fixed_version":"130.0.6723.116-1~deb12u1","urgency":"not yet assigned"},"bullseye":{"status":"open","repositories":{"bullseye":"120.0.6099.224-1~deb11u1","bullseye-security":"120.0.6099.224-1~deb11u1"},"urgency":"end-of-life"},"forky":{"status":"resolved","repositories":{"forky":"145.0.7632.159-1"},"fixed_version":"130.0.6723.116-1","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"146.0.7680.71-1"},"fixed_version":"130.0.6723.116-1","urgency":"not yet assigned"},"trixie":{"status":"resolved","repositories":{"trixie":"143.0.7499.169-1~deb13u1","trixie-security":"145.0.7632.159-1~deb13u1"},"fixed_version":"130.0.6723.116-1","urgency":"not yet assigned"}}},"CVE-2024-11110":{"description":"Inappropriate implementation in Extensions in Google Chrome prior to 131.0.6778.69 allowed a remote attacker to bypass site isolation via a crafted Chrome Extension. (Chromium security severity: High)","scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"143.0.7499.169-1~deb12u1","bookworm-security":"145.0.7632.159-1~deb12u1"},"fixed_version":"131.0.6778.85-1~deb12u1","urgency":"not yet assigned"},"bullseye":{"status":"open","repositories":{"bullseye":"120.0.6099.224-1~deb11u1","bullseye-security":"120.0.6099.224-1~deb11u1"},"urgency":"end-of-life"},"forky":{"status":"resolved","repositories":{"forky":"145.0.7632.159-1"},"fixed_version":"131.0.6778.85-1","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"146.0.7680.71-1"},"fixed_version":"131.0.6778.85-1","urgency":"not yet assigned"},"trixie":{"status":"resolved","repositories":{"trixie":"143.0.7499.169-1~deb13u1","trixie-security":"145.0.7632.159-1~deb13u1"},"fixed_version":"131.0.6778.85-1","urgency":"not yet assigned"}}},"CVE-2024-11111":{"description":"Inappropriate implementation in Autofill in Google Chrome prior to 131.0.6778.69 allowed a remote attacker who convinced a user to engage in specific UI gestures to perform UI spoofing via a crafted HTML page. (Chromium security severity: Medium)","scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"143.0.7499.169-1~deb12u1","bookworm-security":"145.0.7632.159-1~deb12u1"},"fixed_version":"131.0.6778.85-1~deb12u1","urgency":"not yet assigned"},"bullseye":{"status":"open","repositories":{"bullseye":"120.0.6099.224-1~deb11u1","bullseye-security":"120.0.6099.224-1~deb11u1"},"urgency":"end-of-life"},"forky":{"status":"resolved","repositories":{"forky":"145.0.7632.159-1"},"fixed_version":"131.0.6778.85-1","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"146.0.7680.71-1"},"fixed_version":"131.0.6778.85-1","urgency":"not yet assigned"},"trixie":{"status":"resolved","repositories":{"trixie":"143.0.7499.169-1~deb13u1","trixie-security":"145.0.7632.159-1~deb13u1"},"fixed_version":"131.0.6778.85-1","urgency":"not yet assigned"}}},"CVE-2024-11112":{"description":"Use after free in Media in Google Chrome on Windows prior to 131.0.6778.69 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. (Chromium security severity: Medium)","scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"143.0.7499.169-1~deb12u1","bookworm-security":"145.0.7632.159-1~deb12u1"},"fixed_version":"131.0.6778.85-1~deb12u1","urgency":"not yet assigned"},"bullseye":{"status":"open","repositories":{"bullseye":"120.0.6099.224-1~deb11u1","bullseye-security":"120.0.6099.224-1~deb11u1"},"urgency":"end-of-life"},"forky":{"status":"resolved","repositories":{"forky":"145.0.7632.159-1"},"fixed_version":"131.0.6778.85-1","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"146.0.7680.71-1"},"fixed_version":"131.0.6778.85-1","urgency":"not yet assigned"},"trixie":{"status":"resolved","repositories":{"trixie":"143.0.7499.169-1~deb13u1","trixie-security":"145.0.7632.159-1~deb13u1"},"fixed_version":"131.0.6778.85-1","urgency":"not yet assigned"}}},"CVE-2024-11113":{"description":"Use after free in Accessibility in Google Chrome prior to 131.0.6778.69 allowed a remote attacker who had compromised the renderer process to potentially exploit heap corruption via a crafted HTML page. (Chromium security severity: Medium)","scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"143.0.7499.169-1~deb12u1","bookworm-security":"145.0.7632.159-1~deb12u1"},"fixed_version":"131.0.6778.85-1~deb12u1","urgency":"not yet assigned"},"bullseye":{"status":"open","repositories":{"bullseye":"120.0.6099.224-1~deb11u1","bullseye-security":"120.0.6099.224-1~deb11u1"},"urgency":"end-of-life"},"forky":{"status":"resolved","repositories":{"forky":"145.0.7632.159-1"},"fixed_version":"131.0.6778.85-1","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"146.0.7680.71-1"},"fixed_version":"131.0.6778.85-1","urgency":"not yet assigned"},"trixie":{"status":"resolved","repositories":{"trixie":"143.0.7499.169-1~deb13u1","trixie-security":"145.0.7632.159-1~deb13u1"},"fixed_version":"131.0.6778.85-1","urgency":"not yet assigned"}}},"CVE-2024-11114":{"description":"Inappropriate implementation in Views in Google Chrome on Windows prior to 131.0.6778.69 allowed a remote attacker who had compromised the renderer process to potentially perform a sandbox escape via a crafted HTML page. (Chromium security severity: Medium)","scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"143.0.7499.169-1~deb12u1","bookworm-security":"145.0.7632.159-1~deb12u1"},"fixed_version":"131.0.6778.85-1~deb12u1","urgency":"not yet assigned"},"bullseye":{"status":"open","repositories":{"bullseye":"120.0.6099.224-1~deb11u1","bullseye-security":"120.0.6099.224-1~deb11u1"},"urgency":"end-of-life"},"forky":{"status":"resolved","repositories":{"forky":"145.0.7632.159-1"},"fixed_version":"131.0.6778.85-1","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"146.0.7680.71-1"},"fixed_version":"131.0.6778.85-1","urgency":"not yet assigned"},"trixie":{"status":"resolved","repositories":{"trixie":"143.0.7499.169-1~deb13u1","trixie-security":"145.0.7632.159-1~deb13u1"},"fixed_version":"131.0.6778.85-1","urgency":"not yet assigned"}}},"CVE-2024-11115":{"description":"Insufficient policy enforcement in Navigation in Google Chrome on iOS prior to 131.0.6778.69 allowed a remote attacker to perform privilege escalation via a series of UI gestures. (Chromium security severity: Medium)","scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"143.0.7499.169-1~deb12u1","bookworm-security":"145.0.7632.159-1~deb12u1"},"fixed_version":"131.0.6778.85-1~deb12u1","urgency":"not yet assigned"},"bullseye":{"status":"open","repositories":{"bullseye":"120.0.6099.224-1~deb11u1","bullseye-security":"120.0.6099.224-1~deb11u1"},"urgency":"end-of-life"},"forky":{"status":"resolved","repositories":{"forky":"145.0.7632.159-1"},"fixed_version":"131.0.6778.85-1","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"146.0.7680.71-1"},"fixed_version":"131.0.6778.85-1","urgency":"not yet assigned"},"trixie":{"status":"resolved","repositories":{"trixie":"143.0.7499.169-1~deb13u1","trixie-security":"145.0.7632.159-1~deb13u1"},"fixed_version":"131.0.6778.85-1","urgency":"not yet assigned"}}},"CVE-2024-11116":{"description":"Inappropriate implementation in Blink in Google Chrome prior to 131.0.6778.69 allowed a remote attacker who convinced a user to engage in specific UI gestures to perform UI spoofing via a crafted HTML page. (Chromium security severity: Medium)","scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"143.0.7499.169-1~deb12u1","bookworm-security":"145.0.7632.159-1~deb12u1"},"fixed_version":"131.0.6778.85-1~deb12u1","urgency":"not yet assigned"},"bullseye":{"status":"open","repositories":{"bullseye":"120.0.6099.224-1~deb11u1","bullseye-security":"120.0.6099.224-1~deb11u1"},"urgency":"end-of-life"},"forky":{"status":"resolved","repositories":{"forky":"145.0.7632.159-1"},"fixed_version":"131.0.6778.85-1","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"146.0.7680.71-1"},"fixed_version":"131.0.6778.85-1","urgency":"not yet assigned"},"trixie":{"status":"resolved","repositories":{"trixie":"143.0.7499.169-1~deb13u1","trixie-security":"145.0.7632.159-1~deb13u1"},"fixed_version":"131.0.6778.85-1","urgency":"not yet assigned"}}},"CVE-2024-11117":{"description":"Inappropriate implementation in FileSystem in Google Chrome prior to 131.0.6778.69 allowed a remote attacker to bypass filesystem restrictions via a crafted HTML page. (Chromium security severity: Low)","scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"143.0.7499.169-1~deb12u1","bookworm-security":"145.0.7632.159-1~deb12u1"},"fixed_version":"131.0.6778.85-1~deb12u1","urgency":"not yet assigned"},"bullseye":{"status":"open","repositories":{"bullseye":"120.0.6099.224-1~deb11u1","bullseye-security":"120.0.6099.224-1~deb11u1"},"urgency":"end-of-life"},"forky":{"status":"resolved","repositories":{"forky":"145.0.7632.159-1"},"fixed_version":"131.0.6778.85-1","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"146.0.7680.71-1"},"fixed_version":"131.0.6778.85-1","urgency":"not yet assigned"},"trixie":{"status":"resolved","repositories":{"trixie":"143.0.7499.169-1~deb13u1","trixie-security":"145.0.7632.159-1~deb13u1"},"fixed_version":"131.0.6778.85-1","urgency":"not yet assigned"}}},"CVE-2024-11395":{"description":"Type Confusion in V8 in Google Chrome prior to 131.0.6778.85 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. (Chromium security severity: High)","scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"143.0.7499.169-1~deb12u1","bookworm-security":"145.0.7632.159-1~deb12u1"},"fixed_version":"131.0.6778.85-1~deb12u1","urgency":"not yet assigned"},"bullseye":{"status":"open","repositories":{"bullseye":"120.0.6099.224-1~deb11u1","bullseye-security":"120.0.6099.224-1~deb11u1"},"urgency":"end-of-life"},"forky":{"status":"resolved","repositories":{"forky":"145.0.7632.159-1"},"fixed_version":"131.0.6778.85-1","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"146.0.7680.71-1"},"fixed_version":"131.0.6778.85-1","urgency":"not yet assigned"},"trixie":{"status":"resolved","repositories":{"trixie":"143.0.7499.169-1~deb13u1","trixie-security":"145.0.7632.159-1~deb13u1"},"fixed_version":"131.0.6778.85-1","urgency":"not yet assigned"}}},"CVE-2024-11919":{"description":"Inappropriate implementation in Intents in Google Chrome on Android prior to 129.0.6668.58 allowed a remote attacker to perform UI spoofing via a crafted HTML page. (Chromium security severity: Low)","scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"143.0.7499.169-1~deb12u1","bookworm-security":"145.0.7632.159-1~deb12u1"},"fixed_version":"0","urgency":"unimportant"},"bullseye":{"status":"resolved","repositories":{"bullseye":"120.0.6099.224-1~deb11u1","bullseye-security":"120.0.6099.224-1~deb11u1"},"fixed_version":"0","urgency":"unimportant"},"forky":{"status":"resolved","repositories":{"forky":"145.0.7632.159-1"},"fixed_version":"0","urgency":"unimportant"},"sid":{"status":"resolved","repositories":{"sid":"146.0.7680.71-1"},"fixed_version":"0","urgency":"unimportant"},"trixie":{"status":"resolved","repositories":{"trixie":"143.0.7499.169-1~deb13u1","trixie-security":"145.0.7632.159-1~deb13u1"},"fixed_version":"0","urgency":"unimportant"}}},"CVE-2024-11920":{"description":"Inappropriate implementation in Dawn in Google Chrome on Mac prior to 130.0.6723.92 allowed a remote attacker to perform out of bounds memory access via a crafted HTML page. (Chromium security severity: High)","scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"143.0.7499.169-1~deb12u1","bookworm-security":"145.0.7632.159-1~deb12u1"},"fixed_version":"0","urgency":"unimportant"},"bullseye":{"status":"resolved","repositories":{"bullseye":"120.0.6099.224-1~deb11u1","bullseye-security":"120.0.6099.224-1~deb11u1"},"fixed_version":"0","urgency":"unimportant"},"forky":{"status":"resolved","repositories":{"forky":"145.0.7632.159-1"},"fixed_version":"0","urgency":"unimportant"},"sid":{"status":"resolved","repositories":{"sid":"146.0.7680.71-1"},"fixed_version":"0","urgency":"unimportant"},"trixie":{"status":"resolved","repositories":{"trixie":"143.0.7499.169-1~deb13u1","trixie-security":"145.0.7632.159-1~deb13u1"},"fixed_version":"0","urgency":"unimportant"}}},"CVE-2024-12053":{"description":"Type Confusion in V8 in Google Chrome prior to 131.0.6778.108 allowed a remote attacker to potentially exploit object corruption via a crafted HTML page. (Chromium security severity: High)","scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"143.0.7499.169-1~deb12u1","bookworm-security":"145.0.7632.159-1~deb12u1"},"fixed_version":"131.0.6778.108-1~deb12u1","urgency":"not yet assigned"},"bullseye":{"status":"open","repositories":{"bullseye":"120.0.6099.224-1~deb11u1","bullseye-security":"120.0.6099.224-1~deb11u1"},"urgency":"end-of-life"},"forky":{"status":"resolved","repositories":{"forky":"145.0.7632.159-1"},"fixed_version":"131.0.6778.108-1","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"146.0.7680.71-1"},"fixed_version":"131.0.6778.108-1","urgency":"not yet assigned"},"trixie":{"status":"resolved","repositories":{"trixie":"143.0.7499.169-1~deb13u1","trixie-security":"145.0.7632.159-1~deb13u1"},"fixed_version":"131.0.6778.108-1","urgency":"not yet assigned"}}},"CVE-2024-12381":{"description":"Type Confusion in V8 in Google Chrome prior to 131.0.6778.139 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. (Chromium security severity: High)","scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"143.0.7499.169-1~deb12u1","bookworm-security":"145.0.7632.159-1~deb12u1"},"fixed_version":"131.0.6778.139-1~deb12u1","urgency":"not yet assigned"},"bullseye":{"status":"open","repositories":{"bullseye":"120.0.6099.224-1~deb11u1","bullseye-security":"120.0.6099.224-1~deb11u1"},"urgency":"end-of-life"},"forky":{"status":"resolved","repositories":{"forky":"145.0.7632.159-1"},"fixed_version":"131.0.6778.139-1","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"146.0.7680.71-1"},"fixed_version":"131.0.6778.139-1","urgency":"not yet assigned"},"trixie":{"status":"resolved","repositories":{"trixie":"143.0.7499.169-1~deb13u1","trixie-security":"145.0.7632.159-1~deb13u1"},"fixed_version":"131.0.6778.139-1","urgency":"not yet assigned"}}},"CVE-2024-12382":{"description":"Use after free in Translate in Google Chrome prior to 131.0.6778.139 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. (Chromium security severity: High)","scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"143.0.7499.169-1~deb12u1","bookworm-security":"145.0.7632.159-1~deb12u1"},"fixed_version":"131.0.6778.139-1~deb12u1","urgency":"not yet assigned"},"bullseye":{"status":"open","repositories":{"bullseye":"120.0.6099.224-1~deb11u1","bullseye-security":"120.0.6099.224-1~deb11u1"},"urgency":"end-of-life"},"forky":{"status":"resolved","repositories":{"forky":"145.0.7632.159-1"},"fixed_version":"131.0.6778.139-1","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"146.0.7680.71-1"},"fixed_version":"131.0.6778.139-1","urgency":"not yet assigned"},"trixie":{"status":"resolved","repositories":{"trixie":"143.0.7499.169-1~deb13u1","trixie-security":"145.0.7632.159-1~deb13u1"},"fixed_version":"131.0.6778.139-1","urgency":"not yet assigned"}}},"CVE-2024-12692":{"description":"Type Confusion in V8 in Google Chrome prior to 131.0.6778.204 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. (Chromium security severity: High)","scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"143.0.7499.169-1~deb12u1","bookworm-security":"145.0.7632.159-1~deb12u1"},"fixed_version":"131.0.6778.204-1~deb12u1","urgency":"not yet assigned"},"bullseye":{"status":"open","repositories":{"bullseye":"120.0.6099.224-1~deb11u1","bullseye-security":"120.0.6099.224-1~deb11u1"},"urgency":"end-of-life"},"forky":{"status":"resolved","repositories":{"forky":"145.0.7632.159-1"},"fixed_version":"131.0.6778.204-1","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"146.0.7680.71-1"},"fixed_version":"131.0.6778.204-1","urgency":"not yet assigned"},"trixie":{"status":"resolved","repositories":{"trixie":"143.0.7499.169-1~deb13u1","trixie-security":"145.0.7632.159-1~deb13u1"},"fixed_version":"131.0.6778.204-1","urgency":"not yet assigned"}}},"CVE-2024-12693":{"description":"Out of bounds memory access in V8 in Google Chrome prior to 131.0.6778.204 allowed a remote attacker to execute arbitrary code inside a sandbox via a crafted HTML page. (Chromium security severity: High)","scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"143.0.7499.169-1~deb12u1","bookworm-security":"145.0.7632.159-1~deb12u1"},"fixed_version":"131.0.6778.204-1~deb12u1","urgency":"not yet assigned"},"bullseye":{"status":"open","repositories":{"bullseye":"120.0.6099.224-1~deb11u1","bullseye-security":"120.0.6099.224-1~deb11u1"},"urgency":"end-of-life"},"forky":{"status":"resolved","repositories":{"forky":"145.0.7632.159-1"},"fixed_version":"131.0.6778.204-1","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"146.0.7680.71-1"},"fixed_version":"131.0.6778.204-1","urgency":"not yet assigned"},"trixie":{"status":"resolved","repositories":{"trixie":"143.0.7499.169-1~deb13u1","trixie-security":"145.0.7632.159-1~deb13u1"},"fixed_version":"131.0.6778.204-1","urgency":"not yet assigned"}}},"CVE-2024-12694":{"description":"Use after free in Compositing in Google Chrome prior to 131.0.6778.204 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. (Chromium security severity: High)","scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"143.0.7499.169-1~deb12u1","bookworm-security":"145.0.7632.159-1~deb12u1"},"fixed_version":"131.0.6778.204-1~deb12u1","urgency":"not yet assigned"},"bullseye":{"status":"open","repositories":{"bullseye":"120.0.6099.224-1~deb11u1","bullseye-security":"120.0.6099.224-1~deb11u1"},"urgency":"end-of-life"},"forky":{"status":"resolved","repositories":{"forky":"145.0.7632.159-1"},"fixed_version":"131.0.6778.204-1","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"146.0.7680.71-1"},"fixed_version":"131.0.6778.204-1","urgency":"not yet assigned"},"trixie":{"status":"resolved","repositories":{"trixie":"143.0.7499.169-1~deb13u1","trixie-security":"145.0.7632.159-1~deb13u1"},"fixed_version":"131.0.6778.204-1","urgency":"not yet assigned"}}},"CVE-2024-12695":{"description":"Out of bounds write in V8 in Google Chrome prior to 131.0.6778.204 allowed a remote attacker to execute arbitrary code inside a sandbox via a crafted HTML page. (Chromium security severity: High)","scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"143.0.7499.169-1~deb12u1","bookworm-security":"145.0.7632.159-1~deb12u1"},"fixed_version":"131.0.6778.204-1~deb12u1","urgency":"not yet assigned"},"bullseye":{"status":"open","repositories":{"bullseye":"120.0.6099.224-1~deb11u1","bullseye-security":"120.0.6099.224-1~deb11u1"},"urgency":"end-of-life"},"forky":{"status":"resolved","repositories":{"forky":"145.0.7632.159-1"},"fixed_version":"131.0.6778.204-1","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"146.0.7680.71-1"},"fixed_version":"131.0.6778.204-1","urgency":"not yet assigned"},"trixie":{"status":"resolved","repositories":{"trixie":"143.0.7499.169-1~deb13u1","trixie-security":"145.0.7632.159-1~deb13u1"},"fixed_version":"131.0.6778.204-1","urgency":"not yet assigned"}}},"CVE-2024-1283":{"description":"Heap buffer overflow in Skia in Google Chrome prior to 121.0.6167.160 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. (Chromium security severity: High)","scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"143.0.7499.169-1~deb12u1","bookworm-security":"145.0.7632.159-1~deb12u1"},"fixed_version":"121.0.6167.160-1~deb12u1","urgency":"not yet assigned"},"bullseye":{"status":"open","repositories":{"bullseye":"120.0.6099.224-1~deb11u1","bullseye-security":"120.0.6099.224-1~deb11u1"},"urgency":"end-of-life"},"forky":{"status":"resolved","repositories":{"forky":"145.0.7632.159-1"},"fixed_version":"121.0.6167.160-1","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"146.0.7680.71-1"},"fixed_version":"121.0.6167.160-1","urgency":"not yet assigned"},"trixie":{"status":"resolved","repositories":{"trixie":"143.0.7499.169-1~deb13u1","trixie-security":"145.0.7632.159-1~deb13u1"},"fixed_version":"121.0.6167.160-1","urgency":"not yet assigned"}}},"CVE-2024-1284":{"description":"Use after free in Mojo in Google Chrome prior to 121.0.6167.160 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. (Chromium security severity: High)","scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"143.0.7499.169-1~deb12u1","bookworm-security":"145.0.7632.159-1~deb12u1"},"fixed_version":"121.0.6167.160-1~deb12u1","urgency":"not yet assigned"},"bullseye":{"status":"open","repositories":{"bullseye":"120.0.6099.224-1~deb11u1","bullseye-security":"120.0.6099.224-1~deb11u1"},"urgency":"end-of-life"},"forky":{"status":"resolved","repositories":{"forky":"145.0.7632.159-1"},"fixed_version":"121.0.6167.160-1","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"146.0.7680.71-1"},"fixed_version":"121.0.6167.160-1","urgency":"not yet assigned"},"trixie":{"status":"resolved","repositories":{"trixie":"143.0.7499.169-1~deb13u1","trixie-security":"145.0.7632.159-1~deb13u1"},"fixed_version":"121.0.6167.160-1","urgency":"not yet assigned"}}},"CVE-2024-13178":{"description":"Inappropriate implementation in Fullscreen in Google Chrome prior to 128.0.6613.84 allowed a remote attacker to perform UI spoofing via a crafted HTML page. (Chromium security severity: Medium)","scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"143.0.7499.169-1~deb12u1","bookworm-security":"145.0.7632.159-1~deb12u1"},"fixed_version":"128.0.6613.84-1~deb12u1","urgency":"not yet assigned"},"bullseye":{"status":"open","repositories":{"bullseye":"120.0.6099.224-1~deb11u1","bullseye-security":"120.0.6099.224-1~deb11u1"},"urgency":"end-of-life"},"forky":{"status":"resolved","repositories":{"forky":"145.0.7632.159-1"},"fixed_version":"128.0.6613.84-1","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"146.0.7680.71-1"},"fixed_version":"128.0.6613.84-1","urgency":"not yet assigned"},"trixie":{"status":"resolved","repositories":{"trixie":"143.0.7499.169-1~deb13u1","trixie-security":"145.0.7632.159-1~deb13u1"},"fixed_version":"128.0.6613.84-1","urgency":"not yet assigned"}}},"CVE-2024-13983":{"description":"Inappropriate implementation in Lens in Google Chrome on iOS prior to 136.0.7103.59 allowed a remote attacker to perform UI spoofing via a crafted QR code. (Chromium security severity: Low)","scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"143.0.7499.169-1~deb12u1","bookworm-security":"145.0.7632.159-1~deb12u1"},"fixed_version":"0","urgency":"unimportant"},"bullseye":{"status":"resolved","repositories":{"bullseye":"120.0.6099.224-1~deb11u1","bullseye-security":"120.0.6099.224-1~deb11u1"},"fixed_version":"0","urgency":"unimportant"},"forky":{"status":"resolved","repositories":{"forky":"145.0.7632.159-1"},"fixed_version":"0","urgency":"unimportant"},"sid":{"status":"resolved","repositories":{"sid":"146.0.7680.71-1"},"fixed_version":"0","urgency":"unimportant"},"trixie":{"status":"resolved","repositories":{"trixie":"143.0.7499.169-1~deb13u1","trixie-security":"145.0.7632.159-1~deb13u1"},"fixed_version":"0","urgency":"unimportant"}}},"CVE-2024-1669":{"description":"Out of bounds memory access in Blink in Google Chrome prior to 122.0.6261.57 allowed a remote attacker to perform out of bounds memory access via a crafted HTML page. (Chromium security severity: High)","scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"143.0.7499.169-1~deb12u1","bookworm-security":"145.0.7632.159-1~deb12u1"},"fixed_version":"122.0.6261.57-1~deb12u1","urgency":"not yet assigned"},"bullseye":{"status":"open","repositories":{"bullseye":"120.0.6099.224-1~deb11u1","bullseye-security":"120.0.6099.224-1~deb11u1"},"urgency":"end-of-life"},"forky":{"status":"resolved","repositories":{"forky":"145.0.7632.159-1"},"fixed_version":"122.0.6261.57-1","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"146.0.7680.71-1"},"fixed_version":"122.0.6261.57-1","urgency":"not yet assigned"},"trixie":{"status":"resolved","repositories":{"trixie":"143.0.7499.169-1~deb13u1","trixie-security":"145.0.7632.159-1~deb13u1"},"fixed_version":"122.0.6261.57-1","urgency":"not yet assigned"}}},"CVE-2024-1670":{"description":"Use after free in Mojo in Google Chrome prior to 122.0.6261.57 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. (Chromium security severity: High)","scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"143.0.7499.169-1~deb12u1","bookworm-security":"145.0.7632.159-1~deb12u1"},"fixed_version":"122.0.6261.57-1~deb12u1","urgency":"not yet assigned"},"bullseye":{"status":"open","repositories":{"bullseye":"120.0.6099.224-1~deb11u1","bullseye-security":"120.0.6099.224-1~deb11u1"},"urgency":"end-of-life"},"forky":{"status":"resolved","repositories":{"forky":"145.0.7632.159-1"},"fixed_version":"122.0.6261.57-1","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"146.0.7680.71-1"},"fixed_version":"122.0.6261.57-1","urgency":"not yet assigned"},"trixie":{"status":"resolved","repositories":{"trixie":"143.0.7499.169-1~deb13u1","trixie-security":"145.0.7632.159-1~deb13u1"},"fixed_version":"122.0.6261.57-1","urgency":"not yet assigned"}}},"CVE-2024-1671":{"description":"Inappropriate implementation in Site Isolation in Google Chrome prior to 122.0.6261.57 allowed a remote attacker to bypass content security policy via a crafted HTML page. (Chromium security severity: Medium)","scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"143.0.7499.169-1~deb12u1","bookworm-security":"145.0.7632.159-1~deb12u1"},"fixed_version":"122.0.6261.57-1~deb12u1","urgency":"not yet assigned"},"bullseye":{"status":"open","repositories":{"bullseye":"120.0.6099.224-1~deb11u1","bullseye-security":"120.0.6099.224-1~deb11u1"},"urgency":"end-of-life"},"forky":{"status":"resolved","repositories":{"forky":"145.0.7632.159-1"},"fixed_version":"122.0.6261.57-1","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"146.0.7680.71-1"},"fixed_version":"122.0.6261.57-1","urgency":"not yet assigned"},"trixie":{"status":"resolved","repositories":{"trixie":"143.0.7499.169-1~deb13u1","trixie-security":"145.0.7632.159-1~deb13u1"},"fixed_version":"122.0.6261.57-1","urgency":"not yet assigned"}}},"CVE-2024-1672":{"description":"Inappropriate implementation in Content Security Policy in Google Chrome prior to 122.0.6261.57 allowed a remote attacker to bypass content security policy via a crafted HTML page. (Chromium security severity: Medium)","scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"143.0.7499.169-1~deb12u1","bookworm-security":"145.0.7632.159-1~deb12u1"},"fixed_version":"122.0.6261.57-1~deb12u1","urgency":"not yet assigned"},"bullseye":{"status":"open","repositories":{"bullseye":"120.0.6099.224-1~deb11u1","bullseye-security":"120.0.6099.224-1~deb11u1"},"urgency":"end-of-life"},"forky":{"status":"resolved","repositories":{"forky":"145.0.7632.159-1"},"fixed_version":"122.0.6261.57-1","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"146.0.7680.71-1"},"fixed_version":"122.0.6261.57-1","urgency":"not yet assigned"},"trixie":{"status":"resolved","repositories":{"trixie":"143.0.7499.169-1~deb13u1","trixie-security":"145.0.7632.159-1~deb13u1"},"fixed_version":"122.0.6261.57-1","urgency":"not yet assigned"}}},"CVE-2024-1673":{"description":"Use after free in Accessibility in Google Chrome prior to 122.0.6261.57 allowed a remote attacker who had compromised the renderer process to potentially exploit heap corruption via specific UI gestures. (Chromium security severity: Medium)","scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"143.0.7499.169-1~deb12u1","bookworm-security":"145.0.7632.159-1~deb12u1"},"fixed_version":"122.0.6261.57-1~deb12u1","urgency":"not yet assigned"},"bullseye":{"status":"open","repositories":{"bullseye":"120.0.6099.224-1~deb11u1","bullseye-security":"120.0.6099.224-1~deb11u1"},"urgency":"end-of-life"},"forky":{"status":"resolved","repositories":{"forky":"145.0.7632.159-1"},"fixed_version":"122.0.6261.57-1","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"146.0.7680.71-1"},"fixed_version":"122.0.6261.57-1","urgency":"not yet assigned"},"trixie":{"status":"resolved","repositories":{"trixie":"143.0.7499.169-1~deb13u1","trixie-security":"145.0.7632.159-1~deb13u1"},"fixed_version":"122.0.6261.57-1","urgency":"not yet assigned"}}},"CVE-2024-1674":{"description":"Inappropriate implementation in Navigation in Google Chrome prior to 122.0.6261.57 allowed a remote attacker to bypass navigation restrictions via a crafted HTML page. (Chromium security severity: Medium)","scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"143.0.7499.169-1~deb12u1","bookworm-security":"145.0.7632.159-1~deb12u1"},"fixed_version":"122.0.6261.57-1~deb12u1","urgency":"not yet assigned"},"bullseye":{"status":"open","repositories":{"bullseye":"120.0.6099.224-1~deb11u1","bullseye-security":"120.0.6099.224-1~deb11u1"},"urgency":"end-of-life"},"forky":{"status":"resolved","repositories":{"forky":"145.0.7632.159-1"},"fixed_version":"122.0.6261.57-1","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"146.0.7680.71-1"},"fixed_version":"122.0.6261.57-1","urgency":"not yet assigned"},"trixie":{"status":"resolved","repositories":{"trixie":"143.0.7499.169-1~deb13u1","trixie-security":"145.0.7632.159-1~deb13u1"},"fixed_version":"122.0.6261.57-1","urgency":"not yet assigned"}}},"CVE-2024-1675":{"description":"Insufficient policy enforcement in Download in Google Chrome prior to 122.0.6261.57 allowed a remote attacker to bypass filesystem restrictions via a crafted HTML page. (Chromium security severity: Medium)","scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"143.0.7499.169-1~deb12u1","bookworm-security":"145.0.7632.159-1~deb12u1"},"fixed_version":"122.0.6261.57-1~deb12u1","urgency":"not yet assigned"},"bullseye":{"status":"open","repositories":{"bullseye":"120.0.6099.224-1~deb11u1","bullseye-security":"120.0.6099.224-1~deb11u1"},"urgency":"end-of-life"},"forky":{"status":"resolved","repositories":{"forky":"145.0.7632.159-1"},"fixed_version":"122.0.6261.57-1","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"146.0.7680.71-1"},"fixed_version":"122.0.6261.57-1","urgency":"not yet assigned"},"trixie":{"status":"resolved","repositories":{"trixie":"143.0.7499.169-1~deb13u1","trixie-security":"145.0.7632.159-1~deb13u1"},"fixed_version":"122.0.6261.57-1","urgency":"not yet assigned"}}},"CVE-2024-1676":{"description":"Inappropriate implementation in Navigation in Google Chrome prior to 122.0.6261.57 allowed a remote attacker to spoof security UI via a crafted HTML page. (Chromium security severity: Low)","scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"143.0.7499.169-1~deb12u1","bookworm-security":"145.0.7632.159-1~deb12u1"},"fixed_version":"122.0.6261.57-1~deb12u1","urgency":"not yet assigned"},"bullseye":{"status":"open","repositories":{"bullseye":"120.0.6099.224-1~deb11u1","bullseye-security":"120.0.6099.224-1~deb11u1"},"urgency":"end-of-life"},"forky":{"status":"resolved","repositories":{"forky":"145.0.7632.159-1"},"fixed_version":"122.0.6261.57-1","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"146.0.7680.71-1"},"fixed_version":"122.0.6261.57-1","urgency":"not yet assigned"},"trixie":{"status":"resolved","repositories":{"trixie":"143.0.7499.169-1~deb13u1","trixie-security":"145.0.7632.159-1~deb13u1"},"fixed_version":"122.0.6261.57-1","urgency":"not yet assigned"}}},"CVE-2024-1694":{"description":"Inappropriate implementation in Google Updator prior to 1.3.36.351 in Google Chrome allowed a local attacker to bypass discretionary access control via a malicious file. (Chromium security severity: High)","scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"143.0.7499.169-1~deb12u1","bookworm-security":"145.0.7632.159-1~deb12u1"},"fixed_version":"0","urgency":"unimportant"},"bullseye":{"status":"resolved","repositories":{"bullseye":"120.0.6099.224-1~deb11u1","bullseye-security":"120.0.6099.224-1~deb11u1"},"fixed_version":"0","urgency":"unimportant"},"forky":{"status":"resolved","repositories":{"forky":"145.0.7632.159-1"},"fixed_version":"0","urgency":"unimportant"},"sid":{"status":"resolved","repositories":{"sid":"146.0.7680.71-1"},"fixed_version":"0","urgency":"unimportant"},"trixie":{"status":"resolved","repositories":{"trixie":"143.0.7499.169-1~deb13u1","trixie-security":"145.0.7632.159-1~deb13u1"},"fixed_version":"0","urgency":"unimportant"}}},"CVE-2024-1938":{"description":"Type Confusion in V8 in Google Chrome prior to 122.0.6261.94 allowed a remote attacker to potentially exploit object corruption via a crafted HTML page. (Chromium security severity: High)","scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"143.0.7499.169-1~deb12u1","bookworm-security":"145.0.7632.159-1~deb12u1"},"fixed_version":"122.0.6261.94-1~deb12u1","urgency":"not yet assigned"},"bullseye":{"status":"open","repositories":{"bullseye":"120.0.6099.224-1~deb11u1","bullseye-security":"120.0.6099.224-1~deb11u1"},"urgency":"end-of-life"},"forky":{"status":"resolved","repositories":{"forky":"145.0.7632.159-1"},"fixed_version":"122.0.6261.94-1","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"146.0.7680.71-1"},"fixed_version":"122.0.6261.94-1","urgency":"not yet assigned"},"trixie":{"status":"resolved","repositories":{"trixie":"143.0.7499.169-1~deb13u1","trixie-security":"145.0.7632.159-1~deb13u1"},"fixed_version":"122.0.6261.94-1","urgency":"not yet assigned"}}},"CVE-2024-1939":{"description":"Type Confusion in V8 in Google Chrome prior to 122.0.6261.94 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. (Chromium security severity: High)","scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"143.0.7499.169-1~deb12u1","bookworm-security":"145.0.7632.159-1~deb12u1"},"fixed_version":"122.0.6261.94-1~deb12u1","urgency":"not yet assigned"},"bullseye":{"status":"open","repositories":{"bullseye":"120.0.6099.224-1~deb11u1","bullseye-security":"120.0.6099.224-1~deb11u1"},"urgency":"end-of-life"},"forky":{"status":"resolved","repositories":{"forky":"145.0.7632.159-1"},"fixed_version":"122.0.6261.94-1","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"146.0.7680.71-1"},"fixed_version":"122.0.6261.94-1","urgency":"not yet assigned"},"trixie":{"status":"resolved","repositories":{"trixie":"143.0.7499.169-1~deb13u1","trixie-security":"145.0.7632.159-1~deb13u1"},"fixed_version":"122.0.6261.94-1","urgency":"not yet assigned"}}},"CVE-2024-2173":{"description":"Out of bounds memory access in V8 in Google Chrome prior to 122.0.6261.111 allowed a remote attacker to perform out of bounds memory access via a crafted HTML page. (Chromium security severity: High)","scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"143.0.7499.169-1~deb12u1","bookworm-security":"145.0.7632.159-1~deb12u1"},"fixed_version":"122.0.6261.111-1~deb12u1","urgency":"not yet assigned"},"bullseye":{"status":"open","repositories":{"bullseye":"120.0.6099.224-1~deb11u1","bullseye-security":"120.0.6099.224-1~deb11u1"},"urgency":"end-of-life"},"forky":{"status":"resolved","repositories":{"forky":"145.0.7632.159-1"},"fixed_version":"122.0.6261.111-1","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"146.0.7680.71-1"},"fixed_version":"122.0.6261.111-1","urgency":"not yet assigned"},"trixie":{"status":"resolved","repositories":{"trixie":"143.0.7499.169-1~deb13u1","trixie-security":"145.0.7632.159-1~deb13u1"},"fixed_version":"122.0.6261.111-1","urgency":"not yet assigned"}}},"CVE-2024-2174":{"description":"Inappropriate implementation in V8 in Google Chrome prior to 122.0.6261.111 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. (Chromium security severity: High)","scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"143.0.7499.169-1~deb12u1","bookworm-security":"145.0.7632.159-1~deb12u1"},"fixed_version":"122.0.6261.111-1~deb12u1","urgency":"not yet assigned"},"bullseye":{"status":"open","repositories":{"bullseye":"120.0.6099.224-1~deb11u1","bullseye-security":"120.0.6099.224-1~deb11u1"},"urgency":"end-of-life"},"forky":{"status":"resolved","repositories":{"forky":"145.0.7632.159-1"},"fixed_version":"122.0.6261.111-1","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"146.0.7680.71-1"},"fixed_version":"122.0.6261.111-1","urgency":"not yet assigned"},"trixie":{"status":"resolved","repositories":{"trixie":"143.0.7499.169-1~deb13u1","trixie-security":"145.0.7632.159-1~deb13u1"},"fixed_version":"122.0.6261.111-1","urgency":"not yet assigned"}}},"CVE-2024-2176":{"description":"Use after free in FedCM in Google Chrome prior to 122.0.6261.111 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. (Chromium security severity: High)","scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"143.0.7499.169-1~deb12u1","bookworm-security":"145.0.7632.159-1~deb12u1"},"fixed_version":"122.0.6261.111-1~deb12u1","urgency":"not yet assigned"},"bullseye":{"status":"open","repositories":{"bullseye":"120.0.6099.224-1~deb11u1","bullseye-security":"120.0.6099.224-1~deb11u1"},"urgency":"end-of-life"},"forky":{"status":"resolved","repositories":{"forky":"145.0.7632.159-1"},"fixed_version":"122.0.6261.111-1","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"146.0.7680.71-1"},"fixed_version":"122.0.6261.111-1","urgency":"not yet assigned"},"trixie":{"status":"resolved","repositories":{"trixie":"143.0.7499.169-1~deb13u1","trixie-security":"145.0.7632.159-1~deb13u1"},"fixed_version":"122.0.6261.111-1","urgency":"not yet assigned"}}},"CVE-2024-2400":{"description":"Use after free in Performance Manager in Google Chrome prior to 122.0.6261.128 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. (Chromium security severity: High)","scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"143.0.7499.169-1~deb12u1","bookworm-security":"145.0.7632.159-1~deb12u1"},"fixed_version":"122.0.6261.128-1~deb12u1","urgency":"not yet assigned"},"bullseye":{"status":"open","repositories":{"bullseye":"120.0.6099.224-1~deb11u1","bullseye-security":"120.0.6099.224-1~deb11u1"},"urgency":"end-of-life"},"forky":{"status":"resolved","repositories":{"forky":"145.0.7632.159-1"},"fixed_version":"122.0.6261.128-1","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"146.0.7680.71-1"},"fixed_version":"122.0.6261.128-1","urgency":"not yet assigned"},"trixie":{"status":"resolved","repositories":{"trixie":"143.0.7499.169-1~deb13u1","trixie-security":"145.0.7632.159-1~deb13u1"},"fixed_version":"122.0.6261.128-1","urgency":"not yet assigned"}}},"CVE-2024-2625":{"description":"Object lifecycle issue in V8 in Google Chrome prior to 123.0.6312.58 allowed a remote attacker to potentially exploit object corruption via a crafted HTML page. (Chromium security severity: High)","scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"143.0.7499.169-1~deb12u1","bookworm-security":"145.0.7632.159-1~deb12u1"},"fixed_version":"123.0.6312.86-1~deb12u1","urgency":"not yet assigned"},"bullseye":{"status":"open","repositories":{"bullseye":"120.0.6099.224-1~deb11u1","bullseye-security":"120.0.6099.224-1~deb11u1"},"urgency":"end-of-life"},"forky":{"status":"resolved","repositories":{"forky":"145.0.7632.159-1"},"fixed_version":"123.0.6312.58-1","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"146.0.7680.71-1"},"fixed_version":"123.0.6312.58-1","urgency":"not yet assigned"},"trixie":{"status":"resolved","repositories":{"trixie":"143.0.7499.169-1~deb13u1","trixie-security":"145.0.7632.159-1~deb13u1"},"fixed_version":"123.0.6312.58-1","urgency":"not yet assigned"}}},"CVE-2024-2626":{"description":"Out of bounds read in Swiftshader in Google Chrome prior to 123.0.6312.58 allowed a remote attacker to perform out of bounds memory access via a crafted HTML page. (Chromium security severity: Medium)","scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"143.0.7499.169-1~deb12u1","bookworm-security":"145.0.7632.159-1~deb12u1"},"fixed_version":"123.0.6312.86-1~deb12u1","urgency":"not yet assigned"},"bullseye":{"status":"open","repositories":{"bullseye":"120.0.6099.224-1~deb11u1","bullseye-security":"120.0.6099.224-1~deb11u1"},"urgency":"end-of-life"},"forky":{"status":"resolved","repositories":{"forky":"145.0.7632.159-1"},"fixed_version":"123.0.6312.58-1","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"146.0.7680.71-1"},"fixed_version":"123.0.6312.58-1","urgency":"not yet assigned"},"trixie":{"status":"resolved","repositories":{"trixie":"143.0.7499.169-1~deb13u1","trixie-security":"145.0.7632.159-1~deb13u1"},"fixed_version":"123.0.6312.58-1","urgency":"not yet assigned"}}},"CVE-2024-2627":{"description":"Use after free in Canvas in Google Chrome prior to 123.0.6312.58 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. (Chromium security severity: Medium)","scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"143.0.7499.169-1~deb12u1","bookworm-security":"145.0.7632.159-1~deb12u1"},"fixed_version":"123.0.6312.86-1~deb12u1","urgency":"not yet assigned"},"bullseye":{"status":"open","repositories":{"bullseye":"120.0.6099.224-1~deb11u1","bullseye-security":"120.0.6099.224-1~deb11u1"},"urgency":"end-of-life"},"forky":{"status":"resolved","repositories":{"forky":"145.0.7632.159-1"},"fixed_version":"123.0.6312.58-1","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"146.0.7680.71-1"},"fixed_version":"123.0.6312.58-1","urgency":"not yet assigned"},"trixie":{"status":"resolved","repositories":{"trixie":"143.0.7499.169-1~deb13u1","trixie-security":"145.0.7632.159-1~deb13u1"},"fixed_version":"123.0.6312.58-1","urgency":"not yet assigned"}}},"CVE-2024-2628":{"description":"Inappropriate implementation in Downloads in Google Chrome prior to 123.0.6312.58 allowed a remote attacker to perform UI spoofing via a crafted URL. (Chromium security severity: Medium)","scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"143.0.7499.169-1~deb12u1","bookworm-security":"145.0.7632.159-1~deb12u1"},"fixed_version":"123.0.6312.86-1~deb12u1","urgency":"not yet assigned"},"bullseye":{"status":"open","repositories":{"bullseye":"120.0.6099.224-1~deb11u1","bullseye-security":"120.0.6099.224-1~deb11u1"},"urgency":"end-of-life"},"forky":{"status":"resolved","repositories":{"forky":"145.0.7632.159-1"},"fixed_version":"123.0.6312.58-1","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"146.0.7680.71-1"},"fixed_version":"123.0.6312.58-1","urgency":"not yet assigned"},"trixie":{"status":"resolved","repositories":{"trixie":"143.0.7499.169-1~deb13u1","trixie-security":"145.0.7632.159-1~deb13u1"},"fixed_version":"123.0.6312.58-1","urgency":"not yet assigned"}}},"CVE-2024-2629":{"description":"Incorrect security UI in iOS in Google Chrome prior to 123.0.6312.58 allowed a remote attacker to perform UI spoofing via a crafted HTML page. (Chromium security severity: Medium)","scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"143.0.7499.169-1~deb12u1","bookworm-security":"145.0.7632.159-1~deb12u1"},"fixed_version":"123.0.6312.86-1~deb12u1","urgency":"not yet assigned"},"bullseye":{"status":"open","repositories":{"bullseye":"120.0.6099.224-1~deb11u1","bullseye-security":"120.0.6099.224-1~deb11u1"},"urgency":"end-of-life"},"forky":{"status":"resolved","repositories":{"forky":"145.0.7632.159-1"},"fixed_version":"123.0.6312.58-1","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"146.0.7680.71-1"},"fixed_version":"123.0.6312.58-1","urgency":"not yet assigned"},"trixie":{"status":"resolved","repositories":{"trixie":"143.0.7499.169-1~deb13u1","trixie-security":"145.0.7632.159-1~deb13u1"},"fixed_version":"123.0.6312.58-1","urgency":"not yet assigned"}}},"CVE-2024-2630":{"description":"Inappropriate implementation in iOS in Google Chrome prior to 123.0.6312.58 allowed a remote attacker to leak cross-origin data via a crafted HTML page. (Chromium security severity: Medium)","scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"143.0.7499.169-1~deb12u1","bookworm-security":"145.0.7632.159-1~deb12u1"},"fixed_version":"123.0.6312.86-1~deb12u1","urgency":"not yet assigned"},"bullseye":{"status":"open","repositories":{"bullseye":"120.0.6099.224-1~deb11u1","bullseye-security":"120.0.6099.224-1~deb11u1"},"urgency":"end-of-life"},"forky":{"status":"resolved","repositories":{"forky":"145.0.7632.159-1"},"fixed_version":"123.0.6312.58-1","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"146.0.7680.71-1"},"fixed_version":"123.0.6312.58-1","urgency":"not yet assigned"},"trixie":{"status":"resolved","repositories":{"trixie":"143.0.7499.169-1~deb13u1","trixie-security":"145.0.7632.159-1~deb13u1"},"fixed_version":"123.0.6312.58-1","urgency":"not yet assigned"}}},"CVE-2024-2631":{"description":"Inappropriate implementation in iOS in Google Chrome prior to 123.0.6312.58 allowed a remote attacker to perform UI spoofing via a crafted HTML page. (Chromium security severity: Low)","scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"143.0.7499.169-1~deb12u1","bookworm-security":"145.0.7632.159-1~deb12u1"},"fixed_version":"123.0.6312.86-1~deb12u1","urgency":"not yet assigned"},"bullseye":{"status":"open","repositories":{"bullseye":"120.0.6099.224-1~deb11u1","bullseye-security":"120.0.6099.224-1~deb11u1"},"urgency":"end-of-life"},"forky":{"status":"resolved","repositories":{"forky":"145.0.7632.159-1"},"fixed_version":"123.0.6312.58-1","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"146.0.7680.71-1"},"fixed_version":"123.0.6312.58-1","urgency":"not yet assigned"},"trixie":{"status":"resolved","repositories":{"trixie":"143.0.7499.169-1~deb13u1","trixie-security":"145.0.7632.159-1~deb13u1"},"fixed_version":"123.0.6312.58-1","urgency":"not yet assigned"}}},"CVE-2024-2883":{"description":"Use after free in ANGLE in Google Chrome prior to 123.0.6312.86 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. (Chromium security severity: Critical)","scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"143.0.7499.169-1~deb12u1","bookworm-security":"145.0.7632.159-1~deb12u1"},"fixed_version":"123.0.6312.86-1~deb12u1","urgency":"not yet assigned"},"bullseye":{"status":"open","repositories":{"bullseye":"120.0.6099.224-1~deb11u1","bullseye-security":"120.0.6099.224-1~deb11u1"},"urgency":"end-of-life"},"forky":{"status":"resolved","repositories":{"forky":"145.0.7632.159-1"},"fixed_version":"123.0.6312.86-1","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"146.0.7680.71-1"},"fixed_version":"123.0.6312.86-1","urgency":"not yet assigned"},"trixie":{"status":"resolved","repositories":{"trixie":"143.0.7499.169-1~deb13u1","trixie-security":"145.0.7632.159-1~deb13u1"},"fixed_version":"123.0.6312.86-1","urgency":"not yet assigned"}}},"CVE-2024-2884":{"description":"Out of bounds read in V8 in Google Chrome prior to 121.0.6167.139 allowed a remote attacker to potentially perform out of bounds memory access via a crafted HTML page. (Chromium security severity: Medium)","scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"143.0.7499.169-1~deb12u1","bookworm-security":"145.0.7632.159-1~deb12u1"},"fixed_version":"121.0.6167.139-1~deb12u1","urgency":"not yet assigned"},"bullseye":{"status":"open","repositories":{"bullseye":"120.0.6099.224-1~deb11u1","bullseye-security":"120.0.6099.224-1~deb11u1"},"urgency":"end-of-life"},"forky":{"status":"resolved","repositories":{"forky":"145.0.7632.159-1"},"fixed_version":"121.0.6167.139-1","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"146.0.7680.71-1"},"fixed_version":"121.0.6167.139-1","urgency":"not yet assigned"},"trixie":{"status":"resolved","repositories":{"trixie":"143.0.7499.169-1~deb13u1","trixie-security":"145.0.7632.159-1~deb13u1"},"fixed_version":"121.0.6167.139-1","urgency":"not yet assigned"}}},"CVE-2024-2885":{"description":"Use after free in Dawn in Google Chrome prior to 123.0.6312.86 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. (Chromium security severity: High)","scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"143.0.7499.169-1~deb12u1","bookworm-security":"145.0.7632.159-1~deb12u1"},"fixed_version":"123.0.6312.86-1~deb12u1","urgency":"not yet assigned"},"bullseye":{"status":"open","repositories":{"bullseye":"120.0.6099.224-1~deb11u1","bullseye-security":"120.0.6099.224-1~deb11u1"},"urgency":"end-of-life"},"forky":{"status":"resolved","repositories":{"forky":"145.0.7632.159-1"},"fixed_version":"123.0.6312.86-1","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"146.0.7680.71-1"},"fixed_version":"123.0.6312.86-1","urgency":"not yet assigned"},"trixie":{"status":"resolved","repositories":{"trixie":"143.0.7499.169-1~deb13u1","trixie-security":"145.0.7632.159-1~deb13u1"},"fixed_version":"123.0.6312.86-1","urgency":"not yet assigned"}}},"CVE-2024-2886":{"description":"Use after free in WebCodecs in Google Chrome prior to 123.0.6312.86 allowed a remote attacker to perform arbitrary read/write via a crafted HTML page. (Chromium security severity: High)","scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"143.0.7499.169-1~deb12u1","bookworm-security":"145.0.7632.159-1~deb12u1"},"fixed_version":"123.0.6312.86-1~deb12u1","urgency":"not yet assigned"},"bullseye":{"status":"open","repositories":{"bullseye":"120.0.6099.224-1~deb11u1","bullseye-security":"120.0.6099.224-1~deb11u1"},"urgency":"end-of-life"},"forky":{"status":"resolved","repositories":{"forky":"145.0.7632.159-1"},"fixed_version":"123.0.6312.86-1","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"146.0.7680.71-1"},"fixed_version":"123.0.6312.86-1","urgency":"not yet assigned"},"trixie":{"status":"resolved","repositories":{"trixie":"143.0.7499.169-1~deb13u1","trixie-security":"145.0.7632.159-1~deb13u1"},"fixed_version":"123.0.6312.86-1","urgency":"not yet assigned"}}},"CVE-2024-2887":{"description":"Type Confusion in WebAssembly in Google Chrome prior to 123.0.6312.86 allowed a remote attacker to execute arbitrary code via a crafted HTML page. (Chromium security severity: High)","scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"143.0.7499.169-1~deb12u1","bookworm-security":"145.0.7632.159-1~deb12u1"},"fixed_version":"123.0.6312.86-1~deb12u1","urgency":"not yet assigned"},"bullseye":{"status":"open","repositories":{"bullseye":"120.0.6099.224-1~deb11u1","bullseye-security":"120.0.6099.224-1~deb11u1"},"urgency":"end-of-life"},"forky":{"status":"resolved","repositories":{"forky":"145.0.7632.159-1"},"fixed_version":"123.0.6312.86-1","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"146.0.7680.71-1"},"fixed_version":"123.0.6312.86-1","urgency":"not yet assigned"},"trixie":{"status":"resolved","repositories":{"trixie":"143.0.7499.169-1~deb13u1","trixie-security":"145.0.7632.159-1~deb13u1"},"fixed_version":"123.0.6312.86-1","urgency":"not yet assigned"}}},"CVE-2024-3156":{"description":"Inappropriate implementation in V8 in Google Chrome prior to 123.0.6312.105 allowed a remote attacker to potentially perform out of bounds memory access via a crafted HTML page. (Chromium security severity: High)","scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"143.0.7499.169-1~deb12u1","bookworm-security":"145.0.7632.159-1~deb12u1"},"fixed_version":"123.0.6312.105-1~deb12u1","urgency":"not yet assigned"},"bullseye":{"status":"open","repositories":{"bullseye":"120.0.6099.224-1~deb11u1","bullseye-security":"120.0.6099.224-1~deb11u1"},"urgency":"end-of-life"},"forky":{"status":"resolved","repositories":{"forky":"145.0.7632.159-1"},"fixed_version":"123.0.6312.105-1","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"146.0.7680.71-1"},"fixed_version":"123.0.6312.105-1","urgency":"not yet assigned"},"trixie":{"status":"resolved","repositories":{"trixie":"143.0.7499.169-1~deb13u1","trixie-security":"145.0.7632.159-1~deb13u1"},"fixed_version":"123.0.6312.105-1","urgency":"not yet assigned"}}},"CVE-2024-3157":{"description":"Out of bounds memory access in Compositing in Google Chrome prior to 123.0.6312.122 allowed a remote attacker who had compromised the GPU process to potentially perform a sandbox escape via specific UI gestures. (Chromium security severity: High)","scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"143.0.7499.169-1~deb12u1","bookworm-security":"145.0.7632.159-1~deb12u1"},"fixed_version":"123.0.6312.122-1~deb12u1","urgency":"not yet assigned"},"bullseye":{"status":"open","repositories":{"bullseye":"120.0.6099.224-1~deb11u1","bullseye-security":"120.0.6099.224-1~deb11u1"},"urgency":"end-of-life"},"forky":{"status":"resolved","repositories":{"forky":"145.0.7632.159-1"},"fixed_version":"123.0.6312.122-1","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"146.0.7680.71-1"},"fixed_version":"123.0.6312.122-1","urgency":"not yet assigned"},"trixie":{"status":"resolved","repositories":{"trixie":"143.0.7499.169-1~deb13u1","trixie-security":"145.0.7632.159-1~deb13u1"},"fixed_version":"123.0.6312.122-1","urgency":"not yet assigned"}}},"CVE-2024-3158":{"description":"Use after free in Bookmarks in Google Chrome prior to 123.0.6312.105 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. (Chromium security severity: High)","scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"143.0.7499.169-1~deb12u1","bookworm-security":"145.0.7632.159-1~deb12u1"},"fixed_version":"123.0.6312.105-1~deb12u1","urgency":"not yet assigned"},"bullseye":{"status":"open","repositories":{"bullseye":"120.0.6099.224-1~deb11u1","bullseye-security":"120.0.6099.224-1~deb11u1"},"urgency":"end-of-life"},"forky":{"status":"resolved","repositories":{"forky":"145.0.7632.159-1"},"fixed_version":"123.0.6312.105-1","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"146.0.7680.71-1"},"fixed_version":"123.0.6312.105-1","urgency":"not yet assigned"},"trixie":{"status":"resolved","repositories":{"trixie":"143.0.7499.169-1~deb13u1","trixie-security":"145.0.7632.159-1~deb13u1"},"fixed_version":"123.0.6312.105-1","urgency":"not yet assigned"}}},"CVE-2024-3159":{"description":"Out of bounds memory access in V8 in Google Chrome prior to 123.0.6312.105 allowed a remote attacker to perform arbitrary read/write via a crafted HTML page. (Chromium security severity: High)","scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"143.0.7499.169-1~deb12u1","bookworm-security":"145.0.7632.159-1~deb12u1"},"fixed_version":"123.0.6312.105-1~deb12u1","urgency":"not yet assigned"},"bullseye":{"status":"open","repositories":{"bullseye":"120.0.6099.224-1~deb11u1","bullseye-security":"120.0.6099.224-1~deb11u1"},"urgency":"end-of-life"},"forky":{"status":"resolved","repositories":{"forky":"145.0.7632.159-1"},"fixed_version":"123.0.6312.105-1","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"146.0.7680.71-1"},"fixed_version":"123.0.6312.105-1","urgency":"not yet assigned"},"trixie":{"status":"resolved","repositories":{"trixie":"143.0.7499.169-1~deb13u1","trixie-security":"145.0.7632.159-1~deb13u1"},"fixed_version":"123.0.6312.105-1","urgency":"not yet assigned"}}},"CVE-2024-3168":{"description":"Use after free in DevTools in Google Chrome prior to 122.0.6261.57 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. (Chromium security severity: Medium)","scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"143.0.7499.169-1~deb12u1","bookworm-security":"145.0.7632.159-1~deb12u1"},"fixed_version":"122.0.6261.57-1~deb12u1","urgency":"not yet assigned"},"bullseye":{"status":"open","repositories":{"bullseye":"120.0.6099.224-1~deb11u1","bullseye-security":"120.0.6099.224-1~deb11u1"},"urgency":"end-of-life"},"forky":{"status":"resolved","repositories":{"forky":"145.0.7632.159-1"},"fixed_version":"122.0.6261.57-1","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"146.0.7680.71-1"},"fixed_version":"122.0.6261.57-1","urgency":"not yet assigned"},"trixie":{"status":"resolved","repositories":{"trixie":"143.0.7499.169-1~deb13u1","trixie-security":"145.0.7632.159-1~deb13u1"},"fixed_version":"122.0.6261.57-1","urgency":"not yet assigned"}}},"CVE-2024-3169":{"description":"Use after free in V8 in Google Chrome prior to 121.0.6167.139 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. (Chromium security severity: High)","scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"143.0.7499.169-1~deb12u1","bookworm-security":"145.0.7632.159-1~deb12u1"},"fixed_version":"121.0.6167.139-1~deb12u1","urgency":"not yet assigned"},"bullseye":{"status":"open","repositories":{"bullseye":"120.0.6099.224-1~deb11u1","bullseye-security":"120.0.6099.224-1~deb11u1"},"urgency":"end-of-life"},"forky":{"status":"resolved","repositories":{"forky":"145.0.7632.159-1"},"fixed_version":"121.0.6167.139-1","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"146.0.7680.71-1"},"fixed_version":"121.0.6167.139-1","urgency":"not yet assigned"},"trixie":{"status":"resolved","repositories":{"trixie":"143.0.7499.169-1~deb13u1","trixie-security":"145.0.7632.159-1~deb13u1"},"fixed_version":"121.0.6167.139-1","urgency":"not yet assigned"}}},"CVE-2024-3170":{"description":"Use after free in WebRTC in Google Chrome prior to 121.0.6167.85 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. (Chromium security severity: High)","scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"143.0.7499.169-1~deb12u1","bookworm-security":"145.0.7632.159-1~deb12u1"},"fixed_version":"121.0.6167.85-1~deb12u1","urgency":"not yet assigned"},"bullseye":{"status":"open","repositories":{"bullseye":"120.0.6099.224-1~deb11u1","bullseye-security":"120.0.6099.224-1~deb11u1"},"urgency":"end-of-life"},"forky":{"status":"resolved","repositories":{"forky":"145.0.7632.159-1"},"fixed_version":"121.0.6167.85-1","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"146.0.7680.71-1"},"fixed_version":"121.0.6167.85-1","urgency":"not yet assigned"},"trixie":{"status":"resolved","repositories":{"trixie":"143.0.7499.169-1~deb13u1","trixie-security":"145.0.7632.159-1~deb13u1"},"fixed_version":"121.0.6167.85-1","urgency":"not yet assigned"}}},"CVE-2024-3171":{"description":"Use after free in Accessibility in Google Chrome prior to 122.0.6261.57 allowed a remote attacker who convinced a user to engage in specific UI gestures to potentially exploit heap corruption via specific UI gestures. (Chromium security severity: Medium)","scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"143.0.7499.169-1~deb12u1","bookworm-security":"145.0.7632.159-1~deb12u1"},"fixed_version":"122.0.6261.57-1~deb12u1","urgency":"not yet assigned"},"bullseye":{"status":"open","repositories":{"bullseye":"120.0.6099.224-1~deb11u1","bullseye-security":"120.0.6099.224-1~deb11u1"},"urgency":"end-of-life"},"forky":{"status":"resolved","repositories":{"forky":"145.0.7632.159-1"},"fixed_version":"122.0.6261.57-1","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"146.0.7680.71-1"},"fixed_version":"122.0.6261.57-1","urgency":"not yet assigned"},"trixie":{"status":"resolved","repositories":{"trixie":"143.0.7499.169-1~deb13u1","trixie-security":"145.0.7632.159-1~deb13u1"},"fixed_version":"122.0.6261.57-1","urgency":"not yet assigned"}}},"CVE-2024-3172":{"description":"Insufficient data validation in DevTools in Google Chrome prior to 121.0.6167.85 allowed a remote attacker who convinced a user to engage in specific UI gestures to execute arbitrary code via a crafted HTML page. (Chromium security severity: High)","scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"143.0.7499.169-1~deb12u1","bookworm-security":"145.0.7632.159-1~deb12u1"},"fixed_version":"121.0.6167.85-1~deb12u1","urgency":"not yet assigned"},"bullseye":{"status":"open","repositories":{"bullseye":"120.0.6099.224-1~deb11u1","bullseye-security":"120.0.6099.224-1~deb11u1"},"urgency":"end-of-life"},"forky":{"status":"resolved","repositories":{"forky":"145.0.7632.159-1"},"fixed_version":"121.0.6167.85-1","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"146.0.7680.71-1"},"fixed_version":"121.0.6167.85-1","urgency":"not yet assigned"},"trixie":{"status":"resolved","repositories":{"trixie":"143.0.7499.169-1~deb13u1","trixie-security":"145.0.7632.159-1~deb13u1"},"fixed_version":"121.0.6167.85-1","urgency":"not yet assigned"}}},"CVE-2024-3173":{"description":"Insufficient data validation in Updater in Google Chrome prior to 120.0.6099.62 allowed a remote attacker to perform OS-level privilege escalation via a malicious file. (Chromium security severity: High)","scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"143.0.7499.169-1~deb12u1","bookworm-security":"145.0.7632.159-1~deb12u1"},"fixed_version":"120.0.6099.71-1~deb12u1","urgency":"not yet assigned"},"bullseye":{"status":"resolved","repositories":{"bullseye":"120.0.6099.224-1~deb11u1","bullseye-security":"120.0.6099.224-1~deb11u1"},"fixed_version":"120.0.6099.71-1~deb11u1","urgency":"not yet assigned"},"forky":{"status":"resolved","repositories":{"forky":"145.0.7632.159-1"},"fixed_version":"120.0.6099.71-1","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"146.0.7680.71-1"},"fixed_version":"120.0.6099.71-1","urgency":"not yet assigned"},"trixie":{"status":"resolved","repositories":{"trixie":"143.0.7499.169-1~deb13u1","trixie-security":"145.0.7632.159-1~deb13u1"},"fixed_version":"120.0.6099.71-1","urgency":"not yet assigned"}}},"CVE-2024-3174":{"description":"Inappropriate implementation in V8 in Google Chrome prior to 119.0.6045.105 allowed a remote attacker to potentially exploit object corruption via a crafted HTML page. (Chromium security severity: High)","scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"143.0.7499.169-1~deb12u1","bookworm-security":"145.0.7632.159-1~deb12u1"},"fixed_version":"119.0.6045.105-1~deb12u1","urgency":"not yet assigned"},"bullseye":{"status":"resolved","repositories":{"bullseye":"120.0.6099.224-1~deb11u1","bullseye-security":"120.0.6099.224-1~deb11u1"},"fixed_version":"119.0.6045.105-1~deb11u1","urgency":"not yet assigned"},"forky":{"status":"resolved","repositories":{"forky":"145.0.7632.159-1"},"fixed_version":"119.0.6045.105-1","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"146.0.7680.71-1"},"fixed_version":"119.0.6045.105-1","urgency":"not yet assigned"},"trixie":{"status":"resolved","repositories":{"trixie":"143.0.7499.169-1~deb13u1","trixie-security":"145.0.7632.159-1~deb13u1"},"fixed_version":"119.0.6045.105-1","urgency":"not yet assigned"}}},"CVE-2024-3175":{"description":"Insufficient data validation in Extensions in Google Chrome prior to 120.0.6099.62 allowed a remote attacker to perform privilege escalation via a crafted Chrome Extension. (Chromium security severity: Low)","scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"143.0.7499.169-1~deb12u1","bookworm-security":"145.0.7632.159-1~deb12u1"},"fixed_version":"120.0.6099.71-1~deb12u1","urgency":"not yet assigned"},"bullseye":{"status":"resolved","repositories":{"bullseye":"120.0.6099.224-1~deb11u1","bullseye-security":"120.0.6099.224-1~deb11u1"},"fixed_version":"120.0.6099.71-1~deb11u1","urgency":"not yet assigned"},"forky":{"status":"resolved","repositories":{"forky":"145.0.7632.159-1"},"fixed_version":"120.0.6099.71-1","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"146.0.7680.71-1"},"fixed_version":"120.0.6099.71-1","urgency":"not yet assigned"},"trixie":{"status":"resolved","repositories":{"trixie":"143.0.7499.169-1~deb13u1","trixie-security":"145.0.7632.159-1~deb13u1"},"fixed_version":"120.0.6099.71-1","urgency":"not yet assigned"}}},"CVE-2024-3176":{"description":"Out of bounds write in SwiftShader in Google Chrome prior to 117.0.5938.62 allowed a remote attacker to perform an out of bounds memory write via a crafted HTML page. (Chromium security severity: High)","scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"143.0.7499.169-1~deb12u1","bookworm-security":"145.0.7632.159-1~deb12u1"},"fixed_version":"117.0.5938.62-1~deb12u1","urgency":"not yet assigned"},"bullseye":{"status":"resolved","repositories":{"bullseye":"120.0.6099.224-1~deb11u1","bullseye-security":"120.0.6099.224-1~deb11u1"},"fixed_version":"117.0.5938.62-1~deb11u1","urgency":"not yet assigned"},"forky":{"status":"resolved","repositories":{"forky":"145.0.7632.159-1"},"fixed_version":"117.0.5938.62-1","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"146.0.7680.71-1"},"fixed_version":"117.0.5938.62-1","urgency":"not yet assigned"},"trixie":{"status":"resolved","repositories":{"trixie":"143.0.7499.169-1~deb13u1","trixie-security":"145.0.7632.159-1~deb13u1"},"fixed_version":"117.0.5938.62-1","urgency":"not yet assigned"}}},"CVE-2024-3515":{"description":"Use after free in Dawn in Google Chrome prior to 123.0.6312.122 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. (Chromium security severity: High)","scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"143.0.7499.169-1~deb12u1","bookworm-security":"145.0.7632.159-1~deb12u1"},"fixed_version":"123.0.6312.122-1~deb12u1","urgency":"not yet assigned"},"bullseye":{"status":"open","repositories":{"bullseye":"120.0.6099.224-1~deb11u1","bullseye-security":"120.0.6099.224-1~deb11u1"},"urgency":"end-of-life"},"forky":{"status":"resolved","repositories":{"forky":"145.0.7632.159-1"},"fixed_version":"123.0.6312.122-1","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"146.0.7680.71-1"},"fixed_version":"123.0.6312.122-1","urgency":"not yet assigned"},"trixie":{"status":"resolved","repositories":{"trixie":"143.0.7499.169-1~deb13u1","trixie-security":"145.0.7632.159-1~deb13u1"},"fixed_version":"123.0.6312.122-1","urgency":"not yet assigned"}}},"CVE-2024-3516":{"description":"Heap buffer overflow in ANGLE in Google Chrome prior to 123.0.6312.122 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. (Chromium security severity: High)","scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"143.0.7499.169-1~deb12u1","bookworm-security":"145.0.7632.159-1~deb12u1"},"fixed_version":"123.0.6312.122-1~deb12u1","urgency":"not yet assigned"},"bullseye":{"status":"open","repositories":{"bullseye":"120.0.6099.224-1~deb11u1","bullseye-security":"120.0.6099.224-1~deb11u1"},"urgency":"end-of-life"},"forky":{"status":"resolved","repositories":{"forky":"145.0.7632.159-1"},"fixed_version":"123.0.6312.122-1","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"146.0.7680.71-1"},"fixed_version":"123.0.6312.122-1","urgency":"not yet assigned"},"trixie":{"status":"resolved","repositories":{"trixie":"143.0.7499.169-1~deb13u1","trixie-security":"145.0.7632.159-1~deb13u1"},"fixed_version":"123.0.6312.122-1","urgency":"not yet assigned"}}},"CVE-2024-3832":{"description":"Object corruption in V8 in Google Chrome prior to 124.0.6367.60 allowed a remote attacker to potentially exploit object corruption via a crafted HTML page. (Chromium security severity: High)","scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"143.0.7499.169-1~deb12u1","bookworm-security":"145.0.7632.159-1~deb12u1"},"fixed_version":"124.0.6367.60-1~deb12u1","urgency":"not yet assigned"},"bullseye":{"status":"open","repositories":{"bullseye":"120.0.6099.224-1~deb11u1","bullseye-security":"120.0.6099.224-1~deb11u1"},"urgency":"end-of-life"},"forky":{"status":"resolved","repositories":{"forky":"145.0.7632.159-1"},"fixed_version":"124.0.6367.60-1","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"146.0.7680.71-1"},"fixed_version":"124.0.6367.60-1","urgency":"not yet assigned"},"trixie":{"status":"resolved","repositories":{"trixie":"143.0.7499.169-1~deb13u1","trixie-security":"145.0.7632.159-1~deb13u1"},"fixed_version":"124.0.6367.60-1","urgency":"not yet assigned"}}},"CVE-2024-3833":{"description":"Object corruption in WebAssembly in Google Chrome prior to 124.0.6367.60 allowed a remote attacker to potentially exploit object corruption via a crafted HTML page. (Chromium security severity: High)","scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"143.0.7499.169-1~deb12u1","bookworm-security":"145.0.7632.159-1~deb12u1"},"fixed_version":"124.0.6367.60-1~deb12u1","urgency":"not yet assigned"},"bullseye":{"status":"open","repositories":{"bullseye":"120.0.6099.224-1~deb11u1","bullseye-security":"120.0.6099.224-1~deb11u1"},"urgency":"end-of-life"},"forky":{"status":"resolved","repositories":{"forky":"145.0.7632.159-1"},"fixed_version":"124.0.6367.60-1","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"146.0.7680.71-1"},"fixed_version":"124.0.6367.60-1","urgency":"not yet assigned"},"trixie":{"status":"resolved","repositories":{"trixie":"143.0.7499.169-1~deb13u1","trixie-security":"145.0.7632.159-1~deb13u1"},"fixed_version":"124.0.6367.60-1","urgency":"not yet assigned"}}},"CVE-2024-3834":{"description":"Use after free in Downloads in Google Chrome prior to 124.0.6367.60 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. (Chromium security severity: High)","scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"143.0.7499.169-1~deb12u1","bookworm-security":"145.0.7632.159-1~deb12u1"},"fixed_version":"124.0.6367.60-1~deb12u1","urgency":"not yet assigned"},"bullseye":{"status":"open","repositories":{"bullseye":"120.0.6099.224-1~deb11u1","bullseye-security":"120.0.6099.224-1~deb11u1"},"urgency":"end-of-life"},"forky":{"status":"resolved","repositories":{"forky":"145.0.7632.159-1"},"fixed_version":"124.0.6367.60-1","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"146.0.7680.71-1"},"fixed_version":"124.0.6367.60-1","urgency":"not yet assigned"},"trixie":{"status":"resolved","repositories":{"trixie":"143.0.7499.169-1~deb13u1","trixie-security":"145.0.7632.159-1~deb13u1"},"fixed_version":"124.0.6367.60-1","urgency":"not yet assigned"}}},"CVE-2024-3837":{"description":"Use after free in QUIC in Google Chrome prior to 124.0.6367.60 allowed a remote attacker who had compromised the renderer process to potentially exploit heap corruption via a crafted HTML page. (Chromium security severity: Medium)","scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"143.0.7499.169-1~deb12u1","bookworm-security":"145.0.7632.159-1~deb12u1"},"fixed_version":"124.0.6367.60-1~deb12u1","urgency":"not yet assigned"},"bullseye":{"status":"open","repositories":{"bullseye":"120.0.6099.224-1~deb11u1","bullseye-security":"120.0.6099.224-1~deb11u1"},"urgency":"end-of-life"},"forky":{"status":"resolved","repositories":{"forky":"145.0.7632.159-1"},"fixed_version":"124.0.6367.60-1","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"146.0.7680.71-1"},"fixed_version":"124.0.6367.60-1","urgency":"not yet assigned"},"trixie":{"status":"resolved","repositories":{"trixie":"143.0.7499.169-1~deb13u1","trixie-security":"145.0.7632.159-1~deb13u1"},"fixed_version":"124.0.6367.60-1","urgency":"not yet assigned"}}},"CVE-2024-3838":{"description":"Inappropriate implementation in Autofill in Google Chrome prior to 124.0.6367.60 allowed an attacker who convinced a user to install a malicious app to perform UI spoofing via a crafted app. (Chromium security severity: Medium)","scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"143.0.7499.169-1~deb12u1","bookworm-security":"145.0.7632.159-1~deb12u1"},"fixed_version":"124.0.6367.60-1~deb12u1","urgency":"not yet assigned"},"bullseye":{"status":"open","repositories":{"bullseye":"120.0.6099.224-1~deb11u1","bullseye-security":"120.0.6099.224-1~deb11u1"},"urgency":"end-of-life"},"forky":{"status":"resolved","repositories":{"forky":"145.0.7632.159-1"},"fixed_version":"124.0.6367.60-1","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"146.0.7680.71-1"},"fixed_version":"124.0.6367.60-1","urgency":"not yet assigned"},"trixie":{"status":"resolved","repositories":{"trixie":"143.0.7499.169-1~deb13u1","trixie-security":"145.0.7632.159-1~deb13u1"},"fixed_version":"124.0.6367.60-1","urgency":"not yet assigned"}}},"CVE-2024-3839":{"description":"Out of bounds read in Fonts in Google Chrome prior to 124.0.6367.60 allowed a remote attacker to obtain potentially sensitive information from process memory via a crafted HTML page. (Chromium security severity: Medium)","scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"143.0.7499.169-1~deb12u1","bookworm-security":"145.0.7632.159-1~deb12u1"},"fixed_version":"124.0.6367.60-1~deb12u1","urgency":"not yet assigned"},"bullseye":{"status":"open","repositories":{"bullseye":"120.0.6099.224-1~deb11u1","bullseye-security":"120.0.6099.224-1~deb11u1"},"urgency":"end-of-life"},"forky":{"status":"resolved","repositories":{"forky":"145.0.7632.159-1"},"fixed_version":"124.0.6367.60-1","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"146.0.7680.71-1"},"fixed_version":"124.0.6367.60-1","urgency":"not yet assigned"},"trixie":{"status":"resolved","repositories":{"trixie":"143.0.7499.169-1~deb13u1","trixie-security":"145.0.7632.159-1~deb13u1"},"fixed_version":"124.0.6367.60-1","urgency":"not yet assigned"}}},"CVE-2024-3840":{"description":"Insufficient policy enforcement in Site Isolation in Google Chrome prior to 124.0.6367.60 allowed a remote attacker to bypass navigation restrictions via a crafted HTML page. (Chromium security severity: Medium)","scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"143.0.7499.169-1~deb12u1","bookworm-security":"145.0.7632.159-1~deb12u1"},"fixed_version":"124.0.6367.60-1~deb12u1","urgency":"not yet assigned"},"bullseye":{"status":"open","repositories":{"bullseye":"120.0.6099.224-1~deb11u1","bullseye-security":"120.0.6099.224-1~deb11u1"},"urgency":"end-of-life"},"forky":{"status":"resolved","repositories":{"forky":"145.0.7632.159-1"},"fixed_version":"124.0.6367.60-1","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"146.0.7680.71-1"},"fixed_version":"124.0.6367.60-1","urgency":"not yet assigned"},"trixie":{"status":"resolved","repositories":{"trixie":"143.0.7499.169-1~deb13u1","trixie-security":"145.0.7632.159-1~deb13u1"},"fixed_version":"124.0.6367.60-1","urgency":"not yet assigned"}}},"CVE-2024-3841":{"description":"Insufficient data validation in Browser Switcher in Google Chrome prior to 124.0.6367.60 allowed a remote attacker to inject scripts or HTML into a privileged page via a malicious file. (Chromium security severity: Medium)","scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"143.0.7499.169-1~deb12u1","bookworm-security":"145.0.7632.159-1~deb12u1"},"fixed_version":"124.0.6367.60-1~deb12u1","urgency":"not yet assigned"},"bullseye":{"status":"open","repositories":{"bullseye":"120.0.6099.224-1~deb11u1","bullseye-security":"120.0.6099.224-1~deb11u1"},"urgency":"end-of-life"},"forky":{"status":"resolved","repositories":{"forky":"145.0.7632.159-1"},"fixed_version":"124.0.6367.60-1","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"146.0.7680.71-1"},"fixed_version":"124.0.6367.60-1","urgency":"not yet assigned"},"trixie":{"status":"resolved","repositories":{"trixie":"143.0.7499.169-1~deb13u1","trixie-security":"145.0.7632.159-1~deb13u1"},"fixed_version":"124.0.6367.60-1","urgency":"not yet assigned"}}},"CVE-2024-3843":{"description":"Insufficient data validation in Downloads in Google Chrome prior to 124.0.6367.60 allowed a remote attacker to perform UI spoofing via a crafted HTML page. (Chromium security severity: Medium)","scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"143.0.7499.169-1~deb12u1","bookworm-security":"145.0.7632.159-1~deb12u1"},"fixed_version":"124.0.6367.60-1~deb12u1","urgency":"not yet assigned"},"bullseye":{"status":"open","repositories":{"bullseye":"120.0.6099.224-1~deb11u1","bullseye-security":"120.0.6099.224-1~deb11u1"},"urgency":"end-of-life"},"forky":{"status":"resolved","repositories":{"forky":"145.0.7632.159-1"},"fixed_version":"124.0.6367.60-1","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"146.0.7680.71-1"},"fixed_version":"124.0.6367.60-1","urgency":"not yet assigned"},"trixie":{"status":"resolved","repositories":{"trixie":"143.0.7499.169-1~deb13u1","trixie-security":"145.0.7632.159-1~deb13u1"},"fixed_version":"124.0.6367.60-1","urgency":"not yet assigned"}}},"CVE-2024-3844":{"description":"Inappropriate implementation in Extensions in Google Chrome prior to 124.0.6367.60 allowed a remote attacker to perform UI spoofing via a crafted Chrome Extension. (Chromium security severity: Low)","scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"143.0.7499.169-1~deb12u1","bookworm-security":"145.0.7632.159-1~deb12u1"},"fixed_version":"124.0.6367.60-1~deb12u1","urgency":"not yet assigned"},"bullseye":{"status":"open","repositories":{"bullseye":"120.0.6099.224-1~deb11u1","bullseye-security":"120.0.6099.224-1~deb11u1"},"urgency":"end-of-life"},"forky":{"status":"resolved","repositories":{"forky":"145.0.7632.159-1"},"fixed_version":"124.0.6367.60-1","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"146.0.7680.71-1"},"fixed_version":"124.0.6367.60-1","urgency":"not yet assigned"},"trixie":{"status":"resolved","repositories":{"trixie":"143.0.7499.169-1~deb13u1","trixie-security":"145.0.7632.159-1~deb13u1"},"fixed_version":"124.0.6367.60-1","urgency":"not yet assigned"}}},"CVE-2024-3845":{"description":"Inappropriate implementation in Networks in Google Chrome prior to 124.0.6367.60 allowed a remote attacker to bypass mixed content policy via a crafted HTML page. (Chromium security severity: Low)","scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"143.0.7499.169-1~deb12u1","bookworm-security":"145.0.7632.159-1~deb12u1"},"fixed_version":"124.0.6367.60-1~deb12u1","urgency":"not yet assigned"},"bullseye":{"status":"open","repositories":{"bullseye":"120.0.6099.224-1~deb11u1","bullseye-security":"120.0.6099.224-1~deb11u1"},"urgency":"end-of-life"},"forky":{"status":"resolved","repositories":{"forky":"145.0.7632.159-1"},"fixed_version":"124.0.6367.60-1","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"146.0.7680.71-1"},"fixed_version":"124.0.6367.60-1","urgency":"not yet assigned"},"trixie":{"status":"resolved","repositories":{"trixie":"143.0.7499.169-1~deb13u1","trixie-security":"145.0.7632.159-1~deb13u1"},"fixed_version":"124.0.6367.60-1","urgency":"not yet assigned"}}},"CVE-2024-3846":{"description":"Inappropriate implementation in Prompts in Google Chrome prior to 124.0.6367.60 allowed a remote attacker who convinced a user to engage in specific UI gestures to perform UI spoofing via a crafted HTML page. (Chromium security severity: Low)","scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"143.0.7499.169-1~deb12u1","bookworm-security":"145.0.7632.159-1~deb12u1"},"fixed_version":"124.0.6367.60-1~deb12u1","urgency":"not yet assigned"},"bullseye":{"status":"open","repositories":{"bullseye":"120.0.6099.224-1~deb11u1","bullseye-security":"120.0.6099.224-1~deb11u1"},"urgency":"end-of-life"},"forky":{"status":"resolved","repositories":{"forky":"145.0.7632.159-1"},"fixed_version":"124.0.6367.60-1","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"146.0.7680.71-1"},"fixed_version":"124.0.6367.60-1","urgency":"not yet assigned"},"trixie":{"status":"resolved","repositories":{"trixie":"143.0.7499.169-1~deb13u1","trixie-security":"145.0.7632.159-1~deb13u1"},"fixed_version":"124.0.6367.60-1","urgency":"not yet assigned"}}},"CVE-2024-3847":{"description":"Insufficient policy enforcement in WebUI in Google Chrome prior to 124.0.6367.60 allowed a remote attacker to bypass content security policy via a crafted HTML page. (Chromium security severity: Low)","scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"143.0.7499.169-1~deb12u1","bookworm-security":"145.0.7632.159-1~deb12u1"},"fixed_version":"124.0.6367.60-1~deb12u1","urgency":"not yet assigned"},"bullseye":{"status":"open","repositories":{"bullseye":"120.0.6099.224-1~deb11u1","bullseye-security":"120.0.6099.224-1~deb11u1"},"urgency":"end-of-life"},"forky":{"status":"resolved","repositories":{"forky":"145.0.7632.159-1"},"fixed_version":"124.0.6367.60-1","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"146.0.7680.71-1"},"fixed_version":"124.0.6367.60-1","urgency":"not yet assigned"},"trixie":{"status":"resolved","repositories":{"trixie":"143.0.7499.169-1~deb13u1","trixie-security":"145.0.7632.159-1~deb13u1"},"fixed_version":"124.0.6367.60-1","urgency":"not yet assigned"}}},"CVE-2024-3914":{"description":"Use after free in V8 in Google Chrome prior to 124.0.6367.60 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. (Chromium security severity: High)","scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"143.0.7499.169-1~deb12u1","bookworm-security":"145.0.7632.159-1~deb12u1"},"fixed_version":"124.0.6367.60-1~deb12u1","urgency":"not yet assigned"},"bullseye":{"status":"open","repositories":{"bullseye":"120.0.6099.224-1~deb11u1","bullseye-security":"120.0.6099.224-1~deb11u1"},"urgency":"end-of-life"},"forky":{"status":"resolved","repositories":{"forky":"145.0.7632.159-1"},"fixed_version":"124.0.6367.60-1","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"146.0.7680.71-1"},"fixed_version":"124.0.6367.60-1","urgency":"not yet assigned"},"trixie":{"status":"resolved","repositories":{"trixie":"143.0.7499.169-1~deb13u1","trixie-security":"145.0.7632.159-1~deb13u1"},"fixed_version":"124.0.6367.60-1","urgency":"not yet assigned"}}},"CVE-2024-4058":{"description":"Type confusion in ANGLE in Google Chrome prior to 124.0.6367.78 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. (Chromium security severity: Critical)","scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"143.0.7499.169-1~deb12u1","bookworm-security":"145.0.7632.159-1~deb12u1"},"fixed_version":"124.0.6367.78-1~deb12u1","urgency":"not yet assigned"},"bullseye":{"status":"open","repositories":{"bullseye":"120.0.6099.224-1~deb11u1","bullseye-security":"120.0.6099.224-1~deb11u1"},"urgency":"end-of-life"},"forky":{"status":"resolved","repositories":{"forky":"145.0.7632.159-1"},"fixed_version":"124.0.6367.78-1","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"146.0.7680.71-1"},"fixed_version":"124.0.6367.78-1","urgency":"not yet assigned"},"trixie":{"status":"resolved","repositories":{"trixie":"143.0.7499.169-1~deb13u1","trixie-security":"145.0.7632.159-1~deb13u1"},"fixed_version":"124.0.6367.78-1","urgency":"not yet assigned"}}},"CVE-2024-4059":{"description":"Out of bounds read in V8 API in Google Chrome prior to 124.0.6367.78 allowed a remote attacker to leak cross-site data via a crafted HTML page. (Chromium security severity: High)","scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"143.0.7499.169-1~deb12u1","bookworm-security":"145.0.7632.159-1~deb12u1"},"fixed_version":"124.0.6367.78-1~deb12u1","urgency":"not yet assigned"},"bullseye":{"status":"open","repositories":{"bullseye":"120.0.6099.224-1~deb11u1","bullseye-security":"120.0.6099.224-1~deb11u1"},"urgency":"end-of-life"},"forky":{"status":"resolved","repositories":{"forky":"145.0.7632.159-1"},"fixed_version":"124.0.6367.78-1","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"146.0.7680.71-1"},"fixed_version":"124.0.6367.78-1","urgency":"not yet assigned"},"trixie":{"status":"resolved","repositories":{"trixie":"143.0.7499.169-1~deb13u1","trixie-security":"145.0.7632.159-1~deb13u1"},"fixed_version":"124.0.6367.78-1","urgency":"not yet assigned"}}},"CVE-2024-4060":{"description":"Use after free in Dawn in Google Chrome prior to 124.0.6367.78 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. (Chromium security severity: High)","scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"143.0.7499.169-1~deb12u1","bookworm-security":"145.0.7632.159-1~deb12u1"},"fixed_version":"124.0.6367.78-1~deb12u1","urgency":"not yet assigned"},"bullseye":{"status":"open","repositories":{"bullseye":"120.0.6099.224-1~deb11u1","bullseye-security":"120.0.6099.224-1~deb11u1"},"urgency":"end-of-life"},"forky":{"status":"resolved","repositories":{"forky":"145.0.7632.159-1"},"fixed_version":"124.0.6367.78-1","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"146.0.7680.71-1"},"fixed_version":"124.0.6367.78-1","urgency":"not yet assigned"},"trixie":{"status":"resolved","repositories":{"trixie":"143.0.7499.169-1~deb13u1","trixie-security":"145.0.7632.159-1~deb13u1"},"fixed_version":"124.0.6367.78-1","urgency":"not yet assigned"}}},"CVE-2024-4331":{"description":"Use after free in Picture In Picture in Google Chrome prior to 124.0.6367.118 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. (Chromium security severity: High)","scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"143.0.7499.169-1~deb12u1","bookworm-security":"145.0.7632.159-1~deb12u1"},"fixed_version":"124.0.6367.118-1~deb12u1","urgency":"not yet assigned"},"bullseye":{"status":"open","repositories":{"bullseye":"120.0.6099.224-1~deb11u1","bullseye-security":"120.0.6099.224-1~deb11u1"},"urgency":"end-of-life"},"forky":{"status":"resolved","repositories":{"forky":"145.0.7632.159-1"},"fixed_version":"124.0.6367.118-1","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"146.0.7680.71-1"},"fixed_version":"124.0.6367.118-1","urgency":"not yet assigned"},"trixie":{"status":"resolved","repositories":{"trixie":"143.0.7499.169-1~deb13u1","trixie-security":"145.0.7632.159-1~deb13u1"},"fixed_version":"124.0.6367.118-1","urgency":"not yet assigned"}}},"CVE-2024-4368":{"description":"Use after free in Dawn in Google Chrome prior to 124.0.6367.118 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. (Chromium security severity: High)","scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"143.0.7499.169-1~deb12u1","bookworm-security":"145.0.7632.159-1~deb12u1"},"fixed_version":"124.0.6367.118-1~deb12u1","urgency":"not yet assigned"},"bullseye":{"status":"open","repositories":{"bullseye":"120.0.6099.224-1~deb11u1","bullseye-security":"120.0.6099.224-1~deb11u1"},"urgency":"end-of-life"},"forky":{"status":"resolved","repositories":{"forky":"145.0.7632.159-1"},"fixed_version":"124.0.6367.118-1","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"146.0.7680.71-1"},"fixed_version":"124.0.6367.118-1","urgency":"not yet assigned"},"trixie":{"status":"resolved","repositories":{"trixie":"143.0.7499.169-1~deb13u1","trixie-security":"145.0.7632.159-1~deb13u1"},"fixed_version":"124.0.6367.118-1","urgency":"not yet assigned"}}},"CVE-2024-4558":{"description":"Use after free in ANGLE in Google Chrome prior to 124.0.6367.155 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. (Chromium security severity: High)","scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"143.0.7499.169-1~deb12u1","bookworm-security":"145.0.7632.159-1~deb12u1"},"fixed_version":"124.0.6367.155-1~deb12u1","urgency":"not yet assigned"},"bullseye":{"status":"open","repositories":{"bullseye":"120.0.6099.224-1~deb11u1","bullseye-security":"120.0.6099.224-1~deb11u1"},"urgency":"end-of-life"},"forky":{"status":"resolved","repositories":{"forky":"145.0.7632.159-1"},"fixed_version":"124.0.6367.155-1","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"146.0.7680.71-1"},"fixed_version":"124.0.6367.155-1","urgency":"not yet assigned"},"trixie":{"status":"resolved","repositories":{"trixie":"143.0.7499.169-1~deb13u1","trixie-security":"145.0.7632.159-1~deb13u1"},"fixed_version":"124.0.6367.155-1","urgency":"not yet assigned"}}},"CVE-2024-4559":{"description":"Heap buffer overflow in WebAudio in Google Chrome prior to 124.0.6367.155 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. (Chromium security severity: High)","scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"143.0.7499.169-1~deb12u1","bookworm-security":"145.0.7632.159-1~deb12u1"},"fixed_version":"124.0.6367.155-1~deb12u1","urgency":"not yet assigned"},"bullseye":{"status":"open","repositories":{"bullseye":"120.0.6099.224-1~deb11u1","bullseye-security":"120.0.6099.224-1~deb11u1"},"urgency":"end-of-life"},"forky":{"status":"resolved","repositories":{"forky":"145.0.7632.159-1"},"fixed_version":"124.0.6367.155-1","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"146.0.7680.71-1"},"fixed_version":"124.0.6367.155-1","urgency":"not yet assigned"},"trixie":{"status":"resolved","repositories":{"trixie":"143.0.7499.169-1~deb13u1","trixie-security":"145.0.7632.159-1~deb13u1"},"fixed_version":"124.0.6367.155-1","urgency":"not yet assigned"}}},"CVE-2024-4671":{"description":"Use after free in Visuals in Google Chrome prior to 124.0.6367.201 allowed a remote attacker who had compromised the renderer process to potentially perform a sandbox escape via a crafted HTML page. (Chromium security severity: High)","scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"143.0.7499.169-1~deb12u1","bookworm-security":"145.0.7632.159-1~deb12u1"},"fixed_version":"124.0.6367.201-1~deb12u1","urgency":"not yet assigned"},"bullseye":{"status":"open","repositories":{"bullseye":"120.0.6099.224-1~deb11u1","bullseye-security":"120.0.6099.224-1~deb11u1"},"urgency":"end-of-life"},"forky":{"status":"resolved","repositories":{"forky":"145.0.7632.159-1"},"fixed_version":"124.0.6367.201-1","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"146.0.7680.71-1"},"fixed_version":"124.0.6367.201-1","urgency":"not yet assigned"},"trixie":{"status":"resolved","repositories":{"trixie":"143.0.7499.169-1~deb13u1","trixie-security":"145.0.7632.159-1~deb13u1"},"fixed_version":"124.0.6367.201-1","urgency":"not yet assigned"}}},"CVE-2024-4761":{"description":"Out of bounds write in V8 in Google Chrome prior to 124.0.6367.207 allowed a remote attacker to perform an out of bounds memory write via a crafted HTML page. (Chromium security severity: High)","scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"143.0.7499.169-1~deb12u1","bookworm-security":"145.0.7632.159-1~deb12u1"},"fixed_version":"124.0.6367.207-1~deb12u1","urgency":"not yet assigned"},"bullseye":{"status":"open","repositories":{"bullseye":"120.0.6099.224-1~deb11u1","bullseye-security":"120.0.6099.224-1~deb11u1"},"urgency":"end-of-life"},"forky":{"status":"resolved","repositories":{"forky":"145.0.7632.159-1"},"fixed_version":"124.0.6367.207-1","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"146.0.7680.71-1"},"fixed_version":"124.0.6367.207-1","urgency":"not yet assigned"},"trixie":{"status":"resolved","repositories":{"trixie":"143.0.7499.169-1~deb13u1","trixie-security":"145.0.7632.159-1~deb13u1"},"fixed_version":"124.0.6367.207-1","urgency":"not yet assigned"}}},"CVE-2024-4947":{"description":"Type Confusion in V8 in Google Chrome prior to 125.0.6422.60 allowed a remote attacker to execute arbitrary code inside a sandbox via a crafted HTML page. (Chromium security severity: High)","scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"143.0.7499.169-1~deb12u1","bookworm-security":"145.0.7632.159-1~deb12u1"},"fixed_version":"125.0.6422.60-1~deb12u1","urgency":"not yet assigned"},"bullseye":{"status":"open","repositories":{"bullseye":"120.0.6099.224-1~deb11u1","bullseye-security":"120.0.6099.224-1~deb11u1"},"urgency":"end-of-life"},"forky":{"status":"resolved","repositories":{"forky":"145.0.7632.159-1"},"fixed_version":"125.0.6422.60-1","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"146.0.7680.71-1"},"fixed_version":"125.0.6422.60-1","urgency":"not yet assigned"},"trixie":{"status":"resolved","repositories":{"trixie":"143.0.7499.169-1~deb13u1","trixie-security":"145.0.7632.159-1~deb13u1"},"fixed_version":"125.0.6422.60-1","urgency":"not yet assigned"}}},"CVE-2024-4948":{"description":"Use after free in Dawn in Google Chrome prior to 125.0.6422.60 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. (Chromium security severity: High)","scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"143.0.7499.169-1~deb12u1","bookworm-security":"145.0.7632.159-1~deb12u1"},"fixed_version":"125.0.6422.60-1~deb12u1","urgency":"not yet assigned"},"bullseye":{"status":"open","repositories":{"bullseye":"120.0.6099.224-1~deb11u1","bullseye-security":"120.0.6099.224-1~deb11u1"},"urgency":"end-of-life"},"forky":{"status":"resolved","repositories":{"forky":"145.0.7632.159-1"},"fixed_version":"125.0.6422.60-1","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"146.0.7680.71-1"},"fixed_version":"125.0.6422.60-1","urgency":"not yet assigned"},"trixie":{"status":"resolved","repositories":{"trixie":"143.0.7499.169-1~deb13u1","trixie-security":"145.0.7632.159-1~deb13u1"},"fixed_version":"125.0.6422.60-1","urgency":"not yet assigned"}}},"CVE-2024-4949":{"description":"Use after free in V8 in Google Chrome prior to 125.0.6422.60 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. (Chromium security severity: Medium)","scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"143.0.7499.169-1~deb12u1","bookworm-security":"145.0.7632.159-1~deb12u1"},"fixed_version":"125.0.6422.60-1~deb12u1","urgency":"not yet assigned"},"bullseye":{"status":"open","repositories":{"bullseye":"120.0.6099.224-1~deb11u1","bullseye-security":"120.0.6099.224-1~deb11u1"},"urgency":"end-of-life"},"forky":{"status":"resolved","repositories":{"forky":"145.0.7632.159-1"},"fixed_version":"125.0.6422.60-1","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"146.0.7680.71-1"},"fixed_version":"125.0.6422.60-1","urgency":"not yet assigned"},"trixie":{"status":"resolved","repositories":{"trixie":"143.0.7499.169-1~deb13u1","trixie-security":"145.0.7632.159-1~deb13u1"},"fixed_version":"125.0.6422.60-1","urgency":"not yet assigned"}}},"CVE-2024-4950":{"description":"Inappropriate implementation in Downloads in Google Chrome prior to 125.0.6422.60 allowed a remote attacker who convinced a user to engage in specific UI gestures to perform UI spoofing via a crafted HTML page. (Chromium security severity: Low)","scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"143.0.7499.169-1~deb12u1","bookworm-security":"145.0.7632.159-1~deb12u1"},"fixed_version":"125.0.6422.60-1~deb12u1","urgency":"not yet assigned"},"bullseye":{"status":"open","repositories":{"bullseye":"120.0.6099.224-1~deb11u1","bullseye-security":"120.0.6099.224-1~deb11u1"},"urgency":"end-of-life"},"forky":{"status":"resolved","repositories":{"forky":"145.0.7632.159-1"},"fixed_version":"125.0.6422.60-1","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"146.0.7680.71-1"},"fixed_version":"125.0.6422.60-1","urgency":"not yet assigned"},"trixie":{"status":"resolved","repositories":{"trixie":"143.0.7499.169-1~deb13u1","trixie-security":"145.0.7632.159-1~deb13u1"},"fixed_version":"125.0.6422.60-1","urgency":"not yet assigned"}}},"CVE-2024-5157":{"description":"Use after free in Scheduling in Google Chrome prior to 125.0.6422.76 allowed a remote attacker to execute arbitrary code inside a sandbox via a crafted HTML page. (Chromium security severity: High)","scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"143.0.7499.169-1~deb12u1","bookworm-security":"145.0.7632.159-1~deb12u1"},"fixed_version":"125.0.6422.76-1~deb12u1","urgency":"not yet assigned"},"bullseye":{"status":"open","repositories":{"bullseye":"120.0.6099.224-1~deb11u1","bullseye-security":"120.0.6099.224-1~deb11u1"},"urgency":"end-of-life"},"forky":{"status":"resolved","repositories":{"forky":"145.0.7632.159-1"},"fixed_version":"125.0.6422.76-1","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"146.0.7680.71-1"},"fixed_version":"125.0.6422.76-1","urgency":"not yet assigned"},"trixie":{"status":"resolved","repositories":{"trixie":"143.0.7499.169-1~deb13u1","trixie-security":"145.0.7632.159-1~deb13u1"},"fixed_version":"125.0.6422.76-1","urgency":"not yet assigned"}}},"CVE-2024-5158":{"description":"Type Confusion in V8 in Google Chrome prior to 125.0.6422.76 allowed a remote attacker to potentially perform arbitrary read/write via a crafted HTML page. (Chromium security severity: High)","scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"143.0.7499.169-1~deb12u1","bookworm-security":"145.0.7632.159-1~deb12u1"},"fixed_version":"125.0.6422.76-1~deb12u1","urgency":"not yet assigned"},"bullseye":{"status":"open","repositories":{"bullseye":"120.0.6099.224-1~deb11u1","bullseye-security":"120.0.6099.224-1~deb11u1"},"urgency":"end-of-life"},"forky":{"status":"resolved","repositories":{"forky":"145.0.7632.159-1"},"fixed_version":"125.0.6422.76-1","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"146.0.7680.71-1"},"fixed_version":"125.0.6422.76-1","urgency":"not yet assigned"},"trixie":{"status":"resolved","repositories":{"trixie":"143.0.7499.169-1~deb13u1","trixie-security":"145.0.7632.159-1~deb13u1"},"fixed_version":"125.0.6422.76-1","urgency":"not yet assigned"}}},"CVE-2024-5159":{"description":"Heap buffer overflow in ANGLE in Google Chrome prior to 125.0.6422.76 allowed a remote attacker to perform an out of bounds memory read via a crafted HTML page. (Chromium security severity: High)","scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"143.0.7499.169-1~deb12u1","bookworm-security":"145.0.7632.159-1~deb12u1"},"fixed_version":"125.0.6422.76-1~deb12u1","urgency":"not yet assigned"},"bullseye":{"status":"open","repositories":{"bullseye":"120.0.6099.224-1~deb11u1","bullseye-security":"120.0.6099.224-1~deb11u1"},"urgency":"end-of-life"},"forky":{"status":"resolved","repositories":{"forky":"145.0.7632.159-1"},"fixed_version":"125.0.6422.76-1","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"146.0.7680.71-1"},"fixed_version":"125.0.6422.76-1","urgency":"not yet assigned"},"trixie":{"status":"resolved","repositories":{"trixie":"143.0.7499.169-1~deb13u1","trixie-security":"145.0.7632.159-1~deb13u1"},"fixed_version":"125.0.6422.76-1","urgency":"not yet assigned"}}},"CVE-2024-5160":{"description":"Heap buffer overflow in Dawn in Google Chrome prior to 125.0.6422.76 allowed a remote attacker to perform an out of bounds memory write via a crafted HTML page. (Chromium security severity: High)","scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"143.0.7499.169-1~deb12u1","bookworm-security":"145.0.7632.159-1~deb12u1"},"fixed_version":"125.0.6422.76-1~deb12u1","urgency":"not yet assigned"},"bullseye":{"status":"open","repositories":{"bullseye":"120.0.6099.224-1~deb11u1","bullseye-security":"120.0.6099.224-1~deb11u1"},"urgency":"end-of-life"},"forky":{"status":"resolved","repositories":{"forky":"145.0.7632.159-1"},"fixed_version":"125.0.6422.76-1","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"146.0.7680.71-1"},"fixed_version":"125.0.6422.76-1","urgency":"not yet assigned"},"trixie":{"status":"resolved","repositories":{"trixie":"143.0.7499.169-1~deb13u1","trixie-security":"145.0.7632.159-1~deb13u1"},"fixed_version":"125.0.6422.76-1","urgency":"not yet assigned"}}},"CVE-2024-5274":{"description":"Type Confusion in V8 in Google Chrome prior to 125.0.6422.112 allowed a remote attacker to execute arbitrary code inside a sandbox via a crafted HTML page. (Chromium security severity: High)","scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"143.0.7499.169-1~deb12u1","bookworm-security":"145.0.7632.159-1~deb12u1"},"fixed_version":"125.0.6422.112-1~deb12u1","urgency":"not yet assigned"},"bullseye":{"status":"open","repositories":{"bullseye":"120.0.6099.224-1~deb11u1","bullseye-security":"120.0.6099.224-1~deb11u1"},"urgency":"end-of-life"},"forky":{"status":"resolved","repositories":{"forky":"145.0.7632.159-1"},"fixed_version":"125.0.6422.112-1","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"146.0.7680.71-1"},"fixed_version":"125.0.6422.112-1","urgency":"not yet assigned"},"trixie":{"status":"resolved","repositories":{"trixie":"143.0.7499.169-1~deb13u1","trixie-security":"145.0.7632.159-1~deb13u1"},"fixed_version":"125.0.6422.112-1","urgency":"not yet assigned"}}},"CVE-2024-5493":{"description":"Heap buffer overflow in WebRTC in Google Chrome prior to 125.0.6422.141 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. (Chromium security severity: High)","scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"143.0.7499.169-1~deb12u1","bookworm-security":"145.0.7632.159-1~deb12u1"},"fixed_version":"125.0.6422.141-1~deb12u1","urgency":"not yet assigned"},"bullseye":{"status":"open","repositories":{"bullseye":"120.0.6099.224-1~deb11u1","bullseye-security":"120.0.6099.224-1~deb11u1"},"urgency":"end-of-life"},"forky":{"status":"resolved","repositories":{"forky":"145.0.7632.159-1"},"fixed_version":"125.0.6422.141-1","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"146.0.7680.71-1"},"fixed_version":"125.0.6422.141-1","urgency":"not yet assigned"},"trixie":{"status":"resolved","repositories":{"trixie":"143.0.7499.169-1~deb13u1","trixie-security":"145.0.7632.159-1~deb13u1"},"fixed_version":"125.0.6422.141-1","urgency":"not yet assigned"}}},"CVE-2024-5494":{"description":"Use after free in Dawn in Google Chrome prior to 125.0.6422.141 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. (Chromium security severity: High)","scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"143.0.7499.169-1~deb12u1","bookworm-security":"145.0.7632.159-1~deb12u1"},"fixed_version":"125.0.6422.141-1~deb12u1","urgency":"not yet assigned"},"bullseye":{"status":"open","repositories":{"bullseye":"120.0.6099.224-1~deb11u1","bullseye-security":"120.0.6099.224-1~deb11u1"},"urgency":"end-of-life"},"forky":{"status":"resolved","repositories":{"forky":"145.0.7632.159-1"},"fixed_version":"125.0.6422.141-1","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"146.0.7680.71-1"},"fixed_version":"125.0.6422.141-1","urgency":"not yet assigned"},"trixie":{"status":"resolved","repositories":{"trixie":"143.0.7499.169-1~deb13u1","trixie-security":"145.0.7632.159-1~deb13u1"},"fixed_version":"125.0.6422.141-1","urgency":"not yet assigned"}}},"CVE-2024-5495":{"description":"Use after free in Dawn in Google Chrome prior to 125.0.6422.141 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. (Chromium security severity: High)","scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"143.0.7499.169-1~deb12u1","bookworm-security":"145.0.7632.159-1~deb12u1"},"fixed_version":"125.0.6422.141-1~deb12u1","urgency":"not yet assigned"},"bullseye":{"status":"open","repositories":{"bullseye":"120.0.6099.224-1~deb11u1","bullseye-security":"120.0.6099.224-1~deb11u1"},"urgency":"end-of-life"},"forky":{"status":"resolved","repositories":{"forky":"145.0.7632.159-1"},"fixed_version":"125.0.6422.141-1","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"146.0.7680.71-1"},"fixed_version":"125.0.6422.141-1","urgency":"not yet assigned"},"trixie":{"status":"resolved","repositories":{"trixie":"143.0.7499.169-1~deb13u1","trixie-security":"145.0.7632.159-1~deb13u1"},"fixed_version":"125.0.6422.141-1","urgency":"not yet assigned"}}},"CVE-2024-5496":{"description":"Use after free in Media Session in Google Chrome prior to 125.0.6422.141 allowed a remote attacker to execute arbitrary code inside a sandbox via a crafted HTML page. (Chromium security severity: High)","scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"143.0.7499.169-1~deb12u1","bookworm-security":"145.0.7632.159-1~deb12u1"},"fixed_version":"125.0.6422.141-1~deb12u1","urgency":"not yet assigned"},"bullseye":{"status":"open","repositories":{"bullseye":"120.0.6099.224-1~deb11u1","bullseye-security":"120.0.6099.224-1~deb11u1"},"urgency":"end-of-life"},"forky":{"status":"resolved","repositories":{"forky":"145.0.7632.159-1"},"fixed_version":"125.0.6422.141-1","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"146.0.7680.71-1"},"fixed_version":"125.0.6422.141-1","urgency":"not yet assigned"},"trixie":{"status":"resolved","repositories":{"trixie":"143.0.7499.169-1~deb13u1","trixie-security":"145.0.7632.159-1~deb13u1"},"fixed_version":"125.0.6422.141-1","urgency":"not yet assigned"}}},"CVE-2024-5497":{"description":"Out of bounds memory access in Browser UI in Google Chrome prior to 125.0.6422.141 allowed a remote attacker who convinced a user to engage in specific UI gestures to potentially exploit heap corruption via a crafted HTML page. (Chromium security severity: High)","scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"143.0.7499.169-1~deb12u1","bookworm-security":"145.0.7632.159-1~deb12u1"},"fixed_version":"125.0.6422.141-1~deb12u1","urgency":"not yet assigned"},"bullseye":{"status":"open","repositories":{"bullseye":"120.0.6099.224-1~deb11u1","bullseye-security":"120.0.6099.224-1~deb11u1"},"urgency":"end-of-life"},"forky":{"status":"resolved","repositories":{"forky":"145.0.7632.159-1"},"fixed_version":"125.0.6422.141-1","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"146.0.7680.71-1"},"fixed_version":"125.0.6422.141-1","urgency":"not yet assigned"},"trixie":{"status":"resolved","repositories":{"trixie":"143.0.7499.169-1~deb13u1","trixie-security":"145.0.7632.159-1~deb13u1"},"fixed_version":"125.0.6422.141-1","urgency":"not yet assigned"}}},"CVE-2024-5498":{"description":"Use after free in Presentation API in Google Chrome prior to 125.0.6422.141 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. (Chromium security severity: High)","scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"143.0.7499.169-1~deb12u1","bookworm-security":"145.0.7632.159-1~deb12u1"},"fixed_version":"125.0.6422.141-1~deb12u1","urgency":"not yet assigned"},"bullseye":{"status":"open","repositories":{"bullseye":"120.0.6099.224-1~deb11u1","bullseye-security":"120.0.6099.224-1~deb11u1"},"urgency":"end-of-life"},"forky":{"status":"resolved","repositories":{"forky":"145.0.7632.159-1"},"fixed_version":"125.0.6422.141-1","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"146.0.7680.71-1"},"fixed_version":"125.0.6422.141-1","urgency":"not yet assigned"},"trixie":{"status":"resolved","repositories":{"trixie":"143.0.7499.169-1~deb13u1","trixie-security":"145.0.7632.159-1~deb13u1"},"fixed_version":"125.0.6422.141-1","urgency":"not yet assigned"}}},"CVE-2024-5499":{"description":"Out of bounds write in Streams API in Google Chrome prior to 125.0.6422.141 allowed a remote attacker to execute arbitrary code inside a sandbox via a crafted HTML page. (Chromium security severity: High)","scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"143.0.7499.169-1~deb12u1","bookworm-security":"145.0.7632.159-1~deb12u1"},"fixed_version":"125.0.6422.141-1~deb12u1","urgency":"not yet assigned"},"bullseye":{"status":"open","repositories":{"bullseye":"120.0.6099.224-1~deb11u1","bullseye-security":"120.0.6099.224-1~deb11u1"},"urgency":"end-of-life"},"forky":{"status":"resolved","repositories":{"forky":"145.0.7632.159-1"},"fixed_version":"125.0.6422.141-1","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"146.0.7680.71-1"},"fixed_version":"125.0.6422.141-1","urgency":"not yet assigned"},"trixie":{"status":"resolved","repositories":{"trixie":"143.0.7499.169-1~deb13u1","trixie-security":"145.0.7632.159-1~deb13u1"},"fixed_version":"125.0.6422.141-1","urgency":"not yet assigned"}}},"CVE-2024-5500":{"description":"Inappropriate implementation in Sign-In in Google Chrome prior to 1.3.36.351 allowed a remote attacker to bypass navigation restrictions via a crafted HTML page. (Chromium security severity: Medium)","scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"143.0.7499.169-1~deb12u1","bookworm-security":"145.0.7632.159-1~deb12u1"},"fixed_version":"122.0.6261.57-1~deb12u1","urgency":"not yet assigned"},"bullseye":{"status":"open","repositories":{"bullseye":"120.0.6099.224-1~deb11u1","bullseye-security":"120.0.6099.224-1~deb11u1"},"urgency":"end-of-life"},"forky":{"status":"resolved","repositories":{"forky":"145.0.7632.159-1"},"fixed_version":"122.0.6261.57-1","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"146.0.7680.71-1"},"fixed_version":"122.0.6261.57-1","urgency":"not yet assigned"},"trixie":{"status":"resolved","repositories":{"trixie":"143.0.7499.169-1~deb13u1","trixie-security":"145.0.7632.159-1~deb13u1"},"fixed_version":"122.0.6261.57-1","urgency":"not yet assigned"}}},"CVE-2024-5830":{"description":"Type Confusion in V8 in Google Chrome prior to 126.0.6478.54 allowed a remote attacker to perform an out of bounds memory write via a crafted HTML page. (Chromium security severity: High)","scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"143.0.7499.169-1~deb12u1","bookworm-security":"145.0.7632.159-1~deb12u1"},"fixed_version":"126.0.6478.56-1~deb12u1","urgency":"not yet assigned"},"bullseye":{"status":"open","repositories":{"bullseye":"120.0.6099.224-1~deb11u1","bullseye-security":"120.0.6099.224-1~deb11u1"},"urgency":"end-of-life"},"forky":{"status":"resolved","repositories":{"forky":"145.0.7632.159-1"},"fixed_version":"126.0.6478.56-1","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"146.0.7680.71-1"},"fixed_version":"126.0.6478.56-1","urgency":"not yet assigned"},"trixie":{"status":"resolved","repositories":{"trixie":"143.0.7499.169-1~deb13u1","trixie-security":"145.0.7632.159-1~deb13u1"},"fixed_version":"126.0.6478.56-1","urgency":"not yet assigned"}}},"CVE-2024-5831":{"description":"Use after free in Dawn in Google Chrome prior to 126.0.6478.54 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. (Chromium security severity: High)","scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"143.0.7499.169-1~deb12u1","bookworm-security":"145.0.7632.159-1~deb12u1"},"fixed_version":"126.0.6478.56-1~deb12u1","urgency":"not yet assigned"},"bullseye":{"status":"open","repositories":{"bullseye":"120.0.6099.224-1~deb11u1","bullseye-security":"120.0.6099.224-1~deb11u1"},"urgency":"end-of-life"},"forky":{"status":"resolved","repositories":{"forky":"145.0.7632.159-1"},"fixed_version":"126.0.6478.56-1","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"146.0.7680.71-1"},"fixed_version":"126.0.6478.56-1","urgency":"not yet assigned"},"trixie":{"status":"resolved","repositories":{"trixie":"143.0.7499.169-1~deb13u1","trixie-security":"145.0.7632.159-1~deb13u1"},"fixed_version":"126.0.6478.56-1","urgency":"not yet assigned"}}},"CVE-2024-5832":{"description":"Use after free in Dawn in Google Chrome prior to 126.0.6478.54 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. (Chromium security severity: High)","scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"143.0.7499.169-1~deb12u1","bookworm-security":"145.0.7632.159-1~deb12u1"},"fixed_version":"126.0.6478.56-1~deb12u1","urgency":"not yet assigned"},"bullseye":{"status":"open","repositories":{"bullseye":"120.0.6099.224-1~deb11u1","bullseye-security":"120.0.6099.224-1~deb11u1"},"urgency":"end-of-life"},"forky":{"status":"resolved","repositories":{"forky":"145.0.7632.159-1"},"fixed_version":"126.0.6478.56-1","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"146.0.7680.71-1"},"fixed_version":"126.0.6478.56-1","urgency":"not yet assigned"},"trixie":{"status":"resolved","repositories":{"trixie":"143.0.7499.169-1~deb13u1","trixie-security":"145.0.7632.159-1~deb13u1"},"fixed_version":"126.0.6478.56-1","urgency":"not yet assigned"}}},"CVE-2024-5833":{"description":"Type Confusion in V8 in Google Chrome prior to 126.0.6478.54 allowed a remote attacker to potentially perform out of bounds memory access via a crafted HTML page. (Chromium security severity: High)","scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"143.0.7499.169-1~deb12u1","bookworm-security":"145.0.7632.159-1~deb12u1"},"fixed_version":"126.0.6478.56-1~deb12u1","urgency":"not yet assigned"},"bullseye":{"status":"open","repositories":{"bullseye":"120.0.6099.224-1~deb11u1","bullseye-security":"120.0.6099.224-1~deb11u1"},"urgency":"end-of-life"},"forky":{"status":"resolved","repositories":{"forky":"145.0.7632.159-1"},"fixed_version":"126.0.6478.56-1","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"146.0.7680.71-1"},"fixed_version":"126.0.6478.56-1","urgency":"not yet assigned"},"trixie":{"status":"resolved","repositories":{"trixie":"143.0.7499.169-1~deb13u1","trixie-security":"145.0.7632.159-1~deb13u1"},"fixed_version":"126.0.6478.56-1","urgency":"not yet assigned"}}},"CVE-2024-5834":{"description":"Inappropriate implementation in Dawn in Google Chrome prior to 126.0.6478.54 allowed a remote attacker to execute arbitrary code via a crafted HTML page. (Chromium security severity: High)","scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"143.0.7499.169-1~deb12u1","bookworm-security":"145.0.7632.159-1~deb12u1"},"fixed_version":"126.0.6478.56-1~deb12u1","urgency":"not yet assigned"},"bullseye":{"status":"open","repositories":{"bullseye":"120.0.6099.224-1~deb11u1","bullseye-security":"120.0.6099.224-1~deb11u1"},"urgency":"end-of-life"},"forky":{"status":"resolved","repositories":{"forky":"145.0.7632.159-1"},"fixed_version":"126.0.6478.56-1","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"146.0.7680.71-1"},"fixed_version":"126.0.6478.56-1","urgency":"not yet assigned"},"trixie":{"status":"resolved","repositories":{"trixie":"143.0.7499.169-1~deb13u1","trixie-security":"145.0.7632.159-1~deb13u1"},"fixed_version":"126.0.6478.56-1","urgency":"not yet assigned"}}},"CVE-2024-5835":{"description":"Heap buffer overflow in Tab Groups in Google Chrome prior to 126.0.6478.54 allowed a remote attacker who convinced a user to engage in specific UI gestures to potentially exploit heap corruption via a crafted HTML page. (Chromium security severity: High)","scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"143.0.7499.169-1~deb12u1","bookworm-security":"145.0.7632.159-1~deb12u1"},"fixed_version":"126.0.6478.56-1~deb12u1","urgency":"not yet assigned"},"bullseye":{"status":"open","repositories":{"bullseye":"120.0.6099.224-1~deb11u1","bullseye-security":"120.0.6099.224-1~deb11u1"},"urgency":"end-of-life"},"forky":{"status":"resolved","repositories":{"forky":"145.0.7632.159-1"},"fixed_version":"126.0.6478.56-1","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"146.0.7680.71-1"},"fixed_version":"126.0.6478.56-1","urgency":"not yet assigned"},"trixie":{"status":"resolved","repositories":{"trixie":"143.0.7499.169-1~deb13u1","trixie-security":"145.0.7632.159-1~deb13u1"},"fixed_version":"126.0.6478.56-1","urgency":"not yet assigned"}}},"CVE-2024-5836":{"description":"Inappropriate Implementation in DevTools in Google Chrome prior to 126.0.6478.54 allowed an attacker who convinced a user to install a malicious extension to execute arbitrary code via a crafted Chrome Extension. (Chromium security severity: High)","scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"143.0.7499.169-1~deb12u1","bookworm-security":"145.0.7632.159-1~deb12u1"},"fixed_version":"126.0.6478.56-1~deb12u1","urgency":"not yet assigned"},"bullseye":{"status":"open","repositories":{"bullseye":"120.0.6099.224-1~deb11u1","bullseye-security":"120.0.6099.224-1~deb11u1"},"urgency":"end-of-life"},"forky":{"status":"resolved","repositories":{"forky":"145.0.7632.159-1"},"fixed_version":"126.0.6478.56-1","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"146.0.7680.71-1"},"fixed_version":"126.0.6478.56-1","urgency":"not yet assigned"},"trixie":{"status":"resolved","repositories":{"trixie":"143.0.7499.169-1~deb13u1","trixie-security":"145.0.7632.159-1~deb13u1"},"fixed_version":"126.0.6478.56-1","urgency":"not yet assigned"}}},"CVE-2024-5837":{"description":"Type Confusion in V8 in Google Chrome prior to 126.0.6478.54 allowed a remote attacker to potentially perform out of bounds memory access via a crafted HTML page. (Chromium security severity: High)","scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"143.0.7499.169-1~deb12u1","bookworm-security":"145.0.7632.159-1~deb12u1"},"fixed_version":"126.0.6478.56-1~deb12u1","urgency":"not yet assigned"},"bullseye":{"status":"open","repositories":{"bullseye":"120.0.6099.224-1~deb11u1","bullseye-security":"120.0.6099.224-1~deb11u1"},"urgency":"end-of-life"},"forky":{"status":"resolved","repositories":{"forky":"145.0.7632.159-1"},"fixed_version":"126.0.6478.56-1","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"146.0.7680.71-1"},"fixed_version":"126.0.6478.56-1","urgency":"not yet assigned"},"trixie":{"status":"resolved","repositories":{"trixie":"143.0.7499.169-1~deb13u1","trixie-security":"145.0.7632.159-1~deb13u1"},"fixed_version":"126.0.6478.56-1","urgency":"not yet assigned"}}},"CVE-2024-5838":{"description":"Type Confusion in V8 in Google Chrome prior to 126.0.6478.54 allowed a remote attacker to perform out of bounds memory access via a crafted HTML page. (Chromium security severity: High)","scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"143.0.7499.169-1~deb12u1","bookworm-security":"145.0.7632.159-1~deb12u1"},"fixed_version":"126.0.6478.56-1~deb12u1","urgency":"not yet assigned"},"bullseye":{"status":"open","repositories":{"bullseye":"120.0.6099.224-1~deb11u1","bullseye-security":"120.0.6099.224-1~deb11u1"},"urgency":"end-of-life"},"forky":{"status":"resolved","repositories":{"forky":"145.0.7632.159-1"},"fixed_version":"126.0.6478.56-1","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"146.0.7680.71-1"},"fixed_version":"126.0.6478.56-1","urgency":"not yet assigned"},"trixie":{"status":"resolved","repositories":{"trixie":"143.0.7499.169-1~deb13u1","trixie-security":"145.0.7632.159-1~deb13u1"},"fixed_version":"126.0.6478.56-1","urgency":"not yet assigned"}}},"CVE-2024-5839":{"description":"Inappropriate Implementation in Memory Allocator in Google Chrome prior to 126.0.6478.54 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. (Chromium security severity: Medium)","scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"143.0.7499.169-1~deb12u1","bookworm-security":"145.0.7632.159-1~deb12u1"},"fixed_version":"126.0.6478.56-1~deb12u1","urgency":"not yet assigned"},"bullseye":{"status":"open","repositories":{"bullseye":"120.0.6099.224-1~deb11u1","bullseye-security":"120.0.6099.224-1~deb11u1"},"urgency":"end-of-life"},"forky":{"status":"resolved","repositories":{"forky":"145.0.7632.159-1"},"fixed_version":"126.0.6478.56-1","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"146.0.7680.71-1"},"fixed_version":"126.0.6478.56-1","urgency":"not yet assigned"},"trixie":{"status":"resolved","repositories":{"trixie":"143.0.7499.169-1~deb13u1","trixie-security":"145.0.7632.159-1~deb13u1"},"fixed_version":"126.0.6478.56-1","urgency":"not yet assigned"}}},"CVE-2024-5840":{"description":"Policy bypass in CORS in Google Chrome prior to 126.0.6478.54 allowed a remote attacker to bypass discretionary access control via a crafted HTML page. (Chromium security severity: Medium)","scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"143.0.7499.169-1~deb12u1","bookworm-security":"145.0.7632.159-1~deb12u1"},"fixed_version":"126.0.6478.56-1~deb12u1","urgency":"not yet assigned"},"bullseye":{"status":"open","repositories":{"bullseye":"120.0.6099.224-1~deb11u1","bullseye-security":"120.0.6099.224-1~deb11u1"},"urgency":"end-of-life"},"forky":{"status":"resolved","repositories":{"forky":"145.0.7632.159-1"},"fixed_version":"126.0.6478.56-1","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"146.0.7680.71-1"},"fixed_version":"126.0.6478.56-1","urgency":"not yet assigned"},"trixie":{"status":"resolved","repositories":{"trixie":"143.0.7499.169-1~deb13u1","trixie-security":"145.0.7632.159-1~deb13u1"},"fixed_version":"126.0.6478.56-1","urgency":"not yet assigned"}}},"CVE-2024-5841":{"description":"Use after free in V8 in Google Chrome prior to 126.0.6478.54 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. (Chromium security severity: Medium)","scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"143.0.7499.169-1~deb12u1","bookworm-security":"145.0.7632.159-1~deb12u1"},"fixed_version":"126.0.6478.56-1~deb12u1","urgency":"not yet assigned"},"bullseye":{"status":"open","repositories":{"bullseye":"120.0.6099.224-1~deb11u1","bullseye-security":"120.0.6099.224-1~deb11u1"},"urgency":"end-of-life"},"forky":{"status":"resolved","repositories":{"forky":"145.0.7632.159-1"},"fixed_version":"126.0.6478.56-1","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"146.0.7680.71-1"},"fixed_version":"126.0.6478.56-1","urgency":"not yet assigned"},"trixie":{"status":"resolved","repositories":{"trixie":"143.0.7499.169-1~deb13u1","trixie-security":"145.0.7632.159-1~deb13u1"},"fixed_version":"126.0.6478.56-1","urgency":"not yet assigned"}}},"CVE-2024-5842":{"description":"Use after free in Browser UI in Google Chrome prior to 126.0.6478.54 allowed a remote attacker who convinced a user to engage in specific UI gestures to perform an out of bounds memory read via a crafted HTML page. (Chromium security severity: Medium)","scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"143.0.7499.169-1~deb12u1","bookworm-security":"145.0.7632.159-1~deb12u1"},"fixed_version":"126.0.6478.56-1~deb12u1","urgency":"not yet assigned"},"bullseye":{"status":"open","repositories":{"bullseye":"120.0.6099.224-1~deb11u1","bullseye-security":"120.0.6099.224-1~deb11u1"},"urgency":"end-of-life"},"forky":{"status":"resolved","repositories":{"forky":"145.0.7632.159-1"},"fixed_version":"126.0.6478.56-1","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"146.0.7680.71-1"},"fixed_version":"126.0.6478.56-1","urgency":"not yet assigned"},"trixie":{"status":"resolved","repositories":{"trixie":"143.0.7499.169-1~deb13u1","trixie-security":"145.0.7632.159-1~deb13u1"},"fixed_version":"126.0.6478.56-1","urgency":"not yet assigned"}}},"CVE-2024-5843":{"description":"Inappropriate implementation in Downloads in Google Chrome prior to 126.0.6478.54 allowed a remote attacker to obfuscate security UI via a malicious file. (Chromium security severity: Medium)","scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"143.0.7499.169-1~deb12u1","bookworm-security":"145.0.7632.159-1~deb12u1"},"fixed_version":"126.0.6478.56-1~deb12u1","urgency":"not yet assigned"},"bullseye":{"status":"open","repositories":{"bullseye":"120.0.6099.224-1~deb11u1","bullseye-security":"120.0.6099.224-1~deb11u1"},"urgency":"end-of-life"},"forky":{"status":"resolved","repositories":{"forky":"145.0.7632.159-1"},"fixed_version":"126.0.6478.56-1","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"146.0.7680.71-1"},"fixed_version":"126.0.6478.56-1","urgency":"not yet assigned"},"trixie":{"status":"resolved","repositories":{"trixie":"143.0.7499.169-1~deb13u1","trixie-security":"145.0.7632.159-1~deb13u1"},"fixed_version":"126.0.6478.56-1","urgency":"not yet assigned"}}},"CVE-2024-5844":{"description":"Heap buffer overflow in Tab Strip in Google Chrome prior to 126.0.6478.54 allowed a remote attacker to perform an out of bounds memory read via a crafted HTML page. (Chromium security severity: Medium)","scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"143.0.7499.169-1~deb12u1","bookworm-security":"145.0.7632.159-1~deb12u1"},"fixed_version":"126.0.6478.56-1~deb12u1","urgency":"not yet assigned"},"bullseye":{"status":"open","repositories":{"bullseye":"120.0.6099.224-1~deb11u1","bullseye-security":"120.0.6099.224-1~deb11u1"},"urgency":"end-of-life"},"forky":{"status":"resolved","repositories":{"forky":"145.0.7632.159-1"},"fixed_version":"126.0.6478.56-1","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"146.0.7680.71-1"},"fixed_version":"126.0.6478.56-1","urgency":"not yet assigned"},"trixie":{"status":"resolved","repositories":{"trixie":"143.0.7499.169-1~deb13u1","trixie-security":"145.0.7632.159-1~deb13u1"},"fixed_version":"126.0.6478.56-1","urgency":"not yet assigned"}}},"CVE-2024-5845":{"description":"Use after free in Audio in Google Chrome prior to 126.0.6478.54 allowed a remote attacker to potentially exploit heap corruption via a crafted PDF file. (Chromium security severity: Medium)","scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"143.0.7499.169-1~deb12u1","bookworm-security":"145.0.7632.159-1~deb12u1"},"fixed_version":"126.0.6478.56-1~deb12u1","urgency":"not yet assigned"},"bullseye":{"status":"open","repositories":{"bullseye":"120.0.6099.224-1~deb11u1","bullseye-security":"120.0.6099.224-1~deb11u1"},"urgency":"end-of-life"},"forky":{"status":"resolved","repositories":{"forky":"145.0.7632.159-1"},"fixed_version":"126.0.6478.56-1","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"146.0.7680.71-1"},"fixed_version":"126.0.6478.56-1","urgency":"not yet assigned"},"trixie":{"status":"resolved","repositories":{"trixie":"143.0.7499.169-1~deb13u1","trixie-security":"145.0.7632.159-1~deb13u1"},"fixed_version":"126.0.6478.56-1","urgency":"not yet assigned"}}},"CVE-2024-5846":{"description":"Use after free in PDFium in Google Chrome prior to 126.0.6478.54 allowed a remote attacker to potentially exploit heap corruption via a crafted PDF file. (Chromium security severity: Medium)","scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"143.0.7499.169-1~deb12u1","bookworm-security":"145.0.7632.159-1~deb12u1"},"fixed_version":"126.0.6478.56-1~deb12u1","urgency":"not yet assigned"},"bullseye":{"status":"open","repositories":{"bullseye":"120.0.6099.224-1~deb11u1","bullseye-security":"120.0.6099.224-1~deb11u1"},"urgency":"end-of-life"},"forky":{"status":"resolved","repositories":{"forky":"145.0.7632.159-1"},"fixed_version":"126.0.6478.56-1","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"146.0.7680.71-1"},"fixed_version":"126.0.6478.56-1","urgency":"not yet assigned"},"trixie":{"status":"resolved","repositories":{"trixie":"143.0.7499.169-1~deb13u1","trixie-security":"145.0.7632.159-1~deb13u1"},"fixed_version":"126.0.6478.56-1","urgency":"not yet assigned"}}},"CVE-2024-5847":{"description":"Use after free in PDFium in Google Chrome prior to 126.0.6478.54 allowed a remote attacker to potentially exploit heap corruption via a crafted PDF file. (Chromium security severity: Medium)","scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"143.0.7499.169-1~deb12u1","bookworm-security":"145.0.7632.159-1~deb12u1"},"fixed_version":"126.0.6478.56-1~deb12u1","urgency":"not yet assigned"},"bullseye":{"status":"open","repositories":{"bullseye":"120.0.6099.224-1~deb11u1","bullseye-security":"120.0.6099.224-1~deb11u1"},"urgency":"end-of-life"},"forky":{"status":"resolved","repositories":{"forky":"145.0.7632.159-1"},"fixed_version":"126.0.6478.56-1","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"146.0.7680.71-1"},"fixed_version":"126.0.6478.56-1","urgency":"not yet assigned"},"trixie":{"status":"resolved","repositories":{"trixie":"143.0.7499.169-1~deb13u1","trixie-security":"145.0.7632.159-1~deb13u1"},"fixed_version":"126.0.6478.56-1","urgency":"not yet assigned"}}},"CVE-2024-6100":{"description":"Type Confusion in V8 in Google Chrome prior to 126.0.6478.114 allowed a remote attacker to execute arbitrary code via a crafted HTML page. (Chromium security severity: High)","scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"143.0.7499.169-1~deb12u1","bookworm-security":"145.0.7632.159-1~deb12u1"},"fixed_version":"126.0.6478.114-1~deb12u1","urgency":"not yet assigned"},"bullseye":{"status":"open","repositories":{"bullseye":"120.0.6099.224-1~deb11u1","bullseye-security":"120.0.6099.224-1~deb11u1"},"urgency":"end-of-life"},"forky":{"status":"resolved","repositories":{"forky":"145.0.7632.159-1"},"fixed_version":"126.0.6478.114-1","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"146.0.7680.71-1"},"fixed_version":"126.0.6478.114-1","urgency":"not yet assigned"},"trixie":{"status":"resolved","repositories":{"trixie":"143.0.7499.169-1~deb13u1","trixie-security":"145.0.7632.159-1~deb13u1"},"fixed_version":"126.0.6478.114-1","urgency":"not yet assigned"}}},"CVE-2024-6101":{"description":"Inappropriate implementation in V8 in Google Chrome prior to 126.0.6478.114 allowed a remote attacker to perform out of bounds memory access via a crafted HTML page. (Chromium security severity: High)","scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"143.0.7499.169-1~deb12u1","bookworm-security":"145.0.7632.159-1~deb12u1"},"fixed_version":"126.0.6478.114-1~deb12u1","urgency":"not yet assigned"},"bullseye":{"status":"open","repositories":{"bullseye":"120.0.6099.224-1~deb11u1","bullseye-security":"120.0.6099.224-1~deb11u1"},"urgency":"end-of-life"},"forky":{"status":"resolved","repositories":{"forky":"145.0.7632.159-1"},"fixed_version":"126.0.6478.114-1","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"146.0.7680.71-1"},"fixed_version":"126.0.6478.114-1","urgency":"not yet assigned"},"trixie":{"status":"resolved","repositories":{"trixie":"143.0.7499.169-1~deb13u1","trixie-security":"145.0.7632.159-1~deb13u1"},"fixed_version":"126.0.6478.114-1","urgency":"not yet assigned"}}},"CVE-2024-6102":{"description":"Out of bounds memory access in Dawn in Google Chrome prior to 126.0.6478.114 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. (Chromium security severity: High)","scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"143.0.7499.169-1~deb12u1","bookworm-security":"145.0.7632.159-1~deb12u1"},"fixed_version":"126.0.6478.114-1~deb12u1","urgency":"not yet assigned"},"bullseye":{"status":"open","repositories":{"bullseye":"120.0.6099.224-1~deb11u1","bullseye-security":"120.0.6099.224-1~deb11u1"},"urgency":"end-of-life"},"forky":{"status":"resolved","repositories":{"forky":"145.0.7632.159-1"},"fixed_version":"126.0.6478.114-1","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"146.0.7680.71-1"},"fixed_version":"126.0.6478.114-1","urgency":"not yet assigned"},"trixie":{"status":"resolved","repositories":{"trixie":"143.0.7499.169-1~deb13u1","trixie-security":"145.0.7632.159-1~deb13u1"},"fixed_version":"126.0.6478.114-1","urgency":"not yet assigned"}}},"CVE-2024-6103":{"description":"Use after free in Dawn in Google Chrome prior to 126.0.6478.114 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. (Chromium security severity: High)","scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"143.0.7499.169-1~deb12u1","bookworm-security":"145.0.7632.159-1~deb12u1"},"fixed_version":"126.0.6478.114-1~deb12u1","urgency":"not yet assigned"},"bullseye":{"status":"open","repositories":{"bullseye":"120.0.6099.224-1~deb11u1","bullseye-security":"120.0.6099.224-1~deb11u1"},"urgency":"end-of-life"},"forky":{"status":"resolved","repositories":{"forky":"145.0.7632.159-1"},"fixed_version":"126.0.6478.114-1","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"146.0.7680.71-1"},"fixed_version":"126.0.6478.114-1","urgency":"not yet assigned"},"trixie":{"status":"resolved","repositories":{"trixie":"143.0.7499.169-1~deb13u1","trixie-security":"145.0.7632.159-1~deb13u1"},"fixed_version":"126.0.6478.114-1","urgency":"not yet assigned"}}},"CVE-2024-6290":{"description":"Use after free in Dawn in Google Chrome prior to 126.0.6478.126 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. (Chromium security severity: High)","scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"143.0.7499.169-1~deb12u1","bookworm-security":"145.0.7632.159-1~deb12u1"},"fixed_version":"126.0.6478.126-1~deb12u1","urgency":"not yet assigned"},"bullseye":{"status":"open","repositories":{"bullseye":"120.0.6099.224-1~deb11u1","bullseye-security":"120.0.6099.224-1~deb11u1"},"urgency":"end-of-life"},"forky":{"status":"resolved","repositories":{"forky":"145.0.7632.159-1"},"fixed_version":"126.0.6478.126-1","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"146.0.7680.71-1"},"fixed_version":"126.0.6478.126-1","urgency":"not yet assigned"},"trixie":{"status":"resolved","repositories":{"trixie":"143.0.7499.169-1~deb13u1","trixie-security":"145.0.7632.159-1~deb13u1"},"fixed_version":"126.0.6478.126-1","urgency":"not yet assigned"}}},"CVE-2024-6291":{"description":"Use after free in Swiftshader in Google Chrome prior to 126.0.6478.126 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. (Chromium security severity: High)","scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"143.0.7499.169-1~deb12u1","bookworm-security":"145.0.7632.159-1~deb12u1"},"fixed_version":"126.0.6478.126-1~deb12u1","urgency":"not yet assigned"},"bullseye":{"status":"open","repositories":{"bullseye":"120.0.6099.224-1~deb11u1","bullseye-security":"120.0.6099.224-1~deb11u1"},"urgency":"end-of-life"},"forky":{"status":"resolved","repositories":{"forky":"145.0.7632.159-1"},"fixed_version":"126.0.6478.126-1","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"146.0.7680.71-1"},"fixed_version":"126.0.6478.126-1","urgency":"not yet assigned"},"trixie":{"status":"resolved","repositories":{"trixie":"143.0.7499.169-1~deb13u1","trixie-security":"145.0.7632.159-1~deb13u1"},"fixed_version":"126.0.6478.126-1","urgency":"not yet assigned"}}},"CVE-2024-6292":{"description":"Use after free in Dawn in Google Chrome prior to 126.0.6478.126 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. (Chromium security severity: High)","scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"143.0.7499.169-1~deb12u1","bookworm-security":"145.0.7632.159-1~deb12u1"},"fixed_version":"126.0.6478.126-1~deb12u1","urgency":"not yet assigned"},"bullseye":{"status":"open","repositories":{"bullseye":"120.0.6099.224-1~deb11u1","bullseye-security":"120.0.6099.224-1~deb11u1"},"urgency":"end-of-life"},"forky":{"status":"resolved","repositories":{"forky":"145.0.7632.159-1"},"fixed_version":"126.0.6478.126-1","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"146.0.7680.71-1"},"fixed_version":"126.0.6478.126-1","urgency":"not yet assigned"},"trixie":{"status":"resolved","repositories":{"trixie":"143.0.7499.169-1~deb13u1","trixie-security":"145.0.7632.159-1~deb13u1"},"fixed_version":"126.0.6478.126-1","urgency":"not yet assigned"}}},"CVE-2024-6293":{"description":"Use after free in Dawn in Google Chrome prior to 126.0.6478.126 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. (Chromium security severity: High)","scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"143.0.7499.169-1~deb12u1","bookworm-security":"145.0.7632.159-1~deb12u1"},"fixed_version":"126.0.6478.126-1~deb12u1","urgency":"not yet assigned"},"bullseye":{"status":"open","repositories":{"bullseye":"120.0.6099.224-1~deb11u1","bullseye-security":"120.0.6099.224-1~deb11u1"},"urgency":"end-of-life"},"forky":{"status":"resolved","repositories":{"forky":"145.0.7632.159-1"},"fixed_version":"126.0.6478.126-1","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"146.0.7680.71-1"},"fixed_version":"126.0.6478.126-1","urgency":"not yet assigned"},"trixie":{"status":"resolved","repositories":{"trixie":"143.0.7499.169-1~deb13u1","trixie-security":"145.0.7632.159-1~deb13u1"},"fixed_version":"126.0.6478.126-1","urgency":"not yet assigned"}}},"CVE-2024-6772":{"description":"Inappropriate implementation in V8 in Google Chrome prior to 126.0.6478.182 allowed a remote attacker to perform out of bounds memory access via a crafted HTML page. (Chromium security severity: High)","scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"143.0.7499.169-1~deb12u1","bookworm-security":"145.0.7632.159-1~deb12u1"},"fixed_version":"126.0.6478.182-1~deb12u1","urgency":"not yet assigned"},"bullseye":{"status":"open","repositories":{"bullseye":"120.0.6099.224-1~deb11u1","bullseye-security":"120.0.6099.224-1~deb11u1"},"urgency":"end-of-life"},"forky":{"status":"resolved","repositories":{"forky":"145.0.7632.159-1"},"fixed_version":"126.0.6478.182-1","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"146.0.7680.71-1"},"fixed_version":"126.0.6478.182-1","urgency":"not yet assigned"},"trixie":{"status":"resolved","repositories":{"trixie":"143.0.7499.169-1~deb13u1","trixie-security":"145.0.7632.159-1~deb13u1"},"fixed_version":"126.0.6478.182-1","urgency":"not yet assigned"}}},"CVE-2024-6773":{"description":"Inappropriate implementation in V8 in Google Chrome prior to 126.0.6478.182 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. (Chromium security severity: High)","scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"143.0.7499.169-1~deb12u1","bookworm-security":"145.0.7632.159-1~deb12u1"},"fixed_version":"126.0.6478.182-1~deb12u1","urgency":"not yet assigned"},"bullseye":{"status":"open","repositories":{"bullseye":"120.0.6099.224-1~deb11u1","bullseye-security":"120.0.6099.224-1~deb11u1"},"urgency":"end-of-life"},"forky":{"status":"resolved","repositories":{"forky":"145.0.7632.159-1"},"fixed_version":"126.0.6478.182-1","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"146.0.7680.71-1"},"fixed_version":"126.0.6478.182-1","urgency":"not yet assigned"},"trixie":{"status":"resolved","repositories":{"trixie":"143.0.7499.169-1~deb13u1","trixie-security":"145.0.7632.159-1~deb13u1"},"fixed_version":"126.0.6478.182-1","urgency":"not yet assigned"}}},"CVE-2024-6774":{"description":"Use after free in Screen Capture in Google Chrome prior to 126.0.6478.182 allowed a remote attacker who convinced a user to engage in specific UI gestures to potentially exploit heap corruption via a crafted HTML page. (Chromium security severity: High)","scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"143.0.7499.169-1~deb12u1","bookworm-security":"145.0.7632.159-1~deb12u1"},"fixed_version":"126.0.6478.182-1~deb12u1","urgency":"not yet assigned"},"bullseye":{"status":"open","repositories":{"bullseye":"120.0.6099.224-1~deb11u1","bullseye-security":"120.0.6099.224-1~deb11u1"},"urgency":"end-of-life"},"forky":{"status":"resolved","repositories":{"forky":"145.0.7632.159-1"},"fixed_version":"126.0.6478.182-1","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"146.0.7680.71-1"},"fixed_version":"126.0.6478.182-1","urgency":"not yet assigned"},"trixie":{"status":"resolved","repositories":{"trixie":"143.0.7499.169-1~deb13u1","trixie-security":"145.0.7632.159-1~deb13u1"},"fixed_version":"126.0.6478.182-1","urgency":"not yet assigned"}}},"CVE-2024-6775":{"description":"Use after free in Media Stream in Google Chrome prior to 126.0.6478.182 allowed a remote attacker who convinced a user to engage in specific UI gestures to potentially exploit heap corruption via a crafted HTML page. (Chromium security severity: High)","scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"143.0.7499.169-1~deb12u1","bookworm-security":"145.0.7632.159-1~deb12u1"},"fixed_version":"126.0.6478.182-1~deb12u1","urgency":"not yet assigned"},"bullseye":{"status":"open","repositories":{"bullseye":"120.0.6099.224-1~deb11u1","bullseye-security":"120.0.6099.224-1~deb11u1"},"urgency":"end-of-life"},"forky":{"status":"resolved","repositories":{"forky":"145.0.7632.159-1"},"fixed_version":"126.0.6478.182-1","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"146.0.7680.71-1"},"fixed_version":"126.0.6478.182-1","urgency":"not yet assigned"},"trixie":{"status":"resolved","repositories":{"trixie":"143.0.7499.169-1~deb13u1","trixie-security":"145.0.7632.159-1~deb13u1"},"fixed_version":"126.0.6478.182-1","urgency":"not yet assigned"}}},"CVE-2024-6776":{"description":"Use after free in Audio in Google Chrome prior to 126.0.6478.182 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. (Chromium security severity: High)","scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"143.0.7499.169-1~deb12u1","bookworm-security":"145.0.7632.159-1~deb12u1"},"fixed_version":"126.0.6478.182-1~deb12u1","urgency":"not yet assigned"},"bullseye":{"status":"open","repositories":{"bullseye":"120.0.6099.224-1~deb11u1","bullseye-security":"120.0.6099.224-1~deb11u1"},"urgency":"end-of-life"},"forky":{"status":"resolved","repositories":{"forky":"145.0.7632.159-1"},"fixed_version":"126.0.6478.182-1","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"146.0.7680.71-1"},"fixed_version":"126.0.6478.182-1","urgency":"not yet assigned"},"trixie":{"status":"resolved","repositories":{"trixie":"143.0.7499.169-1~deb13u1","trixie-security":"145.0.7632.159-1~deb13u1"},"fixed_version":"126.0.6478.182-1","urgency":"not yet assigned"}}},"CVE-2024-6777":{"description":"Use after free in Navigation in Google Chrome prior to 126.0.6478.182 allowed an attacker who convinced a user to install a malicious extension to potentially exploit heap corruption via a crafted Chrome Extension. (Chromium security severity: High)","scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"143.0.7499.169-1~deb12u1","bookworm-security":"145.0.7632.159-1~deb12u1"},"fixed_version":"126.0.6478.182-1~deb12u1","urgency":"not yet assigned"},"bullseye":{"status":"open","repositories":{"bullseye":"120.0.6099.224-1~deb11u1","bullseye-security":"120.0.6099.224-1~deb11u1"},"urgency":"end-of-life"},"forky":{"status":"resolved","repositories":{"forky":"145.0.7632.159-1"},"fixed_version":"126.0.6478.182-1","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"146.0.7680.71-1"},"fixed_version":"126.0.6478.182-1","urgency":"not yet assigned"},"trixie":{"status":"resolved","repositories":{"trixie":"143.0.7499.169-1~deb13u1","trixie-security":"145.0.7632.159-1~deb13u1"},"fixed_version":"126.0.6478.182-1","urgency":"not yet assigned"}}},"CVE-2024-6778":{"description":"Race in DevTools in Google Chrome prior to 126.0.6478.182 allowed an attacker who convinced a user to install a malicious extension to inject scripts or HTML into a privileged page via a crafted Chrome Extension. (Chromium security severity: High)","scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"143.0.7499.169-1~deb12u1","bookworm-security":"145.0.7632.159-1~deb12u1"},"fixed_version":"126.0.6478.182-1~deb12u1","urgency":"not yet assigned"},"bullseye":{"status":"open","repositories":{"bullseye":"120.0.6099.224-1~deb11u1","bullseye-security":"120.0.6099.224-1~deb11u1"},"urgency":"end-of-life"},"forky":{"status":"resolved","repositories":{"forky":"145.0.7632.159-1"},"fixed_version":"126.0.6478.182-1","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"146.0.7680.71-1"},"fixed_version":"126.0.6478.182-1","urgency":"not yet assigned"},"trixie":{"status":"resolved","repositories":{"trixie":"143.0.7499.169-1~deb13u1","trixie-security":"145.0.7632.159-1~deb13u1"},"fixed_version":"126.0.6478.182-1","urgency":"not yet assigned"}}},"CVE-2024-6779":{"description":"Out of bounds memory access in V8 in Google Chrome prior to 126.0.6478.182 allowed a remote attacker to potentially perform a sandbox escape via a crafted HTML page. (Chromium security severity: High)","scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"143.0.7499.169-1~deb12u1","bookworm-security":"145.0.7632.159-1~deb12u1"},"fixed_version":"126.0.6478.182-1~deb12u1","urgency":"not yet assigned"},"bullseye":{"status":"open","repositories":{"bullseye":"120.0.6099.224-1~deb11u1","bullseye-security":"120.0.6099.224-1~deb11u1"},"urgency":"end-of-life"},"forky":{"status":"resolved","repositories":{"forky":"145.0.7632.159-1"},"fixed_version":"126.0.6478.182-1","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"146.0.7680.71-1"},"fixed_version":"126.0.6478.182-1","urgency":"not yet assigned"},"trixie":{"status":"resolved","repositories":{"trixie":"143.0.7499.169-1~deb13u1","trixie-security":"145.0.7632.159-1~deb13u1"},"fixed_version":"126.0.6478.182-1","urgency":"not yet assigned"}}},"CVE-2024-6988":{"description":"Use after free in Downloads in Google Chrome on iOS prior to 127.0.6533.72 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. (Chromium security severity: High)","scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"143.0.7499.169-1~deb12u1","bookworm-security":"145.0.7632.159-1~deb12u1"},"fixed_version":"127.0.6533.88-1~deb12u1","urgency":"not yet assigned"},"bullseye":{"status":"open","repositories":{"bullseye":"120.0.6099.224-1~deb11u1","bullseye-security":"120.0.6099.224-1~deb11u1"},"urgency":"end-of-life"},"forky":{"status":"resolved","repositories":{"forky":"145.0.7632.159-1"},"fixed_version":"127.0.6533.88-1","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"146.0.7680.71-1"},"fixed_version":"127.0.6533.88-1","urgency":"not yet assigned"},"trixie":{"status":"resolved","repositories":{"trixie":"143.0.7499.169-1~deb13u1","trixie-security":"145.0.7632.159-1~deb13u1"},"fixed_version":"127.0.6533.88-1","urgency":"not yet assigned"}}},"CVE-2024-6989":{"description":"Use after free in Loader in Google Chrome prior to 127.0.6533.72 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. (Chromium security severity: High)","scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"143.0.7499.169-1~deb12u1","bookworm-security":"145.0.7632.159-1~deb12u1"},"fixed_version":"127.0.6533.88-1~deb12u1","urgency":"not yet assigned"},"bullseye":{"status":"open","repositories":{"bullseye":"120.0.6099.224-1~deb11u1","bullseye-security":"120.0.6099.224-1~deb11u1"},"urgency":"end-of-life"},"forky":{"status":"resolved","repositories":{"forky":"145.0.7632.159-1"},"fixed_version":"127.0.6533.88-1","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"146.0.7680.71-1"},"fixed_version":"127.0.6533.88-1","urgency":"not yet assigned"},"trixie":{"status":"resolved","repositories":{"trixie":"143.0.7499.169-1~deb13u1","trixie-security":"145.0.7632.159-1~deb13u1"},"fixed_version":"127.0.6533.88-1","urgency":"not yet assigned"}}},"CVE-2024-6990":{"description":"Uninitialized Use in Dawn in Google Chrome on Android prior to 127.0.6533.88 allowed a remote attacker to potentially perform out of bounds memory access via a crafted HTML page. (Chromium security severity: Critical)","scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"143.0.7499.169-1~deb12u1","bookworm-security":"145.0.7632.159-1~deb12u1"},"fixed_version":"127.0.6533.88-1~deb12u1","urgency":"not yet assigned"},"bullseye":{"status":"open","repositories":{"bullseye":"120.0.6099.224-1~deb11u1","bullseye-security":"120.0.6099.224-1~deb11u1"},"urgency":"end-of-life"},"forky":{"status":"resolved","repositories":{"forky":"145.0.7632.159-1"},"fixed_version":"127.0.6533.88-1","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"146.0.7680.71-1"},"fixed_version":"127.0.6533.88-1","urgency":"not yet assigned"},"trixie":{"status":"resolved","repositories":{"trixie":"143.0.7499.169-1~deb13u1","trixie-security":"145.0.7632.159-1~deb13u1"},"fixed_version":"127.0.6533.88-1","urgency":"not yet assigned"}}},"CVE-2024-6991":{"description":"Use after free in Dawn in Google Chrome prior to 127.0.6533.72 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. (Chromium security severity: High)","scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"143.0.7499.169-1~deb12u1","bookworm-security":"145.0.7632.159-1~deb12u1"},"fixed_version":"127.0.6533.88-1~deb12u1","urgency":"not yet assigned"},"bullseye":{"status":"open","repositories":{"bullseye":"120.0.6099.224-1~deb11u1","bullseye-security":"120.0.6099.224-1~deb11u1"},"urgency":"end-of-life"},"forky":{"status":"resolved","repositories":{"forky":"145.0.7632.159-1"},"fixed_version":"127.0.6533.88-1","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"146.0.7680.71-1"},"fixed_version":"127.0.6533.88-1","urgency":"not yet assigned"},"trixie":{"status":"resolved","repositories":{"trixie":"143.0.7499.169-1~deb13u1","trixie-security":"145.0.7632.159-1~deb13u1"},"fixed_version":"127.0.6533.88-1","urgency":"not yet assigned"}}},"CVE-2024-6992":{"releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"143.0.7499.169-1~deb12u1","bookworm-security":"145.0.7632.159-1~deb12u1"},"fixed_version":"127.0.6533.88-1~deb12u1","urgency":"not yet assigned"},"bullseye":{"status":"open","repositories":{"bullseye":"120.0.6099.224-1~deb11u1","bullseye-security":"120.0.6099.224-1~deb11u1"},"urgency":"end-of-life"},"forky":{"status":"resolved","repositories":{"forky":"145.0.7632.159-1"},"fixed_version":"127.0.6533.88-1","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"146.0.7680.71-1"},"fixed_version":"127.0.6533.88-1","urgency":"not yet assigned"},"trixie":{"status":"resolved","repositories":{"trixie":"143.0.7499.169-1~deb13u1","trixie-security":"145.0.7632.159-1~deb13u1"},"fixed_version":"127.0.6533.88-1","urgency":"not yet assigned"}}},"CVE-2024-6993":{"releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"143.0.7499.169-1~deb12u1","bookworm-security":"145.0.7632.159-1~deb12u1"},"fixed_version":"127.0.6533.88-1~deb12u1","urgency":"not yet assigned"},"bullseye":{"status":"open","repositories":{"bullseye":"120.0.6099.224-1~deb11u1","bullseye-security":"120.0.6099.224-1~deb11u1"},"urgency":"end-of-life"},"forky":{"status":"resolved","repositories":{"forky":"145.0.7632.159-1"},"fixed_version":"127.0.6533.88-1","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"146.0.7680.71-1"},"fixed_version":"127.0.6533.88-1","urgency":"not yet assigned"},"trixie":{"status":"resolved","repositories":{"trixie":"143.0.7499.169-1~deb13u1","trixie-security":"145.0.7632.159-1~deb13u1"},"fixed_version":"127.0.6533.88-1","urgency":"not yet assigned"}}},"CVE-2024-6994":{"description":"Heap buffer overflow in Layout in Google Chrome prior to 127.0.6533.72 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. (Chromium security severity: Medium)","scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"143.0.7499.169-1~deb12u1","bookworm-security":"145.0.7632.159-1~deb12u1"},"fixed_version":"127.0.6533.88-1~deb12u1","urgency":"not yet assigned"},"bullseye":{"status":"open","repositories":{"bullseye":"120.0.6099.224-1~deb11u1","bullseye-security":"120.0.6099.224-1~deb11u1"},"urgency":"end-of-life"},"forky":{"status":"resolved","repositories":{"forky":"145.0.7632.159-1"},"fixed_version":"127.0.6533.88-1","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"146.0.7680.71-1"},"fixed_version":"127.0.6533.88-1","urgency":"not yet assigned"},"trixie":{"status":"resolved","repositories":{"trixie":"143.0.7499.169-1~deb13u1","trixie-security":"145.0.7632.159-1~deb13u1"},"fixed_version":"127.0.6533.88-1","urgency":"not yet assigned"}}},"CVE-2024-6995":{"description":"Inappropriate implementation in Fullscreen in Google Chrome on Android prior to 127.0.6533.72 allowed a remote attacker who convinced a user to engage in specific UI gestures to spoof the contents of the Omnibox (URL bar) via a crafted HTML page. (Chromium security severity: Medium)","scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"143.0.7499.169-1~deb12u1","bookworm-security":"145.0.7632.159-1~deb12u1"},"fixed_version":"127.0.6533.88-1~deb12u1","urgency":"not yet assigned"},"bullseye":{"status":"open","repositories":{"bullseye":"120.0.6099.224-1~deb11u1","bullseye-security":"120.0.6099.224-1~deb11u1"},"urgency":"end-of-life"},"forky":{"status":"resolved","repositories":{"forky":"145.0.7632.159-1"},"fixed_version":"127.0.6533.88-1","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"146.0.7680.71-1"},"fixed_version":"127.0.6533.88-1","urgency":"not yet assigned"},"trixie":{"status":"resolved","repositories":{"trixie":"143.0.7499.169-1~deb13u1","trixie-security":"145.0.7632.159-1~deb13u1"},"fixed_version":"127.0.6533.88-1","urgency":"not yet assigned"}}},"CVE-2024-6996":{"description":"Race in Frames in Google Chrome prior to 127.0.6533.72 allowed a remote attacker who convinced a user to engage in specific UI gestures to perform UI spoofing via a crafted HTML page. (Chromium security severity: Medium)","scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"143.0.7499.169-1~deb12u1","bookworm-security":"145.0.7632.159-1~deb12u1"},"fixed_version":"127.0.6533.88-1~deb12u1","urgency":"not yet assigned"},"bullseye":{"status":"open","repositories":{"bullseye":"120.0.6099.224-1~deb11u1","bullseye-security":"120.0.6099.224-1~deb11u1"},"urgency":"end-of-life"},"forky":{"status":"resolved","repositories":{"forky":"145.0.7632.159-1"},"fixed_version":"127.0.6533.88-1","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"146.0.7680.71-1"},"fixed_version":"127.0.6533.88-1","urgency":"not yet assigned"},"trixie":{"status":"resolved","repositories":{"trixie":"143.0.7499.169-1~deb13u1","trixie-security":"145.0.7632.159-1~deb13u1"},"fixed_version":"127.0.6533.88-1","urgency":"not yet assigned"}}},"CVE-2024-6997":{"description":"Use after free in Tabs in Google Chrome prior to 127.0.6533.72 allowed a remote attacker who convinced a user to engage in specific UI gestures to potentially exploit heap corruption via a crafted HTML page. (Chromium security severity: Medium)","scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"143.0.7499.169-1~deb12u1","bookworm-security":"145.0.7632.159-1~deb12u1"},"fixed_version":"127.0.6533.88-1~deb12u1","urgency":"not yet assigned"},"bullseye":{"status":"open","repositories":{"bullseye":"120.0.6099.224-1~deb11u1","bullseye-security":"120.0.6099.224-1~deb11u1"},"urgency":"end-of-life"},"forky":{"status":"resolved","repositories":{"forky":"145.0.7632.159-1"},"fixed_version":"127.0.6533.88-1","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"146.0.7680.71-1"},"fixed_version":"127.0.6533.88-1","urgency":"not yet assigned"},"trixie":{"status":"resolved","repositories":{"trixie":"143.0.7499.169-1~deb13u1","trixie-security":"145.0.7632.159-1~deb13u1"},"fixed_version":"127.0.6533.88-1","urgency":"not yet assigned"}}},"CVE-2024-6998":{"description":"Use after free in User Education in Google Chrome prior to 127.0.6533.72 allowed a remote attacker who convinced a user to engage in specific UI gestures to potentially exploit heap corruption via a crafted HTML page. (Chromium security severity: Medium)","scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"143.0.7499.169-1~deb12u1","bookworm-security":"145.0.7632.159-1~deb12u1"},"fixed_version":"127.0.6533.88-1~deb12u1","urgency":"not yet assigned"},"bullseye":{"status":"open","repositories":{"bullseye":"120.0.6099.224-1~deb11u1","bullseye-security":"120.0.6099.224-1~deb11u1"},"urgency":"end-of-life"},"forky":{"status":"resolved","repositories":{"forky":"145.0.7632.159-1"},"fixed_version":"127.0.6533.88-1","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"146.0.7680.71-1"},"fixed_version":"127.0.6533.88-1","urgency":"not yet assigned"},"trixie":{"status":"resolved","repositories":{"trixie":"143.0.7499.169-1~deb13u1","trixie-security":"145.0.7632.159-1~deb13u1"},"fixed_version":"127.0.6533.88-1","urgency":"not yet assigned"}}},"CVE-2024-6999":{"description":"Inappropriate implementation in FedCM in Google Chrome prior to 127.0.6533.72 allowed a remote attacker who convinced a user to engage in specific UI gestures to perform UI spoofing via a crafted HTML page. (Chromium security severity: Medium)","scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"143.0.7499.169-1~deb12u1","bookworm-security":"145.0.7632.159-1~deb12u1"},"fixed_version":"127.0.6533.88-1~deb12u1","urgency":"not yet assigned"},"bullseye":{"status":"open","repositories":{"bullseye":"120.0.6099.224-1~deb11u1","bullseye-security":"120.0.6099.224-1~deb11u1"},"urgency":"end-of-life"},"forky":{"status":"resolved","repositories":{"forky":"145.0.7632.159-1"},"fixed_version":"127.0.6533.88-1","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"146.0.7680.71-1"},"fixed_version":"127.0.6533.88-1","urgency":"not yet assigned"},"trixie":{"status":"resolved","repositories":{"trixie":"143.0.7499.169-1~deb13u1","trixie-security":"145.0.7632.159-1~deb13u1"},"fixed_version":"127.0.6533.88-1","urgency":"not yet assigned"}}},"CVE-2024-7000":{"description":"Use after free in CSS in Google Chrome prior to 127.0.6533.72 allowed a remote attacker who convinced a user to engage in specific UI gestures to potentially exploit heap corruption via a crafted HTML page. (Chromium security severity: Medium)","scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"143.0.7499.169-1~deb12u1","bookworm-security":"145.0.7632.159-1~deb12u1"},"fixed_version":"127.0.6533.88-1~deb12u1","urgency":"not yet assigned"},"bullseye":{"status":"open","repositories":{"bullseye":"120.0.6099.224-1~deb11u1","bullseye-security":"120.0.6099.224-1~deb11u1"},"urgency":"end-of-life"},"forky":{"status":"resolved","repositories":{"forky":"145.0.7632.159-1"},"fixed_version":"127.0.6533.88-1","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"146.0.7680.71-1"},"fixed_version":"127.0.6533.88-1","urgency":"not yet assigned"},"trixie":{"status":"resolved","repositories":{"trixie":"143.0.7499.169-1~deb13u1","trixie-security":"145.0.7632.159-1~deb13u1"},"fixed_version":"127.0.6533.88-1","urgency":"not yet assigned"}}},"CVE-2024-7001":{"description":"Inappropriate implementation in HTML in Google Chrome prior to 127.0.6533.72 allowed a remote attacker who convinced a user to engage in specific UI gestures to perform UI spoofing via a crafted HTML page. (Chromium security severity: Medium)","scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"143.0.7499.169-1~deb12u1","bookworm-security":"145.0.7632.159-1~deb12u1"},"fixed_version":"127.0.6533.88-1~deb12u1","urgency":"not yet assigned"},"bullseye":{"status":"open","repositories":{"bullseye":"120.0.6099.224-1~deb11u1","bullseye-security":"120.0.6099.224-1~deb11u1"},"urgency":"end-of-life"},"forky":{"status":"resolved","repositories":{"forky":"145.0.7632.159-1"},"fixed_version":"127.0.6533.88-1","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"146.0.7680.71-1"},"fixed_version":"127.0.6533.88-1","urgency":"not yet assigned"},"trixie":{"status":"resolved","repositories":{"trixie":"143.0.7499.169-1~deb13u1","trixie-security":"145.0.7632.159-1~deb13u1"},"fixed_version":"127.0.6533.88-1","urgency":"not yet assigned"}}},"CVE-2024-7003":{"description":"Inappropriate implementation in FedCM in Google Chrome prior to 127.0.6533.72 allowed a remote attacker who convinced a user to engage in specific UI gestures to perform UI spoofing via a crafted HTML page. (Chromium security severity: Low)","scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"143.0.7499.169-1~deb12u1","bookworm-security":"145.0.7632.159-1~deb12u1"},"fixed_version":"127.0.6533.88-1~deb12u1","urgency":"not yet assigned"},"bullseye":{"status":"open","repositories":{"bullseye":"120.0.6099.224-1~deb11u1","bullseye-security":"120.0.6099.224-1~deb11u1"},"urgency":"end-of-life"},"forky":{"status":"resolved","repositories":{"forky":"145.0.7632.159-1"},"fixed_version":"127.0.6533.88-1","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"146.0.7680.71-1"},"fixed_version":"127.0.6533.88-1","urgency":"not yet assigned"},"trixie":{"status":"resolved","repositories":{"trixie":"143.0.7499.169-1~deb13u1","trixie-security":"145.0.7632.159-1~deb13u1"},"fixed_version":"127.0.6533.88-1","urgency":"not yet assigned"}}},"CVE-2024-7004":{"description":"Insufficient validation of untrusted input in Safe Browsing in Google Chrome prior to 127.0.6533.72 allowed a remote attacker who convinced a user to engage in specific UI gestures to bypass discretionary access control via a malicious file. (Chromium security severity: Low)","scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"143.0.7499.169-1~deb12u1","bookworm-security":"145.0.7632.159-1~deb12u1"},"fixed_version":"127.0.6533.88-1~deb12u1","urgency":"not yet assigned"},"bullseye":{"status":"open","repositories":{"bullseye":"120.0.6099.224-1~deb11u1","bullseye-security":"120.0.6099.224-1~deb11u1"},"urgency":"end-of-life"},"forky":{"status":"resolved","repositories":{"forky":"145.0.7632.159-1"},"fixed_version":"127.0.6533.88-1","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"146.0.7680.71-1"},"fixed_version":"127.0.6533.88-1","urgency":"not yet assigned"},"trixie":{"status":"resolved","repositories":{"trixie":"143.0.7499.169-1~deb13u1","trixie-security":"145.0.7632.159-1~deb13u1"},"fixed_version":"127.0.6533.88-1","urgency":"not yet assigned"}}},"CVE-2024-7005":{"description":"Insufficient validation of untrusted input in Safe Browsing in Google Chrome prior to 127.0.6533.72 allowed a remote attacker who convinced a user to engage in specific UI gestures to bypass discretionary access control via a malicious file. (Chromium security severity: Low)","scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"143.0.7499.169-1~deb12u1","bookworm-security":"145.0.7632.159-1~deb12u1"},"fixed_version":"127.0.6533.88-1~deb12u1","urgency":"not yet assigned"},"bullseye":{"status":"open","repositories":{"bullseye":"120.0.6099.224-1~deb11u1","bullseye-security":"120.0.6099.224-1~deb11u1"},"urgency":"end-of-life"},"forky":{"status":"resolved","repositories":{"forky":"145.0.7632.159-1"},"fixed_version":"127.0.6533.88-1","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"146.0.7680.71-1"},"fixed_version":"127.0.6533.88-1","urgency":"not yet assigned"},"trixie":{"status":"resolved","repositories":{"trixie":"143.0.7499.169-1~deb13u1","trixie-security":"145.0.7632.159-1~deb13u1"},"fixed_version":"127.0.6533.88-1","urgency":"not yet assigned"}}},"CVE-2024-7017":{"description":"Inappropriate implementation in DevTools in Google Chrome prior to 126.0.6478.182 allowed a remote attacker to potentially perform a sandbox escape via a crafted HTML page. (Chromium security severity: High)","scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"143.0.7499.169-1~deb12u1","bookworm-security":"145.0.7632.159-1~deb12u1"},"fixed_version":"126.0.6478.182-1~deb12u1","urgency":"not yet assigned"},"bullseye":{"status":"open","repositories":{"bullseye":"120.0.6099.224-1~deb11u1","bullseye-security":"120.0.6099.224-1~deb11u1"},"urgency":"end-of-life"},"forky":{"status":"resolved","repositories":{"forky":"145.0.7632.159-1"},"fixed_version":"126.0.6478.182-1","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"146.0.7680.71-1"},"fixed_version":"126.0.6478.182-1","urgency":"not yet assigned"},"trixie":{"status":"resolved","repositories":{"trixie":"143.0.7499.169-1~deb13u1","trixie-security":"145.0.7632.159-1~deb13u1"},"fixed_version":"126.0.6478.182-1","urgency":"not yet assigned"}}},"CVE-2024-7018":{"description":"Heap buffer overflow in PDF in Google Chrome prior to 124.0.6367.78 allowed a remote attacker to potentially exploit heap corruption via a crafted PDF file. (Chromium security severity: Medium)","scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"143.0.7499.169-1~deb12u1","bookworm-security":"145.0.7632.159-1~deb12u1"},"fixed_version":"124.0.6367.78-1~deb12u1","urgency":"not yet assigned"},"bullseye":{"status":"open","repositories":{"bullseye":"120.0.6099.224-1~deb11u1","bullseye-security":"120.0.6099.224-1~deb11u1"},"urgency":"end-of-life"},"forky":{"status":"resolved","repositories":{"forky":"145.0.7632.159-1"},"fixed_version":"124.0.6367.78-1","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"146.0.7680.71-1"},"fixed_version":"124.0.6367.78-1","urgency":"not yet assigned"},"trixie":{"status":"resolved","repositories":{"trixie":"143.0.7499.169-1~deb13u1","trixie-security":"145.0.7632.159-1~deb13u1"},"fixed_version":"124.0.6367.78-1","urgency":"not yet assigned"}}},"CVE-2024-7019":{"description":"Inappropriate implementation in UI in Google Chrome prior to 124.0.6367.60 allowed a remote attacker who convinced a user to engage in specific UI gestures to perform UI spoofing via a crafted HTML page. (Chromium security severity: Medium)","scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"143.0.7499.169-1~deb12u1","bookworm-security":"145.0.7632.159-1~deb12u1"},"fixed_version":"124.0.6367.60-1~deb12u1","urgency":"not yet assigned"},"bullseye":{"status":"open","repositories":{"bullseye":"120.0.6099.224-1~deb11u1","bullseye-security":"120.0.6099.224-1~deb11u1"},"urgency":"end-of-life"},"forky":{"status":"resolved","repositories":{"forky":"145.0.7632.159-1"},"fixed_version":"124.0.6367.60-1","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"146.0.7680.71-1"},"fixed_version":"124.0.6367.60-1","urgency":"not yet assigned"},"trixie":{"status":"resolved","repositories":{"trixie":"143.0.7499.169-1~deb13u1","trixie-security":"145.0.7632.159-1~deb13u1"},"fixed_version":"124.0.6367.60-1","urgency":"not yet assigned"}}},"CVE-2024-7020":{"description":"Inappropriate implementation in Autofill in Google Chrome prior to 124.0.6367.60 allowed a remote attacker to perform UI spoofing via a crafted HTML page. (Chromium security severity: Low)","scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"143.0.7499.169-1~deb12u1","bookworm-security":"145.0.7632.159-1~deb12u1"},"fixed_version":"124.0.6367.60-1~deb12u1","urgency":"not yet assigned"},"bullseye":{"status":"open","repositories":{"bullseye":"120.0.6099.224-1~deb11u1","bullseye-security":"120.0.6099.224-1~deb11u1"},"urgency":"end-of-life"},"forky":{"status":"resolved","repositories":{"forky":"145.0.7632.159-1"},"fixed_version":"124.0.6367.60-1","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"146.0.7680.71-1"},"fixed_version":"124.0.6367.60-1","urgency":"not yet assigned"},"trixie":{"status":"resolved","repositories":{"trixie":"143.0.7499.169-1~deb13u1","trixie-security":"145.0.7632.159-1~deb13u1"},"fixed_version":"124.0.6367.60-1","urgency":"not yet assigned"}}},"CVE-2024-7021":{"description":"Inappropriate implementation in Autofill in Google Chrome on Windows prior to 124.0.6367.60 allowed a remote attacker to perform UI spoofing via a crafted HTML page. (Chromium security severity: Medium)","scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"143.0.7499.169-1~deb12u1","bookworm-security":"145.0.7632.159-1~deb12u1"},"fixed_version":"0","urgency":"unimportant"},"bullseye":{"status":"resolved","repositories":{"bullseye":"120.0.6099.224-1~deb11u1","bullseye-security":"120.0.6099.224-1~deb11u1"},"fixed_version":"0","urgency":"unimportant"},"forky":{"status":"resolved","repositories":{"forky":"145.0.7632.159-1"},"fixed_version":"0","urgency":"unimportant"},"sid":{"status":"resolved","repositories":{"sid":"146.0.7680.71-1"},"fixed_version":"0","urgency":"unimportant"},"trixie":{"status":"resolved","repositories":{"trixie":"143.0.7499.169-1~deb13u1","trixie-security":"145.0.7632.159-1~deb13u1"},"fixed_version":"0","urgency":"unimportant"}}},"CVE-2024-7022":{"description":"Uninitialized Use in V8 in Google Chrome prior to 123.0.6312.58 allowed a remote attacker to perform out of bounds memory access via a crafted HTML page. (Chromium security severity: Medium)","scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"143.0.7499.169-1~deb12u1","bookworm-security":"145.0.7632.159-1~deb12u1"},"fixed_version":"123.0.6312.86-1~deb12u1","urgency":"not yet assigned"},"bullseye":{"status":"open","repositories":{"bullseye":"120.0.6099.224-1~deb11u1","bullseye-security":"120.0.6099.224-1~deb11u1"},"urgency":"end-of-life"},"forky":{"status":"resolved","repositories":{"forky":"145.0.7632.159-1"},"fixed_version":"123.0.6312.58-1","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"146.0.7680.71-1"},"fixed_version":"123.0.6312.58-1","urgency":"not yet assigned"},"trixie":{"status":"resolved","repositories":{"trixie":"143.0.7499.169-1~deb13u1","trixie-security":"145.0.7632.159-1~deb13u1"},"fixed_version":"123.0.6312.58-1","urgency":"not yet assigned"}}},"CVE-2024-7023":{"description":"Insufficient data validation in Updater in Google Chrome prior to 128.0.6537.0 allowed a remote attacker to perform privilege escalation via a malicious file. (Chromium security severity: Medium)","scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"143.0.7499.169-1~deb12u1","bookworm-security":"145.0.7632.159-1~deb12u1"},"fixed_version":"0","urgency":"unimportant"},"bullseye":{"status":"resolved","repositories":{"bullseye":"120.0.6099.224-1~deb11u1","bullseye-security":"120.0.6099.224-1~deb11u1"},"fixed_version":"0","urgency":"unimportant"},"forky":{"status":"resolved","repositories":{"forky":"145.0.7632.159-1"},"fixed_version":"0","urgency":"unimportant"},"sid":{"status":"resolved","repositories":{"sid":"146.0.7680.71-1"},"fixed_version":"0","urgency":"unimportant"},"trixie":{"status":"resolved","repositories":{"trixie":"143.0.7499.169-1~deb13u1","trixie-security":"145.0.7632.159-1~deb13u1"},"fixed_version":"0","urgency":"unimportant"}}},"CVE-2024-7024":{"description":"Inappropriate implementation in V8 in Google Chrome prior to 126.0.6478.54 allowed a remote attacker to potentially perform a sandbox escape via a crafted HTML page. (Chromium security severity: Low)","scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"143.0.7499.169-1~deb12u1","bookworm-security":"145.0.7632.159-1~deb12u1"},"fixed_version":"126.0.6478.56-1~deb12u1","urgency":"not yet assigned"},"bullseye":{"status":"open","repositories":{"bullseye":"120.0.6099.224-1~deb11u1","bullseye-security":"120.0.6099.224-1~deb11u1"},"urgency":"end-of-life"},"forky":{"status":"resolved","repositories":{"forky":"145.0.7632.159-1"},"fixed_version":"126.0.6478.56-1","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"146.0.7680.71-1"},"fixed_version":"126.0.6478.56-1","urgency":"not yet assigned"},"trixie":{"status":"resolved","repositories":{"trixie":"143.0.7499.169-1~deb13u1","trixie-security":"145.0.7632.159-1~deb13u1"},"fixed_version":"126.0.6478.56-1","urgency":"not yet assigned"}}},"CVE-2024-7025":{"description":"Integer overflow in Layout in Google Chrome prior to 129.0.6668.89 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. (Chromium security severity: High)","scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"143.0.7499.169-1~deb12u1","bookworm-security":"145.0.7632.159-1~deb12u1"},"fixed_version":"129.0.6668.89-1~deb12u1","urgency":"not yet assigned"},"bullseye":{"status":"open","repositories":{"bullseye":"120.0.6099.224-1~deb11u1","bullseye-security":"120.0.6099.224-1~deb11u1"},"urgency":"end-of-life"},"forky":{"status":"resolved","repositories":{"forky":"145.0.7632.159-1"},"fixed_version":"129.0.6668.89-1","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"146.0.7680.71-1"},"fixed_version":"129.0.6668.89-1","urgency":"not yet assigned"},"trixie":{"status":"resolved","repositories":{"trixie":"143.0.7499.169-1~deb13u1","trixie-security":"145.0.7632.159-1~deb13u1"},"fixed_version":"129.0.6668.89-1","urgency":"not yet assigned"}}},"CVE-2024-7255":{"description":"Out of bounds read in WebTransport in Google Chrome prior to 127.0.6533.88 allowed a remote attacker to potentially perform out of bounds memory access via a crafted HTML page. (Chromium security severity: High)","scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"143.0.7499.169-1~deb12u1","bookworm-security":"145.0.7632.159-1~deb12u1"},"fixed_version":"127.0.6533.88-1~deb12u1","urgency":"not yet assigned"},"bullseye":{"status":"open","repositories":{"bullseye":"120.0.6099.224-1~deb11u1","bullseye-security":"120.0.6099.224-1~deb11u1"},"urgency":"end-of-life"},"forky":{"status":"resolved","repositories":{"forky":"145.0.7632.159-1"},"fixed_version":"127.0.6533.88-1","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"146.0.7680.71-1"},"fixed_version":"127.0.6533.88-1","urgency":"not yet assigned"},"trixie":{"status":"resolved","repositories":{"trixie":"143.0.7499.169-1~deb13u1","trixie-security":"145.0.7632.159-1~deb13u1"},"fixed_version":"127.0.6533.88-1","urgency":"not yet assigned"}}},"CVE-2024-7256":{"description":"Insufficient data validation in Dawn in Google Chrome on Android prior to 127.0.6533.88 allowed a remote attacker to execute arbitrary code via a crafted HTML page. (Chromium security severity: High)","scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"143.0.7499.169-1~deb12u1","bookworm-security":"145.0.7632.159-1~deb12u1"},"fixed_version":"127.0.6533.88-1~deb12u1","urgency":"not yet assigned"},"bullseye":{"status":"open","repositories":{"bullseye":"120.0.6099.224-1~deb11u1","bullseye-security":"120.0.6099.224-1~deb11u1"},"urgency":"end-of-life"},"forky":{"status":"resolved","repositories":{"forky":"145.0.7632.159-1"},"fixed_version":"127.0.6533.88-1","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"146.0.7680.71-1"},"fixed_version":"127.0.6533.88-1","urgency":"not yet assigned"},"trixie":{"status":"resolved","repositories":{"trixie":"143.0.7499.169-1~deb13u1","trixie-security":"145.0.7632.159-1~deb13u1"},"fixed_version":"127.0.6533.88-1","urgency":"not yet assigned"}}},"CVE-2024-7532":{"description":"Out of bounds memory access in ANGLE in Google Chrome prior to 127.0.6533.99 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. (Chromium security severity: Critical)","scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"143.0.7499.169-1~deb12u1","bookworm-security":"145.0.7632.159-1~deb12u1"},"fixed_version":"127.0.6533.99-1~deb12u1","urgency":"not yet assigned"},"bullseye":{"status":"open","repositories":{"bullseye":"120.0.6099.224-1~deb11u1","bullseye-security":"120.0.6099.224-1~deb11u1"},"urgency":"end-of-life"},"forky":{"status":"resolved","repositories":{"forky":"145.0.7632.159-1"},"fixed_version":"127.0.6533.99-1","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"146.0.7680.71-1"},"fixed_version":"127.0.6533.99-1","urgency":"not yet assigned"},"trixie":{"status":"resolved","repositories":{"trixie":"143.0.7499.169-1~deb13u1","trixie-security":"145.0.7632.159-1~deb13u1"},"fixed_version":"127.0.6533.99-1","urgency":"not yet assigned"}}},"CVE-2024-7533":{"description":"Use after free in Sharing in Google Chrome on iOS prior to 127.0.6533.99 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. (Chromium security severity: High)","scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"143.0.7499.169-1~deb12u1","bookworm-security":"145.0.7632.159-1~deb12u1"},"fixed_version":"127.0.6533.99-1~deb12u1","urgency":"not yet assigned"},"bullseye":{"status":"open","repositories":{"bullseye":"120.0.6099.224-1~deb11u1","bullseye-security":"120.0.6099.224-1~deb11u1"},"urgency":"end-of-life"},"forky":{"status":"resolved","repositories":{"forky":"145.0.7632.159-1"},"fixed_version":"127.0.6533.99-1","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"146.0.7680.71-1"},"fixed_version":"127.0.6533.99-1","urgency":"not yet assigned"},"trixie":{"status":"resolved","repositories":{"trixie":"143.0.7499.169-1~deb13u1","trixie-security":"145.0.7632.159-1~deb13u1"},"fixed_version":"127.0.6533.99-1","urgency":"not yet assigned"}}},"CVE-2024-7534":{"description":"Heap buffer overflow in Layout in Google Chrome prior to 127.0.6533.99 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. (Chromium security severity: High)","scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"143.0.7499.169-1~deb12u1","bookworm-security":"145.0.7632.159-1~deb12u1"},"fixed_version":"127.0.6533.99-1~deb12u1","urgency":"not yet assigned"},"bullseye":{"status":"open","repositories":{"bullseye":"120.0.6099.224-1~deb11u1","bullseye-security":"120.0.6099.224-1~deb11u1"},"urgency":"end-of-life"},"forky":{"status":"resolved","repositories":{"forky":"145.0.7632.159-1"},"fixed_version":"127.0.6533.99-1","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"146.0.7680.71-1"},"fixed_version":"127.0.6533.99-1","urgency":"not yet assigned"},"trixie":{"status":"resolved","repositories":{"trixie":"143.0.7499.169-1~deb13u1","trixie-security":"145.0.7632.159-1~deb13u1"},"fixed_version":"127.0.6533.99-1","urgency":"not yet assigned"}}},"CVE-2024-7535":{"description":"Inappropriate implementation in V8 in Google Chrome prior to 127.0.6533.99 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. (Chromium security severity: High)","scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"143.0.7499.169-1~deb12u1","bookworm-security":"145.0.7632.159-1~deb12u1"},"fixed_version":"127.0.6533.99-1~deb12u1","urgency":"not yet assigned"},"bullseye":{"status":"open","repositories":{"bullseye":"120.0.6099.224-1~deb11u1","bullseye-security":"120.0.6099.224-1~deb11u1"},"urgency":"end-of-life"},"forky":{"status":"resolved","repositories":{"forky":"145.0.7632.159-1"},"fixed_version":"127.0.6533.99-1","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"146.0.7680.71-1"},"fixed_version":"127.0.6533.99-1","urgency":"not yet assigned"},"trixie":{"status":"resolved","repositories":{"trixie":"143.0.7499.169-1~deb13u1","trixie-security":"145.0.7632.159-1~deb13u1"},"fixed_version":"127.0.6533.99-1","urgency":"not yet assigned"}}},"CVE-2024-7536":{"description":"Use after free in WebAudio in Google Chrome prior to 127.0.6533.99 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. (Chromium security severity: High)","scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"143.0.7499.169-1~deb12u1","bookworm-security":"145.0.7632.159-1~deb12u1"},"fixed_version":"127.0.6533.99-1~deb12u1","urgency":"not yet assigned"},"bullseye":{"status":"open","repositories":{"bullseye":"120.0.6099.224-1~deb11u1","bullseye-security":"120.0.6099.224-1~deb11u1"},"urgency":"end-of-life"},"forky":{"status":"resolved","repositories":{"forky":"145.0.7632.159-1"},"fixed_version":"127.0.6533.99-1","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"146.0.7680.71-1"},"fixed_version":"127.0.6533.99-1","urgency":"not yet assigned"},"trixie":{"status":"resolved","repositories":{"trixie":"143.0.7499.169-1~deb13u1","trixie-security":"145.0.7632.159-1~deb13u1"},"fixed_version":"127.0.6533.99-1","urgency":"not yet assigned"}}},"CVE-2024-7550":{"description":"Type Confusion in V8 in Google Chrome prior to 127.0.6533.99 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. (Chromium security severity: High)","scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"143.0.7499.169-1~deb12u1","bookworm-security":"145.0.7632.159-1~deb12u1"},"fixed_version":"127.0.6533.99-1~deb12u1","urgency":"not yet assigned"},"bullseye":{"status":"open","repositories":{"bullseye":"120.0.6099.224-1~deb11u1","bullseye-security":"120.0.6099.224-1~deb11u1"},"urgency":"end-of-life"},"forky":{"status":"resolved","repositories":{"forky":"145.0.7632.159-1"},"fixed_version":"127.0.6533.99-1","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"146.0.7680.71-1"},"fixed_version":"127.0.6533.99-1","urgency":"not yet assigned"},"trixie":{"status":"resolved","repositories":{"trixie":"143.0.7499.169-1~deb13u1","trixie-security":"145.0.7632.159-1~deb13u1"},"fixed_version":"127.0.6533.99-1","urgency":"not yet assigned"}}},"CVE-2024-7964":{"description":"Use after free in Passwords in Google Chrome on Android prior to 128.0.6613.84 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. (Chromium security severity: High)","scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"143.0.7499.169-1~deb12u1","bookworm-security":"145.0.7632.159-1~deb12u1"},"fixed_version":"128.0.6613.84-1~deb12u1","urgency":"not yet assigned"},"bullseye":{"status":"open","repositories":{"bullseye":"120.0.6099.224-1~deb11u1","bullseye-security":"120.0.6099.224-1~deb11u1"},"urgency":"end-of-life"},"forky":{"status":"resolved","repositories":{"forky":"145.0.7632.159-1"},"fixed_version":"128.0.6613.84-1","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"146.0.7680.71-1"},"fixed_version":"128.0.6613.84-1","urgency":"not yet assigned"},"trixie":{"status":"resolved","repositories":{"trixie":"143.0.7499.169-1~deb13u1","trixie-security":"145.0.7632.159-1~deb13u1"},"fixed_version":"128.0.6613.84-1","urgency":"not yet assigned"}}},"CVE-2024-7965":{"description":"Inappropriate implementation in V8 in Google Chrome prior to 128.0.6613.84 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. (Chromium security severity: High)","scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"143.0.7499.169-1~deb12u1","bookworm-security":"145.0.7632.159-1~deb12u1"},"fixed_version":"128.0.6613.84-1~deb12u1","urgency":"not yet assigned"},"bullseye":{"status":"open","repositories":{"bullseye":"120.0.6099.224-1~deb11u1","bullseye-security":"120.0.6099.224-1~deb11u1"},"urgency":"end-of-life"},"forky":{"status":"resolved","repositories":{"forky":"145.0.7632.159-1"},"fixed_version":"128.0.6613.84-1","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"146.0.7680.71-1"},"fixed_version":"128.0.6613.84-1","urgency":"not yet assigned"},"trixie":{"status":"resolved","repositories":{"trixie":"143.0.7499.169-1~deb13u1","trixie-security":"145.0.7632.159-1~deb13u1"},"fixed_version":"128.0.6613.84-1","urgency":"not yet assigned"}}},"CVE-2024-7966":{"description":"Out of bounds memory access in Skia in Google Chrome prior to 128.0.6613.84 allowed a remote attacker who had compromised the renderer process to perform out of bounds memory access via a crafted HTML page. (Chromium security severity: High)","scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"143.0.7499.169-1~deb12u1","bookworm-security":"145.0.7632.159-1~deb12u1"},"fixed_version":"128.0.6613.84-1~deb12u1","urgency":"not yet assigned"},"bullseye":{"status":"open","repositories":{"bullseye":"120.0.6099.224-1~deb11u1","bullseye-security":"120.0.6099.224-1~deb11u1"},"urgency":"end-of-life"},"forky":{"status":"resolved","repositories":{"forky":"145.0.7632.159-1"},"fixed_version":"128.0.6613.84-1","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"146.0.7680.71-1"},"fixed_version":"128.0.6613.84-1","urgency":"not yet assigned"},"trixie":{"status":"resolved","repositories":{"trixie":"143.0.7499.169-1~deb13u1","trixie-security":"145.0.7632.159-1~deb13u1"},"fixed_version":"128.0.6613.84-1","urgency":"not yet assigned"}}},"CVE-2024-7967":{"description":"Heap buffer overflow in Fonts in Google Chrome prior to 128.0.6613.84 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. (Chromium security severity: High)","scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"143.0.7499.169-1~deb12u1","bookworm-security":"145.0.7632.159-1~deb12u1"},"fixed_version":"128.0.6613.84-1~deb12u1","urgency":"not yet assigned"},"bullseye":{"status":"open","repositories":{"bullseye":"120.0.6099.224-1~deb11u1","bullseye-security":"120.0.6099.224-1~deb11u1"},"urgency":"end-of-life"},"forky":{"status":"resolved","repositories":{"forky":"145.0.7632.159-1"},"fixed_version":"128.0.6613.84-1","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"146.0.7680.71-1"},"fixed_version":"128.0.6613.84-1","urgency":"not yet assigned"},"trixie":{"status":"resolved","repositories":{"trixie":"143.0.7499.169-1~deb13u1","trixie-security":"145.0.7632.159-1~deb13u1"},"fixed_version":"128.0.6613.84-1","urgency":"not yet assigned"}}},"CVE-2024-7968":{"description":"Use after free in Autofill in Google Chrome prior to 128.0.6613.84 allowed a remote attacker who had convinced the user to engage in specific UI interactions to potentially exploit heap corruption via a crafted HTML page. (Chromium security severity: High)","scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"143.0.7499.169-1~deb12u1","bookworm-security":"145.0.7632.159-1~deb12u1"},"fixed_version":"128.0.6613.84-1~deb12u1","urgency":"not yet assigned"},"bullseye":{"status":"open","repositories":{"bullseye":"120.0.6099.224-1~deb11u1","bullseye-security":"120.0.6099.224-1~deb11u1"},"urgency":"end-of-life"},"forky":{"status":"resolved","repositories":{"forky":"145.0.7632.159-1"},"fixed_version":"128.0.6613.84-1","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"146.0.7680.71-1"},"fixed_version":"128.0.6613.84-1","urgency":"not yet assigned"},"trixie":{"status":"resolved","repositories":{"trixie":"143.0.7499.169-1~deb13u1","trixie-security":"145.0.7632.159-1~deb13u1"},"fixed_version":"128.0.6613.84-1","urgency":"not yet assigned"}}},"CVE-2024-7969":{"description":"Type Confusion in V8 in Google Chrome prior to 128.0.6613.113 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. (Chromium security severity: High)","scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"143.0.7499.169-1~deb12u1","bookworm-security":"145.0.7632.159-1~deb12u1"},"fixed_version":"128.0.6613.113-1~deb12u1","urgency":"not yet assigned"},"bullseye":{"status":"open","repositories":{"bullseye":"120.0.6099.224-1~deb11u1","bullseye-security":"120.0.6099.224-1~deb11u1"},"urgency":"end-of-life"},"forky":{"status":"resolved","repositories":{"forky":"145.0.7632.159-1"},"fixed_version":"128.0.6613.113-1","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"146.0.7680.71-1"},"fixed_version":"128.0.6613.113-1","urgency":"not yet assigned"},"trixie":{"status":"resolved","repositories":{"trixie":"143.0.7499.169-1~deb13u1","trixie-security":"145.0.7632.159-1~deb13u1"},"fixed_version":"128.0.6613.113-1","urgency":"not yet assigned"}}},"CVE-2024-7970":{"description":"Out of bounds write in V8 in Google Chrome prior to 128.0.6613.119 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. (Chromium security severity: High)","scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"143.0.7499.169-1~deb12u1","bookworm-security":"145.0.7632.159-1~deb12u1"},"fixed_version":"128.0.6613.119-1~deb12u1","urgency":"not yet assigned"},"bullseye":{"status":"open","repositories":{"bullseye":"120.0.6099.224-1~deb11u1","bullseye-security":"120.0.6099.224-1~deb11u1"},"urgency":"end-of-life"},"forky":{"status":"resolved","repositories":{"forky":"145.0.7632.159-1"},"fixed_version":"128.0.6613.119-1","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"146.0.7680.71-1"},"fixed_version":"128.0.6613.119-1","urgency":"not yet assigned"},"trixie":{"status":"resolved","repositories":{"trixie":"143.0.7499.169-1~deb13u1","trixie-security":"145.0.7632.159-1~deb13u1"},"fixed_version":"128.0.6613.119-1","urgency":"not yet assigned"}}},"CVE-2024-7971":{"description":"Type confusion in V8 in Google Chrome prior to 128.0.6613.84 allowed a remote attacker to exploit heap corruption via a crafted HTML page. (Chromium security severity: High)","scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"143.0.7499.169-1~deb12u1","bookworm-security":"145.0.7632.159-1~deb12u1"},"fixed_version":"128.0.6613.84-1~deb12u1","urgency":"not yet assigned"},"bullseye":{"status":"open","repositories":{"bullseye":"120.0.6099.224-1~deb11u1","bullseye-security":"120.0.6099.224-1~deb11u1"},"urgency":"end-of-life"},"forky":{"status":"resolved","repositories":{"forky":"145.0.7632.159-1"},"fixed_version":"128.0.6613.84-1","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"146.0.7680.71-1"},"fixed_version":"128.0.6613.84-1","urgency":"not yet assigned"},"trixie":{"status":"resolved","repositories":{"trixie":"143.0.7499.169-1~deb13u1","trixie-security":"145.0.7632.159-1~deb13u1"},"fixed_version":"128.0.6613.84-1","urgency":"not yet assigned"}}},"CVE-2024-7972":{"description":"Inappropriate implementation in V8 in Google Chrome prior to 128.0.6613.84 allowed a remote attacker to potentially perform out of bounds memory access via a crafted HTML page. (Chromium security severity: Medium)","scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"143.0.7499.169-1~deb12u1","bookworm-security":"145.0.7632.159-1~deb12u1"},"fixed_version":"128.0.6613.84-1~deb12u1","urgency":"not yet assigned"},"bullseye":{"status":"open","repositories":{"bullseye":"120.0.6099.224-1~deb11u1","bullseye-security":"120.0.6099.224-1~deb11u1"},"urgency":"end-of-life"},"forky":{"status":"resolved","repositories":{"forky":"145.0.7632.159-1"},"fixed_version":"128.0.6613.84-1","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"146.0.7680.71-1"},"fixed_version":"128.0.6613.84-1","urgency":"not yet assigned"},"trixie":{"status":"resolved","repositories":{"trixie":"143.0.7499.169-1~deb13u1","trixie-security":"145.0.7632.159-1~deb13u1"},"fixed_version":"128.0.6613.84-1","urgency":"not yet assigned"}}},"CVE-2024-7973":{"description":"Heap buffer overflow in PDFium in Google Chrome prior to 128.0.6613.84 allowed a remote attacker to perform an out of bounds memory read via a crafted PDF file. (Chromium security severity: Medium)","scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"143.0.7499.169-1~deb12u1","bookworm-security":"145.0.7632.159-1~deb12u1"},"fixed_version":"128.0.6613.84-1~deb12u1","urgency":"not yet assigned"},"bullseye":{"status":"open","repositories":{"bullseye":"120.0.6099.224-1~deb11u1","bullseye-security":"120.0.6099.224-1~deb11u1"},"urgency":"end-of-life"},"forky":{"status":"resolved","repositories":{"forky":"145.0.7632.159-1"},"fixed_version":"128.0.6613.84-1","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"146.0.7680.71-1"},"fixed_version":"128.0.6613.84-1","urgency":"not yet assigned"},"trixie":{"status":"resolved","repositories":{"trixie":"143.0.7499.169-1~deb13u1","trixie-security":"145.0.7632.159-1~deb13u1"},"fixed_version":"128.0.6613.84-1","urgency":"not yet assigned"}}},"CVE-2024-7974":{"description":"Insufficient data validation in V8 API in Google Chrome prior to 128.0.6613.84 allowed a remote attacker to potentially exploit heap corruption via a crafted Chrome Extension. (Chromium security severity: Medium)","scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"143.0.7499.169-1~deb12u1","bookworm-security":"145.0.7632.159-1~deb12u1"},"fixed_version":"128.0.6613.84-1~deb12u1","urgency":"not yet assigned"},"bullseye":{"status":"open","repositories":{"bullseye":"120.0.6099.224-1~deb11u1","bullseye-security":"120.0.6099.224-1~deb11u1"},"urgency":"end-of-life"},"forky":{"status":"resolved","repositories":{"forky":"145.0.7632.159-1"},"fixed_version":"128.0.6613.84-1","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"146.0.7680.71-1"},"fixed_version":"128.0.6613.84-1","urgency":"not yet assigned"},"trixie":{"status":"resolved","repositories":{"trixie":"143.0.7499.169-1~deb13u1","trixie-security":"145.0.7632.159-1~deb13u1"},"fixed_version":"128.0.6613.84-1","urgency":"not yet assigned"}}},"CVE-2024-7975":{"description":"Inappropriate implementation in Permissions in Google Chrome prior to 128.0.6613.84 allowed a remote attacker to perform UI spoofing via a crafted HTML page. (Chromium security severity: Medium)","scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"143.0.7499.169-1~deb12u1","bookworm-security":"145.0.7632.159-1~deb12u1"},"fixed_version":"128.0.6613.84-1~deb12u1","urgency":"not yet assigned"},"bullseye":{"status":"open","repositories":{"bullseye":"120.0.6099.224-1~deb11u1","bullseye-security":"120.0.6099.224-1~deb11u1"},"urgency":"end-of-life"},"forky":{"status":"resolved","repositories":{"forky":"145.0.7632.159-1"},"fixed_version":"128.0.6613.84-1","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"146.0.7680.71-1"},"fixed_version":"128.0.6613.84-1","urgency":"not yet assigned"},"trixie":{"status":"resolved","repositories":{"trixie":"143.0.7499.169-1~deb13u1","trixie-security":"145.0.7632.159-1~deb13u1"},"fixed_version":"128.0.6613.84-1","urgency":"not yet assigned"}}},"CVE-2024-7976":{"description":"Inappropriate implementation in FedCM in Google Chrome prior to 128.0.6613.84 allowed a remote attacker to perform UI spoofing via a crafted HTML page. (Chromium security severity: Medium)","scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"143.0.7499.169-1~deb12u1","bookworm-security":"145.0.7632.159-1~deb12u1"},"fixed_version":"128.0.6613.84-1~deb12u1","urgency":"not yet assigned"},"bullseye":{"status":"open","repositories":{"bullseye":"120.0.6099.224-1~deb11u1","bullseye-security":"120.0.6099.224-1~deb11u1"},"urgency":"end-of-life"},"forky":{"status":"resolved","repositories":{"forky":"145.0.7632.159-1"},"fixed_version":"128.0.6613.84-1","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"146.0.7680.71-1"},"fixed_version":"128.0.6613.84-1","urgency":"not yet assigned"},"trixie":{"status":"resolved","repositories":{"trixie":"143.0.7499.169-1~deb13u1","trixie-security":"145.0.7632.159-1~deb13u1"},"fixed_version":"128.0.6613.84-1","urgency":"not yet assigned"}}},"CVE-2024-7977":{"description":"Insufficient data validation in Installer in Google Chrome on Windows prior to 128.0.6613.84 allowed a local attacker to perform privilege escalation via a malicious file. (Chromium security severity: Medium)","scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"143.0.7499.169-1~deb12u1","bookworm-security":"145.0.7632.159-1~deb12u1"},"fixed_version":"128.0.6613.84-1~deb12u1","urgency":"not yet assigned"},"bullseye":{"status":"open","repositories":{"bullseye":"120.0.6099.224-1~deb11u1","bullseye-security":"120.0.6099.224-1~deb11u1"},"urgency":"end-of-life"},"forky":{"status":"resolved","repositories":{"forky":"145.0.7632.159-1"},"fixed_version":"128.0.6613.84-1","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"146.0.7680.71-1"},"fixed_version":"128.0.6613.84-1","urgency":"not yet assigned"},"trixie":{"status":"resolved","repositories":{"trixie":"143.0.7499.169-1~deb13u1","trixie-security":"145.0.7632.159-1~deb13u1"},"fixed_version":"128.0.6613.84-1","urgency":"not yet assigned"}}},"CVE-2024-7978":{"description":"Insufficient policy enforcement in Data Transfer in Google Chrome prior to 128.0.6613.84 allowed a remote attacker who convinced a user to engage in specific UI gestures to leak cross-origin data via a crafted HTML page. (Chromium security severity: Medium)","scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"143.0.7499.169-1~deb12u1","bookworm-security":"145.0.7632.159-1~deb12u1"},"fixed_version":"128.0.6613.84-1~deb12u1","urgency":"not yet assigned"},"bullseye":{"status":"open","repositories":{"bullseye":"120.0.6099.224-1~deb11u1","bullseye-security":"120.0.6099.224-1~deb11u1"},"urgency":"end-of-life"},"forky":{"status":"resolved","repositories":{"forky":"145.0.7632.159-1"},"fixed_version":"128.0.6613.84-1","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"146.0.7680.71-1"},"fixed_version":"128.0.6613.84-1","urgency":"not yet assigned"},"trixie":{"status":"resolved","repositories":{"trixie":"143.0.7499.169-1~deb13u1","trixie-security":"145.0.7632.159-1~deb13u1"},"fixed_version":"128.0.6613.84-1","urgency":"not yet assigned"}}},"CVE-2024-7979":{"description":"Insufficient data validation in Installer in Google Chrome on Windows prior to 128.0.6613.84 allowed a local attacker to perform privilege escalation via a crafted symbolic link. (Chromium security severity: Medium)","scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"143.0.7499.169-1~deb12u1","bookworm-security":"145.0.7632.159-1~deb12u1"},"fixed_version":"128.0.6613.84-1~deb12u1","urgency":"not yet assigned"},"bullseye":{"status":"open","repositories":{"bullseye":"120.0.6099.224-1~deb11u1","bullseye-security":"120.0.6099.224-1~deb11u1"},"urgency":"end-of-life"},"forky":{"status":"resolved","repositories":{"forky":"145.0.7632.159-1"},"fixed_version":"128.0.6613.84-1","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"146.0.7680.71-1"},"fixed_version":"128.0.6613.84-1","urgency":"not yet assigned"},"trixie":{"status":"resolved","repositories":{"trixie":"143.0.7499.169-1~deb13u1","trixie-security":"145.0.7632.159-1~deb13u1"},"fixed_version":"128.0.6613.84-1","urgency":"not yet assigned"}}},"CVE-2024-7980":{"description":"Insufficient data validation in Installer in Google Chrome on Windows prior to 128.0.6613.84 allowed a local attacker to perform privilege escalation via a crafted symbolic link. (Chromium security severity: Medium)","scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"143.0.7499.169-1~deb12u1","bookworm-security":"145.0.7632.159-1~deb12u1"},"fixed_version":"128.0.6613.84-1~deb12u1","urgency":"not yet assigned"},"bullseye":{"status":"open","repositories":{"bullseye":"120.0.6099.224-1~deb11u1","bullseye-security":"120.0.6099.224-1~deb11u1"},"urgency":"end-of-life"},"forky":{"status":"resolved","repositories":{"forky":"145.0.7632.159-1"},"fixed_version":"128.0.6613.84-1","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"146.0.7680.71-1"},"fixed_version":"128.0.6613.84-1","urgency":"not yet assigned"},"trixie":{"status":"resolved","repositories":{"trixie":"143.0.7499.169-1~deb13u1","trixie-security":"145.0.7632.159-1~deb13u1"},"fixed_version":"128.0.6613.84-1","urgency":"not yet assigned"}}},"CVE-2024-7981":{"description":"Inappropriate implementation in Views in Google Chrome prior to 128.0.6613.84 allowed a remote attacker to perform UI spoofing via a crafted HTML page. (Chromium security severity: Low)","scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"143.0.7499.169-1~deb12u1","bookworm-security":"145.0.7632.159-1~deb12u1"},"fixed_version":"128.0.6613.84-1~deb12u1","urgency":"not yet assigned"},"bullseye":{"status":"open","repositories":{"bullseye":"120.0.6099.224-1~deb11u1","bullseye-security":"120.0.6099.224-1~deb11u1"},"urgency":"end-of-life"},"forky":{"status":"resolved","repositories":{"forky":"145.0.7632.159-1"},"fixed_version":"128.0.6613.84-1","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"146.0.7680.71-1"},"fixed_version":"128.0.6613.84-1","urgency":"not yet assigned"},"trixie":{"status":"resolved","repositories":{"trixie":"143.0.7499.169-1~deb13u1","trixie-security":"145.0.7632.159-1~deb13u1"},"fixed_version":"128.0.6613.84-1","urgency":"not yet assigned"}}},"CVE-2024-8033":{"description":"Inappropriate implementation in WebApp Installs in Google Chrome on Windows prior to 128.0.6613.84 allowed an attacker who convinced a user to install a malicious application to perform UI spoofing via a crafted HTML page. (Chromium security severity: Low)","scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"143.0.7499.169-1~deb12u1","bookworm-security":"145.0.7632.159-1~deb12u1"},"fixed_version":"128.0.6613.84-1~deb12u1","urgency":"not yet assigned"},"bullseye":{"status":"open","repositories":{"bullseye":"120.0.6099.224-1~deb11u1","bullseye-security":"120.0.6099.224-1~deb11u1"},"urgency":"end-of-life"},"forky":{"status":"resolved","repositories":{"forky":"145.0.7632.159-1"},"fixed_version":"128.0.6613.84-1","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"146.0.7680.71-1"},"fixed_version":"128.0.6613.84-1","urgency":"not yet assigned"},"trixie":{"status":"resolved","repositories":{"trixie":"143.0.7499.169-1~deb13u1","trixie-security":"145.0.7632.159-1~deb13u1"},"fixed_version":"128.0.6613.84-1","urgency":"not yet assigned"}}},"CVE-2024-8034":{"description":"Inappropriate implementation in Custom Tabs in Google Chrome on Android prior to 128.0.6613.84 allowed a remote attacker to perform UI spoofing via a crafted HTML page. (Chromium security severity: Low)","scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"143.0.7499.169-1~deb12u1","bookworm-security":"145.0.7632.159-1~deb12u1"},"fixed_version":"128.0.6613.84-1~deb12u1","urgency":"not yet assigned"},"bullseye":{"status":"open","repositories":{"bullseye":"120.0.6099.224-1~deb11u1","bullseye-security":"120.0.6099.224-1~deb11u1"},"urgency":"end-of-life"},"forky":{"status":"resolved","repositories":{"forky":"145.0.7632.159-1"},"fixed_version":"128.0.6613.84-1","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"146.0.7680.71-1"},"fixed_version":"128.0.6613.84-1","urgency":"not yet assigned"},"trixie":{"status":"resolved","repositories":{"trixie":"143.0.7499.169-1~deb13u1","trixie-security":"145.0.7632.159-1~deb13u1"},"fixed_version":"128.0.6613.84-1","urgency":"not yet assigned"}}},"CVE-2024-8035":{"description":"Inappropriate implementation in Extensions in Google Chrome on Windows prior to 128.0.6613.84 allowed a remote attacker to perform UI spoofing via a crafted HTML page. (Chromium security severity: Low)","scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"143.0.7499.169-1~deb12u1","bookworm-security":"145.0.7632.159-1~deb12u1"},"fixed_version":"128.0.6613.84-1~deb12u1","urgency":"not yet assigned"},"bullseye":{"status":"open","repositories":{"bullseye":"120.0.6099.224-1~deb11u1","bullseye-security":"120.0.6099.224-1~deb11u1"},"urgency":"end-of-life"},"forky":{"status":"resolved","repositories":{"forky":"145.0.7632.159-1"},"fixed_version":"128.0.6613.84-1","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"146.0.7680.71-1"},"fixed_version":"128.0.6613.84-1","urgency":"not yet assigned"},"trixie":{"status":"resolved","repositories":{"trixie":"143.0.7499.169-1~deb13u1","trixie-security":"145.0.7632.159-1~deb13u1"},"fixed_version":"128.0.6613.84-1","urgency":"not yet assigned"}}},"CVE-2024-8193":{"description":"Heap buffer overflow in Skia in Google Chrome prior to 128.0.6613.113 allowed a remote attacker who had compromised the renderer process to potentially exploit heap corruption via a crafted HTML page. (Chromium security severity: High)","scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"143.0.7499.169-1~deb12u1","bookworm-security":"145.0.7632.159-1~deb12u1"},"fixed_version":"128.0.6613.113-1~deb12u1","urgency":"not yet assigned"},"bullseye":{"status":"open","repositories":{"bullseye":"120.0.6099.224-1~deb11u1","bullseye-security":"120.0.6099.224-1~deb11u1"},"urgency":"end-of-life"},"forky":{"status":"resolved","repositories":{"forky":"145.0.7632.159-1"},"fixed_version":"128.0.6613.113-1","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"146.0.7680.71-1"},"fixed_version":"128.0.6613.113-1","urgency":"not yet assigned"},"trixie":{"status":"resolved","repositories":{"trixie":"143.0.7499.169-1~deb13u1","trixie-security":"145.0.7632.159-1~deb13u1"},"fixed_version":"128.0.6613.113-1","urgency":"not yet assigned"}}},"CVE-2024-8194":{"description":"Type Confusion in V8 in Google Chrome prior to 128.0.6613.113 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. (Chromium security severity: High)","scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"143.0.7499.169-1~deb12u1","bookworm-security":"145.0.7632.159-1~deb12u1"},"fixed_version":"128.0.6613.113-1~deb12u1","urgency":"not yet assigned"},"bullseye":{"status":"open","repositories":{"bullseye":"120.0.6099.224-1~deb11u1","bullseye-security":"120.0.6099.224-1~deb11u1"},"urgency":"end-of-life"},"forky":{"status":"resolved","repositories":{"forky":"145.0.7632.159-1"},"fixed_version":"128.0.6613.113-1","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"146.0.7680.71-1"},"fixed_version":"128.0.6613.113-1","urgency":"not yet assigned"},"trixie":{"status":"resolved","repositories":{"trixie":"143.0.7499.169-1~deb13u1","trixie-security":"145.0.7632.159-1~deb13u1"},"fixed_version":"128.0.6613.113-1","urgency":"not yet assigned"}}},"CVE-2024-8198":{"description":"Heap buffer overflow in Skia in Google Chrome prior to 128.0.6613.113 allowed a remote attacker who had compromised the renderer process to potentially exploit heap corruption via a crafted HTML page. (Chromium security severity: High)","scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"143.0.7499.169-1~deb12u1","bookworm-security":"145.0.7632.159-1~deb12u1"},"fixed_version":"128.0.6613.113-1~deb12u1","urgency":"not yet assigned"},"bullseye":{"status":"open","repositories":{"bullseye":"120.0.6099.224-1~deb11u1","bullseye-security":"120.0.6099.224-1~deb11u1"},"urgency":"end-of-life"},"forky":{"status":"resolved","repositories":{"forky":"145.0.7632.159-1"},"fixed_version":"128.0.6613.113-1","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"146.0.7680.71-1"},"fixed_version":"128.0.6613.113-1","urgency":"not yet assigned"},"trixie":{"status":"resolved","repositories":{"trixie":"143.0.7499.169-1~deb13u1","trixie-security":"145.0.7632.159-1~deb13u1"},"fixed_version":"128.0.6613.113-1","urgency":"not yet assigned"}}},"CVE-2024-8362":{"description":"Use after free in WebAudio in Google Chrome prior to 128.0.6613.119 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. (Chromium security severity: High)","scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"143.0.7499.169-1~deb12u1","bookworm-security":"145.0.7632.159-1~deb12u1"},"fixed_version":"128.0.6613.119-1~deb12u1","urgency":"not yet assigned"},"bullseye":{"status":"open","repositories":{"bullseye":"120.0.6099.224-1~deb11u1","bullseye-security":"120.0.6099.224-1~deb11u1"},"urgency":"end-of-life"},"forky":{"status":"resolved","repositories":{"forky":"145.0.7632.159-1"},"fixed_version":"128.0.6613.119-1","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"146.0.7680.71-1"},"fixed_version":"128.0.6613.119-1","urgency":"not yet assigned"},"trixie":{"status":"resolved","repositories":{"trixie":"143.0.7499.169-1~deb13u1","trixie-security":"145.0.7632.159-1~deb13u1"},"fixed_version":"128.0.6613.119-1","urgency":"not yet assigned"}}},"CVE-2024-8636":{"description":"Heap buffer overflow in Skia in Google Chrome prior to 128.0.6613.137 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. (Chromium security severity: High)","scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"143.0.7499.169-1~deb12u1","bookworm-security":"145.0.7632.159-1~deb12u1"},"fixed_version":"128.0.6613.137-1~deb12u1","urgency":"not yet assigned"},"bullseye":{"status":"open","repositories":{"bullseye":"120.0.6099.224-1~deb11u1","bullseye-security":"120.0.6099.224-1~deb11u1"},"urgency":"end-of-life"},"forky":{"status":"resolved","repositories":{"forky":"145.0.7632.159-1"},"fixed_version":"128.0.6613.137-1","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"146.0.7680.71-1"},"fixed_version":"128.0.6613.137-1","urgency":"not yet assigned"},"trixie":{"status":"resolved","repositories":{"trixie":"143.0.7499.169-1~deb13u1","trixie-security":"145.0.7632.159-1~deb13u1"},"fixed_version":"128.0.6613.137-1","urgency":"not yet assigned"}}},"CVE-2024-8637":{"description":"Use after free in Media Router in Google Chrome on Android prior to 128.0.6613.137 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. (Chromium security severity: High)","scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"143.0.7499.169-1~deb12u1","bookworm-security":"145.0.7632.159-1~deb12u1"},"fixed_version":"128.0.6613.137-1~deb12u1","urgency":"not yet assigned"},"bullseye":{"status":"open","repositories":{"bullseye":"120.0.6099.224-1~deb11u1","bullseye-security":"120.0.6099.224-1~deb11u1"},"urgency":"end-of-life"},"forky":{"status":"resolved","repositories":{"forky":"145.0.7632.159-1"},"fixed_version":"128.0.6613.137-1","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"146.0.7680.71-1"},"fixed_version":"128.0.6613.137-1","urgency":"not yet assigned"},"trixie":{"status":"resolved","repositories":{"trixie":"143.0.7499.169-1~deb13u1","trixie-security":"145.0.7632.159-1~deb13u1"},"fixed_version":"128.0.6613.137-1","urgency":"not yet assigned"}}},"CVE-2024-8638":{"description":"Type Confusion in V8 in Google Chrome prior to 128.0.6613.137 allowed a remote attacker to potentially exploit object corruption via a crafted HTML page. (Chromium security severity: High)","scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"143.0.7499.169-1~deb12u1","bookworm-security":"145.0.7632.159-1~deb12u1"},"fixed_version":"128.0.6613.137-1~deb12u1","urgency":"not yet assigned"},"bullseye":{"status":"open","repositories":{"bullseye":"120.0.6099.224-1~deb11u1","bullseye-security":"120.0.6099.224-1~deb11u1"},"urgency":"end-of-life"},"forky":{"status":"resolved","repositories":{"forky":"145.0.7632.159-1"},"fixed_version":"128.0.6613.137-1","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"146.0.7680.71-1"},"fixed_version":"128.0.6613.137-1","urgency":"not yet assigned"},"trixie":{"status":"resolved","repositories":{"trixie":"143.0.7499.169-1~deb13u1","trixie-security":"145.0.7632.159-1~deb13u1"},"fixed_version":"128.0.6613.137-1","urgency":"not yet assigned"}}},"CVE-2024-8639":{"description":"Use after free in Autofill in Google Chrome on Android prior to 128.0.6613.137 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. (Chromium security severity: High)","scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"143.0.7499.169-1~deb12u1","bookworm-security":"145.0.7632.159-1~deb12u1"},"fixed_version":"128.0.6613.137-1~deb12u1","urgency":"not yet assigned"},"bullseye":{"status":"open","repositories":{"bullseye":"120.0.6099.224-1~deb11u1","bullseye-security":"120.0.6099.224-1~deb11u1"},"urgency":"end-of-life"},"forky":{"status":"resolved","repositories":{"forky":"145.0.7632.159-1"},"fixed_version":"128.0.6613.137-1","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"146.0.7680.71-1"},"fixed_version":"128.0.6613.137-1","urgency":"not yet assigned"},"trixie":{"status":"resolved","repositories":{"trixie":"143.0.7499.169-1~deb13u1","trixie-security":"145.0.7632.159-1~deb13u1"},"fixed_version":"128.0.6613.137-1","urgency":"not yet assigned"}}},"CVE-2024-8904":{"description":"Type Confusion in V8 in Google Chrome prior to 129.0.6668.58 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. (Chromium security severity: High)","scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"143.0.7499.169-1~deb12u1","bookworm-security":"145.0.7632.159-1~deb12u1"},"fixed_version":"129.0.6668.58-1~deb12u1","urgency":"not yet assigned"},"bullseye":{"status":"open","repositories":{"bullseye":"120.0.6099.224-1~deb11u1","bullseye-security":"120.0.6099.224-1~deb11u1"},"urgency":"end-of-life"},"forky":{"status":"resolved","repositories":{"forky":"145.0.7632.159-1"},"fixed_version":"129.0.6668.58-1","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"146.0.7680.71-1"},"fixed_version":"129.0.6668.58-1","urgency":"not yet assigned"},"trixie":{"status":"resolved","repositories":{"trixie":"143.0.7499.169-1~deb13u1","trixie-security":"145.0.7632.159-1~deb13u1"},"fixed_version":"129.0.6668.58-1","urgency":"not yet assigned"}}},"CVE-2024-8905":{"description":"Inappropriate implementation in V8 in Google Chrome prior to 129.0.6668.58 allowed a remote attacker to potentially exploit stack corruption via a crafted HTML page. (Chromium security severity: Medium)","scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"143.0.7499.169-1~deb12u1","bookworm-security":"145.0.7632.159-1~deb12u1"},"fixed_version":"129.0.6668.58-1~deb12u1","urgency":"not yet assigned"},"bullseye":{"status":"open","repositories":{"bullseye":"120.0.6099.224-1~deb11u1","bullseye-security":"120.0.6099.224-1~deb11u1"},"urgency":"end-of-life"},"forky":{"status":"resolved","repositories":{"forky":"145.0.7632.159-1"},"fixed_version":"129.0.6668.58-1","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"146.0.7680.71-1"},"fixed_version":"129.0.6668.58-1","urgency":"not yet assigned"},"trixie":{"status":"resolved","repositories":{"trixie":"143.0.7499.169-1~deb13u1","trixie-security":"145.0.7632.159-1~deb13u1"},"fixed_version":"129.0.6668.58-1","urgency":"not yet assigned"}}},"CVE-2024-8906":{"description":"Incorrect security UI in Downloads in Google Chrome prior to 129.0.6668.58 allowed a remote attacker who convinced a user to engage in specific UI gestures to perform UI spoofing via a crafted HTML page. (Chromium security severity: Medium)","scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"143.0.7499.169-1~deb12u1","bookworm-security":"145.0.7632.159-1~deb12u1"},"fixed_version":"129.0.6668.58-1~deb12u1","urgency":"not yet assigned"},"bullseye":{"status":"open","repositories":{"bullseye":"120.0.6099.224-1~deb11u1","bullseye-security":"120.0.6099.224-1~deb11u1"},"urgency":"end-of-life"},"forky":{"status":"resolved","repositories":{"forky":"145.0.7632.159-1"},"fixed_version":"129.0.6668.58-1","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"146.0.7680.71-1"},"fixed_version":"129.0.6668.58-1","urgency":"not yet assigned"},"trixie":{"status":"resolved","repositories":{"trixie":"143.0.7499.169-1~deb13u1","trixie-security":"145.0.7632.159-1~deb13u1"},"fixed_version":"129.0.6668.58-1","urgency":"not yet assigned"}}},"CVE-2024-8907":{"description":"Insufficient data validation in Omnibox in Google Chrome on Android prior to 129.0.6668.58 allowed a remote attacker who convinced a user to engage in specific UI gestures to inject arbitrary scripts or HTML (XSS) via a crafted set of UI gestures. (Chromium security severity: Medium)","scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"143.0.7499.169-1~deb12u1","bookworm-security":"145.0.7632.159-1~deb12u1"},"fixed_version":"129.0.6668.58-1~deb12u1","urgency":"not yet assigned"},"bullseye":{"status":"open","repositories":{"bullseye":"120.0.6099.224-1~deb11u1","bullseye-security":"120.0.6099.224-1~deb11u1"},"urgency":"end-of-life"},"forky":{"status":"resolved","repositories":{"forky":"145.0.7632.159-1"},"fixed_version":"129.0.6668.58-1","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"146.0.7680.71-1"},"fixed_version":"129.0.6668.58-1","urgency":"not yet assigned"},"trixie":{"status":"resolved","repositories":{"trixie":"143.0.7499.169-1~deb13u1","trixie-security":"145.0.7632.159-1~deb13u1"},"fixed_version":"129.0.6668.58-1","urgency":"not yet assigned"}}},"CVE-2024-8908":{"description":"Inappropriate implementation in Autofill in Google Chrome prior to 129.0.6668.58 allowed a remote attacker to perform UI spoofing via a crafted HTML page. (Chromium security severity: Low)","scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"143.0.7499.169-1~deb12u1","bookworm-security":"145.0.7632.159-1~deb12u1"},"fixed_version":"129.0.6668.58-1~deb12u1","urgency":"not yet assigned"},"bullseye":{"status":"open","repositories":{"bullseye":"120.0.6099.224-1~deb11u1","bullseye-security":"120.0.6099.224-1~deb11u1"},"urgency":"end-of-life"},"forky":{"status":"resolved","repositories":{"forky":"145.0.7632.159-1"},"fixed_version":"129.0.6668.58-1","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"146.0.7680.71-1"},"fixed_version":"129.0.6668.58-1","urgency":"not yet assigned"},"trixie":{"status":"resolved","repositories":{"trixie":"143.0.7499.169-1~deb13u1","trixie-security":"145.0.7632.159-1~deb13u1"},"fixed_version":"129.0.6668.58-1","urgency":"not yet assigned"}}},"CVE-2024-8909":{"description":"Inappropriate implementation in UI in Google Chrome on iOS prior to 129.0.6668.58 allowed a remote attacker to perform UI spoofing via a crafted HTML page. (Chromium security severity: Low)","scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"143.0.7499.169-1~deb12u1","bookworm-security":"145.0.7632.159-1~deb12u1"},"fixed_version":"129.0.6668.58-1~deb12u1","urgency":"not yet assigned"},"bullseye":{"status":"open","repositories":{"bullseye":"120.0.6099.224-1~deb11u1","bullseye-security":"120.0.6099.224-1~deb11u1"},"urgency":"end-of-life"},"forky":{"status":"resolved","repositories":{"forky":"145.0.7632.159-1"},"fixed_version":"129.0.6668.58-1","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"146.0.7680.71-1"},"fixed_version":"129.0.6668.58-1","urgency":"not yet assigned"},"trixie":{"status":"resolved","repositories":{"trixie":"143.0.7499.169-1~deb13u1","trixie-security":"145.0.7632.159-1~deb13u1"},"fixed_version":"129.0.6668.58-1","urgency":"not yet assigned"}}},"CVE-2024-9120":{"description":"Use after free in Dawn in Google Chrome on Windows prior to 129.0.6668.70 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. (Chromium security severity: High)","scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"143.0.7499.169-1~deb12u1","bookworm-security":"145.0.7632.159-1~deb12u1"},"fixed_version":"129.0.6668.70-1~deb12u1","urgency":"not yet assigned"},"bullseye":{"status":"open","repositories":{"bullseye":"120.0.6099.224-1~deb11u1","bullseye-security":"120.0.6099.224-1~deb11u1"},"urgency":"end-of-life"},"forky":{"status":"resolved","repositories":{"forky":"145.0.7632.159-1"},"fixed_version":"129.0.6668.70-1","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"146.0.7680.71-1"},"fixed_version":"129.0.6668.70-1","urgency":"not yet assigned"},"trixie":{"status":"resolved","repositories":{"trixie":"143.0.7499.169-1~deb13u1","trixie-security":"145.0.7632.159-1~deb13u1"},"fixed_version":"129.0.6668.70-1","urgency":"not yet assigned"}}},"CVE-2024-9121":{"description":"Inappropriate implementation in V8 in Google Chrome prior to 129.0.6668.70 allowed a remote attacker to potentially perform out of bounds memory access via a crafted HTML page. (Chromium security severity: High)","scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"143.0.7499.169-1~deb12u1","bookworm-security":"145.0.7632.159-1~deb12u1"},"fixed_version":"129.0.6668.70-1~deb12u1","urgency":"not yet assigned"},"bullseye":{"status":"open","repositories":{"bullseye":"120.0.6099.224-1~deb11u1","bullseye-security":"120.0.6099.224-1~deb11u1"},"urgency":"end-of-life"},"forky":{"status":"resolved","repositories":{"forky":"145.0.7632.159-1"},"fixed_version":"129.0.6668.70-1","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"146.0.7680.71-1"},"fixed_version":"129.0.6668.70-1","urgency":"not yet assigned"},"trixie":{"status":"resolved","repositories":{"trixie":"143.0.7499.169-1~deb13u1","trixie-security":"145.0.7632.159-1~deb13u1"},"fixed_version":"129.0.6668.70-1","urgency":"not yet assigned"}}},"CVE-2024-9122":{"description":"Type Confusion in V8 in Google Chrome prior to 129.0.6668.70 allowed a remote attacker to perform out of bounds memory access via a crafted HTML page. (Chromium security severity: High)","scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"143.0.7499.169-1~deb12u1","bookworm-security":"145.0.7632.159-1~deb12u1"},"fixed_version":"129.0.6668.70-1~deb12u1","urgency":"not yet assigned"},"bullseye":{"status":"open","repositories":{"bullseye":"120.0.6099.224-1~deb11u1","bullseye-security":"120.0.6099.224-1~deb11u1"},"urgency":"end-of-life"},"forky":{"status":"resolved","repositories":{"forky":"145.0.7632.159-1"},"fixed_version":"129.0.6668.70-1","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"146.0.7680.71-1"},"fixed_version":"129.0.6668.70-1","urgency":"not yet assigned"},"trixie":{"status":"resolved","repositories":{"trixie":"143.0.7499.169-1~deb13u1","trixie-security":"145.0.7632.159-1~deb13u1"},"fixed_version":"129.0.6668.70-1","urgency":"not yet assigned"}}},"CVE-2024-9123":{"description":"Integer overflow in Skia in Google Chrome prior to 129.0.6668.70 allowed a remote attacker to perform an out of bounds memory write via a crafted HTML page. (Chromium security severity: High)","scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"143.0.7499.169-1~deb12u1","bookworm-security":"145.0.7632.159-1~deb12u1"},"fixed_version":"129.0.6668.70-1~deb12u1","urgency":"not yet assigned"},"bullseye":{"status":"open","repositories":{"bullseye":"120.0.6099.224-1~deb11u1","bullseye-security":"120.0.6099.224-1~deb11u1"},"urgency":"end-of-life"},"forky":{"status":"resolved","repositories":{"forky":"145.0.7632.159-1"},"fixed_version":"129.0.6668.70-1","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"146.0.7680.71-1"},"fixed_version":"129.0.6668.70-1","urgency":"not yet assigned"},"trixie":{"status":"resolved","repositories":{"trixie":"143.0.7499.169-1~deb13u1","trixie-security":"145.0.7632.159-1~deb13u1"},"fixed_version":"129.0.6668.70-1","urgency":"not yet assigned"}}},"CVE-2024-9126":{"description":"Use after free in Internals in Google Chrome on iOS prior to 127.0.6533.88 allowed a remote attacker who convinced a user to engage in specific UI gestures to potentially exploit heap corruption via a series of curated UI gestures. (Chromium security severity: Medium)","scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"143.0.7499.169-1~deb12u1","bookworm-security":"145.0.7632.159-1~deb12u1"},"fixed_version":"0","urgency":"unimportant"},"bullseye":{"status":"resolved","repositories":{"bullseye":"120.0.6099.224-1~deb11u1","bullseye-security":"120.0.6099.224-1~deb11u1"},"fixed_version":"0","urgency":"unimportant"},"forky":{"status":"resolved","repositories":{"forky":"145.0.7632.159-1"},"fixed_version":"0","urgency":"unimportant"},"sid":{"status":"resolved","repositories":{"sid":"146.0.7680.71-1"},"fixed_version":"0","urgency":"unimportant"},"trixie":{"status":"resolved","repositories":{"trixie":"143.0.7499.169-1~deb13u1","trixie-security":"145.0.7632.159-1~deb13u1"},"fixed_version":"0","urgency":"unimportant"}}},"CVE-2024-9369":{"description":"Insufficient data validation in Mojo in Google Chrome prior to 129.0.6668.89 allowed a remote attacker who had compromised the renderer process to perform an out of bounds memory write via a crafted HTML page. (Chromium security severity: High)","scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"143.0.7499.169-1~deb12u1","bookworm-security":"145.0.7632.159-1~deb12u1"},"fixed_version":"129.0.6668.89-1~deb12u1","urgency":"not yet assigned"},"bullseye":{"status":"open","repositories":{"bullseye":"120.0.6099.224-1~deb11u1","bullseye-security":"120.0.6099.224-1~deb11u1"},"urgency":"end-of-life"},"forky":{"status":"resolved","repositories":{"forky":"145.0.7632.159-1"},"fixed_version":"129.0.6668.89-1","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"146.0.7680.71-1"},"fixed_version":"129.0.6668.89-1","urgency":"not yet assigned"},"trixie":{"status":"resolved","repositories":{"trixie":"143.0.7499.169-1~deb13u1","trixie-security":"145.0.7632.159-1~deb13u1"},"fixed_version":"129.0.6668.89-1","urgency":"not yet assigned"}}},"CVE-2024-9370":{"releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"143.0.7499.169-1~deb12u1","bookworm-security":"145.0.7632.159-1~deb12u1"},"fixed_version":"129.0.6668.89-1~deb12u1","urgency":"not yet assigned"},"bullseye":{"status":"open","repositories":{"bullseye":"120.0.6099.224-1~deb11u1","bullseye-security":"120.0.6099.224-1~deb11u1"},"urgency":"end-of-life"},"forky":{"status":"resolved","repositories":{"forky":"145.0.7632.159-1"},"fixed_version":"129.0.6668.89-1","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"146.0.7680.71-1"},"fixed_version":"129.0.6668.89-1","urgency":"not yet assigned"},"trixie":{"status":"resolved","repositories":{"trixie":"143.0.7499.169-1~deb13u1","trixie-security":"145.0.7632.159-1~deb13u1"},"fixed_version":"129.0.6668.89-1","urgency":"not yet assigned"}}},"CVE-2024-9602":{"description":"Type Confusion in V8 in Google Chrome prior to 129.0.6668.100 allowed a remote attacker to perform an out of bounds memory write via a crafted HTML page. (Chromium security severity: High)","scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"143.0.7499.169-1~deb12u1","bookworm-security":"145.0.7632.159-1~deb12u1"},"fixed_version":"129.0.6668.100-1~deb12u1","urgency":"not yet assigned"},"bullseye":{"status":"open","repositories":{"bullseye":"120.0.6099.224-1~deb11u1","bullseye-security":"120.0.6099.224-1~deb11u1"},"urgency":"end-of-life"},"forky":{"status":"resolved","repositories":{"forky":"145.0.7632.159-1"},"fixed_version":"129.0.6668.100-1","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"146.0.7680.71-1"},"fixed_version":"129.0.6668.100-1","urgency":"not yet assigned"},"trixie":{"status":"resolved","repositories":{"trixie":"143.0.7499.169-1~deb13u1","trixie-security":"145.0.7632.159-1~deb13u1"},"fixed_version":"129.0.6668.100-1","urgency":"not yet assigned"}}},"CVE-2024-9603":{"description":"Type Confusion in V8 in Google Chrome prior to 129.0.6668.100 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. (Chromium security severity: High)","scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"143.0.7499.169-1~deb12u1","bookworm-security":"145.0.7632.159-1~deb12u1"},"fixed_version":"129.0.6668.100-1~deb12u1","urgency":"not yet assigned"},"bullseye":{"status":"open","repositories":{"bullseye":"120.0.6099.224-1~deb11u1","bullseye-security":"120.0.6099.224-1~deb11u1"},"urgency":"end-of-life"},"forky":{"status":"resolved","repositories":{"forky":"145.0.7632.159-1"},"fixed_version":"129.0.6668.100-1","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"146.0.7680.71-1"},"fixed_version":"129.0.6668.100-1","urgency":"not yet assigned"},"trixie":{"status":"resolved","repositories":{"trixie":"143.0.7499.169-1~deb13u1","trixie-security":"145.0.7632.159-1~deb13u1"},"fixed_version":"129.0.6668.100-1","urgency":"not yet assigned"}}},"CVE-2024-9859":{"description":"Type confusion in WebAssembly in Google Chrome prior to 126.0.6478.126 allowed a remote attacker to execute arbitrary code via a crafted HTML page. (Chromium security severity: High)","scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"143.0.7499.169-1~deb12u1","bookworm-security":"145.0.7632.159-1~deb12u1"},"fixed_version":"126.0.6478.126-1~deb12u1","urgency":"not yet assigned"},"bullseye":{"status":"open","repositories":{"bullseye":"120.0.6099.224-1~deb11u1","bullseye-security":"120.0.6099.224-1~deb11u1"},"urgency":"end-of-life"},"forky":{"status":"resolved","repositories":{"forky":"145.0.7632.159-1"},"fixed_version":"126.0.6478.126-1","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"146.0.7680.71-1"},"fixed_version":"126.0.6478.126-1","urgency":"not yet assigned"},"trixie":{"status":"resolved","repositories":{"trixie":"143.0.7499.169-1~deb13u1","trixie-security":"145.0.7632.159-1~deb13u1"},"fixed_version":"126.0.6478.126-1","urgency":"not yet assigned"}}},"CVE-2024-9954":{"description":"Use after free in AI in Google Chrome prior to 130.0.6723.58 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. (Chromium security severity: High)","scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"143.0.7499.169-1~deb12u1","bookworm-security":"145.0.7632.159-1~deb12u1"},"fixed_version":"130.0.6723.58-1~deb12u1","urgency":"not yet assigned"},"bullseye":{"status":"open","repositories":{"bullseye":"120.0.6099.224-1~deb11u1","bullseye-security":"120.0.6099.224-1~deb11u1"},"urgency":"end-of-life"},"forky":{"status":"resolved","repositories":{"forky":"145.0.7632.159-1"},"fixed_version":"130.0.6723.58-1","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"146.0.7680.71-1"},"fixed_version":"130.0.6723.58-1","urgency":"not yet assigned"},"trixie":{"status":"resolved","repositories":{"trixie":"143.0.7499.169-1~deb13u1","trixie-security":"145.0.7632.159-1~deb13u1"},"fixed_version":"130.0.6723.58-1","urgency":"not yet assigned"}}},"CVE-2024-9955":{"description":"Use after free in WebAuthentication in Google Chrome prior to 130.0.6723.58 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. (Chromium security severity: Medium)","scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"143.0.7499.169-1~deb12u1","bookworm-security":"145.0.7632.159-1~deb12u1"},"fixed_version":"130.0.6723.58-1~deb12u1","urgency":"not yet assigned"},"bullseye":{"status":"open","repositories":{"bullseye":"120.0.6099.224-1~deb11u1","bullseye-security":"120.0.6099.224-1~deb11u1"},"urgency":"end-of-life"},"forky":{"status":"resolved","repositories":{"forky":"145.0.7632.159-1"},"fixed_version":"130.0.6723.58-1","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"146.0.7680.71-1"},"fixed_version":"130.0.6723.58-1","urgency":"not yet assigned"},"trixie":{"status":"resolved","repositories":{"trixie":"143.0.7499.169-1~deb13u1","trixie-security":"145.0.7632.159-1~deb13u1"},"fixed_version":"130.0.6723.58-1","urgency":"not yet assigned"}}},"CVE-2024-9956":{"description":"Inappropriate implementation in WebAuthentication in Google Chrome on Android prior to 130.0.6723.58 allowed a local attacker to perform privilege escalation via a crafted HTML page. (Chromium security severity: Medium)","scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"143.0.7499.169-1~deb12u1","bookworm-security":"145.0.7632.159-1~deb12u1"},"fixed_version":"130.0.6723.58-1~deb12u1","urgency":"not yet assigned"},"bullseye":{"status":"open","repositories":{"bullseye":"120.0.6099.224-1~deb11u1","bullseye-security":"120.0.6099.224-1~deb11u1"},"urgency":"end-of-life"},"forky":{"status":"resolved","repositories":{"forky":"145.0.7632.159-1"},"fixed_version":"130.0.6723.58-1","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"146.0.7680.71-1"},"fixed_version":"130.0.6723.58-1","urgency":"not yet assigned"},"trixie":{"status":"resolved","repositories":{"trixie":"143.0.7499.169-1~deb13u1","trixie-security":"145.0.7632.159-1~deb13u1"},"fixed_version":"130.0.6723.58-1","urgency":"not yet assigned"}}},"CVE-2024-9957":{"description":"Use after free in UI in Google Chrome on iOS prior to 130.0.6723.58 allowed a remote attacker who convinced a user to engage in specific UI gestures to potentially exploit heap corruption via a crafted HTML page. (Chromium security severity: Medium)","scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"143.0.7499.169-1~deb12u1","bookworm-security":"145.0.7632.159-1~deb12u1"},"fixed_version":"130.0.6723.58-1~deb12u1","urgency":"not yet assigned"},"bullseye":{"status":"open","repositories":{"bullseye":"120.0.6099.224-1~deb11u1","bullseye-security":"120.0.6099.224-1~deb11u1"},"urgency":"end-of-life"},"forky":{"status":"resolved","repositories":{"forky":"145.0.7632.159-1"},"fixed_version":"130.0.6723.58-1","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"146.0.7680.71-1"},"fixed_version":"130.0.6723.58-1","urgency":"not yet assigned"},"trixie":{"status":"resolved","repositories":{"trixie":"143.0.7499.169-1~deb13u1","trixie-security":"145.0.7632.159-1~deb13u1"},"fixed_version":"130.0.6723.58-1","urgency":"not yet assigned"}}},"CVE-2024-9958":{"description":"Inappropriate implementation in PictureInPicture in Google Chrome prior to 130.0.6723.58 allowed a remote attacker to perform UI spoofing via a crafted HTML page. (Chromium security severity: Medium)","scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"143.0.7499.169-1~deb12u1","bookworm-security":"145.0.7632.159-1~deb12u1"},"fixed_version":"130.0.6723.58-1~deb12u1","urgency":"not yet assigned"},"bullseye":{"status":"open","repositories":{"bullseye":"120.0.6099.224-1~deb11u1","bullseye-security":"120.0.6099.224-1~deb11u1"},"urgency":"end-of-life"},"forky":{"status":"resolved","repositories":{"forky":"145.0.7632.159-1"},"fixed_version":"130.0.6723.58-1","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"146.0.7680.71-1"},"fixed_version":"130.0.6723.58-1","urgency":"not yet assigned"},"trixie":{"status":"resolved","repositories":{"trixie":"143.0.7499.169-1~deb13u1","trixie-security":"145.0.7632.159-1~deb13u1"},"fixed_version":"130.0.6723.58-1","urgency":"not yet assigned"}}},"CVE-2024-9959":{"description":"Use after free in DevTools in Google Chrome prior to 130.0.6723.58 allowed a remote attacker who had compromised the renderer process to potentially exploit heap corruption via a crafted Chrome Extension. (Chromium security severity: Medium)","scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"143.0.7499.169-1~deb12u1","bookworm-security":"145.0.7632.159-1~deb12u1"},"fixed_version":"130.0.6723.58-1~deb12u1","urgency":"not yet assigned"},"bullseye":{"status":"open","repositories":{"bullseye":"120.0.6099.224-1~deb11u1","bullseye-security":"120.0.6099.224-1~deb11u1"},"urgency":"end-of-life"},"forky":{"status":"resolved","repositories":{"forky":"145.0.7632.159-1"},"fixed_version":"130.0.6723.58-1","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"146.0.7680.71-1"},"fixed_version":"130.0.6723.58-1","urgency":"not yet assigned"},"trixie":{"status":"resolved","repositories":{"trixie":"143.0.7499.169-1~deb13u1","trixie-security":"145.0.7632.159-1~deb13u1"},"fixed_version":"130.0.6723.58-1","urgency":"not yet assigned"}}},"CVE-2024-9960":{"description":"Use after free in Dawn in Google Chrome prior to 130.0.6723.58 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. (Chromium security severity: Medium)","scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"143.0.7499.169-1~deb12u1","bookworm-security":"145.0.7632.159-1~deb12u1"},"fixed_version":"130.0.6723.58-1~deb12u1","urgency":"not yet assigned"},"bullseye":{"status":"open","repositories":{"bullseye":"120.0.6099.224-1~deb11u1","bullseye-security":"120.0.6099.224-1~deb11u1"},"urgency":"end-of-life"},"forky":{"status":"resolved","repositories":{"forky":"145.0.7632.159-1"},"fixed_version":"130.0.6723.58-1","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"146.0.7680.71-1"},"fixed_version":"130.0.6723.58-1","urgency":"not yet assigned"},"trixie":{"status":"resolved","repositories":{"trixie":"143.0.7499.169-1~deb13u1","trixie-security":"145.0.7632.159-1~deb13u1"},"fixed_version":"130.0.6723.58-1","urgency":"not yet assigned"}}},"CVE-2024-9961":{"description":"Use after free in ParcelTracking in Google Chrome on iOS prior to 130.0.6723.58 allowed a remote attacker who convinced a user to engage in specific UI gestures to potentially exploit heap corruption via a crafted HTML page. (Chromium security severity: Medium)","scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"143.0.7499.169-1~deb12u1","bookworm-security":"145.0.7632.159-1~deb12u1"},"fixed_version":"130.0.6723.58-1~deb12u1","urgency":"not yet assigned"},"bullseye":{"status":"open","repositories":{"bullseye":"120.0.6099.224-1~deb11u1","bullseye-security":"120.0.6099.224-1~deb11u1"},"urgency":"end-of-life"},"forky":{"status":"resolved","repositories":{"forky":"145.0.7632.159-1"},"fixed_version":"130.0.6723.58-1","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"146.0.7680.71-1"},"fixed_version":"130.0.6723.58-1","urgency":"not yet assigned"},"trixie":{"status":"resolved","repositories":{"trixie":"143.0.7499.169-1~deb13u1","trixie-security":"145.0.7632.159-1~deb13u1"},"fixed_version":"130.0.6723.58-1","urgency":"not yet assigned"}}},"CVE-2024-9962":{"description":"Inappropriate implementation in Permissions in Google Chrome prior to 130.0.6723.58 allowed a remote attacker who convinced a user to engage in specific UI gestures to perform UI spoofing via a crafted HTML page. (Chromium security severity: Medium)","scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"143.0.7499.169-1~deb12u1","bookworm-security":"145.0.7632.159-1~deb12u1"},"fixed_version":"130.0.6723.58-1~deb12u1","urgency":"not yet assigned"},"bullseye":{"status":"open","repositories":{"bullseye":"120.0.6099.224-1~deb11u1","bullseye-security":"120.0.6099.224-1~deb11u1"},"urgency":"end-of-life"},"forky":{"status":"resolved","repositories":{"forky":"145.0.7632.159-1"},"fixed_version":"130.0.6723.58-1","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"146.0.7680.71-1"},"fixed_version":"130.0.6723.58-1","urgency":"not yet assigned"},"trixie":{"status":"resolved","repositories":{"trixie":"143.0.7499.169-1~deb13u1","trixie-security":"145.0.7632.159-1~deb13u1"},"fixed_version":"130.0.6723.58-1","urgency":"not yet assigned"}}},"CVE-2024-9963":{"description":"Insufficient data validation in Downloads in Google Chrome prior to 130.0.6723.58 allowed a remote attacker who convinced a user to engage in specific UI gestures to perform UI spoofing via a crafted HTML page. (Chromium security severity: Medium)","scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"143.0.7499.169-1~deb12u1","bookworm-security":"145.0.7632.159-1~deb12u1"},"fixed_version":"130.0.6723.58-1~deb12u1","urgency":"not yet assigned"},"bullseye":{"status":"open","repositories":{"bullseye":"120.0.6099.224-1~deb11u1","bullseye-security":"120.0.6099.224-1~deb11u1"},"urgency":"end-of-life"},"forky":{"status":"resolved","repositories":{"forky":"145.0.7632.159-1"},"fixed_version":"130.0.6723.58-1","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"146.0.7680.71-1"},"fixed_version":"130.0.6723.58-1","urgency":"not yet assigned"},"trixie":{"status":"resolved","repositories":{"trixie":"143.0.7499.169-1~deb13u1","trixie-security":"145.0.7632.159-1~deb13u1"},"fixed_version":"130.0.6723.58-1","urgency":"not yet assigned"}}},"CVE-2024-9964":{"description":"Inappropriate implementation in Payments in Google Chrome prior to 130.0.6723.58 allowed a remote attacker who convinced a user to engage in specific UI gestures to perform UI spoofing via a crafted Chrome Extension. (Chromium security severity: Low)","scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"143.0.7499.169-1~deb12u1","bookworm-security":"145.0.7632.159-1~deb12u1"},"fixed_version":"130.0.6723.58-1~deb12u1","urgency":"not yet assigned"},"bullseye":{"status":"open","repositories":{"bullseye":"120.0.6099.224-1~deb11u1","bullseye-security":"120.0.6099.224-1~deb11u1"},"urgency":"end-of-life"},"forky":{"status":"resolved","repositories":{"forky":"145.0.7632.159-1"},"fixed_version":"130.0.6723.58-1","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"146.0.7680.71-1"},"fixed_version":"130.0.6723.58-1","urgency":"not yet assigned"},"trixie":{"status":"resolved","repositories":{"trixie":"143.0.7499.169-1~deb13u1","trixie-security":"145.0.7632.159-1~deb13u1"},"fixed_version":"130.0.6723.58-1","urgency":"not yet assigned"}}},"CVE-2024-9965":{"description":"Insufficient data validation in DevTools in Google Chrome on Windows prior to 130.0.6723.58 allowed a remote attacker who convinced a user to engage in specific UI gestures to execute arbitrary code via a crafted HTML page. (Chromium security severity: Low)","scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"143.0.7499.169-1~deb12u1","bookworm-security":"145.0.7632.159-1~deb12u1"},"fixed_version":"130.0.6723.58-1~deb12u1","urgency":"not yet assigned"},"bullseye":{"status":"open","repositories":{"bullseye":"120.0.6099.224-1~deb11u1","bullseye-security":"120.0.6099.224-1~deb11u1"},"urgency":"end-of-life"},"forky":{"status":"resolved","repositories":{"forky":"145.0.7632.159-1"},"fixed_version":"130.0.6723.58-1","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"146.0.7680.71-1"},"fixed_version":"130.0.6723.58-1","urgency":"not yet assigned"},"trixie":{"status":"resolved","repositories":{"trixie":"143.0.7499.169-1~deb13u1","trixie-security":"145.0.7632.159-1~deb13u1"},"fixed_version":"130.0.6723.58-1","urgency":"not yet assigned"}}},"CVE-2024-9966":{"description":"Inappropriate implementation in Navigations in Google Chrome prior to 130.0.6723.58 allowed a remote attacker to bypass content security policy via a crafted HTML page. (Chromium security severity: Low)","scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"143.0.7499.169-1~deb12u1","bookworm-security":"145.0.7632.159-1~deb12u1"},"fixed_version":"130.0.6723.58-1~deb12u1","urgency":"not yet assigned"},"bullseye":{"status":"open","repositories":{"bullseye":"120.0.6099.224-1~deb11u1","bullseye-security":"120.0.6099.224-1~deb11u1"},"urgency":"end-of-life"},"forky":{"status":"resolved","repositories":{"forky":"145.0.7632.159-1"},"fixed_version":"130.0.6723.58-1","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"146.0.7680.71-1"},"fixed_version":"130.0.6723.58-1","urgency":"not yet assigned"},"trixie":{"status":"resolved","repositories":{"trixie":"143.0.7499.169-1~deb13u1","trixie-security":"145.0.7632.159-1~deb13u1"},"fixed_version":"130.0.6723.58-1","urgency":"not yet assigned"}}},"CVE-2025-0291":{"description":"Type Confusion in V8 in Google Chrome prior to 131.0.6778.264 allowed a remote attacker to execute arbitrary code inside a sandbox via a crafted HTML page. (Chromium security severity: High)","scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"143.0.7499.169-1~deb12u1","bookworm-security":"145.0.7632.159-1~deb12u1"},"fixed_version":"131.0.6778.264-1~deb12u1","urgency":"not yet assigned"},"bullseye":{"status":"open","repositories":{"bullseye":"120.0.6099.224-1~deb11u1","bullseye-security":"120.0.6099.224-1~deb11u1"},"urgency":"end-of-life"},"forky":{"status":"resolved","repositories":{"forky":"145.0.7632.159-1"},"fixed_version":"131.0.6778.264-1","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"146.0.7680.71-1"},"fixed_version":"131.0.6778.264-1","urgency":"not yet assigned"},"trixie":{"status":"resolved","repositories":{"trixie":"143.0.7499.169-1~deb13u1","trixie-security":"145.0.7632.159-1~deb13u1"},"fixed_version":"131.0.6778.264-1","urgency":"not yet assigned"}}},"CVE-2025-0434":{"description":"Out of bounds memory access in V8 in Google Chrome prior to 132.0.6834.83 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. (Chromium security severity: High)","scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"143.0.7499.169-1~deb12u1","bookworm-security":"145.0.7632.159-1~deb12u1"},"fixed_version":"132.0.6834.83-1~deb12u1","urgency":"not yet assigned"},"bullseye":{"status":"open","repositories":{"bullseye":"120.0.6099.224-1~deb11u1","bullseye-security":"120.0.6099.224-1~deb11u1"},"urgency":"end-of-life"},"forky":{"status":"resolved","repositories":{"forky":"145.0.7632.159-1"},"fixed_version":"132.0.6834.83-1","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"146.0.7680.71-1"},"fixed_version":"132.0.6834.83-1","urgency":"not yet assigned"},"trixie":{"status":"resolved","repositories":{"trixie":"143.0.7499.169-1~deb13u1","trixie-security":"145.0.7632.159-1~deb13u1"},"fixed_version":"132.0.6834.83-1","urgency":"not yet assigned"}}},"CVE-2025-0435":{"description":"Inappropriate implementation in Navigation in Google Chrome on Android prior to 132.0.6834.83 allowed a remote attacker to perform UI spoofing via a crafted HTML page. (Chromium security severity: High)","scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"143.0.7499.169-1~deb12u1","bookworm-security":"145.0.7632.159-1~deb12u1"},"fixed_version":"132.0.6834.83-1~deb12u1","urgency":"not yet assigned"},"bullseye":{"status":"open","repositories":{"bullseye":"120.0.6099.224-1~deb11u1","bullseye-security":"120.0.6099.224-1~deb11u1"},"urgency":"end-of-life"},"forky":{"status":"resolved","repositories":{"forky":"145.0.7632.159-1"},"fixed_version":"132.0.6834.83-1","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"146.0.7680.71-1"},"fixed_version":"132.0.6834.83-1","urgency":"not yet assigned"},"trixie":{"status":"resolved","repositories":{"trixie":"143.0.7499.169-1~deb13u1","trixie-security":"145.0.7632.159-1~deb13u1"},"fixed_version":"132.0.6834.83-1","urgency":"not yet assigned"}}},"CVE-2025-0436":{"description":"Integer overflow in Skia in Google Chrome prior to 132.0.6834.83 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. (Chromium security severity: High)","scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"143.0.7499.169-1~deb12u1","bookworm-security":"145.0.7632.159-1~deb12u1"},"fixed_version":"132.0.6834.83-1~deb12u1","urgency":"not yet assigned"},"bullseye":{"status":"open","repositories":{"bullseye":"120.0.6099.224-1~deb11u1","bullseye-security":"120.0.6099.224-1~deb11u1"},"urgency":"end-of-life"},"forky":{"status":"resolved","repositories":{"forky":"145.0.7632.159-1"},"fixed_version":"132.0.6834.83-1","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"146.0.7680.71-1"},"fixed_version":"132.0.6834.83-1","urgency":"not yet assigned"},"trixie":{"status":"resolved","repositories":{"trixie":"143.0.7499.169-1~deb13u1","trixie-security":"145.0.7632.159-1~deb13u1"},"fixed_version":"132.0.6834.83-1","urgency":"not yet assigned"}}},"CVE-2025-0437":{"description":"Out of bounds read in Metrics in Google Chrome prior to 132.0.6834.83 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. (Chromium security severity: High)","scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"143.0.7499.169-1~deb12u1","bookworm-security":"145.0.7632.159-1~deb12u1"},"fixed_version":"132.0.6834.83-1~deb12u1","urgency":"not yet assigned"},"bullseye":{"status":"open","repositories":{"bullseye":"120.0.6099.224-1~deb11u1","bullseye-security":"120.0.6099.224-1~deb11u1"},"urgency":"end-of-life"},"forky":{"status":"resolved","repositories":{"forky":"145.0.7632.159-1"},"fixed_version":"132.0.6834.83-1","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"146.0.7680.71-1"},"fixed_version":"132.0.6834.83-1","urgency":"not yet assigned"},"trixie":{"status":"resolved","repositories":{"trixie":"143.0.7499.169-1~deb13u1","trixie-security":"145.0.7632.159-1~deb13u1"},"fixed_version":"132.0.6834.83-1","urgency":"not yet assigned"}}},"CVE-2025-0438":{"description":"Stack buffer overflow in Tracing in Google Chrome prior to 132.0.6834.83 allowed a remote attacker to potentially exploit stack corruption via a crafted HTML page. (Chromium security severity: High)","scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"143.0.7499.169-1~deb12u1","bookworm-security":"145.0.7632.159-1~deb12u1"},"fixed_version":"132.0.6834.83-1~deb12u1","urgency":"not yet assigned"},"bullseye":{"status":"open","repositories":{"bullseye":"120.0.6099.224-1~deb11u1","bullseye-security":"120.0.6099.224-1~deb11u1"},"urgency":"end-of-life"},"forky":{"status":"resolved","repositories":{"forky":"145.0.7632.159-1"},"fixed_version":"132.0.6834.83-1","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"146.0.7680.71-1"},"fixed_version":"132.0.6834.83-1","urgency":"not yet assigned"},"trixie":{"status":"resolved","repositories":{"trixie":"143.0.7499.169-1~deb13u1","trixie-security":"145.0.7632.159-1~deb13u1"},"fixed_version":"132.0.6834.83-1","urgency":"not yet assigned"}}},"CVE-2025-0439":{"description":"Race in Frames in Google Chrome prior to 132.0.6834.83 allowed a remote attacker who convinced a user to engage in specific UI gestures to perform UI spoofing via a crafted HTML page. (Chromium security severity: Medium)","scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"143.0.7499.169-1~deb12u1","bookworm-security":"145.0.7632.159-1~deb12u1"},"fixed_version":"132.0.6834.83-1~deb12u1","urgency":"not yet assigned"},"bullseye":{"status":"open","repositories":{"bullseye":"120.0.6099.224-1~deb11u1","bullseye-security":"120.0.6099.224-1~deb11u1"},"urgency":"end-of-life"},"forky":{"status":"resolved","repositories":{"forky":"145.0.7632.159-1"},"fixed_version":"132.0.6834.83-1","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"146.0.7680.71-1"},"fixed_version":"132.0.6834.83-1","urgency":"not yet assigned"},"trixie":{"status":"resolved","repositories":{"trixie":"143.0.7499.169-1~deb13u1","trixie-security":"145.0.7632.159-1~deb13u1"},"fixed_version":"132.0.6834.83-1","urgency":"not yet assigned"}}},"CVE-2025-0440":{"description":"Inappropriate implementation in Fullscreen in Google Chrome on Windows prior to 132.0.6834.83 allowed a remote attacker to perform UI spoofing via a crafted HTML page. (Chromium security severity: Medium)","scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"143.0.7499.169-1~deb12u1","bookworm-security":"145.0.7632.159-1~deb12u1"},"fixed_version":"132.0.6834.83-1~deb12u1","urgency":"not yet assigned"},"bullseye":{"status":"open","repositories":{"bullseye":"120.0.6099.224-1~deb11u1","bullseye-security":"120.0.6099.224-1~deb11u1"},"urgency":"end-of-life"},"forky":{"status":"resolved","repositories":{"forky":"145.0.7632.159-1"},"fixed_version":"132.0.6834.83-1","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"146.0.7680.71-1"},"fixed_version":"132.0.6834.83-1","urgency":"not yet assigned"},"trixie":{"status":"resolved","repositories":{"trixie":"143.0.7499.169-1~deb13u1","trixie-security":"145.0.7632.159-1~deb13u1"},"fixed_version":"132.0.6834.83-1","urgency":"not yet assigned"}}},"CVE-2025-0441":{"description":"Inappropriate implementation in Fenced Frames in Google Chrome prior to 132.0.6834.83 allowed a remote attacker to obtain potentially sensitive information from the system via a crafted HTML page. (Chromium security severity: Medium)","scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"143.0.7499.169-1~deb12u1","bookworm-security":"145.0.7632.159-1~deb12u1"},"fixed_version":"132.0.6834.83-1~deb12u1","urgency":"not yet assigned"},"bullseye":{"status":"open","repositories":{"bullseye":"120.0.6099.224-1~deb11u1","bullseye-security":"120.0.6099.224-1~deb11u1"},"urgency":"end-of-life"},"forky":{"status":"resolved","repositories":{"forky":"145.0.7632.159-1"},"fixed_version":"132.0.6834.83-1","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"146.0.7680.71-1"},"fixed_version":"132.0.6834.83-1","urgency":"not yet assigned"},"trixie":{"status":"resolved","repositories":{"trixie":"143.0.7499.169-1~deb13u1","trixie-security":"145.0.7632.159-1~deb13u1"},"fixed_version":"132.0.6834.83-1","urgency":"not yet assigned"}}},"CVE-2025-0442":{"description":"Inappropriate implementation in Payments in Google Chrome prior to 132.0.6834.83 allowed a remote attacker who convinced a user to engage in specific UI gestures to perform UI spoofing via a crafted HTML page. (Chromium security severity: Medium)","scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"143.0.7499.169-1~deb12u1","bookworm-security":"145.0.7632.159-1~deb12u1"},"fixed_version":"132.0.6834.83-1~deb12u1","urgency":"not yet assigned"},"bullseye":{"status":"open","repositories":{"bullseye":"120.0.6099.224-1~deb11u1","bullseye-security":"120.0.6099.224-1~deb11u1"},"urgency":"end-of-life"},"forky":{"status":"resolved","repositories":{"forky":"145.0.7632.159-1"},"fixed_version":"132.0.6834.83-1","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"146.0.7680.71-1"},"fixed_version":"132.0.6834.83-1","urgency":"not yet assigned"},"trixie":{"status":"resolved","repositories":{"trixie":"143.0.7499.169-1~deb13u1","trixie-security":"145.0.7632.159-1~deb13u1"},"fixed_version":"132.0.6834.83-1","urgency":"not yet assigned"}}},"CVE-2025-0443":{"description":"Insufficient data validation in Extensions in Google Chrome prior to 132.0.6834.83 allowed a remote attacker who convinced a user to engage in specific UI gestures to perform privilege escalation via a crafted HTML page. (Chromium security severity: Medium)","scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"143.0.7499.169-1~deb12u1","bookworm-security":"145.0.7632.159-1~deb12u1"},"fixed_version":"132.0.6834.83-1~deb12u1","urgency":"not yet assigned"},"bullseye":{"status":"open","repositories":{"bullseye":"120.0.6099.224-1~deb11u1","bullseye-security":"120.0.6099.224-1~deb11u1"},"urgency":"end-of-life"},"forky":{"status":"resolved","repositories":{"forky":"145.0.7632.159-1"},"fixed_version":"132.0.6834.83-1","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"146.0.7680.71-1"},"fixed_version":"132.0.6834.83-1","urgency":"not yet assigned"},"trixie":{"status":"resolved","repositories":{"trixie":"143.0.7499.169-1~deb13u1","trixie-security":"145.0.7632.159-1~deb13u1"},"fixed_version":"132.0.6834.83-1","urgency":"not yet assigned"}}},"CVE-2025-0444":{"description":"Use after free in Skia in Google Chrome prior to 133.0.6943.53 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. (Chromium security severity: High)","scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"143.0.7499.169-1~deb12u1","bookworm-security":"145.0.7632.159-1~deb12u1"},"fixed_version":"133.0.6943.53-1~deb12u1","urgency":"not yet assigned"},"bullseye":{"status":"open","repositories":{"bullseye":"120.0.6099.224-1~deb11u1","bullseye-security":"120.0.6099.224-1~deb11u1"},"urgency":"end-of-life"},"forky":{"status":"resolved","repositories":{"forky":"145.0.7632.159-1"},"fixed_version":"133.0.6943.53-1","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"146.0.7680.71-1"},"fixed_version":"133.0.6943.53-1","urgency":"not yet assigned"},"trixie":{"status":"resolved","repositories":{"trixie":"143.0.7499.169-1~deb13u1","trixie-security":"145.0.7632.159-1~deb13u1"},"fixed_version":"133.0.6943.53-1","urgency":"not yet assigned"}}},"CVE-2025-0445":{"description":"Use after free in V8 in Google Chrome prior to 133.0.6943.53 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. (Chromium security severity: High)","scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"143.0.7499.169-1~deb12u1","bookworm-security":"145.0.7632.159-1~deb12u1"},"fixed_version":"133.0.6943.53-1~deb12u1","urgency":"not yet assigned"},"bullseye":{"status":"open","repositories":{"bullseye":"120.0.6099.224-1~deb11u1","bullseye-security":"120.0.6099.224-1~deb11u1"},"urgency":"end-of-life"},"forky":{"status":"resolved","repositories":{"forky":"145.0.7632.159-1"},"fixed_version":"133.0.6943.53-1","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"146.0.7680.71-1"},"fixed_version":"133.0.6943.53-1","urgency":"not yet assigned"},"trixie":{"status":"resolved","repositories":{"trixie":"143.0.7499.169-1~deb13u1","trixie-security":"145.0.7632.159-1~deb13u1"},"fixed_version":"133.0.6943.53-1","urgency":"not yet assigned"}}},"CVE-2025-0446":{"description":"Inappropriate implementation in Extensions in Google Chrome prior to 132.0.6834.83 allowed a remote attacker who convinced a user to engage in specific UI gestures to perform UI spoofing via a crafted Chrome Extension. (Chromium security severity: Low)","scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"143.0.7499.169-1~deb12u1","bookworm-security":"145.0.7632.159-1~deb12u1"},"fixed_version":"132.0.6834.83-1~deb12u1","urgency":"not yet assigned"},"bullseye":{"status":"open","repositories":{"bullseye":"120.0.6099.224-1~deb11u1","bullseye-security":"120.0.6099.224-1~deb11u1"},"urgency":"end-of-life"},"forky":{"status":"resolved","repositories":{"forky":"145.0.7632.159-1"},"fixed_version":"132.0.6834.83-1","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"146.0.7680.71-1"},"fixed_version":"132.0.6834.83-1","urgency":"not yet assigned"},"trixie":{"status":"resolved","repositories":{"trixie":"143.0.7499.169-1~deb13u1","trixie-security":"145.0.7632.159-1~deb13u1"},"fixed_version":"132.0.6834.83-1","urgency":"not yet assigned"}}},"CVE-2025-0447":{"description":"Inappropriate implementation in Navigation in Google Chrome prior to 132.0.6834.83 allowed a remote attacker to perform privilege escalation via a crafted HTML page. (Chromium security severity: Low)","scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"143.0.7499.169-1~deb12u1","bookworm-security":"145.0.7632.159-1~deb12u1"},"fixed_version":"132.0.6834.83-1~deb12u1","urgency":"not yet assigned"},"bullseye":{"status":"open","repositories":{"bullseye":"120.0.6099.224-1~deb11u1","bullseye-security":"120.0.6099.224-1~deb11u1"},"urgency":"end-of-life"},"forky":{"status":"resolved","repositories":{"forky":"145.0.7632.159-1"},"fixed_version":"132.0.6834.83-1","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"146.0.7680.71-1"},"fixed_version":"132.0.6834.83-1","urgency":"not yet assigned"},"trixie":{"status":"resolved","repositories":{"trixie":"143.0.7499.169-1~deb13u1","trixie-security":"145.0.7632.159-1~deb13u1"},"fixed_version":"132.0.6834.83-1","urgency":"not yet assigned"}}},"CVE-2025-0448":{"description":"Inappropriate implementation in Compositing in Google Chrome prior to 132.0.6834.83 allowed a remote attacker to perform UI spoofing via a crafted HTML page. (Chromium security severity: Low)","scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"143.0.7499.169-1~deb12u1","bookworm-security":"145.0.7632.159-1~deb12u1"},"fixed_version":"132.0.6834.83-1~deb12u1","urgency":"not yet assigned"},"bullseye":{"status":"open","repositories":{"bullseye":"120.0.6099.224-1~deb11u1","bullseye-security":"120.0.6099.224-1~deb11u1"},"urgency":"end-of-life"},"forky":{"status":"resolved","repositories":{"forky":"145.0.7632.159-1"},"fixed_version":"132.0.6834.83-1","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"146.0.7680.71-1"},"fixed_version":"132.0.6834.83-1","urgency":"not yet assigned"},"trixie":{"status":"resolved","repositories":{"trixie":"143.0.7499.169-1~deb13u1","trixie-security":"145.0.7632.159-1~deb13u1"},"fixed_version":"132.0.6834.83-1","urgency":"not yet assigned"}}},"CVE-2025-0451":{"description":"Inappropriate implementation in Extensions API in Google Chrome prior to 133.0.6943.53 allowed a remote attacker who convinced a user to engage in specific UI gestures to perform UI spoofing via a crafted Chrome Extension. (Chromium security severity: Medium)","scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"143.0.7499.169-1~deb12u1","bookworm-security":"145.0.7632.159-1~deb12u1"},"fixed_version":"133.0.6943.53-1~deb12u1","urgency":"not yet assigned"},"bullseye":{"status":"open","repositories":{"bullseye":"120.0.6099.224-1~deb11u1","bullseye-security":"120.0.6099.224-1~deb11u1"},"urgency":"end-of-life"},"forky":{"status":"resolved","repositories":{"forky":"145.0.7632.159-1"},"fixed_version":"133.0.6943.53-1","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"146.0.7680.71-1"},"fixed_version":"133.0.6943.53-1","urgency":"not yet assigned"},"trixie":{"status":"resolved","repositories":{"trixie":"143.0.7499.169-1~deb13u1","trixie-security":"145.0.7632.159-1~deb13u1"},"fixed_version":"133.0.6943.53-1","urgency":"not yet assigned"}}},"CVE-2025-0611":{"description":"Object corruption in V8 in Google Chrome prior to 132.0.6834.110 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. (Chromium security severity: High)","scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"143.0.7499.169-1~deb12u1","bookworm-security":"145.0.7632.159-1~deb12u1"},"fixed_version":"132.0.6834.110-1~deb12u1","urgency":"not yet assigned"},"bullseye":{"status":"open","repositories":{"bullseye":"120.0.6099.224-1~deb11u1","bullseye-security":"120.0.6099.224-1~deb11u1"},"urgency":"end-of-life"},"forky":{"status":"resolved","repositories":{"forky":"145.0.7632.159-1"},"fixed_version":"132.0.6834.110-1","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"146.0.7680.71-1"},"fixed_version":"132.0.6834.110-1","urgency":"not yet assigned"},"trixie":{"status":"resolved","repositories":{"trixie":"143.0.7499.169-1~deb13u1","trixie-security":"145.0.7632.159-1~deb13u1"},"fixed_version":"132.0.6834.110-1","urgency":"not yet assigned"}}},"CVE-2025-0612":{"description":"Out of bounds memory access in V8 in Google Chrome prior to 132.0.6834.110 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. (Chromium security severity: High)","scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"143.0.7499.169-1~deb12u1","bookworm-security":"145.0.7632.159-1~deb12u1"},"fixed_version":"132.0.6834.110-1~deb12u1","urgency":"not yet assigned"},"bullseye":{"status":"open","repositories":{"bullseye":"120.0.6099.224-1~deb11u1","bullseye-security":"120.0.6099.224-1~deb11u1"},"urgency":"end-of-life"},"forky":{"status":"resolved","repositories":{"forky":"145.0.7632.159-1"},"fixed_version":"132.0.6834.110-1","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"146.0.7680.71-1"},"fixed_version":"132.0.6834.110-1","urgency":"not yet assigned"},"trixie":{"status":"resolved","repositories":{"trixie":"143.0.7499.169-1~deb13u1","trixie-security":"145.0.7632.159-1~deb13u1"},"fixed_version":"132.0.6834.110-1","urgency":"not yet assigned"}}},"CVE-2025-0762":{"description":"Use after free in DevTools in Google Chrome prior to 132.0.6834.159 allowed a remote attacker to potentially exploit heap corruption via a crafted Chrome Extension. (Chromium security severity: Medium)","scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"143.0.7499.169-1~deb12u1","bookworm-security":"145.0.7632.159-1~deb12u1"},"fixed_version":"132.0.6834.159-1~deb12u1","urgency":"not yet assigned"},"bullseye":{"status":"open","repositories":{"bullseye":"120.0.6099.224-1~deb11u1","bullseye-security":"120.0.6099.224-1~deb11u1"},"urgency":"end-of-life"},"forky":{"status":"resolved","repositories":{"forky":"145.0.7632.159-1"},"fixed_version":"132.0.6834.159-1","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"146.0.7680.71-1"},"fixed_version":"132.0.6834.159-1","urgency":"not yet assigned"},"trixie":{"status":"resolved","repositories":{"trixie":"143.0.7499.169-1~deb13u1","trixie-security":"145.0.7632.159-1~deb13u1"},"fixed_version":"132.0.6834.159-1","urgency":"not yet assigned"}}},"CVE-2025-0995":{"description":"Use after free in V8 in Google Chrome prior to 133.0.6943.98 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. (Chromium security severity: High)","scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"143.0.7499.169-1~deb12u1","bookworm-security":"145.0.7632.159-1~deb12u1"},"fixed_version":"133.0.6943.98-1~deb12u1","urgency":"not yet assigned"},"bullseye":{"status":"open","repositories":{"bullseye":"120.0.6099.224-1~deb11u1","bullseye-security":"120.0.6099.224-1~deb11u1"},"urgency":"end-of-life"},"forky":{"status":"resolved","repositories":{"forky":"145.0.7632.159-1"},"fixed_version":"133.0.6943.98-1","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"146.0.7680.71-1"},"fixed_version":"133.0.6943.98-1","urgency":"not yet assigned"},"trixie":{"status":"resolved","repositories":{"trixie":"143.0.7499.169-1~deb13u1","trixie-security":"145.0.7632.159-1~deb13u1"},"fixed_version":"133.0.6943.98-1","urgency":"not yet assigned"}}},"CVE-2025-0996":{"description":"Inappropriate implementation in Browser UI in Google Chrome on Android prior to 133.0.6943.98 allowed a remote attacker to spoof the contents of the Omnibox (URL bar) via a crafted HTML page. (Chromium security severity: High)","scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"143.0.7499.169-1~deb12u1","bookworm-security":"145.0.7632.159-1~deb12u1"},"fixed_version":"133.0.6943.98-1~deb12u1","urgency":"not yet assigned"},"bullseye":{"status":"open","repositories":{"bullseye":"120.0.6099.224-1~deb11u1","bullseye-security":"120.0.6099.224-1~deb11u1"},"urgency":"end-of-life"},"forky":{"status":"resolved","repositories":{"forky":"145.0.7632.159-1"},"fixed_version":"133.0.6943.98-1","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"146.0.7680.71-1"},"fixed_version":"133.0.6943.98-1","urgency":"not yet assigned"},"trixie":{"status":"resolved","repositories":{"trixie":"143.0.7499.169-1~deb13u1","trixie-security":"145.0.7632.159-1~deb13u1"},"fixed_version":"133.0.6943.98-1","urgency":"not yet assigned"}}},"CVE-2025-0997":{"description":"Use after free in Navigation in Google Chrome prior to 133.0.6943.98 allowed a remote attacker to potentially exploit heap corruption via a crafted Chrome Extension. (Chromium security severity: High)","scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"143.0.7499.169-1~deb12u1","bookworm-security":"145.0.7632.159-1~deb12u1"},"fixed_version":"133.0.6943.98-1~deb12u1","urgency":"not yet assigned"},"bullseye":{"status":"open","repositories":{"bullseye":"120.0.6099.224-1~deb11u1","bullseye-security":"120.0.6099.224-1~deb11u1"},"urgency":"end-of-life"},"forky":{"status":"resolved","repositories":{"forky":"145.0.7632.159-1"},"fixed_version":"133.0.6943.98-1","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"146.0.7680.71-1"},"fixed_version":"133.0.6943.98-1","urgency":"not yet assigned"},"trixie":{"status":"resolved","repositories":{"trixie":"143.0.7499.169-1~deb13u1","trixie-security":"145.0.7632.159-1~deb13u1"},"fixed_version":"133.0.6943.98-1","urgency":"not yet assigned"}}},"CVE-2025-0999":{"description":"Heap buffer overflow in V8 in Google Chrome prior to 133.0.6943.126 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. (Chromium security severity: High)","scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"143.0.7499.169-1~deb12u1","bookworm-security":"145.0.7632.159-1~deb12u1"},"fixed_version":"133.0.6943.126-1~deb12u1","urgency":"not yet assigned"},"bullseye":{"status":"open","repositories":{"bullseye":"120.0.6099.224-1~deb11u1","bullseye-security":"120.0.6099.224-1~deb11u1"},"urgency":"end-of-life"},"forky":{"status":"resolved","repositories":{"forky":"145.0.7632.159-1"},"fixed_version":"133.0.6943.126-1","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"146.0.7680.71-1"},"fixed_version":"133.0.6943.126-1","urgency":"not yet assigned"},"trixie":{"status":"resolved","repositories":{"trixie":"143.0.7499.169-1~deb13u1","trixie-security":"145.0.7632.159-1~deb13u1"},"fixed_version":"133.0.6943.126-1","urgency":"not yet assigned"}}},"CVE-2025-1006":{"description":"Use after free in Network in Google Chrome prior to 133.0.6943.126 allowed a remote attacker to potentially exploit heap corruption via a crafted web app. (Chromium security severity: Medium)","scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"143.0.7499.169-1~deb12u1","bookworm-security":"145.0.7632.159-1~deb12u1"},"fixed_version":"133.0.6943.126-1~deb12u1","urgency":"not yet assigned"},"bullseye":{"status":"open","repositories":{"bullseye":"120.0.6099.224-1~deb11u1","bullseye-security":"120.0.6099.224-1~deb11u1"},"urgency":"end-of-life"},"forky":{"status":"resolved","repositories":{"forky":"145.0.7632.159-1"},"fixed_version":"133.0.6943.126-1","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"146.0.7680.71-1"},"fixed_version":"133.0.6943.126-1","urgency":"not yet assigned"},"trixie":{"status":"resolved","repositories":{"trixie":"143.0.7499.169-1~deb13u1","trixie-security":"145.0.7632.159-1~deb13u1"},"fixed_version":"133.0.6943.126-1","urgency":"not yet assigned"}}},"CVE-2025-10200":{"description":"Use after free in Serviceworker in Google Chrome on Desktop prior to 140.0.7339.127 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. (Chromium security severity: Critical)","scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"143.0.7499.169-1~deb12u1","bookworm-security":"145.0.7632.159-1~deb12u1"},"fixed_version":"140.0.7339.127-1~deb12u1","urgency":"not yet assigned"},"bullseye":{"status":"open","repositories":{"bullseye":"120.0.6099.224-1~deb11u1","bullseye-security":"120.0.6099.224-1~deb11u1"},"urgency":"end-of-life"},"forky":{"status":"resolved","repositories":{"forky":"145.0.7632.159-1"},"fixed_version":"140.0.7339.127-1","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"146.0.7680.71-1"},"fixed_version":"140.0.7339.127-1","urgency":"not yet assigned"},"trixie":{"status":"resolved","repositories":{"trixie":"143.0.7499.169-1~deb13u1","trixie-security":"145.0.7632.159-1~deb13u1"},"fixed_version":"140.0.7339.127-1~deb13u1","urgency":"not yet assigned"}}},"CVE-2025-10201":{"description":"Inappropriate implementation in Mojo in Google Chrome on Android, Linux, ChromeOS prior to 140.0.7339.127 allowed a remote attacker to bypass site isolation via a crafted HTML page. (Chromium security severity: High)","scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"143.0.7499.169-1~deb12u1","bookworm-security":"145.0.7632.159-1~deb12u1"},"fixed_version":"140.0.7339.127-1~deb12u1","urgency":"not yet assigned"},"bullseye":{"status":"open","repositories":{"bullseye":"120.0.6099.224-1~deb11u1","bullseye-security":"120.0.6099.224-1~deb11u1"},"urgency":"end-of-life"},"forky":{"status":"resolved","repositories":{"forky":"145.0.7632.159-1"},"fixed_version":"140.0.7339.127-1","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"146.0.7680.71-1"},"fixed_version":"140.0.7339.127-1","urgency":"not yet assigned"},"trixie":{"status":"resolved","repositories":{"trixie":"143.0.7499.169-1~deb13u1","trixie-security":"145.0.7632.159-1~deb13u1"},"fixed_version":"140.0.7339.127-1~deb13u1","urgency":"not yet assigned"}}},"CVE-2025-10500":{"description":"Use after free in Dawn in Google Chrome prior to 140.0.7339.185 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. (Chromium security severity: High)","scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"143.0.7499.169-1~deb12u1","bookworm-security":"145.0.7632.159-1~deb12u1"},"fixed_version":"140.0.7339.185-1~deb12u1","urgency":"not yet assigned"},"bullseye":{"status":"open","repositories":{"bullseye":"120.0.6099.224-1~deb11u1","bullseye-security":"120.0.6099.224-1~deb11u1"},"urgency":"end-of-life"},"forky":{"status":"resolved","repositories":{"forky":"145.0.7632.159-1"},"fixed_version":"140.0.7339.185-1","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"146.0.7680.71-1"},"fixed_version":"140.0.7339.185-1","urgency":"not yet assigned"},"trixie":{"status":"resolved","repositories":{"trixie":"143.0.7499.169-1~deb13u1","trixie-security":"145.0.7632.159-1~deb13u1"},"fixed_version":"140.0.7339.185-1~deb13u1","urgency":"not yet assigned"}}},"CVE-2025-10501":{"description":"Use after free in WebRTC in Google Chrome prior to 140.0.7339.185 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. (Chromium security severity: High)","scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"143.0.7499.169-1~deb12u1","bookworm-security":"145.0.7632.159-1~deb12u1"},"fixed_version":"140.0.7339.185-1~deb12u1","urgency":"not yet assigned"},"bullseye":{"status":"open","repositories":{"bullseye":"120.0.6099.224-1~deb11u1","bullseye-security":"120.0.6099.224-1~deb11u1"},"urgency":"end-of-life"},"forky":{"status":"resolved","repositories":{"forky":"145.0.7632.159-1"},"fixed_version":"140.0.7339.185-1","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"146.0.7680.71-1"},"fixed_version":"140.0.7339.185-1","urgency":"not yet assigned"},"trixie":{"status":"resolved","repositories":{"trixie":"143.0.7499.169-1~deb13u1","trixie-security":"145.0.7632.159-1~deb13u1"},"fixed_version":"140.0.7339.185-1~deb13u1","urgency":"not yet assigned"}}},"CVE-2025-10502":{"description":"Heap buffer overflow in ANGLE in Google Chrome prior to 140.0.7339.185 allowed a remote attacker to potentially exploit heap corruption via malicious network traffic. (Chromium security severity: High)","scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"143.0.7499.169-1~deb12u1","bookworm-security":"145.0.7632.159-1~deb12u1"},"fixed_version":"140.0.7339.185-1~deb12u1","urgency":"not yet assigned"},"bullseye":{"status":"open","repositories":{"bullseye":"120.0.6099.224-1~deb11u1","bullseye-security":"120.0.6099.224-1~deb11u1"},"urgency":"end-of-life"},"forky":{"status":"resolved","repositories":{"forky":"145.0.7632.159-1"},"fixed_version":"140.0.7339.185-1","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"146.0.7680.71-1"},"fixed_version":"140.0.7339.185-1","urgency":"not yet assigned"},"trixie":{"status":"resolved","repositories":{"trixie":"143.0.7499.169-1~deb13u1","trixie-security":"145.0.7632.159-1~deb13u1"},"fixed_version":"140.0.7339.185-1~deb13u1","urgency":"not yet assigned"}}},"CVE-2025-10585":{"description":"Type confusion in V8 in Google Chrome prior to 140.0.7339.185 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. (Chromium security severity: High)","scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"143.0.7499.169-1~deb12u1","bookworm-security":"145.0.7632.159-1~deb12u1"},"fixed_version":"140.0.7339.185-1~deb12u1","urgency":"not yet assigned"},"bullseye":{"status":"open","repositories":{"bullseye":"120.0.6099.224-1~deb11u1","bullseye-security":"120.0.6099.224-1~deb11u1"},"urgency":"end-of-life"},"forky":{"status":"resolved","repositories":{"forky":"145.0.7632.159-1"},"fixed_version":"140.0.7339.185-1","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"146.0.7680.71-1"},"fixed_version":"140.0.7339.185-1","urgency":"not yet assigned"},"trixie":{"status":"resolved","repositories":{"trixie":"143.0.7499.169-1~deb13u1","trixie-security":"145.0.7632.159-1~deb13u1"},"fixed_version":"140.0.7339.185-1~deb13u1","urgency":"not yet assigned"}}},"CVE-2025-10890":{"description":"Side-channel information leakage in V8 in Google Chrome prior to 140.0.7339.207 allowed a remote attacker to leak cross-origin data via a crafted HTML page. (Chromium security severity: High)","scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"143.0.7499.169-1~deb12u1","bookworm-security":"145.0.7632.159-1~deb12u1"},"fixed_version":"140.0.7339.207-1~deb12u1","urgency":"not yet assigned"},"bullseye":{"status":"open","repositories":{"bullseye":"120.0.6099.224-1~deb11u1","bullseye-security":"120.0.6099.224-1~deb11u1"},"urgency":"end-of-life"},"forky":{"status":"resolved","repositories":{"forky":"145.0.7632.159-1"},"fixed_version":"140.0.7339.207-1","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"146.0.7680.71-1"},"fixed_version":"140.0.7339.207-1","urgency":"not yet assigned"},"trixie":{"status":"resolved","repositories":{"trixie":"143.0.7499.169-1~deb13u1","trixie-security":"145.0.7632.159-1~deb13u1"},"fixed_version":"140.0.7339.207-1~deb13u1","urgency":"not yet assigned"}}},"CVE-2025-10891":{"description":"Integer overflow in V8 in Google Chrome prior to 140.0.7339.207 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. (Chromium security severity: High)","scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"143.0.7499.169-1~deb12u1","bookworm-security":"145.0.7632.159-1~deb12u1"},"fixed_version":"140.0.7339.207-1~deb12u1","urgency":"not yet assigned"},"bullseye":{"status":"open","repositories":{"bullseye":"120.0.6099.224-1~deb11u1","bullseye-security":"120.0.6099.224-1~deb11u1"},"urgency":"end-of-life"},"forky":{"status":"resolved","repositories":{"forky":"145.0.7632.159-1"},"fixed_version":"140.0.7339.207-1","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"146.0.7680.71-1"},"fixed_version":"140.0.7339.207-1","urgency":"not yet assigned"},"trixie":{"status":"resolved","repositories":{"trixie":"143.0.7499.169-1~deb13u1","trixie-security":"145.0.7632.159-1~deb13u1"},"fixed_version":"140.0.7339.207-1~deb13u1","urgency":"not yet assigned"}}},"CVE-2025-10892":{"description":"Integer overflow in V8 in Google Chrome prior to 140.0.7339.207 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. (Chromium security severity: High)","scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"143.0.7499.169-1~deb12u1","bookworm-security":"145.0.7632.159-1~deb12u1"},"fixed_version":"140.0.7339.207-1~deb12u1","urgency":"not yet assigned"},"bullseye":{"status":"open","repositories":{"bullseye":"120.0.6099.224-1~deb11u1","bullseye-security":"120.0.6099.224-1~deb11u1"},"urgency":"end-of-life"},"forky":{"status":"resolved","repositories":{"forky":"145.0.7632.159-1"},"fixed_version":"140.0.7339.207-1","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"146.0.7680.71-1"},"fixed_version":"140.0.7339.207-1","urgency":"not yet assigned"},"trixie":{"status":"resolved","repositories":{"trixie":"143.0.7499.169-1~deb13u1","trixie-security":"145.0.7632.159-1~deb13u1"},"fixed_version":"140.0.7339.207-1~deb13u1","urgency":"not yet assigned"}}},"CVE-2025-11205":{"description":"Heap buffer overflow in WebGPU in Google Chrome prior to 141.0.7390.54 allowed a remote attacker who had compromised the renderer process to potentially exploit heap corruption via a crafted HTML page. (Chromium security severity: High)","scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"143.0.7499.169-1~deb12u1","bookworm-security":"145.0.7632.159-1~deb12u1"},"fixed_version":"141.0.7390.54-1~deb12u1","urgency":"not yet assigned"},"bullseye":{"status":"open","repositories":{"bullseye":"120.0.6099.224-1~deb11u1","bullseye-security":"120.0.6099.224-1~deb11u1"},"urgency":"end-of-life"},"forky":{"status":"resolved","repositories":{"forky":"145.0.7632.159-1"},"fixed_version":"141.0.7390.54-1","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"146.0.7680.71-1"},"fixed_version":"141.0.7390.54-1","urgency":"not yet assigned"},"trixie":{"status":"resolved","repositories":{"trixie":"143.0.7499.169-1~deb13u1","trixie-security":"145.0.7632.159-1~deb13u1"},"fixed_version":"141.0.7390.54-1~deb13u1","urgency":"not yet assigned"}}},"CVE-2025-11206":{"description":"Heap buffer overflow in Video in Google Chrome prior to 141.0.7390.54 allowed a remote attacker to potentially perform a sandbox escape via a crafted HTML page. (Chromium security severity: High)","scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"143.0.7499.169-1~deb12u1","bookworm-security":"145.0.7632.159-1~deb12u1"},"fixed_version":"141.0.7390.54-1~deb12u1","urgency":"not yet assigned"},"bullseye":{"status":"open","repositories":{"bullseye":"120.0.6099.224-1~deb11u1","bullseye-security":"120.0.6099.224-1~deb11u1"},"urgency":"end-of-life"},"forky":{"status":"resolved","repositories":{"forky":"145.0.7632.159-1"},"fixed_version":"141.0.7390.54-1","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"146.0.7680.71-1"},"fixed_version":"141.0.7390.54-1","urgency":"not yet assigned"},"trixie":{"status":"resolved","repositories":{"trixie":"143.0.7499.169-1~deb13u1","trixie-security":"145.0.7632.159-1~deb13u1"},"fixed_version":"141.0.7390.54-1~deb13u1","urgency":"not yet assigned"}}},"CVE-2025-11207":{"description":"Side-channel information leakage in Storage in Google Chrome prior to 141.0.7390.54 allowed a remote attacker to perform arbitrary read/write via a crafted HTML page. (Chromium security severity: Medium)","scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"143.0.7499.169-1~deb12u1","bookworm-security":"145.0.7632.159-1~deb12u1"},"fixed_version":"141.0.7390.54-1~deb12u1","urgency":"not yet assigned"},"bullseye":{"status":"open","repositories":{"bullseye":"120.0.6099.224-1~deb11u1","bullseye-security":"120.0.6099.224-1~deb11u1"},"urgency":"end-of-life"},"forky":{"status":"resolved","repositories":{"forky":"145.0.7632.159-1"},"fixed_version":"141.0.7390.54-1","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"146.0.7680.71-1"},"fixed_version":"141.0.7390.54-1","urgency":"not yet assigned"},"trixie":{"status":"resolved","repositories":{"trixie":"143.0.7499.169-1~deb13u1","trixie-security":"145.0.7632.159-1~deb13u1"},"fixed_version":"141.0.7390.54-1~deb13u1","urgency":"not yet assigned"}}},"CVE-2025-11208":{"description":"Inappropriate implementation in Media in Google Chrome prior to 141.0.7390.54 allowed a remote attacker who convinced a user to engage in specific UI gestures to perform UI spoofing via a crafted HTML page. (Chromium security severity: Medium)","scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"143.0.7499.169-1~deb12u1","bookworm-security":"145.0.7632.159-1~deb12u1"},"fixed_version":"141.0.7390.54-1~deb12u1","urgency":"not yet assigned"},"bullseye":{"status":"open","repositories":{"bullseye":"120.0.6099.224-1~deb11u1","bullseye-security":"120.0.6099.224-1~deb11u1"},"urgency":"end-of-life"},"forky":{"status":"resolved","repositories":{"forky":"145.0.7632.159-1"},"fixed_version":"141.0.7390.54-1","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"146.0.7680.71-1"},"fixed_version":"141.0.7390.54-1","urgency":"not yet assigned"},"trixie":{"status":"resolved","repositories":{"trixie":"143.0.7499.169-1~deb13u1","trixie-security":"145.0.7632.159-1~deb13u1"},"fixed_version":"141.0.7390.54-1~deb13u1","urgency":"not yet assigned"}}},"CVE-2025-11209":{"description":"Inappropriate implementation in Omnibox in Google Chrome on Android prior to 141.0.7390.54 allowed a remote attacker to spoof the contents of the Omnibox (URL bar) via a crafted HTML page. (Chromium security severity: Medium)","scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"143.0.7499.169-1~deb12u1","bookworm-security":"145.0.7632.159-1~deb12u1"},"fixed_version":"141.0.7390.54-1~deb12u1","urgency":"not yet assigned"},"bullseye":{"status":"open","repositories":{"bullseye":"120.0.6099.224-1~deb11u1","bullseye-security":"120.0.6099.224-1~deb11u1"},"urgency":"end-of-life"},"forky":{"status":"resolved","repositories":{"forky":"145.0.7632.159-1"},"fixed_version":"141.0.7390.54-1","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"146.0.7680.71-1"},"fixed_version":"141.0.7390.54-1","urgency":"not yet assigned"},"trixie":{"status":"resolved","repositories":{"trixie":"143.0.7499.169-1~deb13u1","trixie-security":"145.0.7632.159-1~deb13u1"},"fixed_version":"141.0.7390.54-1~deb13u1","urgency":"not yet assigned"}}},"CVE-2025-11210":{"description":"Side-channel information leakage in Tab in Google Chrome prior to 141.0.7390.54 allowed a remote attacker who convinced a user to engage in specific UI gestures to perform UI spoofing via a crafted HTML page. (Chromium security severity: Medium)","scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"143.0.7499.169-1~deb12u1","bookworm-security":"145.0.7632.159-1~deb12u1"},"fixed_version":"141.0.7390.54-1~deb12u1","urgency":"not yet assigned"},"bullseye":{"status":"open","repositories":{"bullseye":"120.0.6099.224-1~deb11u1","bullseye-security":"120.0.6099.224-1~deb11u1"},"urgency":"end-of-life"},"forky":{"status":"resolved","repositories":{"forky":"145.0.7632.159-1"},"fixed_version":"141.0.7390.54-1","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"146.0.7680.71-1"},"fixed_version":"141.0.7390.54-1","urgency":"not yet assigned"},"trixie":{"status":"resolved","repositories":{"trixie":"143.0.7499.169-1~deb13u1","trixie-security":"145.0.7632.159-1~deb13u1"},"fixed_version":"141.0.7390.54-1~deb13u1","urgency":"not yet assigned"}}},"CVE-2025-11211":{"description":"Out of bounds read in Media in Google Chrome prior to 141.0.7390.54 allowed a remote attacker to potentially perform out of bounds memory access via a crafted HTML page. (Chromium security severity: Medium)","scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"143.0.7499.169-1~deb12u1","bookworm-security":"145.0.7632.159-1~deb12u1"},"fixed_version":"141.0.7390.65-1~deb12u1","urgency":"not yet assigned"},"bullseye":{"status":"open","repositories":{"bullseye":"120.0.6099.224-1~deb11u1","bullseye-security":"120.0.6099.224-1~deb11u1"},"urgency":"end-of-life"},"forky":{"status":"resolved","repositories":{"forky":"145.0.7632.159-1"},"fixed_version":"141.0.7390.65-1","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"146.0.7680.71-1"},"fixed_version":"141.0.7390.65-1","urgency":"not yet assigned"},"trixie":{"status":"resolved","repositories":{"trixie":"143.0.7499.169-1~deb13u1","trixie-security":"145.0.7632.159-1~deb13u1"},"fixed_version":"141.0.7390.65-1~deb13u1","urgency":"not yet assigned"}}},"CVE-2025-11212":{"description":"Inappropriate implementation in Media in Google Chrome on Windows prior to 141.0.7390.54 allowed a remote attacker who convinced a user to engage in specific UI gestures to perform domain spoofing via a crafted HTML page. (Chromium security severity: Medium)","scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"143.0.7499.169-1~deb12u1","bookworm-security":"145.0.7632.159-1~deb12u1"},"fixed_version":"141.0.7390.54-1~deb12u1","urgency":"not yet assigned"},"bullseye":{"status":"open","repositories":{"bullseye":"120.0.6099.224-1~deb11u1","bullseye-security":"120.0.6099.224-1~deb11u1"},"urgency":"end-of-life"},"forky":{"status":"resolved","repositories":{"forky":"145.0.7632.159-1"},"fixed_version":"141.0.7390.54-1","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"146.0.7680.71-1"},"fixed_version":"141.0.7390.54-1","urgency":"not yet assigned"},"trixie":{"status":"resolved","repositories":{"trixie":"143.0.7499.169-1~deb13u1","trixie-security":"145.0.7632.159-1~deb13u1"},"fixed_version":"141.0.7390.54-1~deb13u1","urgency":"not yet assigned"}}},"CVE-2025-11213":{"description":"Inappropriate implementation in Omnibox in Google Chrome on Android prior to 141.0.7390.54 allowed a remote attacker who convinced a user to engage in specific UI gestures to perform domain spoofing via a crafted HTML page. (Chromium security severity: Medium)","scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"143.0.7499.169-1~deb12u1","bookworm-security":"145.0.7632.159-1~deb12u1"},"fixed_version":"141.0.7390.54-1~deb12u1","urgency":"not yet assigned"},"bullseye":{"status":"open","repositories":{"bullseye":"120.0.6099.224-1~deb11u1","bullseye-security":"120.0.6099.224-1~deb11u1"},"urgency":"end-of-life"},"forky":{"status":"resolved","repositories":{"forky":"145.0.7632.159-1"},"fixed_version":"141.0.7390.54-1","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"146.0.7680.71-1"},"fixed_version":"141.0.7390.54-1","urgency":"not yet assigned"},"trixie":{"status":"resolved","repositories":{"trixie":"143.0.7499.169-1~deb13u1","trixie-security":"145.0.7632.159-1~deb13u1"},"fixed_version":"141.0.7390.54-1~deb13u1","urgency":"not yet assigned"}}},"CVE-2025-11215":{"description":"Off by one error in V8 in Google Chrome prior to 141.0.7390.54 allowed a remote attacker to perform an out of bounds memory read via a crafted HTML page. (Chromium security severity: Medium)","scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"143.0.7499.169-1~deb12u1","bookworm-security":"145.0.7632.159-1~deb12u1"},"fixed_version":"141.0.7390.54-1~deb12u1","urgency":"not yet assigned"},"bullseye":{"status":"open","repositories":{"bullseye":"120.0.6099.224-1~deb11u1","bullseye-security":"120.0.6099.224-1~deb11u1"},"urgency":"end-of-life"},"forky":{"status":"resolved","repositories":{"forky":"145.0.7632.159-1"},"fixed_version":"141.0.7390.54-1","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"146.0.7680.71-1"},"fixed_version":"141.0.7390.54-1","urgency":"not yet assigned"},"trixie":{"status":"resolved","repositories":{"trixie":"143.0.7499.169-1~deb13u1","trixie-security":"145.0.7632.159-1~deb13u1"},"fixed_version":"141.0.7390.54-1~deb13u1","urgency":"not yet assigned"}}},"CVE-2025-11216":{"description":"Inappropriate implementation in Storage in Google Chrome on Mac prior to 141.0.7390.54 allowed a remote attacker to perform domain spoofing via a crafted video file. (Chromium security severity: Low)","scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"143.0.7499.169-1~deb12u1","bookworm-security":"145.0.7632.159-1~deb12u1"},"fixed_version":"141.0.7390.54-1~deb12u1","urgency":"not yet assigned"},"bullseye":{"status":"open","repositories":{"bullseye":"120.0.6099.224-1~deb11u1","bullseye-security":"120.0.6099.224-1~deb11u1"},"urgency":"end-of-life"},"forky":{"status":"resolved","repositories":{"forky":"145.0.7632.159-1"},"fixed_version":"141.0.7390.54-1","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"146.0.7680.71-1"},"fixed_version":"141.0.7390.54-1","urgency":"not yet assigned"},"trixie":{"status":"resolved","repositories":{"trixie":"143.0.7499.169-1~deb13u1","trixie-security":"145.0.7632.159-1~deb13u1"},"fixed_version":"141.0.7390.54-1~deb13u1","urgency":"not yet assigned"}}},"CVE-2025-11219":{"description":"Use after free in V8 in Google Chrome prior to 141.0.7390.54 allowed a remote attacker to potentially perform out of bounds memory access via a crafted HTML page. (Chromium security severity: Low)","scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"143.0.7499.169-1~deb12u1","bookworm-security":"145.0.7632.159-1~deb12u1"},"fixed_version":"141.0.7390.54-1~deb12u1","urgency":"not yet assigned"},"bullseye":{"status":"open","repositories":{"bullseye":"120.0.6099.224-1~deb11u1","bullseye-security":"120.0.6099.224-1~deb11u1"},"urgency":"end-of-life"},"forky":{"status":"resolved","repositories":{"forky":"145.0.7632.159-1"},"fixed_version":"141.0.7390.54-1","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"146.0.7680.71-1"},"fixed_version":"141.0.7390.54-1","urgency":"not yet assigned"},"trixie":{"status":"resolved","repositories":{"trixie":"143.0.7499.169-1~deb13u1","trixie-security":"145.0.7632.159-1~deb13u1"},"fixed_version":"141.0.7390.54-1~deb13u1","urgency":"not yet assigned"}}},"CVE-2025-11458":{"description":"Heap buffer overflow in Sync in Google Chrome prior to 141.0.7390.65 allowed a remote attacker to perform an out of bounds memory read via a crafted HTML page. (Chromium security severity: High)","scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"143.0.7499.169-1~deb12u1","bookworm-security":"145.0.7632.159-1~deb12u1"},"fixed_version":"141.0.7390.65-1~deb12u1","urgency":"not yet assigned"},"bullseye":{"status":"open","repositories":{"bullseye":"120.0.6099.224-1~deb11u1","bullseye-security":"120.0.6099.224-1~deb11u1"},"urgency":"end-of-life"},"forky":{"status":"resolved","repositories":{"forky":"145.0.7632.159-1"},"fixed_version":"141.0.7390.65-1","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"146.0.7680.71-1"},"fixed_version":"141.0.7390.65-1","urgency":"not yet assigned"},"trixie":{"status":"resolved","repositories":{"trixie":"143.0.7499.169-1~deb13u1","trixie-security":"145.0.7632.159-1~deb13u1"},"fixed_version":"141.0.7390.65-1~deb13u1","urgency":"not yet assigned"}}},"CVE-2025-11460":{"description":"Use after free in Storage in Google Chrome prior to 141.0.7390.65 allowed a remote attacker to execute arbitrary code via a crafted video file. (Chromium security severity: High)","scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"143.0.7499.169-1~deb12u1","bookworm-security":"145.0.7632.159-1~deb12u1"},"fixed_version":"141.0.7390.65-1~deb12u1","urgency":"not yet assigned"},"bullseye":{"status":"open","repositories":{"bullseye":"120.0.6099.224-1~deb11u1","bullseye-security":"120.0.6099.224-1~deb11u1"},"urgency":"end-of-life"},"forky":{"status":"resolved","repositories":{"forky":"145.0.7632.159-1"},"fixed_version":"141.0.7390.65-1","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"146.0.7680.71-1"},"fixed_version":"141.0.7390.65-1","urgency":"not yet assigned"},"trixie":{"status":"resolved","repositories":{"trixie":"143.0.7499.169-1~deb13u1","trixie-security":"145.0.7632.159-1~deb13u1"},"fixed_version":"141.0.7390.65-1~deb13u1","urgency":"not yet assigned"}}},"CVE-2025-11756":{"description":"Use after free in Safe Browsing in Google Chrome prior to 141.0.7390.107 allowed a remote attacker who had compromised the renderer process to potentially perform out of bounds memory access via a crafted HTML page. (Chromium security severity: High)","scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"143.0.7499.169-1~deb12u1","bookworm-security":"145.0.7632.159-1~deb12u1"},"fixed_version":"141.0.7390.107-1~deb12u1","urgency":"not yet assigned"},"bullseye":{"status":"open","repositories":{"bullseye":"120.0.6099.224-1~deb11u1","bullseye-security":"120.0.6099.224-1~deb11u1"},"urgency":"end-of-life"},"forky":{"status":"resolved","repositories":{"forky":"145.0.7632.159-1"},"fixed_version":"141.0.7390.107-1","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"146.0.7680.71-1"},"fixed_version":"141.0.7390.107-1","urgency":"not yet assigned"},"trixie":{"status":"resolved","repositories":{"trixie":"143.0.7499.169-1~deb13u1","trixie-security":"145.0.7632.159-1~deb13u1"},"fixed_version":"141.0.7390.107-1~deb13u1","urgency":"not yet assigned"}}},"CVE-2025-12036":{"description":"Out of bounds memory access in V8 in Google Chrome prior to 141.0.7390.122 allowed a remote attacker to perform out of bounds memory access via a crafted HTML page. (Chromium security severity: High)","scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"143.0.7499.169-1~deb12u1","bookworm-security":"145.0.7632.159-1~deb12u1"},"fixed_version":"142.0.7444.59-1~deb12u1","urgency":"not yet assigned"},"bullseye":{"status":"open","repositories":{"bullseye":"120.0.6099.224-1~deb11u1","bullseye-security":"120.0.6099.224-1~deb11u1"},"urgency":"end-of-life"},"forky":{"status":"resolved","repositories":{"forky":"145.0.7632.159-1"},"fixed_version":"142.0.7444.59-1","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"146.0.7680.71-1"},"fixed_version":"142.0.7444.59-1","urgency":"not yet assigned"},"trixie":{"status":"resolved","repositories":{"trixie":"143.0.7499.169-1~deb13u1","trixie-security":"145.0.7632.159-1~deb13u1"},"fixed_version":"142.0.7444.59-1~deb13u1","urgency":"not yet assigned"}}},"CVE-2025-12428":{"description":"Type Confusion in V8 in Google Chrome prior to 142.0.7444.59 allowed a remote attacker to perform arbitrary read/write via a crafted HTML page. (Chromium security severity: High)","scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"143.0.7499.169-1~deb12u1","bookworm-security":"145.0.7632.159-1~deb12u1"},"fixed_version":"142.0.7444.59-1~deb12u1","urgency":"not yet assigned"},"bullseye":{"status":"open","repositories":{"bullseye":"120.0.6099.224-1~deb11u1","bullseye-security":"120.0.6099.224-1~deb11u1"},"urgency":"end-of-life"},"forky":{"status":"resolved","repositories":{"forky":"145.0.7632.159-1"},"fixed_version":"142.0.7444.59-1","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"146.0.7680.71-1"},"fixed_version":"142.0.7444.59-1","urgency":"not yet assigned"},"trixie":{"status":"resolved","repositories":{"trixie":"143.0.7499.169-1~deb13u1","trixie-security":"145.0.7632.159-1~deb13u1"},"fixed_version":"142.0.7444.59-1~deb13u1","urgency":"not yet assigned"}}},"CVE-2025-12429":{"description":"Inappropriate implementation in V8 in Google Chrome prior to 142.0.7444.59 allowed a remote attacker to perform arbitrary read/write via a crafted HTML page. (Chromium security severity: High)","scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"143.0.7499.169-1~deb12u1","bookworm-security":"145.0.7632.159-1~deb12u1"},"fixed_version":"142.0.7444.59-1~deb12u1","urgency":"not yet assigned"},"bullseye":{"status":"open","repositories":{"bullseye":"120.0.6099.224-1~deb11u1","bullseye-security":"120.0.6099.224-1~deb11u1"},"urgency":"end-of-life"},"forky":{"status":"resolved","repositories":{"forky":"145.0.7632.159-1"},"fixed_version":"142.0.7444.59-1","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"146.0.7680.71-1"},"fixed_version":"142.0.7444.59-1","urgency":"not yet assigned"},"trixie":{"status":"resolved","repositories":{"trixie":"143.0.7499.169-1~deb13u1","trixie-security":"145.0.7632.159-1~deb13u1"},"fixed_version":"142.0.7444.59-1~deb13u1","urgency":"not yet assigned"}}},"CVE-2025-12430":{"description":"Object lifecycle issue in Media in Google Chrome prior to 142.0.7444.59 allowed a remote attacker to perform UI spoofing via a crafted HTML page. (Chromium security severity: High)","scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"143.0.7499.169-1~deb12u1","bookworm-security":"145.0.7632.159-1~deb12u1"},"fixed_version":"142.0.7444.59-1~deb12u1","urgency":"not yet assigned"},"bullseye":{"status":"open","repositories":{"bullseye":"120.0.6099.224-1~deb11u1","bullseye-security":"120.0.6099.224-1~deb11u1"},"urgency":"end-of-life"},"forky":{"status":"resolved","repositories":{"forky":"145.0.7632.159-1"},"fixed_version":"142.0.7444.59-1","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"146.0.7680.71-1"},"fixed_version":"142.0.7444.59-1","urgency":"not yet assigned"},"trixie":{"status":"resolved","repositories":{"trixie":"143.0.7499.169-1~deb13u1","trixie-security":"145.0.7632.159-1~deb13u1"},"fixed_version":"142.0.7444.59-1~deb13u1","urgency":"not yet assigned"}}},"CVE-2025-12431":{"description":"Inappropriate implementation in Extensions in Google Chrome prior to 142.0.7444.59 allowed an attacker who convinced a user to install a malicious extension to bypass navigation restrictions via a crafted Chrome Extension. (Chromium security severity: High)","scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"143.0.7499.169-1~deb12u1","bookworm-security":"145.0.7632.159-1~deb12u1"},"fixed_version":"142.0.7444.59-1~deb12u1","urgency":"not yet assigned"},"bullseye":{"status":"open","repositories":{"bullseye":"120.0.6099.224-1~deb11u1","bullseye-security":"120.0.6099.224-1~deb11u1"},"urgency":"end-of-life"},"forky":{"status":"resolved","repositories":{"forky":"145.0.7632.159-1"},"fixed_version":"142.0.7444.59-1","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"146.0.7680.71-1"},"fixed_version":"142.0.7444.59-1","urgency":"not yet assigned"},"trixie":{"status":"resolved","repositories":{"trixie":"143.0.7499.169-1~deb13u1","trixie-security":"145.0.7632.159-1~deb13u1"},"fixed_version":"142.0.7444.59-1~deb13u1","urgency":"not yet assigned"}}},"CVE-2025-12432":{"description":"Race in V8 in Google Chrome prior to 142.0.7444.59 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. (Chromium security severity: High)","scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"143.0.7499.169-1~deb12u1","bookworm-security":"145.0.7632.159-1~deb12u1"},"fixed_version":"142.0.7444.59-1~deb12u1","urgency":"not yet assigned"},"bullseye":{"status":"open","repositories":{"bullseye":"120.0.6099.224-1~deb11u1","bullseye-security":"120.0.6099.224-1~deb11u1"},"urgency":"end-of-life"},"forky":{"status":"resolved","repositories":{"forky":"145.0.7632.159-1"},"fixed_version":"142.0.7444.59-1","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"146.0.7680.71-1"},"fixed_version":"142.0.7444.59-1","urgency":"not yet assigned"},"trixie":{"status":"resolved","repositories":{"trixie":"143.0.7499.169-1~deb13u1","trixie-security":"145.0.7632.159-1~deb13u1"},"fixed_version":"142.0.7444.59-1~deb13u1","urgency":"not yet assigned"}}},"CVE-2025-12433":{"description":"Inappropriate implementation in V8 in Google Chrome prior to 142.0.7444.59 allowed a remote attacker to perform out of bounds memory access via a crafted HTML page. (Chromium security severity: High)","scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"143.0.7499.169-1~deb12u1","bookworm-security":"145.0.7632.159-1~deb12u1"},"fixed_version":"142.0.7444.59-1~deb12u1","urgency":"not yet assigned"},"bullseye":{"status":"open","repositories":{"bullseye":"120.0.6099.224-1~deb11u1","bullseye-security":"120.0.6099.224-1~deb11u1"},"urgency":"end-of-life"},"forky":{"status":"resolved","repositories":{"forky":"145.0.7632.159-1"},"fixed_version":"142.0.7444.59-1","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"146.0.7680.71-1"},"fixed_version":"142.0.7444.59-1","urgency":"not yet assigned"},"trixie":{"status":"resolved","repositories":{"trixie":"143.0.7499.169-1~deb13u1","trixie-security":"145.0.7632.159-1~deb13u1"},"fixed_version":"142.0.7444.59-1~deb13u1","urgency":"not yet assigned"}}},"CVE-2025-12434":{"description":"Race in Storage in Google Chrome on Windows prior to 142.0.7444.59 allowed a remote attacker who convinced a user to engage in specific UI gestures to perform UI spoofing via a crafted HTML page. (Chromium security severity: Medium)","scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"143.0.7499.169-1~deb12u1","bookworm-security":"145.0.7632.159-1~deb12u1"},"fixed_version":"142.0.7444.59-1~deb12u1","urgency":"not yet assigned"},"bullseye":{"status":"open","repositories":{"bullseye":"120.0.6099.224-1~deb11u1","bullseye-security":"120.0.6099.224-1~deb11u1"},"urgency":"end-of-life"},"forky":{"status":"resolved","repositories":{"forky":"145.0.7632.159-1"},"fixed_version":"142.0.7444.59-1","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"146.0.7680.71-1"},"fixed_version":"142.0.7444.59-1","urgency":"not yet assigned"},"trixie":{"status":"resolved","repositories":{"trixie":"143.0.7499.169-1~deb13u1","trixie-security":"145.0.7632.159-1~deb13u1"},"fixed_version":"142.0.7444.59-1~deb13u1","urgency":"not yet assigned"}}},"CVE-2025-12435":{"description":"Incorrect security UI in Omnibox in Google Chrome on Android prior to 142.0.7444.59 allowed a remote attacker to perform UI spoofing via a crafted HTML page. (Chromium security severity: Medium)","scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"143.0.7499.169-1~deb12u1","bookworm-security":"145.0.7632.159-1~deb12u1"},"fixed_version":"142.0.7444.59-1~deb12u1","urgency":"not yet assigned"},"bullseye":{"status":"open","repositories":{"bullseye":"120.0.6099.224-1~deb11u1","bullseye-security":"120.0.6099.224-1~deb11u1"},"urgency":"end-of-life"},"forky":{"status":"resolved","repositories":{"forky":"145.0.7632.159-1"},"fixed_version":"142.0.7444.59-1","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"146.0.7680.71-1"},"fixed_version":"142.0.7444.59-1","urgency":"not yet assigned"},"trixie":{"status":"resolved","repositories":{"trixie":"143.0.7499.169-1~deb13u1","trixie-security":"145.0.7632.159-1~deb13u1"},"fixed_version":"142.0.7444.59-1~deb13u1","urgency":"not yet assigned"}}},"CVE-2025-12436":{"description":"Policy bypass in Extensions in Google Chrome prior to 142.0.7444.59 allowed an attacker who convinced a user to install a malicious extension to obtain potentially sensitive information from process memory via a crafted Chrome Extension. (Chromium security severity: Medium)","scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"143.0.7499.169-1~deb12u1","bookworm-security":"145.0.7632.159-1~deb12u1"},"fixed_version":"142.0.7444.59-1~deb12u1","urgency":"not yet assigned"},"bullseye":{"status":"open","repositories":{"bullseye":"120.0.6099.224-1~deb11u1","bullseye-security":"120.0.6099.224-1~deb11u1"},"urgency":"end-of-life"},"forky":{"status":"resolved","repositories":{"forky":"145.0.7632.159-1"},"fixed_version":"142.0.7444.59-1","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"146.0.7680.71-1"},"fixed_version":"142.0.7444.59-1","urgency":"not yet assigned"},"trixie":{"status":"resolved","repositories":{"trixie":"143.0.7499.169-1~deb13u1","trixie-security":"145.0.7632.159-1~deb13u1"},"fixed_version":"142.0.7444.59-1~deb13u1","urgency":"not yet assigned"}}},"CVE-2025-12437":{"description":"Use after free in PageInfo in Google Chrome prior to 142.0.7444.59 allowed a remote attacker who convinced a user to engage in specific UI gestures to potentially exploit heap corruption via a crafted HTML page. (Chromium security severity: Medium)","scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"143.0.7499.169-1~deb12u1","bookworm-security":"145.0.7632.159-1~deb12u1"},"fixed_version":"142.0.7444.59-1~deb12u1","urgency":"not yet assigned"},"bullseye":{"status":"open","repositories":{"bullseye":"120.0.6099.224-1~deb11u1","bullseye-security":"120.0.6099.224-1~deb11u1"},"urgency":"end-of-life"},"forky":{"status":"resolved","repositories":{"forky":"145.0.7632.159-1"},"fixed_version":"142.0.7444.59-1","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"146.0.7680.71-1"},"fixed_version":"142.0.7444.59-1","urgency":"not yet assigned"},"trixie":{"status":"resolved","repositories":{"trixie":"143.0.7499.169-1~deb13u1","trixie-security":"145.0.7632.159-1~deb13u1"},"fixed_version":"142.0.7444.59-1~deb13u1","urgency":"not yet assigned"}}},"CVE-2025-12438":{"description":"Use after free in Ozone in Google Chrome on Linux and ChromeOS prior to 142.0.7444.59 allowed a remote attacker to potentially exploit object corruption via a crafted HTML page. (Chromium security severity: Medium)","scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"143.0.7499.169-1~deb12u1","bookworm-security":"145.0.7632.159-1~deb12u1"},"fixed_version":"142.0.7444.59-1~deb12u1","urgency":"not yet assigned"},"bullseye":{"status":"open","repositories":{"bullseye":"120.0.6099.224-1~deb11u1","bullseye-security":"120.0.6099.224-1~deb11u1"},"urgency":"end-of-life"},"forky":{"status":"resolved","repositories":{"forky":"145.0.7632.159-1"},"fixed_version":"142.0.7444.59-1","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"146.0.7680.71-1"},"fixed_version":"142.0.7444.59-1","urgency":"not yet assigned"},"trixie":{"status":"resolved","repositories":{"trixie":"143.0.7499.169-1~deb13u1","trixie-security":"145.0.7632.159-1~deb13u1"},"fixed_version":"142.0.7444.59-1~deb13u1","urgency":"not yet assigned"}}},"CVE-2025-12439":{"description":"Inappropriate implementation in App-Bound Encryption in Google Chrome on Windows prior to 142.0.7444.59 allowed a local attacker to obtain potentially sensitive information from process memory via a malicious file. (Chromium security severity: Medium)","scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"143.0.7499.169-1~deb12u1","bookworm-security":"145.0.7632.159-1~deb12u1"},"fixed_version":"142.0.7444.59-1~deb12u1","urgency":"not yet assigned"},"bullseye":{"status":"open","repositories":{"bullseye":"120.0.6099.224-1~deb11u1","bullseye-security":"120.0.6099.224-1~deb11u1"},"urgency":"end-of-life"},"forky":{"status":"resolved","repositories":{"forky":"145.0.7632.159-1"},"fixed_version":"142.0.7444.59-1","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"146.0.7680.71-1"},"fixed_version":"142.0.7444.59-1","urgency":"not yet assigned"},"trixie":{"status":"resolved","repositories":{"trixie":"143.0.7499.169-1~deb13u1","trixie-security":"145.0.7632.159-1~deb13u1"},"fixed_version":"142.0.7444.59-1~deb13u1","urgency":"not yet assigned"}}},"CVE-2025-12440":{"description":"Inappropriate implementation in Autofill in Google Chrome prior to 142.0.7444.59 allowed a remote attacker who convinced a user to engage in specific UI gestures to obtain potentially sensitive information from process memory via a crafted HTML page. (Chromium security severity: Low)","scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"143.0.7499.169-1~deb12u1","bookworm-security":"145.0.7632.159-1~deb12u1"},"fixed_version":"142.0.7444.59-1~deb12u1","urgency":"not yet assigned"},"bullseye":{"status":"open","repositories":{"bullseye":"120.0.6099.224-1~deb11u1","bullseye-security":"120.0.6099.224-1~deb11u1"},"urgency":"end-of-life"},"forky":{"status":"resolved","repositories":{"forky":"145.0.7632.159-1"},"fixed_version":"142.0.7444.59-1","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"146.0.7680.71-1"},"fixed_version":"142.0.7444.59-1","urgency":"not yet assigned"},"trixie":{"status":"resolved","repositories":{"trixie":"143.0.7499.169-1~deb13u1","trixie-security":"145.0.7632.159-1~deb13u1"},"fixed_version":"142.0.7444.59-1~deb13u1","urgency":"not yet assigned"}}},"CVE-2025-12441":{"description":"Out of bounds read in V8 in Google Chrome prior to 142.0.7444.59 allowed a remote attacker to perform an out of bounds memory read via a crafted HTML page. (Chromium security severity: Medium)","scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"143.0.7499.169-1~deb12u1","bookworm-security":"145.0.7632.159-1~deb12u1"},"fixed_version":"142.0.7444.59-1~deb12u1","urgency":"not yet assigned"},"bullseye":{"status":"open","repositories":{"bullseye":"120.0.6099.224-1~deb11u1","bullseye-security":"120.0.6099.224-1~deb11u1"},"urgency":"end-of-life"},"forky":{"status":"resolved","repositories":{"forky":"145.0.7632.159-1"},"fixed_version":"142.0.7444.59-1","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"146.0.7680.71-1"},"fixed_version":"142.0.7444.59-1","urgency":"not yet assigned"},"trixie":{"status":"resolved","repositories":{"trixie":"143.0.7499.169-1~deb13u1","trixie-security":"145.0.7632.159-1~deb13u1"},"fixed_version":"142.0.7444.59-1~deb13u1","urgency":"not yet assigned"}}},"CVE-2025-12443":{"description":"Out of bounds read in WebXR in Google Chrome prior to 142.0.7444.59 allowed a remote attacker to perform an out of bounds memory read via a crafted HTML page. (Chromium security severity: Medium)","scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"143.0.7499.169-1~deb12u1","bookworm-security":"145.0.7632.159-1~deb12u1"},"fixed_version":"142.0.7444.59-1~deb12u1","urgency":"not yet assigned"},"bullseye":{"status":"open","repositories":{"bullseye":"120.0.6099.224-1~deb11u1","bullseye-security":"120.0.6099.224-1~deb11u1"},"urgency":"end-of-life"},"forky":{"status":"resolved","repositories":{"forky":"145.0.7632.159-1"},"fixed_version":"142.0.7444.59-1","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"146.0.7680.71-1"},"fixed_version":"142.0.7444.59-1","urgency":"not yet assigned"},"trixie":{"status":"resolved","repositories":{"trixie":"143.0.7499.169-1~deb13u1","trixie-security":"145.0.7632.159-1~deb13u1"},"fixed_version":"142.0.7444.59-1~deb13u1","urgency":"not yet assigned"}}},"CVE-2025-12444":{"description":"Incorrect security UI in Fullscreen UI in Google Chrome prior to 142.0.7444.59 allowed a remote attacker who convinced a user to engage in specific UI gestures to perform UI spoofing via a crafted HTML page. (Chromium security severity: Low)","scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"143.0.7499.169-1~deb12u1","bookworm-security":"145.0.7632.159-1~deb12u1"},"fixed_version":"142.0.7444.59-1~deb12u1","urgency":"not yet assigned"},"bullseye":{"status":"open","repositories":{"bullseye":"120.0.6099.224-1~deb11u1","bullseye-security":"120.0.6099.224-1~deb11u1"},"urgency":"end-of-life"},"forky":{"status":"resolved","repositories":{"forky":"145.0.7632.159-1"},"fixed_version":"142.0.7444.59-1","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"146.0.7680.71-1"},"fixed_version":"142.0.7444.59-1","urgency":"not yet assigned"},"trixie":{"status":"resolved","repositories":{"trixie":"143.0.7499.169-1~deb13u1","trixie-security":"145.0.7632.159-1~deb13u1"},"fixed_version":"142.0.7444.59-1~deb13u1","urgency":"not yet assigned"}}},"CVE-2025-12445":{"description":"Policy bypass in Extensions in Google Chrome prior to 142.0.7444.59 allowed an attacker who convinced a user to install a malicious extension to leak cross-origin data via a crafted Chrome Extension. (Chromium security severity: Low)","scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"143.0.7499.169-1~deb12u1","bookworm-security":"145.0.7632.159-1~deb12u1"},"fixed_version":"142.0.7444.59-1~deb12u1","urgency":"not yet assigned"},"bullseye":{"status":"open","repositories":{"bullseye":"120.0.6099.224-1~deb11u1","bullseye-security":"120.0.6099.224-1~deb11u1"},"urgency":"end-of-life"},"forky":{"status":"resolved","repositories":{"forky":"145.0.7632.159-1"},"fixed_version":"142.0.7444.59-1","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"146.0.7680.71-1"},"fixed_version":"142.0.7444.59-1","urgency":"not yet assigned"},"trixie":{"status":"resolved","repositories":{"trixie":"143.0.7499.169-1~deb13u1","trixie-security":"145.0.7632.159-1~deb13u1"},"fixed_version":"142.0.7444.59-1~deb13u1","urgency":"not yet assigned"}}},"CVE-2025-12446":{"description":"Incorrect security UI in SplitView in Google Chrome prior to 142.0.7444.59 allowed a remote attacker who convinced a user to engage in specific UI gestures to perform UI spoofing via a crafted domain name. (Chromium security severity: Low)","scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"143.0.7499.169-1~deb12u1","bookworm-security":"145.0.7632.159-1~deb12u1"},"fixed_version":"142.0.7444.59-1~deb12u1","urgency":"not yet assigned"},"bullseye":{"status":"open","repositories":{"bullseye":"120.0.6099.224-1~deb11u1","bullseye-security":"120.0.6099.224-1~deb11u1"},"urgency":"end-of-life"},"forky":{"status":"resolved","repositories":{"forky":"145.0.7632.159-1"},"fixed_version":"142.0.7444.59-1","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"146.0.7680.71-1"},"fixed_version":"142.0.7444.59-1","urgency":"not yet assigned"},"trixie":{"status":"resolved","repositories":{"trixie":"143.0.7499.169-1~deb13u1","trixie-security":"145.0.7632.159-1~deb13u1"},"fixed_version":"142.0.7444.59-1~deb13u1","urgency":"not yet assigned"}}},"CVE-2025-12447":{"description":"Incorrect security UI in Omnibox in Google Chrome on Android prior to 142.0.7444.59 allowed a remote attacker who convinced a user to engage in specific UI gestures to perform UI spoofing via a crafted HTML page. (Chromium security severity: Low)","scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"143.0.7499.169-1~deb12u1","bookworm-security":"145.0.7632.159-1~deb12u1"},"fixed_version":"142.0.7444.59-1~deb12u1","urgency":"not yet assigned"},"bullseye":{"status":"open","repositories":{"bullseye":"120.0.6099.224-1~deb11u1","bullseye-security":"120.0.6099.224-1~deb11u1"},"urgency":"end-of-life"},"forky":{"status":"resolved","repositories":{"forky":"145.0.7632.159-1"},"fixed_version":"142.0.7444.59-1","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"146.0.7680.71-1"},"fixed_version":"142.0.7444.59-1","urgency":"not yet assigned"},"trixie":{"status":"resolved","repositories":{"trixie":"143.0.7499.169-1~deb13u1","trixie-security":"145.0.7632.159-1~deb13u1"},"fixed_version":"142.0.7444.59-1~deb13u1","urgency":"not yet assigned"}}},"CVE-2025-12725":{"description":"Out of bounds read in WebGPU in Google Chrome on Android prior to 142.0.7444.137 allowed a remote attacker to perform an out of bounds memory write via a crafted HTML page. (Chromium security severity: High)","scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"143.0.7499.169-1~deb12u1","bookworm-security":"145.0.7632.159-1~deb12u1"},"fixed_version":"142.0.7444.134-1~deb12u1","urgency":"not yet assigned"},"bullseye":{"status":"open","repositories":{"bullseye":"120.0.6099.224-1~deb11u1","bullseye-security":"120.0.6099.224-1~deb11u1"},"urgency":"end-of-life"},"forky":{"status":"resolved","repositories":{"forky":"145.0.7632.159-1"},"fixed_version":"142.0.7444.134-1","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"146.0.7680.71-1"},"fixed_version":"142.0.7444.134-1","urgency":"not yet assigned"},"trixie":{"status":"resolved","repositories":{"trixie":"143.0.7499.169-1~deb13u1","trixie-security":"145.0.7632.159-1~deb13u1"},"fixed_version":"142.0.7444.134-1~deb13u1","urgency":"not yet assigned"}}},"CVE-2025-12726":{"description":"Inappropriate implementation in Views in Google Chrome on Windows prior to 142.0.7444.137 allowed a remote attacker who had compromised the renderer process to perform privilege escalation via a crafted HTML page. (Chromium security severity: High)","scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"143.0.7499.169-1~deb12u1","bookworm-security":"145.0.7632.159-1~deb12u1"},"fixed_version":"142.0.7444.134-1~deb12u1","urgency":"not yet assigned"},"bullseye":{"status":"open","repositories":{"bullseye":"120.0.6099.224-1~deb11u1","bullseye-security":"120.0.6099.224-1~deb11u1"},"urgency":"end-of-life"},"forky":{"status":"resolved","repositories":{"forky":"145.0.7632.159-1"},"fixed_version":"142.0.7444.134-1","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"146.0.7680.71-1"},"fixed_version":"142.0.7444.134-1","urgency":"not yet assigned"},"trixie":{"status":"resolved","repositories":{"trixie":"143.0.7499.169-1~deb13u1","trixie-security":"145.0.7632.159-1~deb13u1"},"fixed_version":"142.0.7444.134-1~deb13u1","urgency":"not yet assigned"}}},"CVE-2025-12727":{"description":"Inappropriate implementation in V8 in Google Chrome prior to 142.0.7444.137 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. (Chromium security severity: High)","scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"143.0.7499.169-1~deb12u1","bookworm-security":"145.0.7632.159-1~deb12u1"},"fixed_version":"142.0.7444.134-1~deb12u1","urgency":"not yet assigned"},"bullseye":{"status":"open","repositories":{"bullseye":"120.0.6099.224-1~deb11u1","bullseye-security":"120.0.6099.224-1~deb11u1"},"urgency":"end-of-life"},"forky":{"status":"resolved","repositories":{"forky":"145.0.7632.159-1"},"fixed_version":"142.0.7444.134-1","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"146.0.7680.71-1"},"fixed_version":"142.0.7444.134-1","urgency":"not yet assigned"},"trixie":{"status":"resolved","repositories":{"trixie":"143.0.7499.169-1~deb13u1","trixie-security":"145.0.7632.159-1~deb13u1"},"fixed_version":"142.0.7444.134-1~deb13u1","urgency":"not yet assigned"}}},"CVE-2025-12728":{"description":"Inappropriate implementation in Omnibox in Google Chrome on Android prior to 142.0.7444.137 allowed a remote attacker who convinced a user to engage in specific UI gestures to perform UI spoofing via a crafted HTML page. (Chromium security severity: Medium)","scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"143.0.7499.169-1~deb12u1","bookworm-security":"145.0.7632.159-1~deb12u1"},"fixed_version":"142.0.7444.134-1~deb12u1","urgency":"not yet assigned"},"bullseye":{"status":"open","repositories":{"bullseye":"120.0.6099.224-1~deb11u1","bullseye-security":"120.0.6099.224-1~deb11u1"},"urgency":"end-of-life"},"forky":{"status":"resolved","repositories":{"forky":"145.0.7632.159-1"},"fixed_version":"142.0.7444.134-1","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"146.0.7680.71-1"},"fixed_version":"142.0.7444.134-1","urgency":"not yet assigned"},"trixie":{"status":"resolved","repositories":{"trixie":"143.0.7499.169-1~deb13u1","trixie-security":"145.0.7632.159-1~deb13u1"},"fixed_version":"142.0.7444.134-1~deb13u1","urgency":"not yet assigned"}}},"CVE-2025-12729":{"description":"Inappropriate implementation in Omnibox in Google Chrome on Android prior to 142.0.7444.137 allowed a remote attacker who convinced a user to engage in specific UI gestures to perform UI spoofing via a crafted HTML page. (Chromium security severity: Medium)","scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"143.0.7499.169-1~deb12u1","bookworm-security":"145.0.7632.159-1~deb12u1"},"fixed_version":"142.0.7444.134-1~deb12u1","urgency":"not yet assigned"},"bullseye":{"status":"open","repositories":{"bullseye":"120.0.6099.224-1~deb11u1","bullseye-security":"120.0.6099.224-1~deb11u1"},"urgency":"end-of-life"},"forky":{"status":"resolved","repositories":{"forky":"145.0.7632.159-1"},"fixed_version":"142.0.7444.134-1","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"146.0.7680.71-1"},"fixed_version":"142.0.7444.134-1","urgency":"not yet assigned"},"trixie":{"status":"resolved","repositories":{"trixie":"143.0.7499.169-1~deb13u1","trixie-security":"145.0.7632.159-1~deb13u1"},"fixed_version":"142.0.7444.134-1~deb13u1","urgency":"not yet assigned"}}},"CVE-2025-12905":{"description":"Inappropriate implementation in Downloads in Google Chrome on Windows prior to 140.0.7339.80 allowed a remote attacker to bypass Mark of the Web via a crafted HTML page. (Chromium security severity: Low)","scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"143.0.7499.169-1~deb12u1","bookworm-security":"145.0.7632.159-1~deb12u1"},"fixed_version":"0","urgency":"unimportant"},"bullseye":{"status":"resolved","repositories":{"bullseye":"120.0.6099.224-1~deb11u1","bullseye-security":"120.0.6099.224-1~deb11u1"},"fixed_version":"0","urgency":"unimportant"},"forky":{"status":"resolved","repositories":{"forky":"145.0.7632.159-1"},"fixed_version":"0","urgency":"unimportant"},"sid":{"status":"resolved","repositories":{"sid":"146.0.7680.71-1"},"fixed_version":"0","urgency":"unimportant"},"trixie":{"status":"resolved","repositories":{"trixie":"143.0.7499.169-1~deb13u1","trixie-security":"145.0.7632.159-1~deb13u1"},"fixed_version":"0","urgency":"unimportant"}}},"CVE-2025-12906":{"description":"Inappropriate implementation in Permissions in Google Chrome prior to 140.0.7339.80 allowed a remote attacker to perform UI spoofing via a crafted HTML page. (Chromium security severity: Low)","scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"143.0.7499.169-1~deb12u1","bookworm-security":"145.0.7632.159-1~deb12u1"},"fixed_version":"140.0.7339.80-1~deb12u1","urgency":"not yet assigned"},"bullseye":{"status":"open","repositories":{"bullseye":"120.0.6099.224-1~deb11u1","bullseye-security":"120.0.6099.224-1~deb11u1"},"urgency":"end-of-life"},"forky":{"status":"resolved","repositories":{"forky":"145.0.7632.159-1"},"fixed_version":"140.0.7339.80-1","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"146.0.7680.71-1"},"fixed_version":"140.0.7339.80-1","urgency":"not yet assigned"},"trixie":{"status":"resolved","repositories":{"trixie":"143.0.7499.169-1~deb13u1","trixie-security":"145.0.7632.159-1~deb13u1"},"fixed_version":"140.0.7339.80-1~deb13u1","urgency":"not yet assigned"}}},"CVE-2025-12907":{"description":"Insufficient validation of untrusted input in Devtools in Google Chrome prior to 140.0.7339.80 allowed a remote attacker to execute arbitrary code via user action in Devtools. (Chromium security severity: Low)","scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"143.0.7499.169-1~deb12u1","bookworm-security":"145.0.7632.159-1~deb12u1"},"fixed_version":"140.0.7339.80-1~deb12u1","urgency":"not yet assigned"},"bullseye":{"status":"open","repositories":{"bullseye":"120.0.6099.224-1~deb11u1","bullseye-security":"120.0.6099.224-1~deb11u1"},"urgency":"end-of-life"},"forky":{"status":"resolved","repositories":{"forky":"145.0.7632.159-1"},"fixed_version":"140.0.7339.80-1","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"146.0.7680.71-1"},"fixed_version":"140.0.7339.80-1","urgency":"not yet assigned"},"trixie":{"status":"resolved","repositories":{"trixie":"143.0.7499.169-1~deb13u1","trixie-security":"145.0.7632.159-1~deb13u1"},"fixed_version":"140.0.7339.80-1~deb13u1","urgency":"not yet assigned"}}},"CVE-2025-12908":{"description":"Insufficient validation of untrusted input in Downloads in Google Chrome on Android prior to 140.0.7339.80 allowed a remote attacker to perform domain spoofing via a crafted HTML page. (Chromium security severity: Low)","scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"143.0.7499.169-1~deb12u1","bookworm-security":"145.0.7632.159-1~deb12u1"},"fixed_version":"0","urgency":"unimportant"},"bullseye":{"status":"resolved","repositories":{"bullseye":"120.0.6099.224-1~deb11u1","bullseye-security":"120.0.6099.224-1~deb11u1"},"fixed_version":"0","urgency":"unimportant"},"forky":{"status":"resolved","repositories":{"forky":"145.0.7632.159-1"},"fixed_version":"0","urgency":"unimportant"},"sid":{"status":"resolved","repositories":{"sid":"146.0.7680.71-1"},"fixed_version":"0","urgency":"unimportant"},"trixie":{"status":"resolved","repositories":{"trixie":"143.0.7499.169-1~deb13u1","trixie-security":"145.0.7632.159-1~deb13u1"},"fixed_version":"0","urgency":"unimportant"}}},"CVE-2025-12909":{"description":"Insufficient policy enforcement in Devtools in Google Chrome prior to 140.0.7339.80 allowed a remote attacker to leak cross-origin data via Devtools. (Chromium security severity: Low)","scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"143.0.7499.169-1~deb12u1","bookworm-security":"145.0.7632.159-1~deb12u1"},"fixed_version":"140.0.7339.80-1~deb12u1","urgency":"not yet assigned"},"bullseye":{"status":"open","repositories":{"bullseye":"120.0.6099.224-1~deb11u1","bullseye-security":"120.0.6099.224-1~deb11u1"},"urgency":"end-of-life"},"forky":{"status":"resolved","repositories":{"forky":"145.0.7632.159-1"},"fixed_version":"140.0.7339.80-1","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"146.0.7680.71-1"},"fixed_version":"140.0.7339.80-1","urgency":"not yet assigned"},"trixie":{"status":"resolved","repositories":{"trixie":"143.0.7499.169-1~deb13u1","trixie-security":"145.0.7632.159-1~deb13u1"},"fixed_version":"140.0.7339.80-1~deb13u1","urgency":"not yet assigned"}}},"CVE-2025-12910":{"description":"Inappropriate implementation in Passkeys in Google Chrome prior to 140.0.7339.80 allowed a local attacker to obtain potentially sensitive information via debug logs. (Chromium security severity: Low)","scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"143.0.7499.169-1~deb12u1","bookworm-security":"145.0.7632.159-1~deb12u1"},"fixed_version":"140.0.7339.80-1~deb12u1","urgency":"not yet assigned"},"bullseye":{"status":"open","repositories":{"bullseye":"120.0.6099.224-1~deb11u1","bullseye-security":"120.0.6099.224-1~deb11u1"},"urgency":"end-of-life"},"forky":{"status":"resolved","repositories":{"forky":"145.0.7632.159-1"},"fixed_version":"140.0.7339.80-1","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"146.0.7680.71-1"},"fixed_version":"140.0.7339.80-1","urgency":"not yet assigned"},"trixie":{"status":"resolved","repositories":{"trixie":"143.0.7499.169-1~deb13u1","trixie-security":"145.0.7632.159-1~deb13u1"},"fixed_version":"140.0.7339.80-1~deb13u1","urgency":"not yet assigned"}}},"CVE-2025-12911":{"description":"Inappropriate implementation in Permissions in Google Chrome prior to 140.0.7339.80 allowed a remote attacker to perform UI spoofing via a crafted HTML page. (Chromium security severity: Low)","scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"143.0.7499.169-1~deb12u1","bookworm-security":"145.0.7632.159-1~deb12u1"},"fixed_version":"140.0.7339.80-1~deb12u1","urgency":"not yet assigned"},"bullseye":{"status":"open","repositories":{"bullseye":"120.0.6099.224-1~deb11u1","bullseye-security":"120.0.6099.224-1~deb11u1"},"urgency":"end-of-life"},"forky":{"status":"resolved","repositories":{"forky":"145.0.7632.159-1"},"fixed_version":"140.0.7339.80-1","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"146.0.7680.71-1"},"fixed_version":"140.0.7339.80-1","urgency":"not yet assigned"},"trixie":{"status":"resolved","repositories":{"trixie":"143.0.7499.169-1~deb13u1","trixie-security":"145.0.7632.159-1~deb13u1"},"fixed_version":"140.0.7339.80-1~deb13u1","urgency":"not yet assigned"}}},"CVE-2025-13042":{"description":"Inappropriate implementation in V8 in Google Chrome prior to 142.0.7444.166 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. (Chromium security severity: High)","scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"143.0.7499.169-1~deb12u1","bookworm-security":"145.0.7632.159-1~deb12u1"},"fixed_version":"142.0.7444.162-1~deb12u1","urgency":"not yet assigned"},"bullseye":{"status":"open","repositories":{"bullseye":"120.0.6099.224-1~deb11u1","bullseye-security":"120.0.6099.224-1~deb11u1"},"urgency":"end-of-life"},"forky":{"status":"resolved","repositories":{"forky":"145.0.7632.159-1"},"fixed_version":"142.0.7444.162-1","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"146.0.7680.71-1"},"fixed_version":"142.0.7444.162-1","urgency":"not yet assigned"},"trixie":{"status":"resolved","repositories":{"trixie":"143.0.7499.169-1~deb13u1","trixie-security":"145.0.7632.159-1~deb13u1"},"fixed_version":"142.0.7444.162-1~deb13u1","urgency":"not yet assigned"}}},"CVE-2025-13097":{"description":"Inappropriate implementation in DevTools in Google Chrome prior to 136.0.7103.59 allowed a remote attacker to potentially perform a sandbox escape via a crafted HTML page. (Chromium security severity: Medium)","scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"143.0.7499.169-1~deb12u1","bookworm-security":"145.0.7632.159-1~deb12u1"},"fixed_version":"136.0.7103.59-2~deb12u2","urgency":"not yet assigned"},"bullseye":{"status":"open","repositories":{"bullseye":"120.0.6099.224-1~deb11u1","bullseye-security":"120.0.6099.224-1~deb11u1"},"urgency":"end-of-life"},"forky":{"status":"resolved","repositories":{"forky":"145.0.7632.159-1"},"fixed_version":"136.0.7103.59-2","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"146.0.7680.71-1"},"fixed_version":"136.0.7103.59-2","urgency":"not yet assigned"},"trixie":{"status":"resolved","repositories":{"trixie":"143.0.7499.169-1~deb13u1","trixie-security":"145.0.7632.159-1~deb13u1"},"fixed_version":"136.0.7103.59-2","urgency":"not yet assigned"}}},"CVE-2025-13102":{"description":"Inappropriate implementation in WebApp Installs in Google Chrome on Android prior to 134.0.6998.35 allowed a remote attacker to perform UI spoofing via a crafted HTML page. (Chromium security severity: Low)","scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"143.0.7499.169-1~deb12u1","bookworm-security":"145.0.7632.159-1~deb12u1"},"fixed_version":"0","urgency":"unimportant"},"bullseye":{"status":"resolved","repositories":{"bullseye":"120.0.6099.224-1~deb11u1","bullseye-security":"120.0.6099.224-1~deb11u1"},"fixed_version":"0","urgency":"unimportant"},"forky":{"status":"resolved","repositories":{"forky":"145.0.7632.159-1"},"fixed_version":"0","urgency":"unimportant"},"sid":{"status":"resolved","repositories":{"sid":"146.0.7680.71-1"},"fixed_version":"0","urgency":"unimportant"},"trixie":{"status":"resolved","repositories":{"trixie":"143.0.7499.169-1~deb13u1","trixie-security":"145.0.7632.159-1~deb13u1"},"fixed_version":"0","urgency":"unimportant"}}},"CVE-2025-13107":{"description":"Inappropriate implementation in Compositing in Google Chrome prior to 140.0.7339.80 allowed a remote attacker to perform UI spoofing via a crafted HTML page. (Chromium security severity: Low)","scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"143.0.7499.169-1~deb12u1","bookworm-security":"145.0.7632.159-1~deb12u1"},"fixed_version":"140.0.7339.80-1~deb12u1","urgency":"not yet assigned"},"bullseye":{"status":"open","repositories":{"bullseye":"120.0.6099.224-1~deb11u1","bullseye-security":"120.0.6099.224-1~deb11u1"},"urgency":"end-of-life"},"forky":{"status":"resolved","repositories":{"forky":"145.0.7632.159-1"},"fixed_version":"140.0.7339.80-1","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"146.0.7680.71-1"},"fixed_version":"140.0.7339.80-1","urgency":"not yet assigned"},"trixie":{"status":"resolved","repositories":{"trixie":"143.0.7499.169-1~deb13u1","trixie-security":"145.0.7632.159-1~deb13u1"},"fixed_version":"140.0.7339.80-1~deb13u1","urgency":"not yet assigned"}}},"CVE-2025-13223":{"description":"Type Confusion in V8 in Google Chrome prior to 142.0.7444.175 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. (Chromium security severity: High)","scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"143.0.7499.169-1~deb12u1","bookworm-security":"145.0.7632.159-1~deb12u1"},"fixed_version":"142.0.7444.175-1~deb12u1","urgency":"not yet assigned"},"bullseye":{"status":"open","repositories":{"bullseye":"120.0.6099.224-1~deb11u1","bullseye-security":"120.0.6099.224-1~deb11u1"},"urgency":"end-of-life"},"forky":{"status":"resolved","repositories":{"forky":"145.0.7632.159-1"},"fixed_version":"142.0.7444.175-1","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"146.0.7680.71-1"},"fixed_version":"142.0.7444.175-1","urgency":"not yet assigned"},"trixie":{"status":"resolved","repositories":{"trixie":"143.0.7499.169-1~deb13u1","trixie-security":"145.0.7632.159-1~deb13u1"},"fixed_version":"142.0.7444.175-1~deb13u1","urgency":"not yet assigned"}}},"CVE-2025-13224":{"description":"Type Confusion in V8 in Google Chrome prior to 142.0.7444.175 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. (Chromium security severity: High)","scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"143.0.7499.169-1~deb12u1","bookworm-security":"145.0.7632.159-1~deb12u1"},"fixed_version":"142.0.7444.175-1~deb12u1","urgency":"not yet assigned"},"bullseye":{"status":"open","repositories":{"bullseye":"120.0.6099.224-1~deb11u1","bullseye-security":"120.0.6099.224-1~deb11u1"},"urgency":"end-of-life"},"forky":{"status":"resolved","repositories":{"forky":"145.0.7632.159-1"},"fixed_version":"142.0.7444.175-1","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"146.0.7680.71-1"},"fixed_version":"142.0.7444.175-1","urgency":"not yet assigned"},"trixie":{"status":"resolved","repositories":{"trixie":"143.0.7499.169-1~deb13u1","trixie-security":"145.0.7632.159-1~deb13u1"},"fixed_version":"142.0.7444.175-1~deb13u1","urgency":"not yet assigned"}}},"CVE-2025-13226":{"description":"Type Confusion in V8 in Google Chrome prior to 142.0.7444.59 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. (Chromium security severity: High)","scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"143.0.7499.169-1~deb12u1","bookworm-security":"145.0.7632.159-1~deb12u1"},"fixed_version":"142.0.7444.59-1~deb12u1","urgency":"not yet assigned"},"bullseye":{"status":"open","repositories":{"bullseye":"120.0.6099.224-1~deb11u1","bullseye-security":"120.0.6099.224-1~deb11u1"},"urgency":"end-of-life"},"forky":{"status":"resolved","repositories":{"forky":"145.0.7632.159-1"},"fixed_version":"142.0.7444.59-1","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"146.0.7680.71-1"},"fixed_version":"142.0.7444.59-1","urgency":"not yet assigned"},"trixie":{"status":"resolved","repositories":{"trixie":"143.0.7499.169-1~deb13u1","trixie-security":"145.0.7632.159-1~deb13u1"},"fixed_version":"142.0.7444.59-1~deb13u1","urgency":"not yet assigned"}}},"CVE-2025-13227":{"description":"Type Confusion in V8 in Google Chrome prior to 142.0.7444.59 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. (Chromium security severity: High)","scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"143.0.7499.169-1~deb12u1","bookworm-security":"145.0.7632.159-1~deb12u1"},"fixed_version":"142.0.7444.59-1~deb12u1","urgency":"not yet assigned"},"bullseye":{"status":"open","repositories":{"bullseye":"120.0.6099.224-1~deb11u1","bullseye-security":"120.0.6099.224-1~deb11u1"},"urgency":"end-of-life"},"forky":{"status":"resolved","repositories":{"forky":"145.0.7632.159-1"},"fixed_version":"142.0.7444.59-1","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"146.0.7680.71-1"},"fixed_version":"142.0.7444.59-1","urgency":"not yet assigned"},"trixie":{"status":"resolved","repositories":{"trixie":"143.0.7499.169-1~deb13u1","trixie-security":"145.0.7632.159-1~deb13u1"},"fixed_version":"142.0.7444.59-1~deb13u1","urgency":"not yet assigned"}}},"CVE-2025-13228":{"description":"Type Confusion in V8 in Google Chrome prior to 142.0.7444.59 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. (Chromium security severity: High)","scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"143.0.7499.169-1~deb12u1","bookworm-security":"145.0.7632.159-1~deb12u1"},"fixed_version":"142.0.7444.59-1~deb12u1","urgency":"not yet assigned"},"bullseye":{"status":"open","repositories":{"bullseye":"120.0.6099.224-1~deb11u1","bullseye-security":"120.0.6099.224-1~deb11u1"},"urgency":"end-of-life"},"forky":{"status":"resolved","repositories":{"forky":"145.0.7632.159-1"},"fixed_version":"142.0.7444.59-1","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"146.0.7680.71-1"},"fixed_version":"142.0.7444.59-1","urgency":"not yet assigned"},"trixie":{"status":"resolved","repositories":{"trixie":"143.0.7499.169-1~deb13u1","trixie-security":"145.0.7632.159-1~deb13u1"},"fixed_version":"142.0.7444.59-1~deb13u1","urgency":"not yet assigned"}}},"CVE-2025-13229":{"description":"Type Confusion in V8 in Google Chrome prior to 142.0.7444.59 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. (Chromium security severity: High)","scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"143.0.7499.169-1~deb12u1","bookworm-security":"145.0.7632.159-1~deb12u1"},"fixed_version":"142.0.7444.59-1~deb12u1","urgency":"not yet assigned"},"bullseye":{"status":"open","repositories":{"bullseye":"120.0.6099.224-1~deb11u1","bullseye-security":"120.0.6099.224-1~deb11u1"},"urgency":"end-of-life"},"forky":{"status":"resolved","repositories":{"forky":"145.0.7632.159-1"},"fixed_version":"142.0.7444.59-1","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"146.0.7680.71-1"},"fixed_version":"142.0.7444.59-1","urgency":"not yet assigned"},"trixie":{"status":"resolved","repositories":{"trixie":"143.0.7499.169-1~deb13u1","trixie-security":"145.0.7632.159-1~deb13u1"},"fixed_version":"142.0.7444.59-1~deb13u1","urgency":"not yet assigned"}}},"CVE-2025-13230":{"description":"Type Confusion in V8 in Google Chrome prior to 142.0.7444.59 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. (Chromium security severity: High)","scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"143.0.7499.169-1~deb12u1","bookworm-security":"145.0.7632.159-1~deb12u1"},"fixed_version":"142.0.7444.59-1~deb12u1","urgency":"not yet assigned"},"bullseye":{"status":"open","repositories":{"bullseye":"120.0.6099.224-1~deb11u1","bullseye-security":"120.0.6099.224-1~deb11u1"},"urgency":"end-of-life"},"forky":{"status":"resolved","repositories":{"forky":"145.0.7632.159-1"},"fixed_version":"142.0.7444.59-1","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"146.0.7680.71-1"},"fixed_version":"142.0.7444.59-1","urgency":"not yet assigned"},"trixie":{"status":"resolved","repositories":{"trixie":"143.0.7499.169-1~deb13u1","trixie-security":"145.0.7632.159-1~deb13u1"},"fixed_version":"142.0.7444.59-1~deb13u1","urgency":"not yet assigned"}}},"CVE-2025-13630":{"description":"Type Confusion in V8 in Google Chrome prior to 143.0.7499.41 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. (Chromium security severity: High)","scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"143.0.7499.169-1~deb12u1","bookworm-security":"145.0.7632.159-1~deb12u1"},"fixed_version":"143.0.7499.40-1~deb12u1","urgency":"not yet assigned"},"bullseye":{"status":"open","repositories":{"bullseye":"120.0.6099.224-1~deb11u1","bullseye-security":"120.0.6099.224-1~deb11u1"},"urgency":"end-of-life"},"forky":{"status":"resolved","repositories":{"forky":"145.0.7632.159-1"},"fixed_version":"143.0.7499.40-1","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"146.0.7680.71-1"},"fixed_version":"143.0.7499.40-1","urgency":"not yet assigned"},"trixie":{"status":"resolved","repositories":{"trixie":"143.0.7499.169-1~deb13u1","trixie-security":"145.0.7632.159-1~deb13u1"},"fixed_version":"143.0.7499.40-1~deb13u1","urgency":"not yet assigned"}}},"CVE-2025-13631":{"description":"Inappropriate implementation in Google Updater in Google Chrome on Mac prior to 143.0.7499.41 allowed a remote attacker to perform privilege escalation via a crafted file. (Chromium security severity: High)","scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"143.0.7499.169-1~deb12u1","bookworm-security":"145.0.7632.159-1~deb12u1"},"fixed_version":"143.0.7499.40-1~deb12u1","urgency":"not yet assigned"},"bullseye":{"status":"open","repositories":{"bullseye":"120.0.6099.224-1~deb11u1","bullseye-security":"120.0.6099.224-1~deb11u1"},"urgency":"end-of-life"},"forky":{"status":"resolved","repositories":{"forky":"145.0.7632.159-1"},"fixed_version":"143.0.7499.40-1","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"146.0.7680.71-1"},"fixed_version":"143.0.7499.40-1","urgency":"not yet assigned"},"trixie":{"status":"resolved","repositories":{"trixie":"143.0.7499.169-1~deb13u1","trixie-security":"145.0.7632.159-1~deb13u1"},"fixed_version":"143.0.7499.40-1~deb13u1","urgency":"not yet assigned"}}},"CVE-2025-13632":{"description":"Inappropriate implementation in DevTools in Google Chrome prior to 143.0.7499.41 allowed an attacker who convinced a user to install a malicious extension to potentially perform a sandbox escape via a crafted Chrome Extension. (Chromium security severity: High)","scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"143.0.7499.169-1~deb12u1","bookworm-security":"145.0.7632.159-1~deb12u1"},"fixed_version":"143.0.7499.40-1~deb12u1","urgency":"not yet assigned"},"bullseye":{"status":"open","repositories":{"bullseye":"120.0.6099.224-1~deb11u1","bullseye-security":"120.0.6099.224-1~deb11u1"},"urgency":"end-of-life"},"forky":{"status":"resolved","repositories":{"forky":"145.0.7632.159-1"},"fixed_version":"143.0.7499.40-1","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"146.0.7680.71-1"},"fixed_version":"143.0.7499.40-1","urgency":"not yet assigned"},"trixie":{"status":"resolved","repositories":{"trixie":"143.0.7499.169-1~deb13u1","trixie-security":"145.0.7632.159-1~deb13u1"},"fixed_version":"143.0.7499.40-1~deb13u1","urgency":"not yet assigned"}}},"CVE-2025-13633":{"description":"Use after free in Digital Credentials in Google Chrome prior to 143.0.7499.41 allowed a remote attacker who had compromised the renderer process to potentially exploit heap corruption via a crafted HTML page. (Chromium security severity: High)","scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"143.0.7499.169-1~deb12u1","bookworm-security":"145.0.7632.159-1~deb12u1"},"fixed_version":"143.0.7499.40-1~deb12u1","urgency":"not yet assigned"},"bullseye":{"status":"open","repositories":{"bullseye":"120.0.6099.224-1~deb11u1","bullseye-security":"120.0.6099.224-1~deb11u1"},"urgency":"end-of-life"},"forky":{"status":"resolved","repositories":{"forky":"145.0.7632.159-1"},"fixed_version":"143.0.7499.40-1","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"146.0.7680.71-1"},"fixed_version":"143.0.7499.40-1","urgency":"not yet assigned"},"trixie":{"status":"resolved","repositories":{"trixie":"143.0.7499.169-1~deb13u1","trixie-security":"145.0.7632.159-1~deb13u1"},"fixed_version":"143.0.7499.40-1~deb13u1","urgency":"not yet assigned"}}},"CVE-2025-13634":{"description":"Inappropriate implementation in Downloads in Google Chrome on Windows prior to 143.0.7499.41 allowed a local attacker to bypass mark of the web via a crafted HTML page. (Chromium security severity: Medium)","scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"143.0.7499.169-1~deb12u1","bookworm-security":"145.0.7632.159-1~deb12u1"},"fixed_version":"143.0.7499.40-1~deb12u1","urgency":"not yet assigned"},"bullseye":{"status":"open","repositories":{"bullseye":"120.0.6099.224-1~deb11u1","bullseye-security":"120.0.6099.224-1~deb11u1"},"urgency":"end-of-life"},"forky":{"status":"resolved","repositories":{"forky":"145.0.7632.159-1"},"fixed_version":"143.0.7499.40-1","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"146.0.7680.71-1"},"fixed_version":"143.0.7499.40-1","urgency":"not yet assigned"},"trixie":{"status":"resolved","repositories":{"trixie":"143.0.7499.169-1~deb13u1","trixie-security":"145.0.7632.159-1~deb13u1"},"fixed_version":"143.0.7499.40-1~deb13u1","urgency":"not yet assigned"}}},"CVE-2025-13635":{"description":"Inappropriate implementation in Downloads in Google Chrome prior to 143.0.7499.41 allowed a local attacker to perform UI spoofing via a crafted HTML page. (Chromium security severity: Low)","scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"143.0.7499.169-1~deb12u1","bookworm-security":"145.0.7632.159-1~deb12u1"},"fixed_version":"143.0.7499.40-1~deb12u1","urgency":"not yet assigned"},"bullseye":{"status":"open","repositories":{"bullseye":"120.0.6099.224-1~deb11u1","bullseye-security":"120.0.6099.224-1~deb11u1"},"urgency":"end-of-life"},"forky":{"status":"resolved","repositories":{"forky":"145.0.7632.159-1"},"fixed_version":"143.0.7499.40-1","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"146.0.7680.71-1"},"fixed_version":"143.0.7499.40-1","urgency":"not yet assigned"},"trixie":{"status":"resolved","repositories":{"trixie":"143.0.7499.169-1~deb13u1","trixie-security":"145.0.7632.159-1~deb13u1"},"fixed_version":"143.0.7499.40-1~deb13u1","urgency":"not yet assigned"}}},"CVE-2025-13636":{"description":"Inappropriate implementation in Split View in Google Chrome prior to 143.0.7499.41 allowed a remote attacker who convinced a user to engage in specific UI gestures to perform UI spoofing via a crafted domain name. (Chromium security severity: Low)","scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"143.0.7499.169-1~deb12u1","bookworm-security":"145.0.7632.159-1~deb12u1"},"fixed_version":"143.0.7499.40-1~deb12u1","urgency":"not yet assigned"},"bullseye":{"status":"open","repositories":{"bullseye":"120.0.6099.224-1~deb11u1","bullseye-security":"120.0.6099.224-1~deb11u1"},"urgency":"end-of-life"},"forky":{"status":"resolved","repositories":{"forky":"145.0.7632.159-1"},"fixed_version":"143.0.7499.40-1","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"146.0.7680.71-1"},"fixed_version":"143.0.7499.40-1","urgency":"not yet assigned"},"trixie":{"status":"resolved","repositories":{"trixie":"143.0.7499.169-1~deb13u1","trixie-security":"145.0.7632.159-1~deb13u1"},"fixed_version":"143.0.7499.40-1~deb13u1","urgency":"not yet assigned"}}},"CVE-2025-13637":{"description":"Inappropriate implementation in Downloads in Google Chrome prior to 143.0.7499.41 allowed a remote attacker who convinced a user to engage in specific UI gestures to bypass download protections via a crafted HTML page. (Chromium security severity: Low)","scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"143.0.7499.169-1~deb12u1","bookworm-security":"145.0.7632.159-1~deb12u1"},"fixed_version":"143.0.7499.40-1~deb12u1","urgency":"not yet assigned"},"bullseye":{"status":"open","repositories":{"bullseye":"120.0.6099.224-1~deb11u1","bullseye-security":"120.0.6099.224-1~deb11u1"},"urgency":"end-of-life"},"forky":{"status":"resolved","repositories":{"forky":"145.0.7632.159-1"},"fixed_version":"143.0.7499.40-1","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"146.0.7680.71-1"},"fixed_version":"143.0.7499.40-1","urgency":"not yet assigned"},"trixie":{"status":"resolved","repositories":{"trixie":"143.0.7499.169-1~deb13u1","trixie-security":"145.0.7632.159-1~deb13u1"},"fixed_version":"143.0.7499.40-1~deb13u1","urgency":"not yet assigned"}}},"CVE-2025-13638":{"description":"Use after free in Media Stream in Google Chrome prior to 143.0.7499.41 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. (Chromium security severity: Low)","scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"143.0.7499.169-1~deb12u1","bookworm-security":"145.0.7632.159-1~deb12u1"},"fixed_version":"143.0.7499.40-1~deb12u1","urgency":"not yet assigned"},"bullseye":{"status":"open","repositories":{"bullseye":"120.0.6099.224-1~deb11u1","bullseye-security":"120.0.6099.224-1~deb11u1"},"urgency":"end-of-life"},"forky":{"status":"resolved","repositories":{"forky":"145.0.7632.159-1"},"fixed_version":"143.0.7499.40-1","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"146.0.7680.71-1"},"fixed_version":"143.0.7499.40-1","urgency":"not yet assigned"},"trixie":{"status":"resolved","repositories":{"trixie":"143.0.7499.169-1~deb13u1","trixie-security":"145.0.7632.159-1~deb13u1"},"fixed_version":"143.0.7499.40-1~deb13u1","urgency":"not yet assigned"}}},"CVE-2025-13639":{"description":"Inappropriate implementation in WebRTC in Google Chrome prior to 143.0.7499.41 allowed a remote attacker to perform arbitrary read/write via a crafted HTML page. (Chromium security severity: Low)","scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"143.0.7499.169-1~deb12u1","bookworm-security":"145.0.7632.159-1~deb12u1"},"fixed_version":"143.0.7499.40-1~deb12u1","urgency":"not yet assigned"},"bullseye":{"status":"open","repositories":{"bullseye":"120.0.6099.224-1~deb11u1","bullseye-security":"120.0.6099.224-1~deb11u1"},"urgency":"end-of-life"},"forky":{"status":"resolved","repositories":{"forky":"145.0.7632.159-1"},"fixed_version":"143.0.7499.40-1","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"146.0.7680.71-1"},"fixed_version":"143.0.7499.40-1","urgency":"not yet assigned"},"trixie":{"status":"resolved","repositories":{"trixie":"143.0.7499.169-1~deb13u1","trixie-security":"145.0.7632.159-1~deb13u1"},"fixed_version":"143.0.7499.40-1~deb13u1","urgency":"not yet assigned"}}},"CVE-2025-13640":{"description":"Inappropriate implementation in Passwords in Google Chrome prior to 143.0.7499.41 allowed a local attacker to bypass authentication via physical access to the device. (Chromium security severity: Low)","scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"143.0.7499.169-1~deb12u1","bookworm-security":"145.0.7632.159-1~deb12u1"},"fixed_version":"143.0.7499.40-1~deb12u1","urgency":"not yet assigned"},"bullseye":{"status":"open","repositories":{"bullseye":"120.0.6099.224-1~deb11u1","bullseye-security":"120.0.6099.224-1~deb11u1"},"urgency":"end-of-life"},"forky":{"status":"resolved","repositories":{"forky":"145.0.7632.159-1"},"fixed_version":"143.0.7499.40-1","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"146.0.7680.71-1"},"fixed_version":"143.0.7499.40-1","urgency":"not yet assigned"},"trixie":{"status":"resolved","repositories":{"trixie":"143.0.7499.169-1~deb13u1","trixie-security":"145.0.7632.159-1~deb13u1"},"fixed_version":"143.0.7499.40-1~deb13u1","urgency":"not yet assigned"}}},"CVE-2025-13720":{"description":"Bad cast in Loader in Google Chrome prior to 143.0.7499.41 allowed a remote attacker who had compromised the renderer process to potentially exploit heap corruption via a crafted HTML page. (Chromium security severity: Medium)","scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"143.0.7499.169-1~deb12u1","bookworm-security":"145.0.7632.159-1~deb12u1"},"fixed_version":"143.0.7499.40-1~deb12u1","urgency":"not yet assigned"},"bullseye":{"status":"open","repositories":{"bullseye":"120.0.6099.224-1~deb11u1","bullseye-security":"120.0.6099.224-1~deb11u1"},"urgency":"end-of-life"},"forky":{"status":"resolved","repositories":{"forky":"145.0.7632.159-1"},"fixed_version":"143.0.7499.40-1","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"146.0.7680.71-1"},"fixed_version":"143.0.7499.40-1","urgency":"not yet assigned"},"trixie":{"status":"resolved","repositories":{"trixie":"143.0.7499.169-1~deb13u1","trixie-security":"145.0.7632.159-1~deb13u1"},"fixed_version":"143.0.7499.40-1~deb13u1","urgency":"not yet assigned"}}},"CVE-2025-13721":{"description":"Race in v8 in Google Chrome prior to 143.0.7499.41 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. (Chromium security severity: Medium)","scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"143.0.7499.169-1~deb12u1","bookworm-security":"145.0.7632.159-1~deb12u1"},"fixed_version":"143.0.7499.40-1~deb12u1","urgency":"not yet assigned"},"bullseye":{"status":"open","repositories":{"bullseye":"120.0.6099.224-1~deb11u1","bullseye-security":"120.0.6099.224-1~deb11u1"},"urgency":"end-of-life"},"forky":{"status":"resolved","repositories":{"forky":"145.0.7632.159-1"},"fixed_version":"143.0.7499.40-1","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"146.0.7680.71-1"},"fixed_version":"143.0.7499.40-1","urgency":"not yet assigned"},"trixie":{"status":"resolved","repositories":{"trixie":"143.0.7499.169-1~deb13u1","trixie-security":"145.0.7632.159-1~deb13u1"},"fixed_version":"143.0.7499.40-1~deb13u1","urgency":"not yet assigned"}}},"CVE-2025-13992":{"description":"Side-channel information leakage in Navigation and Loading in Google Chrome prior to 139.0.7258.66 allowed a remote attacker to bypass site isolation via a crafted HTML page. (Chromium security severity: Medium)","scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"143.0.7499.169-1~deb12u1","bookworm-security":"145.0.7632.159-1~deb12u1"},"fixed_version":"139.0.7258.66-1~deb12u1","urgency":"not yet assigned"},"bullseye":{"status":"open","repositories":{"bullseye":"120.0.6099.224-1~deb11u1","bullseye-security":"120.0.6099.224-1~deb11u1"},"urgency":"end-of-life"},"forky":{"status":"resolved","repositories":{"forky":"145.0.7632.159-1"},"fixed_version":"139.0.7258.66-1","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"146.0.7680.71-1"},"fixed_version":"139.0.7258.66-1","urgency":"not yet assigned"},"trixie":{"status":"resolved","repositories":{"trixie":"143.0.7499.169-1~deb13u1","trixie-security":"145.0.7632.159-1~deb13u1"},"fixed_version":"139.0.7258.127-1~deb13u1","urgency":"not yet assigned"}}},"CVE-2025-14174":{"description":"Out of bounds memory access in ANGLE in Google Chrome on Mac prior to 143.0.7499.110 allowed a remote attacker to perform out of bounds memory access via a crafted HTML page. (Chromium security severity: High)","scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"143.0.7499.169-1~deb12u1","bookworm-security":"145.0.7632.159-1~deb12u1"},"fixed_version":"0","urgency":"unimportant"},"bullseye":{"status":"resolved","repositories":{"bullseye":"120.0.6099.224-1~deb11u1","bullseye-security":"120.0.6099.224-1~deb11u1"},"fixed_version":"0","urgency":"unimportant"},"forky":{"status":"resolved","repositories":{"forky":"145.0.7632.159-1"},"fixed_version":"0","urgency":"unimportant"},"sid":{"status":"resolved","repositories":{"sid":"146.0.7680.71-1"},"fixed_version":"0","urgency":"unimportant"},"trixie":{"status":"resolved","repositories":{"trixie":"143.0.7499.169-1~deb13u1","trixie-security":"145.0.7632.159-1~deb13u1"},"fixed_version":"0","urgency":"unimportant"}}},"CVE-2025-1426":{"description":"Heap buffer overflow in GPU in Google Chrome on Android prior to 133.0.6943.126 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. (Chromium security severity: High)","scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"143.0.7499.169-1~deb12u1","bookworm-security":"145.0.7632.159-1~deb12u1"},"fixed_version":"133.0.6943.126-1~deb12u1","urgency":"not yet assigned"},"bullseye":{"status":"open","repositories":{"bullseye":"120.0.6099.224-1~deb11u1","bullseye-security":"120.0.6099.224-1~deb11u1"},"urgency":"end-of-life"},"forky":{"status":"resolved","repositories":{"forky":"145.0.7632.159-1"},"fixed_version":"133.0.6943.126-1","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"146.0.7680.71-1"},"fixed_version":"133.0.6943.126-1","urgency":"not yet assigned"},"trixie":{"status":"resolved","repositories":{"trixie":"143.0.7499.169-1~deb13u1","trixie-security":"145.0.7632.159-1~deb13u1"},"fixed_version":"133.0.6943.126-1","urgency":"not yet assigned"}}},"CVE-2025-14372":{"description":"Use after free in Password Manager in Google Chrome prior to 143.0.7499.110 allowed a remote attacker to potentially perform a sandbox escape via a crafted HTML page. (Chromium security severity: Medium)","scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"143.0.7499.169-1~deb12u1","bookworm-security":"145.0.7632.159-1~deb12u1"},"fixed_version":"143.0.7499.109-1~deb12u1","urgency":"not yet assigned"},"bullseye":{"status":"open","repositories":{"bullseye":"120.0.6099.224-1~deb11u1","bullseye-security":"120.0.6099.224-1~deb11u1"},"urgency":"end-of-life"},"forky":{"status":"resolved","repositories":{"forky":"145.0.7632.159-1"},"fixed_version":"143.0.7499.109-1","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"146.0.7680.71-1"},"fixed_version":"143.0.7499.109-1","urgency":"not yet assigned"},"trixie":{"status":"resolved","repositories":{"trixie":"143.0.7499.169-1~deb13u1","trixie-security":"145.0.7632.159-1~deb13u1"},"fixed_version":"143.0.7499.109-1~deb13u1","urgency":"not yet assigned"}}},"CVE-2025-14373":{"description":"Inappropriate implementation in Toolbar in Google Chrome on Android prior to 143.0.7499.110 allowed a remote attacker to perform domain spoofing via a crafted HTML page. (Chromium security severity: Medium)","scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"143.0.7499.169-1~deb12u1","bookworm-security":"145.0.7632.159-1~deb12u1"},"fixed_version":"143.0.7499.109-1~deb12u1","urgency":"not yet assigned"},"bullseye":{"status":"open","repositories":{"bullseye":"120.0.6099.224-1~deb11u1","bullseye-security":"120.0.6099.224-1~deb11u1"},"urgency":"end-of-life"},"forky":{"status":"resolved","repositories":{"forky":"145.0.7632.159-1"},"fixed_version":"143.0.7499.109-1","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"146.0.7680.71-1"},"fixed_version":"143.0.7499.109-1","urgency":"not yet assigned"},"trixie":{"status":"resolved","repositories":{"trixie":"143.0.7499.169-1~deb13u1","trixie-security":"145.0.7632.159-1~deb13u1"},"fixed_version":"143.0.7499.109-1~deb13u1","urgency":"not yet assigned"}}},"CVE-2025-14765":{"description":"Use after free in WebGPU in Google Chrome prior to 143.0.7499.147 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. (Chromium security severity: High)","scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"143.0.7499.169-1~deb12u1","bookworm-security":"145.0.7632.159-1~deb12u1"},"fixed_version":"143.0.7499.169-1~deb12u1","urgency":"not yet assigned"},"bullseye":{"status":"open","repositories":{"bullseye":"120.0.6099.224-1~deb11u1","bullseye-security":"120.0.6099.224-1~deb11u1"},"urgency":"end-of-life"},"forky":{"status":"resolved","repositories":{"forky":"145.0.7632.159-1"},"fixed_version":"143.0.7499.169-1","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"146.0.7680.71-1"},"fixed_version":"143.0.7499.169-1","urgency":"not yet assigned"},"trixie":{"status":"resolved","repositories":{"trixie":"143.0.7499.169-1~deb13u1","trixie-security":"145.0.7632.159-1~deb13u1"},"fixed_version":"143.0.7499.169-1~deb13u1","urgency":"not yet assigned"}}},"CVE-2025-14766":{"description":"Out of bounds read and write in V8 in Google Chrome prior to 143.0.7499.147 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. (Chromium security severity: High)","scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"143.0.7499.169-1~deb12u1","bookworm-security":"145.0.7632.159-1~deb12u1"},"fixed_version":"143.0.7499.169-1~deb12u1","urgency":"not yet assigned"},"bullseye":{"status":"open","repositories":{"bullseye":"120.0.6099.224-1~deb11u1","bullseye-security":"120.0.6099.224-1~deb11u1"},"urgency":"end-of-life"},"forky":{"status":"resolved","repositories":{"forky":"145.0.7632.159-1"},"fixed_version":"143.0.7499.169-1","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"146.0.7680.71-1"},"fixed_version":"143.0.7499.169-1","urgency":"not yet assigned"},"trixie":{"status":"resolved","repositories":{"trixie":"143.0.7499.169-1~deb13u1","trixie-security":"145.0.7632.159-1~deb13u1"},"fixed_version":"143.0.7499.169-1~deb13u1","urgency":"not yet assigned"}}},"CVE-2025-1914":{"description":"Out of bounds read in V8 in Google Chrome prior to 134.0.6998.35 allowed a remote attacker to perform out of bounds memory access via a crafted HTML page. (Chromium security severity: High)","scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"143.0.7499.169-1~deb12u1","bookworm-security":"145.0.7632.159-1~deb12u1"},"fixed_version":"134.0.6998.35-1~deb12u1","urgency":"not yet assigned"},"bullseye":{"status":"open","repositories":{"bullseye":"120.0.6099.224-1~deb11u1","bullseye-security":"120.0.6099.224-1~deb11u1"},"urgency":"end-of-life"},"forky":{"status":"resolved","repositories":{"forky":"145.0.7632.159-1"},"fixed_version":"134.0.6998.35-1","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"146.0.7680.71-1"},"fixed_version":"134.0.6998.35-1","urgency":"not yet assigned"},"trixie":{"status":"resolved","repositories":{"trixie":"143.0.7499.169-1~deb13u1","trixie-security":"145.0.7632.159-1~deb13u1"},"fixed_version":"134.0.6998.35-1","urgency":"not yet assigned"}}},"CVE-2025-1915":{"description":"Improper Limitation of a Pathname to a Restricted Directory in DevTools in Google Chrome on Windows prior to 134.0.6998.35 allowed an attacker who convinced a user to install a malicious extension to bypass file access restrictions via a crafted Chrome Extension. (Chromium security severity: Medium)","scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"143.0.7499.169-1~deb12u1","bookworm-security":"145.0.7632.159-1~deb12u1"},"fixed_version":"134.0.6998.35-1~deb12u1","urgency":"not yet assigned"},"bullseye":{"status":"open","repositories":{"bullseye":"120.0.6099.224-1~deb11u1","bullseye-security":"120.0.6099.224-1~deb11u1"},"urgency":"end-of-life"},"forky":{"status":"resolved","repositories":{"forky":"145.0.7632.159-1"},"fixed_version":"134.0.6998.35-1","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"146.0.7680.71-1"},"fixed_version":"134.0.6998.35-1","urgency":"not yet assigned"},"trixie":{"status":"resolved","repositories":{"trixie":"143.0.7499.169-1~deb13u1","trixie-security":"145.0.7632.159-1~deb13u1"},"fixed_version":"134.0.6998.35-1","urgency":"not yet assigned"}}},"CVE-2025-1916":{"description":"Use after free in Profiles in Google Chrome prior to 134.0.6998.35 allowed an attacker who convinced a user to install a malicious extension to potentially exploit heap corruption via a crafted HTML page. (Chromium security severity: Medium)","scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"143.0.7499.169-1~deb12u1","bookworm-security":"145.0.7632.159-1~deb12u1"},"fixed_version":"134.0.6998.35-1~deb12u1","urgency":"not yet assigned"},"bullseye":{"status":"open","repositories":{"bullseye":"120.0.6099.224-1~deb11u1","bullseye-security":"120.0.6099.224-1~deb11u1"},"urgency":"end-of-life"},"forky":{"status":"resolved","repositories":{"forky":"145.0.7632.159-1"},"fixed_version":"134.0.6998.35-1","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"146.0.7680.71-1"},"fixed_version":"134.0.6998.35-1","urgency":"not yet assigned"},"trixie":{"status":"resolved","repositories":{"trixie":"143.0.7499.169-1~deb13u1","trixie-security":"145.0.7632.159-1~deb13u1"},"fixed_version":"134.0.6998.35-1","urgency":"not yet assigned"}}},"CVE-2025-1917":{"description":"Inappropriate implementation in Browser UI in Google Chrome on Android prior to 134.0.6998.35 allowed a remote attacker to perform UI spoofing via a crafted HTML page. (Chromium security severity: Medium)","scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"143.0.7499.169-1~deb12u1","bookworm-security":"145.0.7632.159-1~deb12u1"},"fixed_version":"134.0.6998.35-1~deb12u1","urgency":"not yet assigned"},"bullseye":{"status":"open","repositories":{"bullseye":"120.0.6099.224-1~deb11u1","bullseye-security":"120.0.6099.224-1~deb11u1"},"urgency":"end-of-life"},"forky":{"status":"resolved","repositories":{"forky":"145.0.7632.159-1"},"fixed_version":"134.0.6998.35-1","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"146.0.7680.71-1"},"fixed_version":"134.0.6998.35-1","urgency":"not yet assigned"},"trixie":{"status":"resolved","repositories":{"trixie":"143.0.7499.169-1~deb13u1","trixie-security":"145.0.7632.159-1~deb13u1"},"fixed_version":"134.0.6998.35-1","urgency":"not yet assigned"}}},"CVE-2025-1918":{"description":"Out of bounds read in PDFium in Google Chrome prior to 134.0.6998.35 allowed a remote attacker to potentially perform out of bounds memory access via a crafted PDF file. (Chromium security severity: Medium)","scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"143.0.7499.169-1~deb12u1","bookworm-security":"145.0.7632.159-1~deb12u1"},"fixed_version":"134.0.6998.35-1~deb12u1","urgency":"not yet assigned"},"bullseye":{"status":"open","repositories":{"bullseye":"120.0.6099.224-1~deb11u1","bullseye-security":"120.0.6099.224-1~deb11u1"},"urgency":"end-of-life"},"forky":{"status":"resolved","repositories":{"forky":"145.0.7632.159-1"},"fixed_version":"134.0.6998.35-1","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"146.0.7680.71-1"},"fixed_version":"134.0.6998.35-1","urgency":"not yet assigned"},"trixie":{"status":"resolved","repositories":{"trixie":"143.0.7499.169-1~deb13u1","trixie-security":"145.0.7632.159-1~deb13u1"},"fixed_version":"134.0.6998.35-1","urgency":"not yet assigned"}}},"CVE-2025-1919":{"description":"Out of bounds read in Media in Google Chrome prior to 134.0.6998.35 allowed a remote attacker to potentially perform out of bounds memory access via a crafted HTML page. (Chromium security severity: Medium)","scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"143.0.7499.169-1~deb12u1","bookworm-security":"145.0.7632.159-1~deb12u1"},"fixed_version":"134.0.6998.35-1~deb12u1","urgency":"not yet assigned"},"bullseye":{"status":"open","repositories":{"bullseye":"120.0.6099.224-1~deb11u1","bullseye-security":"120.0.6099.224-1~deb11u1"},"urgency":"end-of-life"},"forky":{"status":"resolved","repositories":{"forky":"145.0.7632.159-1"},"fixed_version":"134.0.6998.35-1","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"146.0.7680.71-1"},"fixed_version":"134.0.6998.35-1","urgency":"not yet assigned"},"trixie":{"status":"resolved","repositories":{"trixie":"143.0.7499.169-1~deb13u1","trixie-security":"145.0.7632.159-1~deb13u1"},"fixed_version":"134.0.6998.35-1","urgency":"not yet assigned"}}},"CVE-2025-1920":{"description":"Type Confusion in V8 in Google Chrome prior to 134.0.6998.88 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. (Chromium security severity: High)","scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"143.0.7499.169-1~deb12u1","bookworm-security":"145.0.7632.159-1~deb12u1"},"fixed_version":"134.0.6998.88-1~deb12u1","urgency":"not yet assigned"},"bullseye":{"status":"open","repositories":{"bullseye":"120.0.6099.224-1~deb11u1","bullseye-security":"120.0.6099.224-1~deb11u1"},"urgency":"end-of-life"},"forky":{"status":"resolved","repositories":{"forky":"145.0.7632.159-1"},"fixed_version":"134.0.6998.88-1","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"146.0.7680.71-1"},"fixed_version":"134.0.6998.88-1","urgency":"not yet assigned"},"trixie":{"status":"resolved","repositories":{"trixie":"143.0.7499.169-1~deb13u1","trixie-security":"145.0.7632.159-1~deb13u1"},"fixed_version":"134.0.6998.88-1","urgency":"not yet assigned"}}},"CVE-2025-1921":{"description":"Inappropriate implementation in Media Stream in Google Chrome prior to 134.0.6998.35 allowed a remote attacker to obtain information about a peripheral via a crafted HTML page. (Chromium security severity: Medium)","scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"143.0.7499.169-1~deb12u1","bookworm-security":"145.0.7632.159-1~deb12u1"},"fixed_version":"134.0.6998.35-1~deb12u1","urgency":"not yet assigned"},"bullseye":{"status":"open","repositories":{"bullseye":"120.0.6099.224-1~deb11u1","bullseye-security":"120.0.6099.224-1~deb11u1"},"urgency":"end-of-life"},"forky":{"status":"resolved","repositories":{"forky":"145.0.7632.159-1"},"fixed_version":"134.0.6998.35-1","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"146.0.7680.71-1"},"fixed_version":"134.0.6998.35-1","urgency":"not yet assigned"},"trixie":{"status":"resolved","repositories":{"trixie":"143.0.7499.169-1~deb13u1","trixie-security":"145.0.7632.159-1~deb13u1"},"fixed_version":"134.0.6998.35-1","urgency":"not yet assigned"}}},"CVE-2025-1922":{"description":"Inappropriate implementation in Selection in Google Chrome on Android prior to 134.0.6998.35 allowed a remote attacker who convinced a user to engage in specific UI gestures to perform UI spoofing via a crafted HTML page. (Chromium security severity: Low)","scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"143.0.7499.169-1~deb12u1","bookworm-security":"145.0.7632.159-1~deb12u1"},"fixed_version":"134.0.6998.35-1~deb12u1","urgency":"not yet assigned"},"bullseye":{"status":"open","repositories":{"bullseye":"120.0.6099.224-1~deb11u1","bullseye-security":"120.0.6099.224-1~deb11u1"},"urgency":"end-of-life"},"forky":{"status":"resolved","repositories":{"forky":"145.0.7632.159-1"},"fixed_version":"134.0.6998.35-1","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"146.0.7680.71-1"},"fixed_version":"134.0.6998.35-1","urgency":"not yet assigned"},"trixie":{"status":"resolved","repositories":{"trixie":"143.0.7499.169-1~deb13u1","trixie-security":"145.0.7632.159-1~deb13u1"},"fixed_version":"134.0.6998.35-1","urgency":"not yet assigned"}}},"CVE-2025-1923":{"description":"Inappropriate implementation in Permission Prompts in Google Chrome prior to 134.0.6998.35 allowed an attacker who convinced a user to install a malicious extension to perform UI spoofing via a crafted Chrome Extension. (Chromium security severity: Low)","scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"143.0.7499.169-1~deb12u1","bookworm-security":"145.0.7632.159-1~deb12u1"},"fixed_version":"134.0.6998.35-1~deb12u1","urgency":"not yet assigned"},"bullseye":{"status":"open","repositories":{"bullseye":"120.0.6099.224-1~deb11u1","bullseye-security":"120.0.6099.224-1~deb11u1"},"urgency":"end-of-life"},"forky":{"status":"resolved","repositories":{"forky":"145.0.7632.159-1"},"fixed_version":"134.0.6998.35-1","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"146.0.7680.71-1"},"fixed_version":"134.0.6998.35-1","urgency":"not yet assigned"},"trixie":{"status":"resolved","repositories":{"trixie":"143.0.7499.169-1~deb13u1","trixie-security":"145.0.7632.159-1~deb13u1"},"fixed_version":"134.0.6998.35-1","urgency":"not yet assigned"}}},"CVE-2025-2135":{"description":"Type Confusion in V8 in Google Chrome prior to 134.0.6998.88 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. (Chromium security severity: High)","scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"143.0.7499.169-1~deb12u1","bookworm-security":"145.0.7632.159-1~deb12u1"},"fixed_version":"134.0.6998.88-1~deb12u1","urgency":"not yet assigned"},"bullseye":{"status":"open","repositories":{"bullseye":"120.0.6099.224-1~deb11u1","bullseye-security":"120.0.6099.224-1~deb11u1"},"urgency":"end-of-life"},"forky":{"status":"resolved","repositories":{"forky":"145.0.7632.159-1"},"fixed_version":"134.0.6998.88-1","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"146.0.7680.71-1"},"fixed_version":"134.0.6998.88-1","urgency":"not yet assigned"},"trixie":{"status":"resolved","repositories":{"trixie":"143.0.7499.169-1~deb13u1","trixie-security":"145.0.7632.159-1~deb13u1"},"fixed_version":"134.0.6998.88-1","urgency":"not yet assigned"}}},"CVE-2025-2136":{"description":"Use after free in Inspector in Google Chrome prior to 134.0.6998.88 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. (Chromium security severity: Medium)","scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"143.0.7499.169-1~deb12u1","bookworm-security":"145.0.7632.159-1~deb12u1"},"fixed_version":"134.0.6998.88-1~deb12u1","urgency":"not yet assigned"},"bullseye":{"status":"open","repositories":{"bullseye":"120.0.6099.224-1~deb11u1","bullseye-security":"120.0.6099.224-1~deb11u1"},"urgency":"end-of-life"},"forky":{"status":"resolved","repositories":{"forky":"145.0.7632.159-1"},"fixed_version":"134.0.6998.88-1","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"146.0.7680.71-1"},"fixed_version":"134.0.6998.88-1","urgency":"not yet assigned"},"trixie":{"status":"resolved","repositories":{"trixie":"143.0.7499.169-1~deb13u1","trixie-security":"145.0.7632.159-1~deb13u1"},"fixed_version":"134.0.6998.88-1","urgency":"not yet assigned"}}},"CVE-2025-2137":{"description":"Out of bounds read in V8 in Google Chrome prior to 134.0.6998.88 allowed a remote attacker to perform out of bounds memory access via a crafted HTML page. (Chromium security severity: Medium)","scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"143.0.7499.169-1~deb12u1","bookworm-security":"145.0.7632.159-1~deb12u1"},"fixed_version":"134.0.6998.88-1~deb12u1","urgency":"not yet assigned"},"bullseye":{"status":"open","repositories":{"bullseye":"120.0.6099.224-1~deb11u1","bullseye-security":"120.0.6099.224-1~deb11u1"},"urgency":"end-of-life"},"forky":{"status":"resolved","repositories":{"forky":"145.0.7632.159-1"},"fixed_version":"134.0.6998.88-1","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"146.0.7680.71-1"},"fixed_version":"134.0.6998.88-1","urgency":"not yet assigned"},"trixie":{"status":"resolved","repositories":{"trixie":"143.0.7499.169-1~deb13u1","trixie-security":"145.0.7632.159-1~deb13u1"},"fixed_version":"134.0.6998.88-1","urgency":"not yet assigned"}}},"CVE-2025-24201":{"description":"An out-of-bounds write issue was addressed with improved checks to prevent unauthorized actions. This issue is fixed in visionOS 2.3.2, iOS 18.3.2 and iPadOS 18.3.2, macOS Sequoia 15.3.2, Safari 18.3.1, watchOS 11.4, iPadOS 17.7.6, iOS 16.7.11 and iPadOS 16.7.11, iOS 15.8.4 and iPadOS 15.8.4. Maliciously crafted web content may be able to break out of Web Content sandbox. This is a supplementary fix for an attack that was blocked in iOS 17.2. (Apple is aware of a report that this issue may have been exploited in an extremely sophisticated attack against specific targeted individuals on versions of iOS before iOS 17.2.).","scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"143.0.7499.169-1~deb12u1","bookworm-security":"145.0.7632.159-1~deb12u1"},"fixed_version":"134.0.6998.88-1~deb12u1","urgency":"not yet assigned"}}},"CVE-2025-2476":{"description":"Use after free in Lens in Google Chrome prior to 134.0.6998.117 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. (Chromium security severity: Critical)","scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"143.0.7499.169-1~deb12u1","bookworm-security":"145.0.7632.159-1~deb12u1"},"fixed_version":"134.0.6998.117-1~deb12u1","urgency":"not yet assigned"},"bullseye":{"status":"open","repositories":{"bullseye":"120.0.6099.224-1~deb11u1","bullseye-security":"120.0.6099.224-1~deb11u1"},"urgency":"end-of-life"},"forky":{"status":"resolved","repositories":{"forky":"145.0.7632.159-1"},"fixed_version":"134.0.6998.117-1","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"146.0.7680.71-1"},"fixed_version":"134.0.6998.117-1","urgency":"not yet assigned"},"trixie":{"status":"resolved","repositories":{"trixie":"143.0.7499.169-1~deb13u1","trixie-security":"145.0.7632.159-1~deb13u1"},"fixed_version":"134.0.6998.117-1","urgency":"not yet assigned"}}},"CVE-2025-2783":{"description":"Incorrect handle provided in unspecified circumstances in Mojo in Google Chrome on Windows prior to 134.0.6998.177 allowed a remote attacker to perform a sandbox escape via a malicious file. (Chromium security severity: High)","scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"143.0.7499.169-1~deb12u1","bookworm-security":"145.0.7632.159-1~deb12u1"},"fixed_version":"0","urgency":"unimportant"},"bullseye":{"status":"resolved","repositories":{"bullseye":"120.0.6099.224-1~deb11u1","bullseye-security":"120.0.6099.224-1~deb11u1"},"fixed_version":"0","urgency":"unimportant"},"forky":{"status":"resolved","repositories":{"forky":"145.0.7632.159-1"},"fixed_version":"0","urgency":"unimportant"},"sid":{"status":"resolved","repositories":{"sid":"146.0.7680.71-1"},"fixed_version":"0","urgency":"unimportant"},"trixie":{"status":"resolved","repositories":{"trixie":"143.0.7499.169-1~deb13u1","trixie-security":"145.0.7632.159-1~deb13u1"},"fixed_version":"0","urgency":"unimportant"}}},"CVE-2025-3066":{"description":"Use after free in Site Isolation in Google Chrome prior to 135.0.7049.84 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. (Chromium security severity: High)","scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"143.0.7499.169-1~deb12u1","bookworm-security":"145.0.7632.159-1~deb12u1"},"fixed_version":"135.0.7049.84-1~deb12u1","urgency":"not yet assigned"},"bullseye":{"status":"open","repositories":{"bullseye":"120.0.6099.224-1~deb11u1","bullseye-security":"120.0.6099.224-1~deb11u1"},"urgency":"end-of-life"},"forky":{"status":"resolved","repositories":{"forky":"145.0.7632.159-1"},"fixed_version":"135.0.7049.84-1","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"146.0.7680.71-1"},"fixed_version":"135.0.7049.84-1","urgency":"not yet assigned"},"trixie":{"status":"resolved","repositories":{"trixie":"143.0.7499.169-1~deb13u1","trixie-security":"145.0.7632.159-1~deb13u1"},"fixed_version":"135.0.7049.84-1","urgency":"not yet assigned"}}},"CVE-2025-3067":{"description":"Inappropriate implementation in Custom Tabs in Google Chrome on Android prior to 135.0.7049.52 allowed a remote attacker who convinced a user to engage in specific UI gestures to perform privilege escalation via a crafted app. (Chromium security severity: Medium)","scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"143.0.7499.169-1~deb12u1","bookworm-security":"145.0.7632.159-1~deb12u1"},"fixed_version":"135.0.7049.52-1~deb12u1","urgency":"not yet assigned"},"bullseye":{"status":"open","repositories":{"bullseye":"120.0.6099.224-1~deb11u1","bullseye-security":"120.0.6099.224-1~deb11u1"},"urgency":"end-of-life"},"forky":{"status":"resolved","repositories":{"forky":"145.0.7632.159-1"},"fixed_version":"135.0.7049.52-1","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"146.0.7680.71-1"},"fixed_version":"135.0.7049.52-1","urgency":"not yet assigned"},"trixie":{"status":"resolved","repositories":{"trixie":"143.0.7499.169-1~deb13u1","trixie-security":"145.0.7632.159-1~deb13u1"},"fixed_version":"135.0.7049.52-1","urgency":"not yet assigned"}}},"CVE-2025-3068":{"description":"Inappropriate implementation in Intents in Google Chrome on Android prior to 135.0.7049.52 allowed a remote attacker to perform privilege escalation via a crafted HTML page. (Chromium security severity: Medium)","scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"143.0.7499.169-1~deb12u1","bookworm-security":"145.0.7632.159-1~deb12u1"},"fixed_version":"135.0.7049.52-1~deb12u1","urgency":"not yet assigned"},"bullseye":{"status":"open","repositories":{"bullseye":"120.0.6099.224-1~deb11u1","bullseye-security":"120.0.6099.224-1~deb11u1"},"urgency":"end-of-life"},"forky":{"status":"resolved","repositories":{"forky":"145.0.7632.159-1"},"fixed_version":"135.0.7049.52-1","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"146.0.7680.71-1"},"fixed_version":"135.0.7049.52-1","urgency":"not yet assigned"},"trixie":{"status":"resolved","repositories":{"trixie":"143.0.7499.169-1~deb13u1","trixie-security":"145.0.7632.159-1~deb13u1"},"fixed_version":"135.0.7049.52-1","urgency":"not yet assigned"}}},"CVE-2025-3069":{"description":"Inappropriate implementation in Extensions in Google Chrome prior to 135.0.7049.52 allowed a remote attacker to perform privilege escalation via a crafted HTML page. (Chromium security severity: Medium)","scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"143.0.7499.169-1~deb12u1","bookworm-security":"145.0.7632.159-1~deb12u1"},"fixed_version":"135.0.7049.52-1~deb12u1","urgency":"not yet assigned"},"bullseye":{"status":"open","repositories":{"bullseye":"120.0.6099.224-1~deb11u1","bullseye-security":"120.0.6099.224-1~deb11u1"},"urgency":"end-of-life"},"forky":{"status":"resolved","repositories":{"forky":"145.0.7632.159-1"},"fixed_version":"135.0.7049.52-1","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"146.0.7680.71-1"},"fixed_version":"135.0.7049.52-1","urgency":"not yet assigned"},"trixie":{"status":"resolved","repositories":{"trixie":"143.0.7499.169-1~deb13u1","trixie-security":"145.0.7632.159-1~deb13u1"},"fixed_version":"135.0.7049.52-1","urgency":"not yet assigned"}}},"CVE-2025-3070":{"description":"Insufficient validation of untrusted input in Extensions in Google Chrome prior to 135.0.7049.52 allowed a remote attacker to perform privilege escalation via a crafted HTML page. (Chromium security severity: Medium)","scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"143.0.7499.169-1~deb12u1","bookworm-security":"145.0.7632.159-1~deb12u1"},"fixed_version":"135.0.7049.52-1~deb12u1","urgency":"not yet assigned"},"bullseye":{"status":"open","repositories":{"bullseye":"120.0.6099.224-1~deb11u1","bullseye-security":"120.0.6099.224-1~deb11u1"},"urgency":"end-of-life"},"forky":{"status":"resolved","repositories":{"forky":"145.0.7632.159-1"},"fixed_version":"135.0.7049.52-1","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"146.0.7680.71-1"},"fixed_version":"135.0.7049.52-1","urgency":"not yet assigned"},"trixie":{"status":"resolved","repositories":{"trixie":"143.0.7499.169-1~deb13u1","trixie-security":"145.0.7632.159-1~deb13u1"},"fixed_version":"135.0.7049.52-1","urgency":"not yet assigned"}}},"CVE-2025-3071":{"description":"Inappropriate implementation in Navigations in Google Chrome prior to 135.0.7049.52 allowed a remote attacker who convinced a user to engage in specific UI gestures to bypass same origin policy via a crafted HTML page. (Chromium security severity: Low)","scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"143.0.7499.169-1~deb12u1","bookworm-security":"145.0.7632.159-1~deb12u1"},"fixed_version":"135.0.7049.52-1~deb12u1","urgency":"not yet assigned"},"bullseye":{"status":"open","repositories":{"bullseye":"120.0.6099.224-1~deb11u1","bullseye-security":"120.0.6099.224-1~deb11u1"},"urgency":"end-of-life"},"forky":{"status":"resolved","repositories":{"forky":"145.0.7632.159-1"},"fixed_version":"135.0.7049.52-1","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"146.0.7680.71-1"},"fixed_version":"135.0.7049.52-1","urgency":"not yet assigned"},"trixie":{"status":"resolved","repositories":{"trixie":"143.0.7499.169-1~deb13u1","trixie-security":"145.0.7632.159-1~deb13u1"},"fixed_version":"135.0.7049.52-1","urgency":"not yet assigned"}}},"CVE-2025-3072":{"description":"Inappropriate implementation in Custom Tabs in Google Chrome prior to 135.0.7049.52 allowed a remote attacker who convinced a user to engage in specific UI gestures to perform UI spoofing via a crafted HTML page. (Chromium security severity: Low)","scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"143.0.7499.169-1~deb12u1","bookworm-security":"145.0.7632.159-1~deb12u1"},"fixed_version":"135.0.7049.52-1~deb12u1","urgency":"not yet assigned"},"bullseye":{"status":"open","repositories":{"bullseye":"120.0.6099.224-1~deb11u1","bullseye-security":"120.0.6099.224-1~deb11u1"},"urgency":"end-of-life"},"forky":{"status":"resolved","repositories":{"forky":"145.0.7632.159-1"},"fixed_version":"135.0.7049.52-1","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"146.0.7680.71-1"},"fixed_version":"135.0.7049.52-1","urgency":"not yet assigned"},"trixie":{"status":"resolved","repositories":{"trixie":"143.0.7499.169-1~deb13u1","trixie-security":"145.0.7632.159-1~deb13u1"},"fixed_version":"135.0.7049.52-1","urgency":"not yet assigned"}}},"CVE-2025-3073":{"description":"Inappropriate implementation in Autofill in Google Chrome prior to 135.0.7049.52 allowed a remote attacker who convinced a user to engage in specific UI gestures to perform UI spoofing via a crafted HTML page. (Chromium security severity: Low)","scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"143.0.7499.169-1~deb12u1","bookworm-security":"145.0.7632.159-1~deb12u1"},"fixed_version":"135.0.7049.52-1~deb12u1","urgency":"not yet assigned"},"bullseye":{"status":"open","repositories":{"bullseye":"120.0.6099.224-1~deb11u1","bullseye-security":"120.0.6099.224-1~deb11u1"},"urgency":"end-of-life"},"forky":{"status":"resolved","repositories":{"forky":"145.0.7632.159-1"},"fixed_version":"135.0.7049.52-1","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"146.0.7680.71-1"},"fixed_version":"135.0.7049.52-1","urgency":"not yet assigned"},"trixie":{"status":"resolved","repositories":{"trixie":"143.0.7499.169-1~deb13u1","trixie-security":"145.0.7632.159-1~deb13u1"},"fixed_version":"135.0.7049.52-1","urgency":"not yet assigned"}}},"CVE-2025-3074":{"description":"Inappropriate implementation in Downloads in Google Chrome prior to 135.0.7049.52 allowed a remote attacker to perform UI spoofing via a crafted HTML page. (Chromium security severity: Low)","scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"143.0.7499.169-1~deb12u1","bookworm-security":"145.0.7632.159-1~deb12u1"},"fixed_version":"135.0.7049.52-1~deb12u1","urgency":"not yet assigned"},"bullseye":{"status":"open","repositories":{"bullseye":"120.0.6099.224-1~deb11u1","bullseye-security":"120.0.6099.224-1~deb11u1"},"urgency":"end-of-life"},"forky":{"status":"resolved","repositories":{"forky":"145.0.7632.159-1"},"fixed_version":"135.0.7049.52-1","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"146.0.7680.71-1"},"fixed_version":"135.0.7049.52-1","urgency":"not yet assigned"},"trixie":{"status":"resolved","repositories":{"trixie":"143.0.7499.169-1~deb13u1","trixie-security":"145.0.7632.159-1~deb13u1"},"fixed_version":"135.0.7049.52-1","urgency":"not yet assigned"}}},"CVE-2025-3619":{"description":"Heap buffer overflow in Codecs in Google Chrome on Windows prior to 135.0.7049.95 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. (Chromium security severity: Critical)","scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"143.0.7499.169-1~deb12u1","bookworm-security":"145.0.7632.159-1~deb12u1"},"fixed_version":"135.0.7049.95-1~deb12u1","urgency":"not yet assigned"},"bullseye":{"status":"open","repositories":{"bullseye":"120.0.6099.224-1~deb11u1","bullseye-security":"120.0.6099.224-1~deb11u1"},"urgency":"end-of-life"},"forky":{"status":"resolved","repositories":{"forky":"145.0.7632.159-1"},"fixed_version":"135.0.7049.95-1","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"146.0.7680.71-1"},"fixed_version":"135.0.7049.95-1","urgency":"not yet assigned"},"trixie":{"status":"resolved","repositories":{"trixie":"143.0.7499.169-1~deb13u1","trixie-security":"145.0.7632.159-1~deb13u1"},"fixed_version":"135.0.7049.95-1","urgency":"not yet assigned"}}},"CVE-2025-3620":{"description":"Use after free in USB in Google Chrome prior to 135.0.7049.95 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. (Chromium security severity: High)","scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"143.0.7499.169-1~deb12u1","bookworm-security":"145.0.7632.159-1~deb12u1"},"fixed_version":"135.0.7049.95-1~deb12u1","urgency":"not yet assigned"},"bullseye":{"status":"open","repositories":{"bullseye":"120.0.6099.224-1~deb11u1","bullseye-security":"120.0.6099.224-1~deb11u1"},"urgency":"end-of-life"},"forky":{"status":"resolved","repositories":{"forky":"145.0.7632.159-1"},"fixed_version":"135.0.7049.95-1","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"146.0.7680.71-1"},"fixed_version":"135.0.7049.95-1","urgency":"not yet assigned"},"trixie":{"status":"resolved","repositories":{"trixie":"143.0.7499.169-1~deb13u1","trixie-security":"145.0.7632.159-1~deb13u1"},"fixed_version":"135.0.7049.95-1","urgency":"not yet assigned"}}},"CVE-2025-4050":{"description":"Out of bounds memory access in DevTools in Google Chrome prior to 136.0.7103.59 allowed a remote attacker who convinced a user to engage in specific UI gestures to potentially exploit heap corruption via a crafted HTML page. (Chromium security severity: Medium)","scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"143.0.7499.169-1~deb12u1","bookworm-security":"145.0.7632.159-1~deb12u1"},"fixed_version":"136.0.7103.59-2~deb12u2","urgency":"not yet assigned"},"bullseye":{"status":"open","repositories":{"bullseye":"120.0.6099.224-1~deb11u1","bullseye-security":"120.0.6099.224-1~deb11u1"},"urgency":"end-of-life"},"forky":{"status":"resolved","repositories":{"forky":"145.0.7632.159-1"},"fixed_version":"136.0.7103.59-2","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"146.0.7680.71-1"},"fixed_version":"136.0.7103.59-2","urgency":"not yet assigned"},"trixie":{"status":"resolved","repositories":{"trixie":"143.0.7499.169-1~deb13u1","trixie-security":"145.0.7632.159-1~deb13u1"},"fixed_version":"136.0.7103.59-2","urgency":"not yet assigned"}}},"CVE-2025-4051":{"description":"Insufficient data validation in DevTools in Google Chrome prior to 136.0.7103.59 allowed a remote attacker who convinced a user to engage in specific UI gestures to bypass discretionary access control via a crafted HTML page. (Chromium security severity: Medium)","scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"143.0.7499.169-1~deb12u1","bookworm-security":"145.0.7632.159-1~deb12u1"},"fixed_version":"136.0.7103.59-2~deb12u2","urgency":"not yet assigned"},"bullseye":{"status":"open","repositories":{"bullseye":"120.0.6099.224-1~deb11u1","bullseye-security":"120.0.6099.224-1~deb11u1"},"urgency":"end-of-life"},"forky":{"status":"resolved","repositories":{"forky":"145.0.7632.159-1"},"fixed_version":"136.0.7103.59-2","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"146.0.7680.71-1"},"fixed_version":"136.0.7103.59-2","urgency":"not yet assigned"},"trixie":{"status":"resolved","repositories":{"trixie":"143.0.7499.169-1~deb13u1","trixie-security":"145.0.7632.159-1~deb13u1"},"fixed_version":"136.0.7103.59-2","urgency":"not yet assigned"}}},"CVE-2025-4052":{"description":"Inappropriate implementation in DevTools in Google Chrome prior to 136.0.7103.59 allowed a remote attacker who convinced a user to engage in specific UI gestures to bypass discretionary access control via a crafted HTML page. (Chromium security severity: Low)","scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"143.0.7499.169-1~deb12u1","bookworm-security":"145.0.7632.159-1~deb12u1"},"fixed_version":"136.0.7103.59-2~deb12u2","urgency":"not yet assigned"},"bullseye":{"status":"open","repositories":{"bullseye":"120.0.6099.224-1~deb11u1","bullseye-security":"120.0.6099.224-1~deb11u1"},"urgency":"end-of-life"},"forky":{"status":"resolved","repositories":{"forky":"145.0.7632.159-1"},"fixed_version":"136.0.7103.59-2","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"146.0.7680.71-1"},"fixed_version":"136.0.7103.59-2","urgency":"not yet assigned"},"trixie":{"status":"resolved","repositories":{"trixie":"143.0.7499.169-1~deb13u1","trixie-security":"145.0.7632.159-1~deb13u1"},"fixed_version":"136.0.7103.59-2","urgency":"not yet assigned"}}},"CVE-2025-4096":{"description":"Heap buffer overflow in HTML in Google Chrome prior to 136.0.7103.59 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. (Chromium security severity: High)","scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"143.0.7499.169-1~deb12u1","bookworm-security":"145.0.7632.159-1~deb12u1"},"fixed_version":"136.0.7103.59-2~deb12u2","urgency":"not yet assigned"},"bullseye":{"status":"open","repositories":{"bullseye":"120.0.6099.224-1~deb11u1","bullseye-security":"120.0.6099.224-1~deb11u1"},"urgency":"end-of-life"},"forky":{"status":"resolved","repositories":{"forky":"145.0.7632.159-1"},"fixed_version":"136.0.7103.59-2","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"146.0.7680.71-1"},"fixed_version":"136.0.7103.59-2","urgency":"not yet assigned"},"trixie":{"status":"resolved","repositories":{"trixie":"143.0.7499.169-1~deb13u1","trixie-security":"145.0.7632.159-1~deb13u1"},"fixed_version":"136.0.7103.59-2","urgency":"not yet assigned"}}},"CVE-2025-4372":{"description":"Use after free in WebAudio in Google Chrome prior to 136.0.7103.92 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. (Chromium security severity: Medium)","scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"143.0.7499.169-1~deb12u1","bookworm-security":"145.0.7632.159-1~deb12u1"},"fixed_version":"136.0.7103.92-1~deb12u1","urgency":"not yet assigned"},"bullseye":{"status":"open","repositories":{"bullseye":"120.0.6099.224-1~deb11u1","bullseye-security":"120.0.6099.224-1~deb11u1"},"urgency":"end-of-life"},"forky":{"status":"resolved","repositories":{"forky":"145.0.7632.159-1"},"fixed_version":"136.0.7103.92-1","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"146.0.7680.71-1"},"fixed_version":"136.0.7103.92-1","urgency":"not yet assigned"},"trixie":{"status":"resolved","repositories":{"trixie":"143.0.7499.169-1~deb13u1","trixie-security":"145.0.7632.159-1~deb13u1"},"fixed_version":"136.0.7103.92-1","urgency":"not yet assigned"}}},"CVE-2025-4609":{"description":"Incorrect handle provided in unspecified circumstances in Mojo in Google Chrome on Windows prior to 136.0.7103.113 allowed a remote attacker to potentially perform a sandbox escape via a malicious file. (Chromium security severity: High)","scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"143.0.7499.169-1~deb12u1","bookworm-security":"145.0.7632.159-1~deb12u1"},"fixed_version":"136.0.7103.113-1~deb12u1","urgency":"not yet assigned"},"bullseye":{"status":"open","repositories":{"bullseye":"120.0.6099.224-1~deb11u1","bullseye-security":"120.0.6099.224-1~deb11u1"},"urgency":"end-of-life"},"forky":{"status":"resolved","repositories":{"forky":"145.0.7632.159-1"},"fixed_version":"136.0.7103.113-1","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"146.0.7680.71-1"},"fixed_version":"136.0.7103.113-1","urgency":"not yet assigned"},"trixie":{"status":"resolved","repositories":{"trixie":"143.0.7499.169-1~deb13u1","trixie-security":"145.0.7632.159-1~deb13u1"},"fixed_version":"136.0.7103.113-1","urgency":"not yet assigned"}}},"CVE-2025-4664":{"description":"Insufficient policy enforcement in Loader in Google Chrome prior to 136.0.7103.113 allowed a remote attacker to leak cross-origin data via a crafted HTML page. (Chromium security severity: High)","scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"143.0.7499.169-1~deb12u1","bookworm-security":"145.0.7632.159-1~deb12u1"},"fixed_version":"136.0.7103.113-1~deb12u1","urgency":"not yet assigned"},"bullseye":{"status":"open","repositories":{"bullseye":"120.0.6099.224-1~deb11u1","bullseye-security":"120.0.6099.224-1~deb11u1"},"urgency":"end-of-life"},"forky":{"status":"resolved","repositories":{"forky":"145.0.7632.159-1"},"fixed_version":"136.0.7103.113-1","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"146.0.7680.71-1"},"fixed_version":"136.0.7103.113-1","urgency":"not yet assigned"},"trixie":{"status":"resolved","repositories":{"trixie":"143.0.7499.169-1~deb13u1","trixie-security":"145.0.7632.159-1~deb13u1"},"fixed_version":"136.0.7103.113-1","urgency":"not yet assigned"}}},"CVE-2025-5063":{"description":"Use after free in Compositing in Google Chrome prior to 137.0.7151.55 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. (Chromium security severity: High)","scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"143.0.7499.169-1~deb12u1","bookworm-security":"145.0.7632.159-1~deb12u1"},"fixed_version":"137.0.7151.55-3~deb12u1","urgency":"not yet assigned"},"bullseye":{"status":"open","repositories":{"bullseye":"120.0.6099.224-1~deb11u1","bullseye-security":"120.0.6099.224-1~deb11u1"},"urgency":"end-of-life"},"forky":{"status":"resolved","repositories":{"forky":"145.0.7632.159-1"},"fixed_version":"137.0.7151.55-1","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"146.0.7680.71-1"},"fixed_version":"137.0.7151.55-1","urgency":"not yet assigned"},"trixie":{"status":"resolved","repositories":{"trixie":"143.0.7499.169-1~deb13u1","trixie-security":"145.0.7632.159-1~deb13u1"},"fixed_version":"137.0.7151.55-1","urgency":"not yet assigned"}}},"CVE-2025-5064":{"description":"Inappropriate implementation in Background Fetch API in Google Chrome prior to 137.0.7151.55 allowed a remote attacker to leak cross-origin data via a crafted HTML page. (Chromium security severity: Medium)","scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"143.0.7499.169-1~deb12u1","bookworm-security":"145.0.7632.159-1~deb12u1"},"fixed_version":"137.0.7151.55-3~deb12u1","urgency":"not yet assigned"},"bullseye":{"status":"open","repositories":{"bullseye":"120.0.6099.224-1~deb11u1","bullseye-security":"120.0.6099.224-1~deb11u1"},"urgency":"end-of-life"},"forky":{"status":"resolved","repositories":{"forky":"145.0.7632.159-1"},"fixed_version":"137.0.7151.55-1","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"146.0.7680.71-1"},"fixed_version":"137.0.7151.55-1","urgency":"not yet assigned"},"trixie":{"status":"resolved","repositories":{"trixie":"143.0.7499.169-1~deb13u1","trixie-security":"145.0.7632.159-1~deb13u1"},"fixed_version":"137.0.7151.55-1","urgency":"not yet assigned"}}},"CVE-2025-5065":{"description":"Inappropriate implementation in FileSystemAccess API in Google Chrome prior to 137.0.7151.55 allowed a remote attacker to perform UI spoofing via a crafted HTML page. (Chromium security severity: Medium)","scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"143.0.7499.169-1~deb12u1","bookworm-security":"145.0.7632.159-1~deb12u1"},"fixed_version":"137.0.7151.55-3~deb12u1","urgency":"not yet assigned"},"bullseye":{"status":"open","repositories":{"bullseye":"120.0.6099.224-1~deb11u1","bullseye-security":"120.0.6099.224-1~deb11u1"},"urgency":"end-of-life"},"forky":{"status":"resolved","repositories":{"forky":"145.0.7632.159-1"},"fixed_version":"137.0.7151.55-1","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"146.0.7680.71-1"},"fixed_version":"137.0.7151.55-1","urgency":"not yet assigned"},"trixie":{"status":"resolved","repositories":{"trixie":"143.0.7499.169-1~deb13u1","trixie-security":"145.0.7632.159-1~deb13u1"},"fixed_version":"137.0.7151.55-1","urgency":"not yet assigned"}}},"CVE-2025-5066":{"description":"Inappropriate implementation in Messages in Google Chrome on Android prior to 137.0.7151.55 allowed a remote attacker who convinced a user to engage in specific UI gestures to perform UI spoofing via a crafted HTML page. (Chromium security severity: Medium)","scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"143.0.7499.169-1~deb12u1","bookworm-security":"145.0.7632.159-1~deb12u1"},"fixed_version":"137.0.7151.55-3~deb12u1","urgency":"not yet assigned"},"bullseye":{"status":"open","repositories":{"bullseye":"120.0.6099.224-1~deb11u1","bullseye-security":"120.0.6099.224-1~deb11u1"},"urgency":"end-of-life"},"forky":{"status":"resolved","repositories":{"forky":"145.0.7632.159-1"},"fixed_version":"137.0.7151.55-1","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"146.0.7680.71-1"},"fixed_version":"137.0.7151.55-1","urgency":"not yet assigned"},"trixie":{"status":"resolved","repositories":{"trixie":"143.0.7499.169-1~deb13u1","trixie-security":"145.0.7632.159-1~deb13u1"},"fixed_version":"137.0.7151.55-1","urgency":"not yet assigned"}}},"CVE-2025-5067":{"description":"Inappropriate implementation in Tab Strip in Google Chrome prior to 137.0.7151.55 allowed a remote attacker to perform UI spoofing via a crafted HTML page. (Chromium security severity: Low)","scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"143.0.7499.169-1~deb12u1","bookworm-security":"145.0.7632.159-1~deb12u1"},"fixed_version":"137.0.7151.55-3~deb12u1","urgency":"not yet assigned"},"bullseye":{"status":"open","repositories":{"bullseye":"120.0.6099.224-1~deb11u1","bullseye-security":"120.0.6099.224-1~deb11u1"},"urgency":"end-of-life"},"forky":{"status":"resolved","repositories":{"forky":"145.0.7632.159-1"},"fixed_version":"137.0.7151.55-1","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"146.0.7680.71-1"},"fixed_version":"137.0.7151.55-1","urgency":"not yet assigned"},"trixie":{"status":"resolved","repositories":{"trixie":"143.0.7499.169-1~deb13u1","trixie-security":"145.0.7632.159-1~deb13u1"},"fixed_version":"137.0.7151.55-1","urgency":"not yet assigned"}}},"CVE-2025-5068":{"description":"Use after free in Blink in Google Chrome prior to 137.0.7151.68 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. (Chromium security severity: Medium)","scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"143.0.7499.169-1~deb12u1","bookworm-security":"145.0.7632.159-1~deb12u1"},"fixed_version":"137.0.7151.68-1~deb12u1","urgency":"not yet assigned"},"bullseye":{"status":"open","repositories":{"bullseye":"120.0.6099.224-1~deb11u1","bullseye-security":"120.0.6099.224-1~deb11u1"},"urgency":"end-of-life"},"forky":{"status":"resolved","repositories":{"forky":"145.0.7632.159-1"},"fixed_version":"137.0.7151.68-1","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"146.0.7680.71-1"},"fixed_version":"137.0.7151.68-1","urgency":"not yet assigned"},"trixie":{"status":"resolved","repositories":{"trixie":"143.0.7499.169-1~deb13u1","trixie-security":"145.0.7632.159-1~deb13u1"},"fixed_version":"137.0.7151.68-1","urgency":"not yet assigned"}}},"CVE-2025-5280":{"description":"Out of bounds write in V8 in Google Chrome prior to 137.0.7151.55 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. (Chromium security severity: High)","scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"143.0.7499.169-1~deb12u1","bookworm-security":"145.0.7632.159-1~deb12u1"},"fixed_version":"137.0.7151.55-3~deb12u1","urgency":"not yet assigned"},"bullseye":{"status":"open","repositories":{"bullseye":"120.0.6099.224-1~deb11u1","bullseye-security":"120.0.6099.224-1~deb11u1"},"urgency":"end-of-life"},"forky":{"status":"resolved","repositories":{"forky":"145.0.7632.159-1"},"fixed_version":"137.0.7151.55-1","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"146.0.7680.71-1"},"fixed_version":"137.0.7151.55-1","urgency":"not yet assigned"},"trixie":{"status":"resolved","repositories":{"trixie":"143.0.7499.169-1~deb13u1","trixie-security":"145.0.7632.159-1~deb13u1"},"fixed_version":"137.0.7151.55-1","urgency":"not yet assigned"}}},"CVE-2025-5281":{"description":"Inappropriate implementation in BFCache in Google Chrome prior to 137.0.7151.55 allowed a remote attacker to potentially obtain user information via a crafted HTML page. (Chromium security severity: Medium)","scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"143.0.7499.169-1~deb12u1","bookworm-security":"145.0.7632.159-1~deb12u1"},"fixed_version":"137.0.7151.55-3~deb12u1","urgency":"not yet assigned"},"bullseye":{"status":"open","repositories":{"bullseye":"120.0.6099.224-1~deb11u1","bullseye-security":"120.0.6099.224-1~deb11u1"},"urgency":"end-of-life"},"forky":{"status":"resolved","repositories":{"forky":"145.0.7632.159-1"},"fixed_version":"137.0.7151.55-1","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"146.0.7680.71-1"},"fixed_version":"137.0.7151.55-1","urgency":"not yet assigned"},"trixie":{"status":"resolved","repositories":{"trixie":"143.0.7499.169-1~deb13u1","trixie-security":"145.0.7632.159-1~deb13u1"},"fixed_version":"137.0.7151.55-1","urgency":"not yet assigned"}}},"CVE-2025-5283":{"description":"Use after free in libvpx in Google Chrome prior to 137.0.7151.55 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. (Chromium security severity: Medium)","scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"143.0.7499.169-1~deb12u1","bookworm-security":"145.0.7632.159-1~deb12u1"},"fixed_version":"137.0.7151.55-3~deb12u1","urgency":"not yet assigned"},"bullseye":{"status":"open","repositories":{"bullseye":"120.0.6099.224-1~deb11u1","bullseye-security":"120.0.6099.224-1~deb11u1"},"urgency":"end-of-life"},"forky":{"status":"resolved","repositories":{"forky":"145.0.7632.159-1"},"fixed_version":"137.0.7151.55-1","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"146.0.7680.71-1"},"fixed_version":"137.0.7151.55-1","urgency":"not yet assigned"},"trixie":{"status":"resolved","repositories":{"trixie":"143.0.7499.169-1~deb13u1","trixie-security":"145.0.7632.159-1~deb13u1"},"fixed_version":"137.0.7151.55-1","urgency":"not yet assigned"}}},"CVE-2025-5419":{"description":"Out of bounds read and write in V8 in Google Chrome prior to 137.0.7151.68 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. (Chromium security severity: High)","scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"143.0.7499.169-1~deb12u1","bookworm-security":"145.0.7632.159-1~deb12u1"},"fixed_version":"137.0.7151.68-1~deb12u1","urgency":"not yet assigned"},"bullseye":{"status":"open","repositories":{"bullseye":"120.0.6099.224-1~deb11u1","bullseye-security":"120.0.6099.224-1~deb11u1"},"urgency":"end-of-life"},"forky":{"status":"resolved","repositories":{"forky":"145.0.7632.159-1"},"fixed_version":"137.0.7151.68-1","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"146.0.7680.71-1"},"fixed_version":"137.0.7151.68-1","urgency":"not yet assigned"},"trixie":{"status":"resolved","repositories":{"trixie":"143.0.7499.169-1~deb13u1","trixie-security":"145.0.7632.159-1~deb13u1"},"fixed_version":"137.0.7151.68-1","urgency":"not yet assigned"}}},"CVE-2025-5958":{"description":"Use after free in Media in Google Chrome prior to 137.0.7151.103 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. (Chromium security severity: High)","scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"143.0.7499.169-1~deb12u1","bookworm-security":"145.0.7632.159-1~deb12u1"},"fixed_version":"137.0.7151.103-1~deb12u1","urgency":"not yet assigned"},"bullseye":{"status":"open","repositories":{"bullseye":"120.0.6099.224-1~deb11u1","bullseye-security":"120.0.6099.224-1~deb11u1"},"urgency":"end-of-life"},"forky":{"status":"resolved","repositories":{"forky":"145.0.7632.159-1"},"fixed_version":"137.0.7151.103-1","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"146.0.7680.71-1"},"fixed_version":"137.0.7151.103-1","urgency":"not yet assigned"},"trixie":{"status":"resolved","repositories":{"trixie":"143.0.7499.169-1~deb13u1","trixie-security":"145.0.7632.159-1~deb13u1"},"fixed_version":"137.0.7151.103-1","urgency":"not yet assigned"}}},"CVE-2025-5959":{"description":"Type Confusion in V8 in Google Chrome prior to 137.0.7151.103 allowed a remote attacker to execute arbitrary code inside a sandbox via a crafted HTML page. (Chromium security severity: High)","scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"143.0.7499.169-1~deb12u1","bookworm-security":"145.0.7632.159-1~deb12u1"},"fixed_version":"137.0.7151.103-1~deb12u1","urgency":"not yet assigned"},"bullseye":{"status":"open","repositories":{"bullseye":"120.0.6099.224-1~deb11u1","bullseye-security":"120.0.6099.224-1~deb11u1"},"urgency":"end-of-life"},"forky":{"status":"resolved","repositories":{"forky":"145.0.7632.159-1"},"fixed_version":"137.0.7151.103-1","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"146.0.7680.71-1"},"fixed_version":"137.0.7151.103-1","urgency":"not yet assigned"},"trixie":{"status":"resolved","repositories":{"trixie":"143.0.7499.169-1~deb13u1","trixie-security":"145.0.7632.159-1~deb13u1"},"fixed_version":"137.0.7151.103-1","urgency":"not yet assigned"}}},"CVE-2025-6191":{"description":"Integer overflow in V8 in Google Chrome prior to 137.0.7151.119 allowed a remote attacker to potentially perform out of bounds memory access via a crafted HTML page. (Chromium security severity: High)","scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"143.0.7499.169-1~deb12u1","bookworm-security":"145.0.7632.159-1~deb12u1"},"fixed_version":"137.0.7151.119-1~deb12u1","urgency":"not yet assigned"},"bullseye":{"status":"open","repositories":{"bullseye":"120.0.6099.224-1~deb11u1","bullseye-security":"120.0.6099.224-1~deb11u1"},"urgency":"end-of-life"},"forky":{"status":"resolved","repositories":{"forky":"145.0.7632.159-1"},"fixed_version":"137.0.7151.119-1","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"146.0.7680.71-1"},"fixed_version":"137.0.7151.119-1","urgency":"not yet assigned"},"trixie":{"status":"resolved","repositories":{"trixie":"143.0.7499.169-1~deb13u1","trixie-security":"145.0.7632.159-1~deb13u1"},"fixed_version":"137.0.7151.119-1","urgency":"not yet assigned"}}},"CVE-2025-6192":{"description":"Use after free in Metrics in Google Chrome prior to 137.0.7151.119 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. (Chromium security severity: High)","scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"143.0.7499.169-1~deb12u1","bookworm-security":"145.0.7632.159-1~deb12u1"},"fixed_version":"137.0.7151.119-1~deb12u1","urgency":"not yet assigned"},"bullseye":{"status":"open","repositories":{"bullseye":"120.0.6099.224-1~deb11u1","bullseye-security":"120.0.6099.224-1~deb11u1"},"urgency":"end-of-life"},"forky":{"status":"resolved","repositories":{"forky":"145.0.7632.159-1"},"fixed_version":"137.0.7151.119-1","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"146.0.7680.71-1"},"fixed_version":"137.0.7151.119-1","urgency":"not yet assigned"},"trixie":{"status":"resolved","repositories":{"trixie":"143.0.7499.169-1~deb13u1","trixie-security":"145.0.7632.159-1~deb13u1"},"fixed_version":"137.0.7151.119-1","urgency":"not yet assigned"}}},"CVE-2025-6554":{"description":"Type confusion in V8 in Google Chrome prior to 138.0.7204.96 allowed a remote attacker to perform arbitrary read/write via a crafted HTML page. (Chromium security severity: High)","scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"143.0.7499.169-1~deb12u1","bookworm-security":"145.0.7632.159-1~deb12u1"},"fixed_version":"138.0.7204.92-1~deb12u1","urgency":"not yet assigned"},"bullseye":{"status":"open","repositories":{"bullseye":"120.0.6099.224-1~deb11u1","bullseye-security":"120.0.6099.224-1~deb11u1"},"urgency":"end-of-life"},"forky":{"status":"resolved","repositories":{"forky":"145.0.7632.159-1"},"fixed_version":"138.0.7204.92-1","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"146.0.7680.71-1"},"fixed_version":"138.0.7204.92-1","urgency":"not yet assigned"},"trixie":{"status":"resolved","repositories":{"trixie":"143.0.7499.169-1~deb13u1","trixie-security":"145.0.7632.159-1~deb13u1"},"fixed_version":"138.0.7204.92-1","urgency":"not yet assigned"}}},"CVE-2025-6555":{"description":"Use after free in Animation in Google Chrome prior to 138.0.7204.49 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. (Chromium security severity: Medium)","scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"143.0.7499.169-1~deb12u1","bookworm-security":"145.0.7632.159-1~deb12u1"},"fixed_version":"138.0.7204.49-1~deb12u1","urgency":"not yet assigned"},"bullseye":{"status":"open","repositories":{"bullseye":"120.0.6099.224-1~deb11u1","bullseye-security":"120.0.6099.224-1~deb11u1"},"urgency":"end-of-life"},"forky":{"status":"resolved","repositories":{"forky":"145.0.7632.159-1"},"fixed_version":"138.0.7204.49-1","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"146.0.7680.71-1"},"fixed_version":"138.0.7204.49-1","urgency":"not yet assigned"},"trixie":{"status":"resolved","repositories":{"trixie":"143.0.7499.169-1~deb13u1","trixie-security":"145.0.7632.159-1~deb13u1"},"fixed_version":"138.0.7204.49-1","urgency":"not yet assigned"}}},"CVE-2025-6556":{"description":"Insufficient policy enforcement in Loader in Google Chrome prior to 138.0.7204.49 allowed a remote attacker to bypass content security policy via a crafted HTML page. (Chromium security severity: Low)","scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"143.0.7499.169-1~deb12u1","bookworm-security":"145.0.7632.159-1~deb12u1"},"fixed_version":"138.0.7204.49-1~deb12u1","urgency":"not yet assigned"},"bullseye":{"status":"open","repositories":{"bullseye":"120.0.6099.224-1~deb11u1","bullseye-security":"120.0.6099.224-1~deb11u1"},"urgency":"end-of-life"},"forky":{"status":"resolved","repositories":{"forky":"145.0.7632.159-1"},"fixed_version":"138.0.7204.49-1","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"146.0.7680.71-1"},"fixed_version":"138.0.7204.49-1","urgency":"not yet assigned"},"trixie":{"status":"resolved","repositories":{"trixie":"143.0.7499.169-1~deb13u1","trixie-security":"145.0.7632.159-1~deb13u1"},"fixed_version":"138.0.7204.49-1","urgency":"not yet assigned"}}},"CVE-2025-6557":{"description":"Insufficient data validation in DevTools in Google Chrome on Windows prior to 138.0.7204.49 allowed a remote attacker who convinced a user to engage in specific UI gestures to execute arbitrary code via a crafted HTML page. (Chromium security severity: Low)","scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"143.0.7499.169-1~deb12u1","bookworm-security":"145.0.7632.159-1~deb12u1"},"fixed_version":"138.0.7204.49-1~deb12u1","urgency":"not yet assigned"},"bullseye":{"status":"open","repositories":{"bullseye":"120.0.6099.224-1~deb11u1","bullseye-security":"120.0.6099.224-1~deb11u1"},"urgency":"end-of-life"},"forky":{"status":"resolved","repositories":{"forky":"145.0.7632.159-1"},"fixed_version":"138.0.7204.49-1","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"146.0.7680.71-1"},"fixed_version":"138.0.7204.49-1","urgency":"not yet assigned"},"trixie":{"status":"resolved","repositories":{"trixie":"143.0.7499.169-1~deb13u1","trixie-security":"145.0.7632.159-1~deb13u1"},"fixed_version":"138.0.7204.49-1","urgency":"not yet assigned"}}},"CVE-2025-6558":{"description":"Insufficient validation of untrusted input in ANGLE and GPU in Google Chrome prior to 138.0.7204.157 allowed a remote attacker to potentially perform a sandbox escape via a crafted HTML page. (Chromium security severity: High)","scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"143.0.7499.169-1~deb12u1","bookworm-security":"145.0.7632.159-1~deb12u1"},"fixed_version":"138.0.7204.157-1~deb12u1","urgency":"not yet assigned"},"bullseye":{"status":"open","repositories":{"bullseye":"120.0.6099.224-1~deb11u1","bullseye-security":"120.0.6099.224-1~deb11u1"},"urgency":"end-of-life"},"forky":{"status":"resolved","repositories":{"forky":"145.0.7632.159-1"},"fixed_version":"138.0.7204.157-1","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"146.0.7680.71-1"},"fixed_version":"138.0.7204.157-1","urgency":"not yet assigned"},"trixie":{"status":"resolved","repositories":{"trixie":"143.0.7499.169-1~deb13u1","trixie-security":"145.0.7632.159-1~deb13u1"},"fixed_version":"138.0.7204.157-1","urgency":"not yet assigned"}}},"CVE-2025-7656":{"description":"Integer overflow in V8 in Google Chrome prior to 138.0.7204.157 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. (Chromium security severity: High)","scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"143.0.7499.169-1~deb12u1","bookworm-security":"145.0.7632.159-1~deb12u1"},"fixed_version":"138.0.7204.157-1~deb12u1","urgency":"not yet assigned"},"bullseye":{"status":"open","repositories":{"bullseye":"120.0.6099.224-1~deb11u1","bullseye-security":"120.0.6099.224-1~deb11u1"},"urgency":"end-of-life"},"forky":{"status":"resolved","repositories":{"forky":"145.0.7632.159-1"},"fixed_version":"138.0.7204.157-1","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"146.0.7680.71-1"},"fixed_version":"138.0.7204.157-1","urgency":"not yet assigned"},"trixie":{"status":"resolved","repositories":{"trixie":"143.0.7499.169-1~deb13u1","trixie-security":"145.0.7632.159-1~deb13u1"},"fixed_version":"138.0.7204.157-1","urgency":"not yet assigned"}}},"CVE-2025-7657":{"description":"Use after free in WebRTC in Google Chrome prior to 138.0.7204.157 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. (Chromium security severity: High)","scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"143.0.7499.169-1~deb12u1","bookworm-security":"145.0.7632.159-1~deb12u1"},"fixed_version":"138.0.7204.157-1~deb12u1","urgency":"not yet assigned"},"bullseye":{"status":"open","repositories":{"bullseye":"120.0.6099.224-1~deb11u1","bullseye-security":"120.0.6099.224-1~deb11u1"},"urgency":"end-of-life"},"forky":{"status":"resolved","repositories":{"forky":"145.0.7632.159-1"},"fixed_version":"138.0.7204.157-1","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"146.0.7680.71-1"},"fixed_version":"138.0.7204.157-1","urgency":"not yet assigned"},"trixie":{"status":"resolved","repositories":{"trixie":"143.0.7499.169-1~deb13u1","trixie-security":"145.0.7632.159-1~deb13u1"},"fixed_version":"138.0.7204.157-1","urgency":"not yet assigned"}}},"CVE-2025-8010":{"description":"Type Confusion in V8 in Google Chrome prior to 138.0.7204.168 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. (Chromium security severity: High)","scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"143.0.7499.169-1~deb12u1","bookworm-security":"145.0.7632.159-1~deb12u1"},"fixed_version":"138.0.7204.168-1~deb12u1","urgency":"not yet assigned"},"bullseye":{"status":"open","repositories":{"bullseye":"120.0.6099.224-1~deb11u1","bullseye-security":"120.0.6099.224-1~deb11u1"},"urgency":"end-of-life"},"forky":{"status":"resolved","repositories":{"forky":"145.0.7632.159-1"},"fixed_version":"138.0.7204.168-1","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"146.0.7680.71-1"},"fixed_version":"138.0.7204.168-1","urgency":"not yet assigned"},"trixie":{"status":"resolved","repositories":{"trixie":"143.0.7499.169-1~deb13u1","trixie-security":"145.0.7632.159-1~deb13u1"},"fixed_version":"138.0.7204.168-1","urgency":"not yet assigned"}}},"CVE-2025-8011":{"description":"Type Confusion in V8 in Google Chrome prior to 138.0.7204.168 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. (Chromium security severity: High)","scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"143.0.7499.169-1~deb12u1","bookworm-security":"145.0.7632.159-1~deb12u1"},"fixed_version":"138.0.7204.168-1~deb12u1","urgency":"not yet assigned"},"bullseye":{"status":"open","repositories":{"bullseye":"120.0.6099.224-1~deb11u1","bullseye-security":"120.0.6099.224-1~deb11u1"},"urgency":"end-of-life"},"forky":{"status":"resolved","repositories":{"forky":"145.0.7632.159-1"},"fixed_version":"138.0.7204.168-1","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"146.0.7680.71-1"},"fixed_version":"138.0.7204.168-1","urgency":"not yet assigned"},"trixie":{"status":"resolved","repositories":{"trixie":"143.0.7499.169-1~deb13u1","trixie-security":"145.0.7632.159-1~deb13u1"},"fixed_version":"138.0.7204.168-1","urgency":"not yet assigned"}}},"CVE-2025-8292":{"description":"Use after free in Media Stream in Google Chrome prior to 138.0.7204.183 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. (Chromium security severity: High)","scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"143.0.7499.169-1~deb12u1","bookworm-security":"145.0.7632.159-1~deb12u1"},"fixed_version":"138.0.7204.183-1~deb12u1","urgency":"not yet assigned"},"bullseye":{"status":"open","repositories":{"bullseye":"120.0.6099.224-1~deb11u1","bullseye-security":"120.0.6099.224-1~deb11u1"},"urgency":"end-of-life"},"forky":{"status":"resolved","repositories":{"forky":"145.0.7632.159-1"},"fixed_version":"138.0.7204.183-1","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"146.0.7680.71-1"},"fixed_version":"138.0.7204.183-1","urgency":"not yet assigned"},"trixie":{"status":"resolved","repositories":{"trixie":"143.0.7499.169-1~deb13u1","trixie-security":"145.0.7632.159-1~deb13u1"},"fixed_version":"138.0.7204.183-1","urgency":"not yet assigned"}}},"CVE-2025-8576":{"description":"Use after free in Extensions in Google Chrome prior to 139.0.7258.66 allowed a remote attacker to potentially exploit heap corruption via a crafted Chrome Extension. (Chromium security severity: Medium)","scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"143.0.7499.169-1~deb12u1","bookworm-security":"145.0.7632.159-1~deb12u1"},"fixed_version":"139.0.7258.66-1~deb12u1","urgency":"not yet assigned"},"bullseye":{"status":"open","repositories":{"bullseye":"120.0.6099.224-1~deb11u1","bullseye-security":"120.0.6099.224-1~deb11u1"},"urgency":"end-of-life"},"forky":{"status":"resolved","repositories":{"forky":"145.0.7632.159-1"},"fixed_version":"139.0.7258.66-1","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"146.0.7680.71-1"},"fixed_version":"139.0.7258.66-1","urgency":"not yet assigned"},"trixie":{"status":"resolved","repositories":{"trixie":"143.0.7499.169-1~deb13u1","trixie-security":"145.0.7632.159-1~deb13u1"},"fixed_version":"139.0.7258.127-1~deb13u1","urgency":"not yet assigned"}}},"CVE-2025-8577":{"description":"Inappropriate implementation in Picture In Picture in Google Chrome prior to 139.0.7258.66 allowed a remote attacker who convinced a user to engage in specific UI gestures to perform UI spoofing via a crafted HTML page. (Chromium security severity: Medium)","scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"143.0.7499.169-1~deb12u1","bookworm-security":"145.0.7632.159-1~deb12u1"},"fixed_version":"139.0.7258.66-1~deb12u1","urgency":"not yet assigned"},"bullseye":{"status":"open","repositories":{"bullseye":"120.0.6099.224-1~deb11u1","bullseye-security":"120.0.6099.224-1~deb11u1"},"urgency":"end-of-life"},"forky":{"status":"resolved","repositories":{"forky":"145.0.7632.159-1"},"fixed_version":"139.0.7258.66-1","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"146.0.7680.71-1"},"fixed_version":"139.0.7258.66-1","urgency":"not yet assigned"},"trixie":{"status":"resolved","repositories":{"trixie":"143.0.7499.169-1~deb13u1","trixie-security":"145.0.7632.159-1~deb13u1"},"fixed_version":"139.0.7258.127-1~deb13u1","urgency":"not yet assigned"}}},"CVE-2025-8578":{"description":"Use after free in Cast in Google Chrome prior to 139.0.7258.66 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. (Chromium security severity: Medium)","scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"143.0.7499.169-1~deb12u1","bookworm-security":"145.0.7632.159-1~deb12u1"},"fixed_version":"139.0.7258.66-1~deb12u1","urgency":"not yet assigned"},"bullseye":{"status":"open","repositories":{"bullseye":"120.0.6099.224-1~deb11u1","bullseye-security":"120.0.6099.224-1~deb11u1"},"urgency":"end-of-life"},"forky":{"status":"resolved","repositories":{"forky":"145.0.7632.159-1"},"fixed_version":"139.0.7258.66-1","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"146.0.7680.71-1"},"fixed_version":"139.0.7258.66-1","urgency":"not yet assigned"},"trixie":{"status":"resolved","repositories":{"trixie":"143.0.7499.169-1~deb13u1","trixie-security":"145.0.7632.159-1~deb13u1"},"fixed_version":"139.0.7258.127-1~deb13u1","urgency":"not yet assigned"}}},"CVE-2025-8579":{"description":"Inappropriate implementation in Picture In Picture in Google Chrome prior to 139.0.7258.66 allowed a remote attacker who convinced a user to engage in specific UI gestures to perform UI spoofing via a crafted HTML page. (Chromium security severity: Low)","scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"143.0.7499.169-1~deb12u1","bookworm-security":"145.0.7632.159-1~deb12u1"},"fixed_version":"139.0.7258.66-1~deb12u1","urgency":"not yet assigned"},"bullseye":{"status":"open","repositories":{"bullseye":"120.0.6099.224-1~deb11u1","bullseye-security":"120.0.6099.224-1~deb11u1"},"urgency":"end-of-life"},"forky":{"status":"resolved","repositories":{"forky":"145.0.7632.159-1"},"fixed_version":"139.0.7258.66-1","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"146.0.7680.71-1"},"fixed_version":"139.0.7258.66-1","urgency":"not yet assigned"},"trixie":{"status":"resolved","repositories":{"trixie":"143.0.7499.169-1~deb13u1","trixie-security":"145.0.7632.159-1~deb13u1"},"fixed_version":"139.0.7258.127-1~deb13u1","urgency":"not yet assigned"}}},"CVE-2025-8580":{"description":"Inappropriate implementation in Filesystems in Google Chrome prior to 139.0.7258.66 allowed a remote attacker to perform UI spoofing via a crafted HTML page. (Chromium security severity: Low)","scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"143.0.7499.169-1~deb12u1","bookworm-security":"145.0.7632.159-1~deb12u1"},"fixed_version":"139.0.7258.66-1~deb12u1","urgency":"not yet assigned"},"bullseye":{"status":"open","repositories":{"bullseye":"120.0.6099.224-1~deb11u1","bullseye-security":"120.0.6099.224-1~deb11u1"},"urgency":"end-of-life"},"forky":{"status":"resolved","repositories":{"forky":"145.0.7632.159-1"},"fixed_version":"139.0.7258.66-1","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"146.0.7680.71-1"},"fixed_version":"139.0.7258.66-1","urgency":"not yet assigned"},"trixie":{"status":"resolved","repositories":{"trixie":"143.0.7499.169-1~deb13u1","trixie-security":"145.0.7632.159-1~deb13u1"},"fixed_version":"139.0.7258.127-1~deb13u1","urgency":"not yet assigned"}}},"CVE-2025-8581":{"description":"Inappropriate implementation in Extensions in Google Chrome prior to 139.0.7258.66 allowed a remote attacker who convinced a user to engage in specific UI gestures to leak cross-origin data via a crafted HTML page. (Chromium security severity: Low)","scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"143.0.7499.169-1~deb12u1","bookworm-security":"145.0.7632.159-1~deb12u1"},"fixed_version":"139.0.7258.66-1~deb12u1","urgency":"not yet assigned"},"bullseye":{"status":"open","repositories":{"bullseye":"120.0.6099.224-1~deb11u1","bullseye-security":"120.0.6099.224-1~deb11u1"},"urgency":"end-of-life"},"forky":{"status":"resolved","repositories":{"forky":"145.0.7632.159-1"},"fixed_version":"139.0.7258.66-1","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"146.0.7680.71-1"},"fixed_version":"139.0.7258.66-1","urgency":"not yet assigned"},"trixie":{"status":"resolved","repositories":{"trixie":"143.0.7499.169-1~deb13u1","trixie-security":"145.0.7632.159-1~deb13u1"},"fixed_version":"139.0.7258.127-1~deb13u1","urgency":"not yet assigned"}}},"CVE-2025-8582":{"description":"Insufficient validation of untrusted input in Core in Google Chrome prior to 139.0.7258.66 allowed a remote attacker to spoof the contents of the Omnibox (URL bar) via a crafted HTML page. (Chromium security severity: Low)","scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"143.0.7499.169-1~deb12u1","bookworm-security":"145.0.7632.159-1~deb12u1"},"fixed_version":"139.0.7258.66-1~deb12u1","urgency":"not yet assigned"},"bullseye":{"status":"open","repositories":{"bullseye":"120.0.6099.224-1~deb11u1","bullseye-security":"120.0.6099.224-1~deb11u1"},"urgency":"end-of-life"},"forky":{"status":"resolved","repositories":{"forky":"145.0.7632.159-1"},"fixed_version":"139.0.7258.66-1","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"146.0.7680.71-1"},"fixed_version":"139.0.7258.66-1","urgency":"not yet assigned"},"trixie":{"status":"resolved","repositories":{"trixie":"143.0.7499.169-1~deb13u1","trixie-security":"145.0.7632.159-1~deb13u1"},"fixed_version":"139.0.7258.127-1~deb13u1","urgency":"not yet assigned"}}},"CVE-2025-8583":{"description":"Inappropriate implementation in Permissions in Google Chrome prior to 139.0.7258.66 allowed a remote attacker to perform UI spoofing via a crafted HTML page. (Chromium security severity: Low)","scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"143.0.7499.169-1~deb12u1","bookworm-security":"145.0.7632.159-1~deb12u1"},"fixed_version":"139.0.7258.66-1~deb12u1","urgency":"not yet assigned"},"bullseye":{"status":"open","repositories":{"bullseye":"120.0.6099.224-1~deb11u1","bullseye-security":"120.0.6099.224-1~deb11u1"},"urgency":"end-of-life"},"forky":{"status":"resolved","repositories":{"forky":"145.0.7632.159-1"},"fixed_version":"139.0.7258.66-1","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"146.0.7680.71-1"},"fixed_version":"139.0.7258.66-1","urgency":"not yet assigned"},"trixie":{"status":"resolved","repositories":{"trixie":"143.0.7499.169-1~deb13u1","trixie-security":"145.0.7632.159-1~deb13u1"},"fixed_version":"139.0.7258.127-1~deb13u1","urgency":"not yet assigned"}}},"CVE-2025-8879":{"description":"Heap buffer overflow in libaom in Google Chrome prior to 139.0.7258.127 allowed a remote attacker to potentially exploit heap corruption via a curated set of gestures. (Chromium security severity: High)","scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"143.0.7499.169-1~deb12u1","bookworm-security":"145.0.7632.159-1~deb12u1"},"fixed_version":"139.0.7258.127-1~deb12u1","urgency":"not yet assigned"},"bullseye":{"status":"open","repositories":{"bullseye":"120.0.6099.224-1~deb11u1","bullseye-security":"120.0.6099.224-1~deb11u1"},"urgency":"end-of-life"},"forky":{"status":"resolved","repositories":{"forky":"145.0.7632.159-1"},"fixed_version":"139.0.7258.127-1","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"146.0.7680.71-1"},"fixed_version":"139.0.7258.127-1","urgency":"not yet assigned"},"trixie":{"status":"resolved","repositories":{"trixie":"143.0.7499.169-1~deb13u1","trixie-security":"145.0.7632.159-1~deb13u1"},"fixed_version":"139.0.7258.127-1~deb13u1","urgency":"not yet assigned"}}},"CVE-2025-8880":{"description":"Race in V8 in Google Chrome prior to 139.0.7258.127 allowed a remote attacker to execute arbitrary code inside a sandbox via a crafted HTML page. (Chromium security severity: High)","scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"143.0.7499.169-1~deb12u1","bookworm-security":"145.0.7632.159-1~deb12u1"},"fixed_version":"139.0.7258.127-1~deb12u1","urgency":"not yet assigned"},"bullseye":{"status":"open","repositories":{"bullseye":"120.0.6099.224-1~deb11u1","bullseye-security":"120.0.6099.224-1~deb11u1"},"urgency":"end-of-life"},"forky":{"status":"resolved","repositories":{"forky":"145.0.7632.159-1"},"fixed_version":"139.0.7258.127-1","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"146.0.7680.71-1"},"fixed_version":"139.0.7258.127-1","urgency":"not yet assigned"},"trixie":{"status":"resolved","repositories":{"trixie":"143.0.7499.169-1~deb13u1","trixie-security":"145.0.7632.159-1~deb13u1"},"fixed_version":"139.0.7258.127-1~deb13u1","urgency":"not yet assigned"}}},"CVE-2025-8881":{"description":"Inappropriate implementation in File Picker in Google Chrome prior to 139.0.7258.127 allowed a remote attacker who convinced a user to engage in specific UI gestures to leak cross-origin data via a crafted HTML page. (Chromium security severity: Medium)","scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"143.0.7499.169-1~deb12u1","bookworm-security":"145.0.7632.159-1~deb12u1"},"fixed_version":"139.0.7258.127-1~deb12u1","urgency":"not yet assigned"},"bullseye":{"status":"open","repositories":{"bullseye":"120.0.6099.224-1~deb11u1","bullseye-security":"120.0.6099.224-1~deb11u1"},"urgency":"end-of-life"},"forky":{"status":"resolved","repositories":{"forky":"145.0.7632.159-1"},"fixed_version":"139.0.7258.127-1","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"146.0.7680.71-1"},"fixed_version":"139.0.7258.127-1","urgency":"not yet assigned"},"trixie":{"status":"resolved","repositories":{"trixie":"143.0.7499.169-1~deb13u1","trixie-security":"145.0.7632.159-1~deb13u1"},"fixed_version":"139.0.7258.127-1~deb13u1","urgency":"not yet assigned"}}},"CVE-2025-8882":{"description":"Use after free in Aura in Google Chrome prior to 139.0.7258.127 allowed a remote attacker who convinced a user to engage in specific UI gestures to potentially exploit heap corruption via a crafted HTML page. (Chromium security severity: Medium)","scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"143.0.7499.169-1~deb12u1","bookworm-security":"145.0.7632.159-1~deb12u1"},"fixed_version":"139.0.7258.127-1~deb12u1","urgency":"not yet assigned"},"bullseye":{"status":"open","repositories":{"bullseye":"120.0.6099.224-1~deb11u1","bullseye-security":"120.0.6099.224-1~deb11u1"},"urgency":"end-of-life"},"forky":{"status":"resolved","repositories":{"forky":"145.0.7632.159-1"},"fixed_version":"139.0.7258.127-1","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"146.0.7680.71-1"},"fixed_version":"139.0.7258.127-1","urgency":"not yet assigned"},"trixie":{"status":"resolved","repositories":{"trixie":"143.0.7499.169-1~deb13u1","trixie-security":"145.0.7632.159-1~deb13u1"},"fixed_version":"139.0.7258.127-1~deb13u1","urgency":"not yet assigned"}}},"CVE-2025-8901":{"description":"Out of bounds write in ANGLE in Google Chrome prior to 139.0.7258.127 allowed a remote attacker to perform out of bounds memory access via a crafted HTML page. (Chromium security severity: High)","scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"143.0.7499.169-1~deb12u1","bookworm-security":"145.0.7632.159-1~deb12u1"},"fixed_version":"139.0.7258.127-1~deb12u1","urgency":"not yet assigned"},"bullseye":{"status":"open","repositories":{"bullseye":"120.0.6099.224-1~deb11u1","bullseye-security":"120.0.6099.224-1~deb11u1"},"urgency":"end-of-life"},"forky":{"status":"resolved","repositories":{"forky":"145.0.7632.159-1"},"fixed_version":"139.0.7258.127-1","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"146.0.7680.71-1"},"fixed_version":"139.0.7258.127-1","urgency":"not yet assigned"},"trixie":{"status":"resolved","repositories":{"trixie":"143.0.7499.169-1~deb13u1","trixie-security":"145.0.7632.159-1~deb13u1"},"fixed_version":"139.0.7258.127-1~deb13u1","urgency":"not yet assigned"}}},"CVE-2025-9132":{"description":"Out of bounds write in V8 in Google Chrome prior to 139.0.7258.138 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. (Chromium security severity: High)","scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"143.0.7499.169-1~deb12u1","bookworm-security":"145.0.7632.159-1~deb12u1"},"fixed_version":"139.0.7258.138-1~deb12u1","urgency":"not yet assigned"},"bullseye":{"status":"open","repositories":{"bullseye":"120.0.6099.224-1~deb11u1","bullseye-security":"120.0.6099.224-1~deb11u1"},"urgency":"end-of-life"},"forky":{"status":"resolved","repositories":{"forky":"145.0.7632.159-1"},"fixed_version":"139.0.7258.138-1","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"146.0.7680.71-1"},"fixed_version":"139.0.7258.138-1","urgency":"not yet assigned"},"trixie":{"status":"resolved","repositories":{"trixie":"143.0.7499.169-1~deb13u1","trixie-security":"145.0.7632.159-1~deb13u1"},"fixed_version":"139.0.7258.138-1~deb13u1","urgency":"not yet assigned"}}},"CVE-2025-9478":{"description":"Use after free in ANGLE in Google Chrome prior to 139.0.7258.154 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. (Chromium security severity: Critical)","scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"143.0.7499.169-1~deb12u1","bookworm-security":"145.0.7632.159-1~deb12u1"},"fixed_version":"139.0.7258.154-1~deb12u1","urgency":"not yet assigned"},"bullseye":{"status":"open","repositories":{"bullseye":"120.0.6099.224-1~deb11u1","bullseye-security":"120.0.6099.224-1~deb11u1"},"urgency":"end-of-life"},"forky":{"status":"resolved","repositories":{"forky":"145.0.7632.159-1"},"fixed_version":"139.0.7258.154-1","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"146.0.7680.71-1"},"fixed_version":"139.0.7258.154-1","urgency":"not yet assigned"},"trixie":{"status":"resolved","repositories":{"trixie":"143.0.7499.169-1~deb13u1","trixie-security":"145.0.7632.159-1~deb13u1"},"fixed_version":"139.0.7258.154-1~deb13u1","urgency":"not yet assigned"}}},"CVE-2025-9479":{"description":"Out of bounds read in V8 in Google Chrome prior to 133.0.6943.141 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. (Chromium security severity: Medium)","scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"143.0.7499.169-1~deb12u1","bookworm-security":"145.0.7632.159-1~deb12u1"},"fixed_version":"134.0.6998.35-1~deb12u1","urgency":"not yet assigned"},"bullseye":{"status":"open","repositories":{"bullseye":"120.0.6099.224-1~deb11u1","bullseye-security":"120.0.6099.224-1~deb11u1"},"urgency":"end-of-life"},"forky":{"status":"resolved","repositories":{"forky":"145.0.7632.159-1"},"fixed_version":"133.0.6943.141-1","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"146.0.7680.71-1"},"fixed_version":"133.0.6943.141-1","urgency":"not yet assigned"},"trixie":{"status":"resolved","repositories":{"trixie":"143.0.7499.169-1~deb13u1","trixie-security":"145.0.7632.159-1~deb13u1"},"fixed_version":"133.0.6943.141-1","urgency":"not yet assigned"}}},"CVE-2025-9865":{"description":"Inappropriate implementation in Toolbar in Google Chrome on Android prior to 140.0.7339.80 allowed a remote attacker who convinced a user to engage in specific UI gestures to perform domain spoofing via a crafted HTML page. (Chromium security severity: Medium)","scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"143.0.7499.169-1~deb12u1","bookworm-security":"145.0.7632.159-1~deb12u1"},"fixed_version":"140.0.7339.80-1~deb12u1","urgency":"not yet assigned"},"bullseye":{"status":"open","repositories":{"bullseye":"120.0.6099.224-1~deb11u1","bullseye-security":"120.0.6099.224-1~deb11u1"},"urgency":"end-of-life"},"forky":{"status":"resolved","repositories":{"forky":"145.0.7632.159-1"},"fixed_version":"140.0.7339.80-1","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"146.0.7680.71-1"},"fixed_version":"140.0.7339.80-1","urgency":"not yet assigned"},"trixie":{"status":"resolved","repositories":{"trixie":"143.0.7499.169-1~deb13u1","trixie-security":"145.0.7632.159-1~deb13u1"},"fixed_version":"140.0.7339.80-1~deb13u1","urgency":"not yet assigned"}}},"CVE-2025-9866":{"description":"Inappropriate implementation in Extensions in Google Chrome prior to 140.0.7339.80 allowed a remote attacker to bypass content security policy via a crafted HTML page. (Chromium security severity: Medium)","scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"143.0.7499.169-1~deb12u1","bookworm-security":"145.0.7632.159-1~deb12u1"},"fixed_version":"140.0.7339.80-1~deb12u1","urgency":"not yet assigned"},"bullseye":{"status":"open","repositories":{"bullseye":"120.0.6099.224-1~deb11u1","bullseye-security":"120.0.6099.224-1~deb11u1"},"urgency":"end-of-life"},"forky":{"status":"resolved","repositories":{"forky":"145.0.7632.159-1"},"fixed_version":"140.0.7339.80-1","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"146.0.7680.71-1"},"fixed_version":"140.0.7339.80-1","urgency":"not yet assigned"},"trixie":{"status":"resolved","repositories":{"trixie":"143.0.7499.169-1~deb13u1","trixie-security":"145.0.7632.159-1~deb13u1"},"fixed_version":"140.0.7339.80-1~deb13u1","urgency":"not yet assigned"}}},"CVE-2025-9867":{"description":"Inappropriate implementation in Downloads in Google Chrome on Android prior to 140.0.7339.80 allowed a remote attacker to perform UI spoofing via a crafted HTML page. (Chromium security severity: Medium)","scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"143.0.7499.169-1~deb12u1","bookworm-security":"145.0.7632.159-1~deb12u1"},"fixed_version":"140.0.7339.80-1~deb12u1","urgency":"not yet assigned"},"bullseye":{"status":"open","repositories":{"bullseye":"120.0.6099.224-1~deb11u1","bullseye-security":"120.0.6099.224-1~deb11u1"},"urgency":"end-of-life"},"forky":{"status":"resolved","repositories":{"forky":"145.0.7632.159-1"},"fixed_version":"140.0.7339.80-1","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"146.0.7680.71-1"},"fixed_version":"140.0.7339.80-1","urgency":"not yet assigned"},"trixie":{"status":"resolved","repositories":{"trixie":"143.0.7499.169-1~deb13u1","trixie-security":"145.0.7632.159-1~deb13u1"},"fixed_version":"140.0.7339.80-1~deb13u1","urgency":"not yet assigned"}}},"CVE-2026-0628":{"description":"Insufficient policy enforcement in WebView tag in Google Chrome prior to 143.0.7499.192 allowed an attacker who convinced a user to install a malicious extension to inject scripts or HTML into a privileged page via a crafted Chrome Extension. (Chromium security severity: High)","scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"143.0.7499.169-1~deb12u1","bookworm-security":"145.0.7632.159-1~deb12u1"},"fixed_version":"143.0.7499.192-1~deb12u1","urgency":"not yet assigned"},"bullseye":{"status":"open","repositories":{"bullseye":"120.0.6099.224-1~deb11u1","bullseye-security":"120.0.6099.224-1~deb11u1"},"urgency":"end-of-life"},"forky":{"status":"resolved","repositories":{"forky":"145.0.7632.159-1"},"fixed_version":"143.0.7499.192-1","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"146.0.7680.71-1"},"fixed_version":"143.0.7499.192-1","urgency":"not yet assigned"},"trixie":{"status":"resolved","repositories":{"trixie":"143.0.7499.169-1~deb13u1","trixie-security":"145.0.7632.159-1~deb13u1"},"fixed_version":"143.0.7499.192-1~deb13u1","urgency":"not yet assigned"}}},"CVE-2026-0899":{"description":"Out of bounds memory access in V8 in Google Chrome prior to 144.0.7559.59 allowed a remote attacker to potentially exploit object corruption via a crafted HTML page. (Chromium security severity: High)","scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"143.0.7499.169-1~deb12u1","bookworm-security":"145.0.7632.159-1~deb12u1"},"fixed_version":"144.0.7559.59-1~deb12u1","urgency":"not yet assigned"},"bullseye":{"status":"open","repositories":{"bullseye":"120.0.6099.224-1~deb11u1","bullseye-security":"120.0.6099.224-1~deb11u1"},"urgency":"end-of-life"},"forky":{"status":"resolved","repositories":{"forky":"145.0.7632.159-1"},"fixed_version":"144.0.7559.59-1","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"146.0.7680.71-1"},"fixed_version":"144.0.7559.59-1","urgency":"not yet assigned"},"trixie":{"status":"resolved","repositories":{"trixie":"143.0.7499.169-1~deb13u1","trixie-security":"145.0.7632.159-1~deb13u1"},"fixed_version":"144.0.7559.59-1~deb13u1","urgency":"not yet assigned"}}},"CVE-2026-0900":{"description":"Inappropriate implementation in V8 in Google Chrome prior to 144.0.7559.59 allowed a remote attacker to potentially exploit object corruption via a crafted HTML page. (Chromium security severity: High)","scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"143.0.7499.169-1~deb12u1","bookworm-security":"145.0.7632.159-1~deb12u1"},"fixed_version":"144.0.7559.59-1~deb12u1","urgency":"not yet assigned"},"bullseye":{"status":"open","repositories":{"bullseye":"120.0.6099.224-1~deb11u1","bullseye-security":"120.0.6099.224-1~deb11u1"},"urgency":"end-of-life"},"forky":{"status":"resolved","repositories":{"forky":"145.0.7632.159-1"},"fixed_version":"144.0.7559.59-1","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"146.0.7680.71-1"},"fixed_version":"144.0.7559.59-1","urgency":"not yet assigned"},"trixie":{"status":"resolved","repositories":{"trixie":"143.0.7499.169-1~deb13u1","trixie-security":"145.0.7632.159-1~deb13u1"},"fixed_version":"144.0.7559.59-1~deb13u1","urgency":"not yet assigned"}}},"CVE-2026-0901":{"description":"Inappropriate implementation in Blink in Google Chrome on Android prior to 144.0.7559.59 allowed a remote attacker to perform UI spoofing via a crafted HTML page. (Chromium security severity: High)","scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"143.0.7499.169-1~deb12u1","bookworm-security":"145.0.7632.159-1~deb12u1"},"fixed_version":"144.0.7559.59-1~deb12u1","urgency":"not yet assigned"},"bullseye":{"status":"open","repositories":{"bullseye":"120.0.6099.224-1~deb11u1","bullseye-security":"120.0.6099.224-1~deb11u1"},"urgency":"end-of-life"},"forky":{"status":"resolved","repositories":{"forky":"145.0.7632.159-1"},"fixed_version":"144.0.7559.59-1","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"146.0.7680.71-1"},"fixed_version":"144.0.7559.59-1","urgency":"not yet assigned"},"trixie":{"status":"resolved","repositories":{"trixie":"143.0.7499.169-1~deb13u1","trixie-security":"145.0.7632.159-1~deb13u1"},"fixed_version":"144.0.7559.59-1~deb13u1","urgency":"not yet assigned"}}},"CVE-2026-0902":{"description":"Inappropriate implementation in V8 in Google Chrome prior to 144.0.7559.59 allowed a remote attacker to perform an out of bounds memory read via a crafted HTML page. (Chromium security severity: Medium)","scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"143.0.7499.169-1~deb12u1","bookworm-security":"145.0.7632.159-1~deb12u1"},"fixed_version":"144.0.7559.59-1~deb12u1","urgency":"not yet assigned"},"bullseye":{"status":"open","repositories":{"bullseye":"120.0.6099.224-1~deb11u1","bullseye-security":"120.0.6099.224-1~deb11u1"},"urgency":"end-of-life"},"forky":{"status":"resolved","repositories":{"forky":"145.0.7632.159-1"},"fixed_version":"144.0.7559.59-1","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"146.0.7680.71-1"},"fixed_version":"144.0.7559.59-1","urgency":"not yet assigned"},"trixie":{"status":"resolved","repositories":{"trixie":"143.0.7499.169-1~deb13u1","trixie-security":"145.0.7632.159-1~deb13u1"},"fixed_version":"144.0.7559.59-1~deb13u1","urgency":"not yet assigned"}}},"CVE-2026-0903":{"description":"Inappropriate implementation in Downloads in Google Chrome on Windows prior to 144.0.7559.59 allowed a remote attacker to bypass dangerous file type protections via a malicious file. (Chromium security severity: Medium)","scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"143.0.7499.169-1~deb12u1","bookworm-security":"145.0.7632.159-1~deb12u1"},"fixed_version":"144.0.7559.59-1~deb12u1","urgency":"not yet assigned"},"bullseye":{"status":"open","repositories":{"bullseye":"120.0.6099.224-1~deb11u1","bullseye-security":"120.0.6099.224-1~deb11u1"},"urgency":"end-of-life"},"forky":{"status":"resolved","repositories":{"forky":"145.0.7632.159-1"},"fixed_version":"144.0.7559.59-1","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"146.0.7680.71-1"},"fixed_version":"144.0.7559.59-1","urgency":"not yet assigned"},"trixie":{"status":"resolved","repositories":{"trixie":"143.0.7499.169-1~deb13u1","trixie-security":"145.0.7632.159-1~deb13u1"},"fixed_version":"144.0.7559.59-1~deb13u1","urgency":"not yet assigned"}}},"CVE-2026-0904":{"description":"Incorrect security UI in Digital Credentials in Google Chrome prior to 144.0.7559.59 allowed a remote attacker to perform domain spoofing via a crafted HTML page. (Chromium security severity: Medium)","scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"143.0.7499.169-1~deb12u1","bookworm-security":"145.0.7632.159-1~deb12u1"},"fixed_version":"144.0.7559.59-1~deb12u1","urgency":"not yet assigned"},"bullseye":{"status":"open","repositories":{"bullseye":"120.0.6099.224-1~deb11u1","bullseye-security":"120.0.6099.224-1~deb11u1"},"urgency":"end-of-life"},"forky":{"status":"resolved","repositories":{"forky":"145.0.7632.159-1"},"fixed_version":"144.0.7559.59-1","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"146.0.7680.71-1"},"fixed_version":"144.0.7559.59-1","urgency":"not yet assigned"},"trixie":{"status":"resolved","repositories":{"trixie":"143.0.7499.169-1~deb13u1","trixie-security":"145.0.7632.159-1~deb13u1"},"fixed_version":"144.0.7559.59-1~deb13u1","urgency":"not yet assigned"}}},"CVE-2026-0905":{"description":"Insufficient policy enforcement in Network in Google Chrome prior to 144.0.7559.59 allowed an attack who obtained a network log file to potentially obtain potentially sensitive information via a network log file. (Chromium security severity: Medium)","scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"143.0.7499.169-1~deb12u1","bookworm-security":"145.0.7632.159-1~deb12u1"},"fixed_version":"144.0.7559.59-1~deb12u1","urgency":"not yet assigned"},"bullseye":{"status":"open","repositories":{"bullseye":"120.0.6099.224-1~deb11u1","bullseye-security":"120.0.6099.224-1~deb11u1"},"urgency":"end-of-life"},"forky":{"status":"resolved","repositories":{"forky":"145.0.7632.159-1"},"fixed_version":"144.0.7559.59-1","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"146.0.7680.71-1"},"fixed_version":"144.0.7559.59-1","urgency":"not yet assigned"},"trixie":{"status":"resolved","repositories":{"trixie":"143.0.7499.169-1~deb13u1","trixie-security":"145.0.7632.159-1~deb13u1"},"fixed_version":"144.0.7559.59-1~deb13u1","urgency":"not yet assigned"}}},"CVE-2026-0906":{"description":"Incorrect security UI  in Google Chrome on Android prior to 144.0.7559.59 allowed a remote attacker to spoof the contents of the Omnibox (URL bar) via a crafted HTML page. (Chromium security severity: Low)","scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"143.0.7499.169-1~deb12u1","bookworm-security":"145.0.7632.159-1~deb12u1"},"fixed_version":"144.0.7559.59-1~deb12u1","urgency":"not yet assigned"},"bullseye":{"status":"open","repositories":{"bullseye":"120.0.6099.224-1~deb11u1","bullseye-security":"120.0.6099.224-1~deb11u1"},"urgency":"end-of-life"},"forky":{"status":"resolved","repositories":{"forky":"145.0.7632.159-1"},"fixed_version":"144.0.7559.59-1","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"146.0.7680.71-1"},"fixed_version":"144.0.7559.59-1","urgency":"not yet assigned"},"trixie":{"status":"resolved","repositories":{"trixie":"143.0.7499.169-1~deb13u1","trixie-security":"145.0.7632.159-1~deb13u1"},"fixed_version":"144.0.7559.59-1~deb13u1","urgency":"not yet assigned"}}},"CVE-2026-0907":{"description":"Incorrect security UI in Split View in Google Chrome prior to 144.0.7559.59 allowed a remote attacker to perform UI spoofing via a crafted HTML page. (Chromium security severity: Low)","scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"143.0.7499.169-1~deb12u1","bookworm-security":"145.0.7632.159-1~deb12u1"},"fixed_version":"144.0.7559.59-1~deb12u1","urgency":"not yet assigned"},"bullseye":{"status":"open","repositories":{"bullseye":"120.0.6099.224-1~deb11u1","bullseye-security":"120.0.6099.224-1~deb11u1"},"urgency":"end-of-life"},"forky":{"status":"resolved","repositories":{"forky":"145.0.7632.159-1"},"fixed_version":"144.0.7559.59-1","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"146.0.7680.71-1"},"fixed_version":"144.0.7559.59-1","urgency":"not yet assigned"},"trixie":{"status":"resolved","repositories":{"trixie":"143.0.7499.169-1~deb13u1","trixie-security":"145.0.7632.159-1~deb13u1"},"fixed_version":"144.0.7559.59-1~deb13u1","urgency":"not yet assigned"}}},"CVE-2026-0908":{"description":"Use after free in ANGLE in Google Chrome prior to 144.0.7559.59 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. (Chromium security severity: Low)","scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"143.0.7499.169-1~deb12u1","bookworm-security":"145.0.7632.159-1~deb12u1"},"fixed_version":"144.0.7559.59-1~deb12u1","urgency":"not yet assigned"},"bullseye":{"status":"open","repositories":{"bullseye":"120.0.6099.224-1~deb11u1","bullseye-security":"120.0.6099.224-1~deb11u1"},"urgency":"end-of-life"},"forky":{"status":"resolved","repositories":{"forky":"145.0.7632.159-1"},"fixed_version":"144.0.7559.59-1","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"146.0.7680.71-1"},"fixed_version":"144.0.7559.59-1","urgency":"not yet assigned"},"trixie":{"status":"resolved","repositories":{"trixie":"143.0.7499.169-1~deb13u1","trixie-security":"145.0.7632.159-1~deb13u1"},"fixed_version":"144.0.7559.59-1~deb13u1","urgency":"not yet assigned"}}},"CVE-2026-1220":{"releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"143.0.7499.169-1~deb12u1","bookworm-security":"145.0.7632.159-1~deb12u1"},"fixed_version":"144.0.7559.96-1~deb12u1","urgency":"not yet assigned"},"bullseye":{"status":"open","repositories":{"bullseye":"120.0.6099.224-1~deb11u1","bullseye-security":"120.0.6099.224-1~deb11u1"},"urgency":"end-of-life"},"forky":{"status":"resolved","repositories":{"forky":"145.0.7632.159-1"},"fixed_version":"144.0.7559.96-1","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"146.0.7680.71-1"},"fixed_version":"144.0.7559.96-1","urgency":"not yet assigned"},"trixie":{"status":"resolved","repositories":{"trixie":"143.0.7499.169-1~deb13u1","trixie-security":"145.0.7632.159-1~deb13u1"},"fixed_version":"144.0.7559.96-1~deb13u1","urgency":"not yet assigned"}}},"CVE-2026-1504":{"description":"Inappropriate implementation in Background Fetch API in Google Chrome prior to 144.0.7559.110 allowed a remote attacker to leak cross-origin data via a crafted HTML page. (Chromium security severity: High)","scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"143.0.7499.169-1~deb12u1","bookworm-security":"145.0.7632.159-1~deb12u1"},"fixed_version":"144.0.7559.109-1~deb12u1","urgency":"not yet assigned"},"bullseye":{"status":"open","repositories":{"bullseye":"120.0.6099.224-1~deb11u1","bullseye-security":"120.0.6099.224-1~deb11u1"},"urgency":"end-of-life"},"forky":{"status":"resolved","repositories":{"forky":"145.0.7632.159-1"},"fixed_version":"144.0.7559.109-1","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"146.0.7680.71-1"},"fixed_version":"144.0.7559.109-1","urgency":"not yet assigned"},"trixie":{"status":"resolved","repositories":{"trixie":"143.0.7499.169-1~deb13u1","trixie-security":"145.0.7632.159-1~deb13u1"},"fixed_version":"144.0.7559.109-1~deb13u1","urgency":"not yet assigned"}}},"CVE-2026-1861":{"description":"Heap buffer overflow in libvpx in Google Chrome prior to 144.0.7559.132 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. (Chromium security severity: High)","scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"143.0.7499.169-1~deb12u1","bookworm-security":"145.0.7632.159-1~deb12u1"},"fixed_version":"144.0.7559.109-2~deb12u1","urgency":"not yet assigned"},"bullseye":{"status":"open","repositories":{"bullseye":"120.0.6099.224-1~deb11u1","bullseye-security":"120.0.6099.224-1~deb11u1"},"urgency":"end-of-life"},"forky":{"status":"resolved","repositories":{"forky":"145.0.7632.159-1"},"fixed_version":"144.0.7559.109-2","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"146.0.7680.71-1"},"fixed_version":"144.0.7559.109-2","urgency":"not yet assigned"},"trixie":{"status":"resolved","repositories":{"trixie":"143.0.7499.169-1~deb13u1","trixie-security":"145.0.7632.159-1~deb13u1"},"fixed_version":"144.0.7559.109-2~deb13u1","urgency":"not yet assigned"}}},"CVE-2026-1862":{"description":"Type Confusion in V8 in Google Chrome prior to 144.0.7559.132 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. (Chromium security severity: High)","scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"143.0.7499.169-1~deb12u1","bookworm-security":"145.0.7632.159-1~deb12u1"},"fixed_version":"144.0.7559.109-2~deb12u1","urgency":"not yet assigned"},"bullseye":{"status":"open","repositories":{"bullseye":"120.0.6099.224-1~deb11u1","bullseye-security":"120.0.6099.224-1~deb11u1"},"urgency":"end-of-life"},"forky":{"status":"resolved","repositories":{"forky":"145.0.7632.159-1"},"fixed_version":"144.0.7559.109-2","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"146.0.7680.71-1"},"fixed_version":"144.0.7559.109-2","urgency":"not yet assigned"},"trixie":{"status":"resolved","repositories":{"trixie":"143.0.7499.169-1~deb13u1","trixie-security":"145.0.7632.159-1~deb13u1"},"fixed_version":"144.0.7559.109-2~deb13u1","urgency":"not yet assigned"}}},"CVE-2026-2313":{"description":"Use after free in CSS in Google Chrome prior to 145.0.7632.45 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. (Chromium security severity: High)","scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"143.0.7499.169-1~deb12u1","bookworm-security":"145.0.7632.159-1~deb12u1"},"fixed_version":"145.0.7632.75-1~deb12u1","urgency":"not yet assigned"},"bullseye":{"status":"open","repositories":{"bullseye":"120.0.6099.224-1~deb11u1","bullseye-security":"120.0.6099.224-1~deb11u1"},"urgency":"end-of-life"},"forky":{"status":"resolved","repositories":{"forky":"145.0.7632.159-1"},"fixed_version":"145.0.7632.45-1","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"146.0.7680.71-1"},"fixed_version":"145.0.7632.45-1","urgency":"not yet assigned"},"trixie":{"status":"resolved","repositories":{"trixie":"143.0.7499.169-1~deb13u1","trixie-security":"145.0.7632.159-1~deb13u1"},"fixed_version":"145.0.7632.75-1~deb13u1","urgency":"not yet assigned"}}},"CVE-2026-2314":{"description":"Heap buffer overflow in Codecs in Google Chrome prior to 145.0.7632.45 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. (Chromium security severity: High)","scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"143.0.7499.169-1~deb12u1","bookworm-security":"145.0.7632.159-1~deb12u1"},"fixed_version":"145.0.7632.75-1~deb12u1","urgency":"not yet assigned"},"bullseye":{"status":"open","repositories":{"bullseye":"120.0.6099.224-1~deb11u1","bullseye-security":"120.0.6099.224-1~deb11u1"},"urgency":"end-of-life"},"forky":{"status":"resolved","repositories":{"forky":"145.0.7632.159-1"},"fixed_version":"145.0.7632.45-1","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"146.0.7680.71-1"},"fixed_version":"145.0.7632.45-1","urgency":"not yet assigned"},"trixie":{"status":"resolved","repositories":{"trixie":"143.0.7499.169-1~deb13u1","trixie-security":"145.0.7632.159-1~deb13u1"},"fixed_version":"145.0.7632.75-1~deb13u1","urgency":"not yet assigned"}}},"CVE-2026-2315":{"description":"Inappropriate implementation in WebGPU in Google Chrome prior to 145.0.7632.45 allowed a remote attacker to potentially perform out of bounds memory access via a crafted HTML page. (Chromium security severity: High)","scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"143.0.7499.169-1~deb12u1","bookworm-security":"145.0.7632.159-1~deb12u1"},"fixed_version":"145.0.7632.75-1~deb12u1","urgency":"not yet assigned"},"bullseye":{"status":"open","repositories":{"bullseye":"120.0.6099.224-1~deb11u1","bullseye-security":"120.0.6099.224-1~deb11u1"},"urgency":"end-of-life"},"forky":{"status":"resolved","repositories":{"forky":"145.0.7632.159-1"},"fixed_version":"145.0.7632.45-1","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"146.0.7680.71-1"},"fixed_version":"145.0.7632.45-1","urgency":"not yet assigned"},"trixie":{"status":"resolved","repositories":{"trixie":"143.0.7499.169-1~deb13u1","trixie-security":"145.0.7632.159-1~deb13u1"},"fixed_version":"145.0.7632.75-1~deb13u1","urgency":"not yet assigned"}}},"CVE-2026-2316":{"description":"Insufficient policy enforcement in Frames in Google Chrome prior to 145.0.7632.45 allowed a remote attacker to perform UI spoofing via a crafted HTML page. (Chromium security severity: Medium)","scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"143.0.7499.169-1~deb12u1","bookworm-security":"145.0.7632.159-1~deb12u1"},"fixed_version":"145.0.7632.75-1~deb12u1","urgency":"not yet assigned"},"bullseye":{"status":"open","repositories":{"bullseye":"120.0.6099.224-1~deb11u1","bullseye-security":"120.0.6099.224-1~deb11u1"},"urgency":"end-of-life"},"forky":{"status":"resolved","repositories":{"forky":"145.0.7632.159-1"},"fixed_version":"145.0.7632.45-1","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"146.0.7680.71-1"},"fixed_version":"145.0.7632.45-1","urgency":"not yet assigned"},"trixie":{"status":"resolved","repositories":{"trixie":"143.0.7499.169-1~deb13u1","trixie-security":"145.0.7632.159-1~deb13u1"},"fixed_version":"145.0.7632.75-1~deb13u1","urgency":"not yet assigned"}}},"CVE-2026-2317":{"description":"Inappropriate implementation in Animation in Google Chrome prior to 145.0.7632.45 allowed a remote attacker to leak cross-origin data via a crafted HTML page. (Chromium security severity: Medium)","scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"143.0.7499.169-1~deb12u1","bookworm-security":"145.0.7632.159-1~deb12u1"},"fixed_version":"145.0.7632.75-1~deb12u1","urgency":"not yet assigned"},"bullseye":{"status":"open","repositories":{"bullseye":"120.0.6099.224-1~deb11u1","bullseye-security":"120.0.6099.224-1~deb11u1"},"urgency":"end-of-life"},"forky":{"status":"resolved","repositories":{"forky":"145.0.7632.159-1"},"fixed_version":"145.0.7632.45-1","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"146.0.7680.71-1"},"fixed_version":"145.0.7632.45-1","urgency":"not yet assigned"},"trixie":{"status":"resolved","repositories":{"trixie":"143.0.7499.169-1~deb13u1","trixie-security":"145.0.7632.159-1~deb13u1"},"fixed_version":"145.0.7632.75-1~deb13u1","urgency":"not yet assigned"}}},"CVE-2026-2318":{"description":"Inappropriate implementation in PictureInPicture in Google Chrome prior to 145.0.7632.45 allowed a remote attacker who convinced a user to engage in specific UI gestures to perform UI spoofing via a crafted HTML page. (Chromium security severity: Medium)","scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"143.0.7499.169-1~deb12u1","bookworm-security":"145.0.7632.159-1~deb12u1"},"fixed_version":"145.0.7632.75-1~deb12u1","urgency":"not yet assigned"},"bullseye":{"status":"open","repositories":{"bullseye":"120.0.6099.224-1~deb11u1","bullseye-security":"120.0.6099.224-1~deb11u1"},"urgency":"end-of-life"},"forky":{"status":"resolved","repositories":{"forky":"145.0.7632.159-1"},"fixed_version":"145.0.7632.45-1","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"146.0.7680.71-1"},"fixed_version":"145.0.7632.45-1","urgency":"not yet assigned"},"trixie":{"status":"resolved","repositories":{"trixie":"143.0.7499.169-1~deb13u1","trixie-security":"145.0.7632.159-1~deb13u1"},"fixed_version":"145.0.7632.75-1~deb13u1","urgency":"not yet assigned"}}},"CVE-2026-2319":{"description":"Race in DevTools in Google Chrome prior to 145.0.7632.45 allowed a remote attacker who convinced a user to engage in specific UI gestures and install a malicious extension to potentially exploit object corruption via a malicious file. (Chromium security severity: Medium)","scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"143.0.7499.169-1~deb12u1","bookworm-security":"145.0.7632.159-1~deb12u1"},"fixed_version":"145.0.7632.75-1~deb12u1","urgency":"not yet assigned"},"bullseye":{"status":"open","repositories":{"bullseye":"120.0.6099.224-1~deb11u1","bullseye-security":"120.0.6099.224-1~deb11u1"},"urgency":"end-of-life"},"forky":{"status":"resolved","repositories":{"forky":"145.0.7632.159-1"},"fixed_version":"145.0.7632.45-1","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"146.0.7680.71-1"},"fixed_version":"145.0.7632.45-1","urgency":"not yet assigned"},"trixie":{"status":"resolved","repositories":{"trixie":"143.0.7499.169-1~deb13u1","trixie-security":"145.0.7632.159-1~deb13u1"},"fixed_version":"145.0.7632.75-1~deb13u1","urgency":"not yet assigned"}}},"CVE-2026-2320":{"description":"Inappropriate implementation in File input in Google Chrome prior to 145.0.7632.45 allowed a remote attacker who convinced a user to engage in specific UI gestures to perform UI spoofing via a crafted HTML page. (Chromium security severity: Medium)","scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"143.0.7499.169-1~deb12u1","bookworm-security":"145.0.7632.159-1~deb12u1"},"fixed_version":"145.0.7632.75-1~deb12u1","urgency":"not yet assigned"},"bullseye":{"status":"open","repositories":{"bullseye":"120.0.6099.224-1~deb11u1","bullseye-security":"120.0.6099.224-1~deb11u1"},"urgency":"end-of-life"},"forky":{"status":"resolved","repositories":{"forky":"145.0.7632.159-1"},"fixed_version":"145.0.7632.45-1","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"146.0.7680.71-1"},"fixed_version":"145.0.7632.45-1","urgency":"not yet assigned"},"trixie":{"status":"resolved","repositories":{"trixie":"143.0.7499.169-1~deb13u1","trixie-security":"145.0.7632.159-1~deb13u1"},"fixed_version":"145.0.7632.75-1~deb13u1","urgency":"not yet assigned"}}},"CVE-2026-2321":{"description":"Use after free in Ozone in Google Chrome prior to 145.0.7632.45 allowed a remote attacker who convinced a user to engage in specific UI gestures to potentially exploit heap corruption via a crafted HTML page. (Chromium security severity: Medium)","scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"143.0.7499.169-1~deb12u1","bookworm-security":"145.0.7632.159-1~deb12u1"},"fixed_version":"145.0.7632.75-1~deb12u1","urgency":"not yet assigned"},"bullseye":{"status":"open","repositories":{"bullseye":"120.0.6099.224-1~deb11u1","bullseye-security":"120.0.6099.224-1~deb11u1"},"urgency":"end-of-life"},"forky":{"status":"resolved","repositories":{"forky":"145.0.7632.159-1"},"fixed_version":"145.0.7632.45-1","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"146.0.7680.71-1"},"fixed_version":"145.0.7632.45-1","urgency":"not yet assigned"},"trixie":{"status":"resolved","repositories":{"trixie":"143.0.7499.169-1~deb13u1","trixie-security":"145.0.7632.159-1~deb13u1"},"fixed_version":"145.0.7632.75-1~deb13u1","urgency":"not yet assigned"}}},"CVE-2026-2322":{"description":"Inappropriate implementation in File input in Google Chrome prior to 145.0.7632.45 allowed a remote attacker who convinced a user to engage in specific UI gestures to perform UI spoofing via a crafted HTML page. (Chromium security severity: Low)","scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"143.0.7499.169-1~deb12u1","bookworm-security":"145.0.7632.159-1~deb12u1"},"fixed_version":"145.0.7632.75-1~deb12u1","urgency":"not yet assigned"},"bullseye":{"status":"open","repositories":{"bullseye":"120.0.6099.224-1~deb11u1","bullseye-security":"120.0.6099.224-1~deb11u1"},"urgency":"end-of-life"},"forky":{"status":"resolved","repositories":{"forky":"145.0.7632.159-1"},"fixed_version":"145.0.7632.45-1","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"146.0.7680.71-1"},"fixed_version":"145.0.7632.45-1","urgency":"not yet assigned"},"trixie":{"status":"resolved","repositories":{"trixie":"143.0.7499.169-1~deb13u1","trixie-security":"145.0.7632.159-1~deb13u1"},"fixed_version":"145.0.7632.75-1~deb13u1","urgency":"not yet assigned"}}},"CVE-2026-2323":{"description":"Inappropriate implementation in Downloads in Google Chrome prior to 145.0.7632.45 allowed a remote attacker to perform UI spoofing via a crafted HTML page. (Chromium security severity: Low)","scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"143.0.7499.169-1~deb12u1","bookworm-security":"145.0.7632.159-1~deb12u1"},"fixed_version":"145.0.7632.75-1~deb12u1","urgency":"not yet assigned"},"bullseye":{"status":"open","repositories":{"bullseye":"120.0.6099.224-1~deb11u1","bullseye-security":"120.0.6099.224-1~deb11u1"},"urgency":"end-of-life"},"forky":{"status":"resolved","repositories":{"forky":"145.0.7632.159-1"},"fixed_version":"145.0.7632.45-1","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"146.0.7680.71-1"},"fixed_version":"145.0.7632.45-1","urgency":"not yet assigned"},"trixie":{"status":"resolved","repositories":{"trixie":"143.0.7499.169-1~deb13u1","trixie-security":"145.0.7632.159-1~deb13u1"},"fixed_version":"145.0.7632.75-1~deb13u1","urgency":"not yet assigned"}}},"CVE-2026-2441":{"description":"Use after free in CSS in Google Chrome prior to 145.0.7632.75 allowed a remote attacker to execute arbitrary code inside a sandbox via a crafted HTML page. (Chromium security severity: High)","scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"143.0.7499.169-1~deb12u1","bookworm-security":"145.0.7632.159-1~deb12u1"},"fixed_version":"145.0.7632.75-1~deb12u1","urgency":"not yet assigned"},"bullseye":{"status":"open","repositories":{"bullseye":"120.0.6099.224-1~deb11u1","bullseye-security":"120.0.6099.224-1~deb11u1"},"urgency":"end-of-life"},"forky":{"status":"resolved","repositories":{"forky":"145.0.7632.159-1"},"fixed_version":"145.0.7632.75-1","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"146.0.7680.71-1"},"fixed_version":"145.0.7632.75-1","urgency":"not yet assigned"},"trixie":{"status":"resolved","repositories":{"trixie":"143.0.7499.169-1~deb13u1","trixie-security":"145.0.7632.159-1~deb13u1"},"fixed_version":"145.0.7632.75-1~deb13u1","urgency":"not yet assigned"}}},"CVE-2026-2648":{"description":"Heap buffer overflow in PDFium in Google Chrome prior to 145.0.7632.109 allowed a remote attacker to perform an out of bounds memory write via a crafted PDF file. (Chromium security severity: High)","scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"143.0.7499.169-1~deb12u1","bookworm-security":"145.0.7632.159-1~deb12u1"},"fixed_version":"145.0.7632.109-1~deb12u3","urgency":"not yet assigned"},"bullseye":{"status":"open","repositories":{"bullseye":"120.0.6099.224-1~deb11u1","bullseye-security":"120.0.6099.224-1~deb11u1"},"urgency":"end-of-life"},"forky":{"status":"resolved","repositories":{"forky":"145.0.7632.159-1"},"fixed_version":"145.0.7632.109-1","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"146.0.7680.71-1"},"fixed_version":"145.0.7632.109-1","urgency":"not yet assigned"},"trixie":{"status":"resolved","repositories":{"trixie":"143.0.7499.169-1~deb13u1","trixie-security":"145.0.7632.159-1~deb13u1"},"fixed_version":"145.0.7632.109-1~deb13u3","urgency":"not yet assigned"}}},"CVE-2026-2649":{"description":"Integer overflow in V8 in Google Chrome prior to 145.0.7632.109 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. (Chromium security severity: High)","scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"143.0.7499.169-1~deb12u1","bookworm-security":"145.0.7632.159-1~deb12u1"},"fixed_version":"145.0.7632.109-1~deb12u3","urgency":"not yet assigned"},"bullseye":{"status":"open","repositories":{"bullseye":"120.0.6099.224-1~deb11u1","bullseye-security":"120.0.6099.224-1~deb11u1"},"urgency":"end-of-life"},"forky":{"status":"resolved","repositories":{"forky":"145.0.7632.159-1"},"fixed_version":"145.0.7632.109-1","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"146.0.7680.71-1"},"fixed_version":"145.0.7632.109-1","urgency":"not yet assigned"},"trixie":{"status":"resolved","repositories":{"trixie":"143.0.7499.169-1~deb13u1","trixie-security":"145.0.7632.159-1~deb13u1"},"fixed_version":"145.0.7632.109-1~deb13u3","urgency":"not yet assigned"}}},"CVE-2026-2650":{"description":"Heap buffer overflow in Media in Google Chrome prior to 145.0.7632.109 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. (Chromium security severity: Medium)","scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"143.0.7499.169-1~deb12u1","bookworm-security":"145.0.7632.159-1~deb12u1"},"fixed_version":"145.0.7632.109-1~deb12u3","urgency":"not yet assigned"},"bullseye":{"status":"open","repositories":{"bullseye":"120.0.6099.224-1~deb11u1","bullseye-security":"120.0.6099.224-1~deb11u1"},"urgency":"end-of-life"},"forky":{"status":"resolved","repositories":{"forky":"145.0.7632.159-1"},"fixed_version":"145.0.7632.109-1","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"146.0.7680.71-1"},"fixed_version":"145.0.7632.109-1","urgency":"not yet assigned"},"trixie":{"status":"resolved","repositories":{"trixie":"143.0.7499.169-1~deb13u1","trixie-security":"145.0.7632.159-1~deb13u1"},"fixed_version":"145.0.7632.109-1~deb13u3","urgency":"not yet assigned"}}},"CVE-2026-3061":{"description":"Out of bounds read in Media in Google Chrome prior to 145.0.7632.116 allowed a remote attacker to perform an out of bounds memory read via a crafted HTML page. (Chromium security severity: High)","scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"143.0.7499.169-1~deb12u1","bookworm-security":"145.0.7632.159-1~deb12u1"},"fixed_version":"145.0.7632.116-1~deb12u1","urgency":"not yet assigned"},"bullseye":{"status":"open","repositories":{"bullseye":"120.0.6099.224-1~deb11u1","bullseye-security":"120.0.6099.224-1~deb11u1"},"urgency":"end-of-life"},"forky":{"status":"resolved","repositories":{"forky":"145.0.7632.159-1"},"fixed_version":"145.0.7632.116-1","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"146.0.7680.71-1"},"fixed_version":"145.0.7632.116-1","urgency":"not yet assigned"},"trixie":{"status":"resolved","repositories":{"trixie":"143.0.7499.169-1~deb13u1","trixie-security":"145.0.7632.159-1~deb13u1"},"fixed_version":"145.0.7632.116-1~deb13u1","urgency":"not yet assigned"}}},"CVE-2026-3062":{"description":"Out of bounds read and write in Tint in Google Chrome on Mac prior to 145.0.7632.116 allowed a remote attacker to perform out of bounds memory access via a crafted HTML page. (Chromium security severity: High)","scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"143.0.7499.169-1~deb12u1","bookworm-security":"145.0.7632.159-1~deb12u1"},"fixed_version":"145.0.7632.116-1~deb12u1","urgency":"not yet assigned"},"bullseye":{"status":"open","repositories":{"bullseye":"120.0.6099.224-1~deb11u1","bullseye-security":"120.0.6099.224-1~deb11u1"},"urgency":"end-of-life"},"forky":{"status":"resolved","repositories":{"forky":"145.0.7632.159-1"},"fixed_version":"145.0.7632.116-1","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"146.0.7680.71-1"},"fixed_version":"145.0.7632.116-1","urgency":"not yet assigned"},"trixie":{"status":"resolved","repositories":{"trixie":"143.0.7499.169-1~deb13u1","trixie-security":"145.0.7632.159-1~deb13u1"},"fixed_version":"145.0.7632.116-1~deb13u1","urgency":"not yet assigned"}}},"CVE-2026-3063":{"description":"Inappropriate implementation in DevTools in Google Chrome prior to 145.0.7632.116 allowed an attacker who convinced a user to install a malicious extension to inject scripts or HTML into a privileged page via DevTools. (Chromium security severity: High)","scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"143.0.7499.169-1~deb12u1","bookworm-security":"145.0.7632.159-1~deb12u1"},"fixed_version":"145.0.7632.116-1~deb12u1","urgency":"not yet assigned"},"bullseye":{"status":"open","repositories":{"bullseye":"120.0.6099.224-1~deb11u1","bullseye-security":"120.0.6099.224-1~deb11u1"},"urgency":"end-of-life"},"forky":{"status":"resolved","repositories":{"forky":"145.0.7632.159-1"},"fixed_version":"145.0.7632.116-1","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"146.0.7680.71-1"},"fixed_version":"145.0.7632.116-1","urgency":"not yet assigned"},"trixie":{"status":"resolved","repositories":{"trixie":"143.0.7499.169-1~deb13u1","trixie-security":"145.0.7632.159-1~deb13u1"},"fixed_version":"145.0.7632.116-1~deb13u1","urgency":"not yet assigned"}}},"CVE-2026-3536":{"description":"Integer overflow in ANGLE in Google Chrome prior to 145.0.7632.159 allowed a remote attacker to potentially perform out of bounds memory access via a crafted HTML page. (Chromium security severity: Critical)","scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"143.0.7499.169-1~deb12u1","bookworm-security":"145.0.7632.159-1~deb12u1"},"fixed_version":"145.0.7632.159-1~deb12u1","urgency":"not yet assigned"},"bullseye":{"status":"open","repositories":{"bullseye":"120.0.6099.224-1~deb11u1","bullseye-security":"120.0.6099.224-1~deb11u1"},"urgency":"end-of-life"},"forky":{"status":"resolved","repositories":{"forky":"145.0.7632.159-1"},"fixed_version":"145.0.7632.159-1","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"146.0.7680.71-1"},"fixed_version":"145.0.7632.159-1","urgency":"not yet assigned"},"trixie":{"status":"resolved","repositories":{"trixie":"143.0.7499.169-1~deb13u1","trixie-security":"145.0.7632.159-1~deb13u1"},"fixed_version":"145.0.7632.159-1~deb13u1","urgency":"not yet assigned"}}},"CVE-2026-3537":{"description":"Object lifecycle issue in PowerVR in Google Chrome on Android prior to 145.0.7632.159 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. (Chromium security severity: Critical)","scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"143.0.7499.169-1~deb12u1","bookworm-security":"145.0.7632.159-1~deb12u1"},"fixed_version":"145.0.7632.159-1~deb12u1","urgency":"not yet assigned"},"bullseye":{"status":"open","repositories":{"bullseye":"120.0.6099.224-1~deb11u1","bullseye-security":"120.0.6099.224-1~deb11u1"},"urgency":"end-of-life"},"forky":{"status":"resolved","repositories":{"forky":"145.0.7632.159-1"},"fixed_version":"145.0.7632.159-1","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"146.0.7680.71-1"},"fixed_version":"145.0.7632.159-1","urgency":"not yet assigned"},"trixie":{"status":"resolved","repositories":{"trixie":"143.0.7499.169-1~deb13u1","trixie-security":"145.0.7632.159-1~deb13u1"},"fixed_version":"145.0.7632.159-1~deb13u1","urgency":"not yet assigned"}}},"CVE-2026-3538":{"description":"Integer overflow in Skia in Google Chrome prior to 145.0.7632.159 allowed a remote attacker to potentially perform out of bounds memory access via a crafted HTML page. (Chromium security severity: Critical)","scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"143.0.7499.169-1~deb12u1","bookworm-security":"145.0.7632.159-1~deb12u1"},"fixed_version":"145.0.7632.159-1~deb12u1","urgency":"not yet assigned"},"bullseye":{"status":"open","repositories":{"bullseye":"120.0.6099.224-1~deb11u1","bullseye-security":"120.0.6099.224-1~deb11u1"},"urgency":"end-of-life"},"forky":{"status":"resolved","repositories":{"forky":"145.0.7632.159-1"},"fixed_version":"145.0.7632.159-1","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"146.0.7680.71-1"},"fixed_version":"145.0.7632.159-1","urgency":"not yet assigned"},"trixie":{"status":"resolved","repositories":{"trixie":"143.0.7499.169-1~deb13u1","trixie-security":"145.0.7632.159-1~deb13u1"},"fixed_version":"145.0.7632.159-1~deb13u1","urgency":"not yet assigned"}}},"CVE-2026-3539":{"description":"Object lifecycle issue in DevTools in Google Chrome prior to 145.0.7632.159 allowed an attacker who convinced a user to install a malicious extension to potentially exploit heap corruption via a crafted Chrome Extension. (Chromium security severity: High)","scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"143.0.7499.169-1~deb12u1","bookworm-security":"145.0.7632.159-1~deb12u1"},"fixed_version":"145.0.7632.159-1~deb12u1","urgency":"not yet assigned"},"bullseye":{"status":"open","repositories":{"bullseye":"120.0.6099.224-1~deb11u1","bullseye-security":"120.0.6099.224-1~deb11u1"},"urgency":"end-of-life"},"forky":{"status":"resolved","repositories":{"forky":"145.0.7632.159-1"},"fixed_version":"145.0.7632.159-1","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"146.0.7680.71-1"},"fixed_version":"145.0.7632.159-1","urgency":"not yet assigned"},"trixie":{"status":"resolved","repositories":{"trixie":"143.0.7499.169-1~deb13u1","trixie-security":"145.0.7632.159-1~deb13u1"},"fixed_version":"145.0.7632.159-1~deb13u1","urgency":"not yet assigned"}}},"CVE-2026-3540":{"description":"Inappropriate implementation in WebAudio in Google Chrome prior to 145.0.7632.159 allowed a remote attacker to perform out of bounds memory access via a crafted HTML page. (Chromium security severity: High)","scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"143.0.7499.169-1~deb12u1","bookworm-security":"145.0.7632.159-1~deb12u1"},"fixed_version":"145.0.7632.159-1~deb12u1","urgency":"not yet assigned"},"bullseye":{"status":"open","repositories":{"bullseye":"120.0.6099.224-1~deb11u1","bullseye-security":"120.0.6099.224-1~deb11u1"},"urgency":"end-of-life"},"forky":{"status":"resolved","repositories":{"forky":"145.0.7632.159-1"},"fixed_version":"145.0.7632.159-1","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"146.0.7680.71-1"},"fixed_version":"145.0.7632.159-1","urgency":"not yet assigned"},"trixie":{"status":"resolved","repositories":{"trixie":"143.0.7499.169-1~deb13u1","trixie-security":"145.0.7632.159-1~deb13u1"},"fixed_version":"145.0.7632.159-1~deb13u1","urgency":"not yet assigned"}}},"CVE-2026-3541":{"description":"Inappropriate implementation in CSS in Google Chrome prior to 145.0.7632.159 allowed a remote attacker to perform an out of bounds memory read via a crafted HTML page. (Chromium security severity: High)","scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"143.0.7499.169-1~deb12u1","bookworm-security":"145.0.7632.159-1~deb12u1"},"fixed_version":"145.0.7632.159-1~deb12u1","urgency":"not yet assigned"},"bullseye":{"status":"open","repositories":{"bullseye":"120.0.6099.224-1~deb11u1","bullseye-security":"120.0.6099.224-1~deb11u1"},"urgency":"end-of-life"},"forky":{"status":"resolved","repositories":{"forky":"145.0.7632.159-1"},"fixed_version":"145.0.7632.159-1","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"146.0.7680.71-1"},"fixed_version":"145.0.7632.159-1","urgency":"not yet assigned"},"trixie":{"status":"resolved","repositories":{"trixie":"143.0.7499.169-1~deb13u1","trixie-security":"145.0.7632.159-1~deb13u1"},"fixed_version":"145.0.7632.159-1~deb13u1","urgency":"not yet assigned"}}},"CVE-2026-3542":{"description":"Inappropriate implementation in WebAssembly in Google Chrome prior to 145.0.7632.159 allowed a remote attacker to perform out of bounds memory access via a crafted HTML page. (Chromium security severity: High)","scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"143.0.7499.169-1~deb12u1","bookworm-security":"145.0.7632.159-1~deb12u1"},"fixed_version":"145.0.7632.159-1~deb12u1","urgency":"not yet assigned"},"bullseye":{"status":"open","repositories":{"bullseye":"120.0.6099.224-1~deb11u1","bullseye-security":"120.0.6099.224-1~deb11u1"},"urgency":"end-of-life"},"forky":{"status":"resolved","repositories":{"forky":"145.0.7632.159-1"},"fixed_version":"145.0.7632.159-1","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"146.0.7680.71-1"},"fixed_version":"145.0.7632.159-1","urgency":"not yet assigned"},"trixie":{"status":"resolved","repositories":{"trixie":"143.0.7499.169-1~deb13u1","trixie-security":"145.0.7632.159-1~deb13u1"},"fixed_version":"145.0.7632.159-1~deb13u1","urgency":"not yet assigned"}}},"CVE-2026-3543":{"description":"Inappropriate implementation in V8 in Google Chrome prior to 145.0.7632.159 allowed a remote attacker to potentially perform out of bounds memory access via a crafted HTML page. (Chromium security severity: High)","scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"143.0.7499.169-1~deb12u1","bookworm-security":"145.0.7632.159-1~deb12u1"},"fixed_version":"145.0.7632.159-1~deb12u1","urgency":"not yet assigned"},"bullseye":{"status":"open","repositories":{"bullseye":"120.0.6099.224-1~deb11u1","bullseye-security":"120.0.6099.224-1~deb11u1"},"urgency":"end-of-life"},"forky":{"status":"resolved","repositories":{"forky":"145.0.7632.159-1"},"fixed_version":"145.0.7632.159-1","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"146.0.7680.71-1"},"fixed_version":"145.0.7632.159-1","urgency":"not yet assigned"},"trixie":{"status":"resolved","repositories":{"trixie":"143.0.7499.169-1~deb13u1","trixie-security":"145.0.7632.159-1~deb13u1"},"fixed_version":"145.0.7632.159-1~deb13u1","urgency":"not yet assigned"}}},"CVE-2026-3544":{"description":"Heap buffer overflow in WebCodecs in Google Chrome prior to 145.0.7632.159 allowed a remote attacker to perform an out of bounds memory write via a crafted HTML page. (Chromium security severity: High)","scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"143.0.7499.169-1~deb12u1","bookworm-security":"145.0.7632.159-1~deb12u1"},"fixed_version":"145.0.7632.159-1~deb12u1","urgency":"not yet assigned"},"bullseye":{"status":"open","repositories":{"bullseye":"120.0.6099.224-1~deb11u1","bullseye-security":"120.0.6099.224-1~deb11u1"},"urgency":"end-of-life"},"forky":{"status":"resolved","repositories":{"forky":"145.0.7632.159-1"},"fixed_version":"145.0.7632.159-1","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"146.0.7680.71-1"},"fixed_version":"145.0.7632.159-1","urgency":"not yet assigned"},"trixie":{"status":"resolved","repositories":{"trixie":"143.0.7499.169-1~deb13u1","trixie-security":"145.0.7632.159-1~deb13u1"},"fixed_version":"145.0.7632.159-1~deb13u1","urgency":"not yet assigned"}}},"CVE-2026-3545":{"description":"Insufficient data validation in Navigation in Google Chrome prior to 145.0.7632.159 allowed a remote attacker to potentially perform a sandbox escape via a crafted HTML page. (Chromium security severity: High)","scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"143.0.7499.169-1~deb12u1","bookworm-security":"145.0.7632.159-1~deb12u1"},"fixed_version":"145.0.7632.159-1~deb12u1","urgency":"not yet assigned"},"bullseye":{"status":"open","repositories":{"bullseye":"120.0.6099.224-1~deb11u1","bullseye-security":"120.0.6099.224-1~deb11u1"},"urgency":"end-of-life"},"forky":{"status":"resolved","repositories":{"forky":"145.0.7632.159-1"},"fixed_version":"145.0.7632.159-1","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"146.0.7680.71-1"},"fixed_version":"145.0.7632.159-1","urgency":"not yet assigned"},"trixie":{"status":"resolved","repositories":{"trixie":"143.0.7499.169-1~deb13u1","trixie-security":"145.0.7632.159-1~deb13u1"},"fixed_version":"145.0.7632.159-1~deb13u1","urgency":"not yet assigned"}}},"CVE-2026-3913":{"description":"Heap buffer overflow in WebML in Google Chrome prior to 146.0.7680.71 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. (Chromium security severity: Critical)","scope":"local","releases":{"bookworm":{"status":"open","repositories":{"bookworm":"143.0.7499.169-1~deb12u1","bookworm-security":"145.0.7632.159-1~deb12u1"},"urgency":"not yet assigned"},"bullseye":{"status":"open","repositories":{"bullseye":"120.0.6099.224-1~deb11u1","bullseye-security":"120.0.6099.224-1~deb11u1"},"urgency":"end-of-life"},"forky":{"status":"open","repositories":{"forky":"145.0.7632.159-1"},"urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"146.0.7680.71-1"},"fixed_version":"146.0.7680.71-1","urgency":"not yet assigned"},"trixie":{"status":"open","repositories":{"trixie":"143.0.7499.169-1~deb13u1","trixie-security":"145.0.7632.159-1~deb13u1"},"urgency":"not yet assigned"}}},"CVE-2026-3914":{"description":"Integer overflow in WebML in Google Chrome prior to 146.0.7680.71 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. (Chromium security severity: High)","scope":"local","releases":{"bookworm":{"status":"open","repositories":{"bookworm":"143.0.7499.169-1~deb12u1","bookworm-security":"145.0.7632.159-1~deb12u1"},"urgency":"not yet assigned"},"bullseye":{"status":"open","repositories":{"bullseye":"120.0.6099.224-1~deb11u1","bullseye-security":"120.0.6099.224-1~deb11u1"},"urgency":"end-of-life"},"forky":{"status":"open","repositories":{"forky":"145.0.7632.159-1"},"urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"146.0.7680.71-1"},"fixed_version":"146.0.7680.71-1","urgency":"not yet assigned"},"trixie":{"status":"open","repositories":{"trixie":"143.0.7499.169-1~deb13u1","trixie-security":"145.0.7632.159-1~deb13u1"},"urgency":"not yet assigned"}}},"CVE-2026-3915":{"description":"Heap buffer overflow in WebML in Google Chrome prior to 146.0.7680.71 allowed a remote attacker to perform an out of bounds memory read via a crafted HTML page. (Chromium security severity: High)","scope":"local","releases":{"bookworm":{"status":"open","repositories":{"bookworm":"143.0.7499.169-1~deb12u1","bookworm-security":"145.0.7632.159-1~deb12u1"},"urgency":"not yet assigned"},"bullseye":{"status":"open","repositories":{"bullseye":"120.0.6099.224-1~deb11u1","bullseye-security":"120.0.6099.224-1~deb11u1"},"urgency":"end-of-life"},"forky":{"status":"open","repositories":{"forky":"145.0.7632.159-1"},"urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"146.0.7680.71-1"},"fixed_version":"146.0.7680.71-1","urgency":"not yet assigned"},"trixie":{"status":"open","repositories":{"trixie":"143.0.7499.169-1~deb13u1","trixie-security":"145.0.7632.159-1~deb13u1"},"urgency":"not yet assigned"}}},"CVE-2026-3916":{"description":"Out of bounds read in Web Speech in Google Chrome prior to 146.0.7680.71 allowed a remote attacker to potentially perform a sandbox escape via a crafted HTML page. (Chromium security severity: High)","scope":"local","releases":{"bookworm":{"status":"open","repositories":{"bookworm":"143.0.7499.169-1~deb12u1","bookworm-security":"145.0.7632.159-1~deb12u1"},"urgency":"not yet assigned"},"bullseye":{"status":"open","repositories":{"bullseye":"120.0.6099.224-1~deb11u1","bullseye-security":"120.0.6099.224-1~deb11u1"},"urgency":"end-of-life"},"forky":{"status":"open","repositories":{"forky":"145.0.7632.159-1"},"urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"146.0.7680.71-1"},"fixed_version":"146.0.7680.71-1","urgency":"not yet assigned"},"trixie":{"status":"open","repositories":{"trixie":"143.0.7499.169-1~deb13u1","trixie-security":"145.0.7632.159-1~deb13u1"},"urgency":"not yet assigned"}}},"CVE-2026-3917":{"description":"Use after free in Agents in Google Chrome prior to 146.0.7680.71 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. (Chromium security severity: High)","scope":"local","releases":{"bookworm":{"status":"open","repositories":{"bookworm":"143.0.7499.169-1~deb12u1","bookworm-security":"145.0.7632.159-1~deb12u1"},"urgency":"not yet assigned"},"bullseye":{"status":"open","repositories":{"bullseye":"120.0.6099.224-1~deb11u1","bullseye-security":"120.0.6099.224-1~deb11u1"},"urgency":"end-of-life"},"forky":{"status":"open","repositories":{"forky":"145.0.7632.159-1"},"urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"146.0.7680.71-1"},"fixed_version":"146.0.7680.71-1","urgency":"not yet assigned"},"trixie":{"status":"open","repositories":{"trixie":"143.0.7499.169-1~deb13u1","trixie-security":"145.0.7632.159-1~deb13u1"},"urgency":"not yet assigned"}}},"CVE-2026-3918":{"description":"Use after free in WebMCP in Google Chrome prior to 146.0.7680.71 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. (Chromium security severity: High)","scope":"local","releases":{"bookworm":{"status":"open","repositories":{"bookworm":"143.0.7499.169-1~deb12u1","bookworm-security":"145.0.7632.159-1~deb12u1"},"urgency":"not yet assigned"},"bullseye":{"status":"open","repositories":{"bullseye":"120.0.6099.224-1~deb11u1","bullseye-security":"120.0.6099.224-1~deb11u1"},"urgency":"end-of-life"},"forky":{"status":"open","repositories":{"forky":"145.0.7632.159-1"},"urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"146.0.7680.71-1"},"fixed_version":"146.0.7680.71-1","urgency":"not yet assigned"},"trixie":{"status":"open","repositories":{"trixie":"143.0.7499.169-1~deb13u1","trixie-security":"145.0.7632.159-1~deb13u1"},"urgency":"not yet assigned"}}},"CVE-2026-3919":{"description":"Use after free in Extensions in Google Chrome prior to 146.0.7680.71 allowed an attacker who convinced a user to install a malicious extension to potentially exploit heap corruption via a crafted HTML page. (Chromium security severity: High)","scope":"local","releases":{"bookworm":{"status":"open","repositories":{"bookworm":"143.0.7499.169-1~deb12u1","bookworm-security":"145.0.7632.159-1~deb12u1"},"urgency":"not yet assigned"},"bullseye":{"status":"open","repositories":{"bullseye":"120.0.6099.224-1~deb11u1","bullseye-security":"120.0.6099.224-1~deb11u1"},"urgency":"end-of-life"},"forky":{"status":"open","repositories":{"forky":"145.0.7632.159-1"},"urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"146.0.7680.71-1"},"fixed_version":"146.0.7680.71-1","urgency":"not yet assigned"},"trixie":{"status":"open","repositories":{"trixie":"143.0.7499.169-1~deb13u1","trixie-security":"145.0.7632.159-1~deb13u1"},"urgency":"not yet assigned"}}},"CVE-2026-3920":{"description":"Out of bounds memory access in WebML in Google Chrome prior to 146.0.7680.71 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. (Chromium security severity: High)","scope":"local","releases":{"bookworm":{"status":"open","repositories":{"bookworm":"143.0.7499.169-1~deb12u1","bookworm-security":"145.0.7632.159-1~deb12u1"},"urgency":"not yet assigned"},"bullseye":{"status":"open","repositories":{"bullseye":"120.0.6099.224-1~deb11u1","bullseye-security":"120.0.6099.224-1~deb11u1"},"urgency":"end-of-life"},"forky":{"status":"open","repositories":{"forky":"145.0.7632.159-1"},"urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"146.0.7680.71-1"},"fixed_version":"146.0.7680.71-1","urgency":"not yet assigned"},"trixie":{"status":"open","repositories":{"trixie":"143.0.7499.169-1~deb13u1","trixie-security":"145.0.7632.159-1~deb13u1"},"urgency":"not yet assigned"}}},"CVE-2026-3921":{"description":"Use after free in TextEncoding in Google Chrome prior to 146.0.7680.71 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. (Chromium security severity: High)","scope":"local","releases":{"bookworm":{"status":"open","repositories":{"bookworm":"143.0.7499.169-1~deb12u1","bookworm-security":"145.0.7632.159-1~deb12u1"},"urgency":"not yet assigned"},"bullseye":{"status":"open","repositories":{"bullseye":"120.0.6099.224-1~deb11u1","bullseye-security":"120.0.6099.224-1~deb11u1"},"urgency":"end-of-life"},"forky":{"status":"open","repositories":{"forky":"145.0.7632.159-1"},"urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"146.0.7680.71-1"},"fixed_version":"146.0.7680.71-1","urgency":"not yet assigned"},"trixie":{"status":"open","repositories":{"trixie":"143.0.7499.169-1~deb13u1","trixie-security":"145.0.7632.159-1~deb13u1"},"urgency":"not yet assigned"}}},"CVE-2026-3922":{"description":"Use after free in MediaStream in Google Chrome prior to 146.0.7680.71 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. (Chromium security severity: High)","scope":"local","releases":{"bookworm":{"status":"open","repositories":{"bookworm":"143.0.7499.169-1~deb12u1","bookworm-security":"145.0.7632.159-1~deb12u1"},"urgency":"not yet assigned"},"bullseye":{"status":"open","repositories":{"bullseye":"120.0.6099.224-1~deb11u1","bullseye-security":"120.0.6099.224-1~deb11u1"},"urgency":"end-of-life"},"forky":{"status":"open","repositories":{"forky":"145.0.7632.159-1"},"urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"146.0.7680.71-1"},"fixed_version":"146.0.7680.71-1","urgency":"not yet assigned"},"trixie":{"status":"open","repositories":{"trixie":"143.0.7499.169-1~deb13u1","trixie-security":"145.0.7632.159-1~deb13u1"},"urgency":"not yet assigned"}}},"CVE-2026-3923":{"description":"Use after free in WebMIDI in Google Chrome prior to 146.0.7680.71 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. (Chromium security severity: High)","scope":"local","releases":{"bookworm":{"status":"open","repositories":{"bookworm":"143.0.7499.169-1~deb12u1","bookworm-security":"145.0.7632.159-1~deb12u1"},"urgency":"not yet assigned"},"bullseye":{"status":"open","repositories":{"bullseye":"120.0.6099.224-1~deb11u1","bullseye-security":"120.0.6099.224-1~deb11u1"},"urgency":"end-of-life"},"forky":{"status":"open","repositories":{"forky":"145.0.7632.159-1"},"urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"146.0.7680.71-1"},"fixed_version":"146.0.7680.71-1","urgency":"not yet assigned"},"trixie":{"status":"open","repositories":{"trixie":"143.0.7499.169-1~deb13u1","trixie-security":"145.0.7632.159-1~deb13u1"},"urgency":"not yet assigned"}}},"CVE-2026-3924":{"description":"use after free in WindowDialog in Google Chrome prior to 146.0.7680.71 allowed a remote attacker who had compromised the renderer process to potentially perform a sandbox escape via a crafted HTML page. (Chromium security severity: High)","scope":"local","releases":{"bookworm":{"status":"open","repositories":{"bookworm":"143.0.7499.169-1~deb12u1","bookworm-security":"145.0.7632.159-1~deb12u1"},"urgency":"not yet assigned"},"bullseye":{"status":"open","repositories":{"bullseye":"120.0.6099.224-1~deb11u1","bullseye-security":"120.0.6099.224-1~deb11u1"},"urgency":"end-of-life"},"forky":{"status":"open","repositories":{"forky":"145.0.7632.159-1"},"urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"146.0.7680.71-1"},"fixed_version":"146.0.7680.71-1","urgency":"not yet assigned"},"trixie":{"status":"open","repositories":{"trixie":"143.0.7499.169-1~deb13u1","trixie-security":"145.0.7632.159-1~deb13u1"},"urgency":"not yet assigned"}}},"CVE-2026-3925":{"description":"Incorrect security UI in LookalikeChecks in Google Chrome on Android prior to 146.0.7680.71 allowed a remote attacker to perform UI spoofing via a crafted HTML page. (Chromium security severity: Medium)","scope":"local","releases":{"bookworm":{"status":"open","repositories":{"bookworm":"143.0.7499.169-1~deb12u1","bookworm-security":"145.0.7632.159-1~deb12u1"},"urgency":"not yet assigned"},"bullseye":{"status":"open","repositories":{"bullseye":"120.0.6099.224-1~deb11u1","bullseye-security":"120.0.6099.224-1~deb11u1"},"urgency":"end-of-life"},"forky":{"status":"open","repositories":{"forky":"145.0.7632.159-1"},"urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"146.0.7680.71-1"},"fixed_version":"146.0.7680.71-1","urgency":"not yet assigned"},"trixie":{"status":"open","repositories":{"trixie":"143.0.7499.169-1~deb13u1","trixie-security":"145.0.7632.159-1~deb13u1"},"urgency":"not yet assigned"}}},"CVE-2026-3926":{"description":"Out of bounds read in V8 in Google Chrome prior to 146.0.7680.71 allowed a remote attacker to perform out of bounds memory access via a crafted HTML page. (Chromium security severity: Medium)","scope":"local","releases":{"bookworm":{"status":"open","repositories":{"bookworm":"143.0.7499.169-1~deb12u1","bookworm-security":"145.0.7632.159-1~deb12u1"},"urgency":"not yet assigned"},"bullseye":{"status":"open","repositories":{"bullseye":"120.0.6099.224-1~deb11u1","bullseye-security":"120.0.6099.224-1~deb11u1"},"urgency":"end-of-life"},"forky":{"status":"open","repositories":{"forky":"145.0.7632.159-1"},"urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"146.0.7680.71-1"},"fixed_version":"146.0.7680.71-1","urgency":"not yet assigned"},"trixie":{"status":"open","repositories":{"trixie":"143.0.7499.169-1~deb13u1","trixie-security":"145.0.7632.159-1~deb13u1"},"urgency":"not yet assigned"}}},"CVE-2026-3927":{"description":"Incorrect security UI in PictureInPicture in Google Chrome prior to 146.0.7680.71 allowed a remote attacker to perform UI spoofing via a crafted HTML page. (Chromium security severity: Medium)","scope":"local","releases":{"bookworm":{"status":"open","repositories":{"bookworm":"143.0.7499.169-1~deb12u1","bookworm-security":"145.0.7632.159-1~deb12u1"},"urgency":"not yet assigned"},"bullseye":{"status":"open","repositories":{"bullseye":"120.0.6099.224-1~deb11u1","bullseye-security":"120.0.6099.224-1~deb11u1"},"urgency":"end-of-life"},"forky":{"status":"open","repositories":{"forky":"145.0.7632.159-1"},"urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"146.0.7680.71-1"},"fixed_version":"146.0.7680.71-1","urgency":"not yet assigned"},"trixie":{"status":"open","repositories":{"trixie":"143.0.7499.169-1~deb13u1","trixie-security":"145.0.7632.159-1~deb13u1"},"urgency":"not yet assigned"}}},"CVE-2026-3928":{"description":"Insufficient policy enforcement in Extensions in Google Chrome prior to 146.0.7680.71 allowed an attacker who convinced a user to install a malicious extension to perform UI spoofing via a crafted Chrome Extension. (Chromium security severity: Medium)","scope":"local","releases":{"bookworm":{"status":"open","repositories":{"bookworm":"143.0.7499.169-1~deb12u1","bookworm-security":"145.0.7632.159-1~deb12u1"},"urgency":"not yet assigned"},"bullseye":{"status":"open","repositories":{"bullseye":"120.0.6099.224-1~deb11u1","bullseye-security":"120.0.6099.224-1~deb11u1"},"urgency":"end-of-life"},"forky":{"status":"open","repositories":{"forky":"145.0.7632.159-1"},"urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"146.0.7680.71-1"},"fixed_version":"146.0.7680.71-1","urgency":"not yet assigned"},"trixie":{"status":"open","repositories":{"trixie":"143.0.7499.169-1~deb13u1","trixie-security":"145.0.7632.159-1~deb13u1"},"urgency":"not yet assigned"}}},"CVE-2026-3929":{"description":"Side-channel information leakage in ResourceTiming in Google Chrome prior to 146.0.7680.71 allowed a remote attacker to leak cross-origin data via a crafted HTML page. (Chromium security severity: Medium)","scope":"local","releases":{"bookworm":{"status":"open","repositories":{"bookworm":"143.0.7499.169-1~deb12u1","bookworm-security":"145.0.7632.159-1~deb12u1"},"urgency":"not yet assigned"},"bullseye":{"status":"open","repositories":{"bullseye":"120.0.6099.224-1~deb11u1","bullseye-security":"120.0.6099.224-1~deb11u1"},"urgency":"end-of-life"},"forky":{"status":"open","repositories":{"forky":"145.0.7632.159-1"},"urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"146.0.7680.71-1"},"fixed_version":"146.0.7680.71-1","urgency":"not yet assigned"},"trixie":{"status":"open","repositories":{"trixie":"143.0.7499.169-1~deb13u1","trixie-security":"145.0.7632.159-1~deb13u1"},"urgency":"not yet assigned"}}},"CVE-2026-3930":{"description":"Unsafe navigation in Navigation in Google Chrome on iOS prior to 146.0.7680.71 allowed a remote attacker to bypass navigation restrictions via a crafted HTML page. (Chromium security severity: Medium)","scope":"local","releases":{"bookworm":{"status":"open","repositories":{"bookworm":"143.0.7499.169-1~deb12u1","bookworm-security":"145.0.7632.159-1~deb12u1"},"urgency":"not yet assigned"},"bullseye":{"status":"open","repositories":{"bullseye":"120.0.6099.224-1~deb11u1","bullseye-security":"120.0.6099.224-1~deb11u1"},"urgency":"end-of-life"},"forky":{"status":"open","repositories":{"forky":"145.0.7632.159-1"},"urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"146.0.7680.71-1"},"fixed_version":"146.0.7680.71-1","urgency":"not yet assigned"},"trixie":{"status":"open","repositories":{"trixie":"143.0.7499.169-1~deb13u1","trixie-security":"145.0.7632.159-1~deb13u1"},"urgency":"not yet assigned"}}},"CVE-2026-3931":{"description":"Heap buffer overflow in Skia in Google Chrome prior to 146.0.7680.71 allowed a remote attacker to perform out of bounds memory access via a crafted HTML page. (Chromium security severity: Medium)","scope":"local","releases":{"bookworm":{"status":"open","repositories":{"bookworm":"143.0.7499.169-1~deb12u1","bookworm-security":"145.0.7632.159-1~deb12u1"},"urgency":"not yet assigned"},"bullseye":{"status":"open","repositories":{"bullseye":"120.0.6099.224-1~deb11u1","bullseye-security":"120.0.6099.224-1~deb11u1"},"urgency":"end-of-life"},"forky":{"status":"open","repositories":{"forky":"145.0.7632.159-1"},"urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"146.0.7680.71-1"},"fixed_version":"146.0.7680.71-1","urgency":"not yet assigned"},"trixie":{"status":"open","repositories":{"trixie":"143.0.7499.169-1~deb13u1","trixie-security":"145.0.7632.159-1~deb13u1"},"urgency":"not yet assigned"}}},"CVE-2026-3932":{"description":"Insufficient policy enforcement in PDF in Google Chrome on Android prior to 146.0.7680.71 allowed a remote attacker to bypass navigation restrictions via a crafted HTML page. (Chromium security severity: Medium)","scope":"local","releases":{"bookworm":{"status":"open","repositories":{"bookworm":"143.0.7499.169-1~deb12u1","bookworm-security":"145.0.7632.159-1~deb12u1"},"urgency":"not yet assigned"},"bullseye":{"status":"open","repositories":{"bullseye":"120.0.6099.224-1~deb11u1","bullseye-security":"120.0.6099.224-1~deb11u1"},"urgency":"end-of-life"},"forky":{"status":"open","repositories":{"forky":"145.0.7632.159-1"},"urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"146.0.7680.71-1"},"fixed_version":"146.0.7680.71-1","urgency":"not yet assigned"},"trixie":{"status":"open","repositories":{"trixie":"143.0.7499.169-1~deb13u1","trixie-security":"145.0.7632.159-1~deb13u1"},"urgency":"not yet assigned"}}},"CVE-2026-3934":{"description":"Insufficient policy enforcement in ChromeDriver in Google Chrome prior to 146.0.7680.71 allowed a remote attacker to bypass same origin policy via a crafted HTML page. (Chromium security severity: Medium)","scope":"local","releases":{"bookworm":{"status":"open","repositories":{"bookworm":"143.0.7499.169-1~deb12u1","bookworm-security":"145.0.7632.159-1~deb12u1"},"urgency":"not yet assigned"},"bullseye":{"status":"open","repositories":{"bullseye":"120.0.6099.224-1~deb11u1","bullseye-security":"120.0.6099.224-1~deb11u1"},"urgency":"end-of-life"},"forky":{"status":"open","repositories":{"forky":"145.0.7632.159-1"},"urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"146.0.7680.71-1"},"fixed_version":"146.0.7680.71-1","urgency":"not yet assigned"},"trixie":{"status":"open","repositories":{"trixie":"143.0.7499.169-1~deb13u1","trixie-security":"145.0.7632.159-1~deb13u1"},"urgency":"not yet assigned"}}},"CVE-2026-3935":{"description":"Incorrect security UI in WebAppInstalls in Google Chrome prior to 146.0.7680.71 allowed a remote attacker to perform UI spoofing via a crafted HTML page. (Chromium security severity: Medium)","scope":"local","releases":{"bookworm":{"status":"open","repositories":{"bookworm":"143.0.7499.169-1~deb12u1","bookworm-security":"145.0.7632.159-1~deb12u1"},"urgency":"not yet assigned"},"bullseye":{"status":"open","repositories":{"bullseye":"120.0.6099.224-1~deb11u1","bullseye-security":"120.0.6099.224-1~deb11u1"},"urgency":"end-of-life"},"forky":{"status":"open","repositories":{"forky":"145.0.7632.159-1"},"urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"146.0.7680.71-1"},"fixed_version":"146.0.7680.71-1","urgency":"not yet assigned"},"trixie":{"status":"open","repositories":{"trixie":"143.0.7499.169-1~deb13u1","trixie-security":"145.0.7632.159-1~deb13u1"},"urgency":"not yet assigned"}}},"CVE-2026-3936":{"description":"Use after free in WebView in Google Chrome on Android prior to 146.0.7680.71 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. (Chromium security severity: Medium)","scope":"local","releases":{"bookworm":{"status":"open","repositories":{"bookworm":"143.0.7499.169-1~deb12u1","bookworm-security":"145.0.7632.159-1~deb12u1"},"urgency":"not yet assigned"},"bullseye":{"status":"open","repositories":{"bullseye":"120.0.6099.224-1~deb11u1","bullseye-security":"120.0.6099.224-1~deb11u1"},"urgency":"end-of-life"},"forky":{"status":"open","repositories":{"forky":"145.0.7632.159-1"},"urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"146.0.7680.71-1"},"fixed_version":"146.0.7680.71-1","urgency":"not yet assigned"},"trixie":{"status":"open","repositories":{"trixie":"143.0.7499.169-1~deb13u1","trixie-security":"145.0.7632.159-1~deb13u1"},"urgency":"not yet assigned"}}},"CVE-2026-3937":{"description":"Incorrect security UI in Downloads in Google Chrome on Android prior to 146.0.7680.71 allowed a remote attacker to perform UI spoofing via a crafted HTML page. (Chromium security severity: Low)","scope":"local","releases":{"bookworm":{"status":"open","repositories":{"bookworm":"143.0.7499.169-1~deb12u1","bookworm-security":"145.0.7632.159-1~deb12u1"},"urgency":"not yet assigned"},"bullseye":{"status":"open","repositories":{"bullseye":"120.0.6099.224-1~deb11u1","bullseye-security":"120.0.6099.224-1~deb11u1"},"urgency":"end-of-life"},"forky":{"status":"open","repositories":{"forky":"145.0.7632.159-1"},"urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"146.0.7680.71-1"},"fixed_version":"146.0.7680.71-1","urgency":"not yet assigned"},"trixie":{"status":"open","repositories":{"trixie":"143.0.7499.169-1~deb13u1","trixie-security":"145.0.7632.159-1~deb13u1"},"urgency":"not yet assigned"}}},"CVE-2026-3938":{"description":"Insufficient policy enforcement in Clipboard in Google Chrome prior to 146.0.7680.71 allowed a remote attacker who had compromised the renderer process to leak cross-origin data via a crafted HTML page. (Chromium security severity: Low)","scope":"local","releases":{"bookworm":{"status":"open","repositories":{"bookworm":"143.0.7499.169-1~deb12u1","bookworm-security":"145.0.7632.159-1~deb12u1"},"urgency":"not yet assigned"},"bullseye":{"status":"open","repositories":{"bullseye":"120.0.6099.224-1~deb11u1","bullseye-security":"120.0.6099.224-1~deb11u1"},"urgency":"end-of-life"},"forky":{"status":"open","repositories":{"forky":"145.0.7632.159-1"},"urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"146.0.7680.71-1"},"fixed_version":"146.0.7680.71-1","urgency":"not yet assigned"},"trixie":{"status":"open","repositories":{"trixie":"143.0.7499.169-1~deb13u1","trixie-security":"145.0.7632.159-1~deb13u1"},"urgency":"not yet assigned"}}},"CVE-2026-3939":{"description":"Insufficient policy enforcement in PDF in Google Chrome prior to 146.0.7680.71 allowed a remote attacker to bypass navigation restrictions via a crafted PDF file. (Chromium security severity: Low)","scope":"local","releases":{"bookworm":{"status":"open","repositories":{"bookworm":"143.0.7499.169-1~deb12u1","bookworm-security":"145.0.7632.159-1~deb12u1"},"urgency":"not yet assigned"},"bullseye":{"status":"open","repositories":{"bullseye":"120.0.6099.224-1~deb11u1","bullseye-security":"120.0.6099.224-1~deb11u1"},"urgency":"end-of-life"},"forky":{"status":"open","repositories":{"forky":"145.0.7632.159-1"},"urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"146.0.7680.71-1"},"fixed_version":"146.0.7680.71-1","urgency":"not yet assigned"},"trixie":{"status":"open","repositories":{"trixie":"143.0.7499.169-1~deb13u1","trixie-security":"145.0.7632.159-1~deb13u1"},"urgency":"not yet assigned"}}},"CVE-2026-3940":{"description":"Insufficient policy enforcement in DevTools in Google Chrome prior to 146.0.7680.71 allowed a remote attacker to bypass navigation restrictions via a crafted HTML page. (Chromium security severity: Low)","scope":"local","releases":{"bookworm":{"status":"open","repositories":{"bookworm":"143.0.7499.169-1~deb12u1","bookworm-security":"145.0.7632.159-1~deb12u1"},"urgency":"not yet assigned"},"bullseye":{"status":"open","repositories":{"bullseye":"120.0.6099.224-1~deb11u1","bullseye-security":"120.0.6099.224-1~deb11u1"},"urgency":"end-of-life"},"forky":{"status":"open","repositories":{"forky":"145.0.7632.159-1"},"urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"146.0.7680.71-1"},"fixed_version":"146.0.7680.71-1","urgency":"not yet assigned"},"trixie":{"status":"open","repositories":{"trixie":"143.0.7499.169-1~deb13u1","trixie-security":"145.0.7632.159-1~deb13u1"},"urgency":"not yet assigned"}}},"CVE-2026-3941":{"description":"Insufficient policy enforcement in DevTools in Google Chrome prior to 146.0.7680.71 allowed a remote attacker to bypass navigation restrictions via a crafted HTML page. (Chromium security severity: Low)","scope":"local","releases":{"bookworm":{"status":"open","repositories":{"bookworm":"143.0.7499.169-1~deb12u1","bookworm-security":"145.0.7632.159-1~deb12u1"},"urgency":"not yet assigned"},"bullseye":{"status":"open","repositories":{"bullseye":"120.0.6099.224-1~deb11u1","bullseye-security":"120.0.6099.224-1~deb11u1"},"urgency":"end-of-life"},"forky":{"status":"open","repositories":{"forky":"145.0.7632.159-1"},"urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"146.0.7680.71-1"},"fixed_version":"146.0.7680.71-1","urgency":"not yet assigned"},"trixie":{"status":"open","repositories":{"trixie":"143.0.7499.169-1~deb13u1","trixie-security":"145.0.7632.159-1~deb13u1"},"urgency":"not yet assigned"}}},"CVE-2026-3942":{"description":"Incorrect security UI in PictureInPicture in Google Chrome prior to 146.0.7680.71 allowed a remote attacker to perform UI spoofing via a crafted HTML page. (Chromium security severity: Low)","scope":"local","releases":{"bookworm":{"status":"open","repositories":{"bookworm":"143.0.7499.169-1~deb12u1","bookworm-security":"145.0.7632.159-1~deb12u1"},"urgency":"not yet assigned"},"bullseye":{"status":"open","repositories":{"bullseye":"120.0.6099.224-1~deb11u1","bullseye-security":"120.0.6099.224-1~deb11u1"},"urgency":"end-of-life"},"forky":{"status":"open","repositories":{"forky":"145.0.7632.159-1"},"urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"146.0.7680.71-1"},"fixed_version":"146.0.7680.71-1","urgency":"not yet assigned"},"trixie":{"status":"open","repositories":{"trixie":"143.0.7499.169-1~deb13u1","trixie-security":"145.0.7632.159-1~deb13u1"},"urgency":"not yet assigned"}}}},"chrony":{"CVE-2010-0292":{"description":"The read_from_cmd_socket function in cmdmon.c in chronyd in Chrony before 1.23.1, and 1.24-pre1, allows remote attackers to cause a denial of service (CPU and bandwidth consumption) by sending a spoofed cmdmon packet that triggers a continuous exchange of NOHOSTACCESS messages between two daemons, a related issue to CVE-2009-3563.","scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"4.3-2+deb12u1"},"fixed_version":"1.23-7","urgency":"medium"},"bullseye":{"status":"resolved","repositories":{"bullseye":"4.0-8+deb11u2"},"fixed_version":"1.23-7","urgency":"medium"},"forky":{"status":"resolved","repositories":{"forky":"4.8-3"},"fixed_version":"1.23-7","urgency":"medium"},"sid":{"status":"resolved","repositories":{"sid":"4.8-3"},"fixed_version":"1.23-7","urgency":"medium"},"trixie":{"status":"resolved","repositories":{"trixie":"4.6.1-3"},"fixed_version":"1.23-7","urgency":"medium"}}},"CVE-2010-0293":{"description":"The client logging functionality in chronyd in Chrony before 1.23.1 does not restrict the amount of memory used for storage of client information, which allows remote attackers to cause a denial of service (memory consumption) via spoofed (1) NTP or (2) cmdmon packets.","scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"4.3-2+deb12u1"},"fixed_version":"1.23-7","urgency":"low"},"bullseye":{"status":"resolved","repositories":{"bullseye":"4.0-8+deb11u2"},"fixed_version":"1.23-7","urgency":"low"},"forky":{"status":"resolved","repositories":{"forky":"4.8-3"},"fixed_version":"1.23-7","urgency":"low"},"sid":{"status":"resolved","repositories":{"sid":"4.8-3"},"fixed_version":"1.23-7","urgency":"low"},"trixie":{"status":"resolved","repositories":{"trixie":"4.6.1-3"},"fixed_version":"1.23-7","urgency":"low"}}},"CVE-2010-0294":{"description":"chronyd in Chrony before 1.23.1, and possibly 1.24-pre1, generates a syslog message for each unauthorized cmdmon packet, which allows remote attackers to cause a denial of service (disk consumption) via a large number of invalid packets.","scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"4.3-2+deb12u1"},"fixed_version":"1.23-7","urgency":"low"},"bullseye":{"status":"resolved","repositories":{"bullseye":"4.0-8+deb11u2"},"fixed_version":"1.23-7","urgency":"low"},"forky":{"status":"resolved","repositories":{"forky":"4.8-3"},"fixed_version":"1.23-7","urgency":"low"},"sid":{"status":"resolved","repositories":{"sid":"4.8-3"},"fixed_version":"1.23-7","urgency":"low"},"trixie":{"status":"resolved","repositories":{"trixie":"4.6.1-3"},"fixed_version":"1.23-7","urgency":"low"}}},"CVE-2012-4502":{"description":"Multiple integer overflows in pktlength.c in Chrony before 1.29 allow remote attackers to cause a denial of service (crash) via a crafted (1) REQ_SUBNETS_ACCESSED or (2) REQ_CLIENT_ACCESSES command request to the PKL_CommandLength function or crafted (3) RPY_SUBNETS_ACCESSED, (4) RPY_CLIENT_ACCESSES, (5) RPY_CLIENT_ACCESSES_BY_INDEX, or (6) RPY_MANUAL_LIST command reply to the PKL_ReplyLength function, which triggers an out-of-bounds read or buffer overflow.  NOTE: versions 1.27 and 1.28 do not require authentication to exploit.","debianbug":719203,"scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"4.3-2+deb12u1"},"fixed_version":"1.29-1","urgency":"not yet assigned"},"bullseye":{"status":"resolved","repositories":{"bullseye":"4.0-8+deb11u2"},"fixed_version":"1.29-1","urgency":"not yet assigned"},"forky":{"status":"resolved","repositories":{"forky":"4.8-3"},"fixed_version":"1.29-1","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"4.8-3"},"fixed_version":"1.29-1","urgency":"not yet assigned"},"trixie":{"status":"resolved","repositories":{"trixie":"4.6.1-3"},"fixed_version":"1.29-1","urgency":"not yet assigned"}}},"CVE-2012-4503":{"description":"cmdmon.c in Chrony before 1.29 allows remote attackers to obtain potentially sensitive information from stack memory via vectors related to (1) an invalid subnet in a RPY_SUBNETS_ACCESSED command to the handle_subnets_accessed function or (2) a RPY_CLIENT_ACCESSES command to the handle_client_accesses function when client logging is disabled, which causes uninitialized data to be included in a reply.","debianbug":719203,"scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"4.3-2+deb12u1"},"fixed_version":"1.29-1","urgency":"not yet assigned"},"bullseye":{"status":"resolved","repositories":{"bullseye":"4.0-8+deb11u2"},"fixed_version":"1.29-1","urgency":"not yet assigned"},"forky":{"status":"resolved","repositories":{"forky":"4.8-3"},"fixed_version":"1.29-1","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"4.8-3"},"fixed_version":"1.29-1","urgency":"not yet assigned"},"trixie":{"status":"resolved","repositories":{"trixie":"4.6.1-3"},"fixed_version":"1.29-1","urgency":"not yet assigned"}}},"CVE-2014-0021":{"description":"Chrony before 1.29.1 has traffic amplification in cmdmon protocol","debianbug":737644,"scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"4.3-2+deb12u1"},"fixed_version":"1.29.1-1","urgency":"low"},"bullseye":{"status":"resolved","repositories":{"bullseye":"4.0-8+deb11u2"},"fixed_version":"1.29.1-1","urgency":"low"},"forky":{"status":"resolved","repositories":{"forky":"4.8-3"},"fixed_version":"1.29.1-1","urgency":"low"},"sid":{"status":"resolved","repositories":{"sid":"4.8-3"},"fixed_version":"1.29.1-1","urgency":"low"},"trixie":{"status":"resolved","repositories":{"trixie":"4.6.1-3"},"fixed_version":"1.29.1-1","urgency":"low"}}},"CVE-2015-1821":{"description":"Heap-based buffer overflow in chrony before 1.31.1 allows remote authenticated users to cause a denial of service (chronyd crash) or possibly execute arbitrary code by configuring the (1) NTP or (2) cmdmon access with a subnet size that is indivisible by four and an address with a nonzero bit in the subnet remainder.","debianbug":782160,"scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"4.3-2+deb12u1"},"fixed_version":"1.30-2","urgency":"not yet assigned"},"bullseye":{"status":"resolved","repositories":{"bullseye":"4.0-8+deb11u2"},"fixed_version":"1.30-2","urgency":"not yet assigned"},"forky":{"status":"resolved","repositories":{"forky":"4.8-3"},"fixed_version":"1.30-2","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"4.8-3"},"fixed_version":"1.30-2","urgency":"not yet assigned"},"trixie":{"status":"resolved","repositories":{"trixie":"4.6.1-3"},"fixed_version":"1.30-2","urgency":"not yet assigned"}}},"CVE-2015-1822":{"description":"chrony before 1.31.1 does not initialize the last \"next\" pointer when saving unacknowledged replies to command requests, which allows remote authenticated users to cause a denial of service (uninitialized pointer dereference and daemon crash) or possibly execute arbitrary code via a large number of command requests.","debianbug":782160,"scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"4.3-2+deb12u1"},"fixed_version":"1.30-2","urgency":"not yet assigned"},"bullseye":{"status":"resolved","repositories":{"bullseye":"4.0-8+deb11u2"},"fixed_version":"1.30-2","urgency":"not yet assigned"},"forky":{"status":"resolved","repositories":{"forky":"4.8-3"},"fixed_version":"1.30-2","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"4.8-3"},"fixed_version":"1.30-2","urgency":"not yet assigned"},"trixie":{"status":"resolved","repositories":{"trixie":"4.6.1-3"},"fixed_version":"1.30-2","urgency":"not yet assigned"}}},"CVE-2015-1853":{"description":"chrony before 1.31.1 does not properly protect state variables in authenticated symmetric NTP associations, which allows remote attackers with knowledge of NTP peering to cause a denial of service (inability to synchronize) via random timestamps in crafted NTP data packets.","debianbug":782160,"scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"4.3-2+deb12u1"},"fixed_version":"1.30-2","urgency":"not yet assigned"},"bullseye":{"status":"resolved","repositories":{"bullseye":"4.0-8+deb11u2"},"fixed_version":"1.30-2","urgency":"not yet assigned"},"forky":{"status":"resolved","repositories":{"forky":"4.8-3"},"fixed_version":"1.30-2","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"4.8-3"},"fixed_version":"1.30-2","urgency":"not yet assigned"},"trixie":{"status":"resolved","repositories":{"trixie":"4.6.1-3"},"fixed_version":"1.30-2","urgency":"not yet assigned"}}},"CVE-2016-1567":{"description":"chrony before 1.31.2 and 2.x before 2.2.1 do not verify peer associations of symmetric keys when authenticating packets, which might allow remote attackers to conduct impersonation attacks via an arbitrary trusted key, aka a \"skeleton key.\"","debianbug":812923,"scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"4.3-2+deb12u1"},"fixed_version":"2.2.1-1","urgency":"low"},"bullseye":{"status":"resolved","repositories":{"bullseye":"4.0-8+deb11u2"},"fixed_version":"2.2.1-1","urgency":"low"},"forky":{"status":"resolved","repositories":{"forky":"4.8-3"},"fixed_version":"2.2.1-1","urgency":"low"},"sid":{"status":"resolved","repositories":{"sid":"4.8-3"},"fixed_version":"2.2.1-1","urgency":"low"},"trixie":{"status":"resolved","repositories":{"trixie":"4.6.1-3"},"fixed_version":"2.2.1-1","urgency":"low"}}},"CVE-2020-14367":{"description":"A flaw was found in chrony versions before 3.5.1 when creating the PID file under the /var/run/chrony folder. The file is created during chronyd startup while still running as the root user, and when it's opened for writing, chronyd does not check for an existing symbolic link with the same file name. This flaw allows an attacker with privileged access to create a symlink with the default PID file name pointing to any destination file in the system, resulting in data loss and a denial of service due to the path traversal.","scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"4.3-2+deb12u1"},"fixed_version":"3.5.1-1","urgency":"unimportant"},"bullseye":{"status":"resolved","repositories":{"bullseye":"4.0-8+deb11u2"},"fixed_version":"3.5.1-1","urgency":"unimportant"},"forky":{"status":"resolved","repositories":{"forky":"4.8-3"},"fixed_version":"3.5.1-1","urgency":"unimportant"},"sid":{"status":"resolved","repositories":{"sid":"4.8-3"},"fixed_version":"3.5.1-1","urgency":"unimportant"},"trixie":{"status":"resolved","repositories":{"trixie":"4.6.1-3"},"fixed_version":"3.5.1-1","urgency":"unimportant"}}}},"cifs-utils":{"CVE-2011-1678":{"description":"smbfs in Samba 3.5.8 and earlier attempts to use (1) mount.cifs to append to the /etc/mtab file and (2) umount.cifs to append to the /etc/mtab.tmp file without first checking whether resource limits would interfere, which allows local users to trigger corruption of the /etc/mtab file via a process with a small RLIMIT_FSIZE value, a related issue to CVE-2011-1089.","scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"2:7.0-2"},"fixed_version":"2:5.1-1","urgency":"low"},"bullseye":{"status":"resolved","repositories":{"bullseye":"2:6.11-3.1+deb11u2","bullseye-security":"2:6.11-3.1+deb11u1"},"fixed_version":"2:5.1-1","urgency":"low"},"forky":{"status":"resolved","repositories":{"forky":"2:7.4-1"},"fixed_version":"2:5.1-1","urgency":"low"},"sid":{"status":"resolved","repositories":{"sid":"2:7.4-1"},"fixed_version":"2:5.1-1","urgency":"low"},"trixie":{"status":"resolved","repositories":{"trixie":"2:7.4-1"},"fixed_version":"2:5.1-1","urgency":"low"}}},"CVE-2011-2724":{"description":"The check_mtab function in client/mount.cifs.c in mount.cifs in smbfs in Samba 3.5.10 and earlier does not properly verify that the (1) device name and (2) mountpoint strings are composed of valid characters, which allows local users to cause a denial of service (mtab corruption) via a crafted string.  NOTE: this vulnerability exists because of an incorrect fix for CVE-2010-0547.","scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"2:7.0-2"},"fixed_version":"2:5.1-1","urgency":"low"},"bullseye":{"status":"resolved","repositories":{"bullseye":"2:6.11-3.1+deb11u2","bullseye-security":"2:6.11-3.1+deb11u1"},"fixed_version":"2:5.1-1","urgency":"low"},"forky":{"status":"resolved","repositories":{"forky":"2:7.4-1"},"fixed_version":"2:5.1-1","urgency":"low"},"sid":{"status":"resolved","repositories":{"sid":"2:7.4-1"},"fixed_version":"2:5.1-1","urgency":"low"},"trixie":{"status":"resolved","repositories":{"trixie":"2:7.4-1"},"fixed_version":"2:5.1-1","urgency":"low"}}},"CVE-2011-3585":{"description":"Multiple race conditions in the (1) mount.cifs and (2) umount.cifs programs in Samba 3.6 allow local users to cause a denial of service (mounting outage) via a SIGKILL signal during a time window when the /etc/mtab~ file exists.","scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"2:7.0-2"},"fixed_version":"2:4.5-1","urgency":"low"},"bullseye":{"status":"resolved","repositories":{"bullseye":"2:6.11-3.1+deb11u2","bullseye-security":"2:6.11-3.1+deb11u1"},"fixed_version":"2:4.5-1","urgency":"low"},"forky":{"status":"resolved","repositories":{"forky":"2:7.4-1"},"fixed_version":"2:4.5-1","urgency":"low"},"sid":{"status":"resolved","repositories":{"sid":"2:7.4-1"},"fixed_version":"2:4.5-1","urgency":"low"},"trixie":{"status":"resolved","repositories":{"trixie":"2:7.4-1"},"fixed_version":"2:4.5-1","urgency":"low"}}},"CVE-2012-1586":{"description":"mount.cifs in cifs-utils 2.6 allows local users to determine the existence of arbitrary files or directories via the file path in the second argument, which reveals their existence in an error message.","debianbug":665923,"scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"2:7.0-2"},"fixed_version":"2:5.3-2","urgency":"unimportant"},"bullseye":{"status":"resolved","repositories":{"bullseye":"2:6.11-3.1+deb11u2","bullseye-security":"2:6.11-3.1+deb11u1"},"fixed_version":"2:5.3-2","urgency":"unimportant"},"forky":{"status":"resolved","repositories":{"forky":"2:7.4-1"},"fixed_version":"2:5.3-2","urgency":"unimportant"},"sid":{"status":"resolved","repositories":{"sid":"2:7.4-1"},"fixed_version":"2:5.3-2","urgency":"unimportant"},"trixie":{"status":"resolved","repositories":{"trixie":"2:7.4-1"},"fixed_version":"2:5.3-2","urgency":"unimportant"}}},"CVE-2014-2830":{"description":"Stack-based buffer overflow in cifskey.c or cifscreds.c in cifs-utils before 6.4, as used in pam_cifscreds, allows remote attackers to have unspecified impact via unknown vectors.","scope":"local","releases":{"bookworm":{"status":"open","repositories":{"bookworm":"2:7.0-2"},"urgency":"unimportant"},"bullseye":{"status":"open","repositories":{"bullseye":"2:6.11-3.1+deb11u2","bullseye-security":"2:6.11-3.1+deb11u1"},"urgency":"unimportant"},"forky":{"status":"open","repositories":{"forky":"2:7.4-1"},"urgency":"unimportant"},"sid":{"status":"open","repositories":{"sid":"2:7.4-1"},"urgency":"unimportant"},"trixie":{"status":"open","repositories":{"trixie":"2:7.4-1"},"urgency":"unimportant"}}},"CVE-2020-14342":{"description":"It was found that cifs-utils' mount.cifs was invoking a shell when requesting the Samba password, which could be used to inject arbitrary commands. An attacker able to invoke mount.cifs with special permission, such as via sudo rules, could use this flaw to escalate their privileges.","debianbug":970172,"scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"2:7.0-2"},"fixed_version":"2:6.11-1","urgency":"not yet assigned"},"bullseye":{"status":"resolved","repositories":{"bullseye":"2:6.11-3.1+deb11u2","bullseye-security":"2:6.11-3.1+deb11u1"},"fixed_version":"2:6.11-1","urgency":"not yet assigned"},"forky":{"status":"resolved","repositories":{"forky":"2:7.4-1"},"fixed_version":"2:6.11-1","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"2:7.4-1"},"fixed_version":"2:6.11-1","urgency":"not yet assigned"},"trixie":{"status":"resolved","repositories":{"trixie":"2:7.4-1"},"fixed_version":"2:6.11-1","urgency":"not yet assigned"}}},"CVE-2021-20208":{"description":"A flaw was found in cifs-utils in versions before 6.13. A user when mounting a krb5 CIFS file system from within a container can use Kerberos credentials of the host. The highest threat from this vulnerability is to data confidentiality and integrity.","debianbug":987308,"scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"2:7.0-2"},"fixed_version":"2:6.11-3","urgency":"not yet assigned"},"bullseye":{"status":"resolved","repositories":{"bullseye":"2:6.11-3.1+deb11u2","bullseye-security":"2:6.11-3.1+deb11u1"},"fixed_version":"2:6.11-3","urgency":"not yet assigned"},"forky":{"status":"resolved","repositories":{"forky":"2:7.4-1"},"fixed_version":"2:6.11-3","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"2:7.4-1"},"fixed_version":"2:6.11-3","urgency":"not yet assigned"},"trixie":{"status":"resolved","repositories":{"trixie":"2:7.4-1"},"fixed_version":"2:6.11-3","urgency":"not yet assigned"}}},"CVE-2022-27239":{"description":"In cifs-utils through 6.14, a stack-based buffer overflow when parsing the mount.cifs ip= command-line argument could lead to local attackers gaining root privileges.","debianbug":1010818,"scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"2:7.0-2"},"fixed_version":"2:6.14-1.1","urgency":"not yet assigned"},"bullseye":{"status":"resolved","repositories":{"bullseye":"2:6.11-3.1+deb11u2","bullseye-security":"2:6.11-3.1+deb11u1"},"fixed_version":"2:6.11-3.1+deb11u1","urgency":"not yet assigned"},"forky":{"status":"resolved","repositories":{"forky":"2:7.4-1"},"fixed_version":"2:6.14-1.1","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"2:7.4-1"},"fixed_version":"2:6.14-1.1","urgency":"not yet assigned"},"trixie":{"status":"resolved","repositories":{"trixie":"2:7.4-1"},"fixed_version":"2:6.14-1.1","urgency":"not yet assigned"}}},"CVE-2022-29869":{"description":"cifs-utils through 6.14, with verbose logging, can cause an information leak when a file contains = (equal sign) characters but is not a valid credentials file.","debianbug":1010818,"scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"2:7.0-2"},"fixed_version":"2:6.14-1.1","urgency":"not yet assigned"},"bullseye":{"status":"resolved","repositories":{"bullseye":"2:6.11-3.1+deb11u2","bullseye-security":"2:6.11-3.1+deb11u1"},"fixed_version":"2:6.11-3.1+deb11u1","urgency":"not yet assigned"},"forky":{"status":"resolved","repositories":{"forky":"2:7.4-1"},"fixed_version":"2:6.14-1.1","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"2:7.4-1"},"fixed_version":"2:6.14-1.1","urgency":"not yet assigned"},"trixie":{"status":"resolved","repositories":{"trixie":"2:7.4-1"},"fixed_version":"2:6.14-1.1","urgency":"not yet assigned"}}},"CVE-2025-2312":{"description":"A flaw was found in cifs-utils. When trying to obtain Kerberos credentials, the cifs.upcall program from the cifs-utils package makes an upcall to the wrong namespace in containerized environments. This issue may lead to disclosing sensitive data from the host's Kerberos credentials cache.","debianbug":1106242,"scope":"local","releases":{"bookworm":{"status":"open","repositories":{"bookworm":"2:7.0-2"},"urgency":"not yet assigned","nodsa":"Minor issue; needs corresponding kernel change","nodsa_reason":"ignored"},"bullseye":{"status":"resolved","repositories":{"bullseye":"2:6.11-3.1+deb11u2","bullseye-security":"2:6.11-3.1+deb11u1"},"fixed_version":"0","urgency":"unimportant"},"forky":{"status":"resolved","repositories":{"forky":"2:7.4-1"},"fixed_version":"2:7.2-1","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"2:7.4-1"},"fixed_version":"2:7.2-1","urgency":"not yet assigned"},"trixie":{"status":"resolved","repositories":{"trixie":"2:7.4-1"},"fixed_version":"2:7.2-1","urgency":"not yet assigned"}}}},"cimg":{"CVE-2018-7587":{"description":"An issue was discovered in CImg v.220. DoS occurs when loading a crafted bmp image that triggers an allocation failure in load_bmp in CImg.h.","debianbug":892780,"scope":"local","releases":{"bookworm":{"status":"open","repositories":{"bookworm":"3.2.1+dfsg-1"},"urgency":"unimportant"},"bullseye":{"status":"open","repositories":{"bullseye":"2.9.4+dfsg-2"},"urgency":"unimportant"},"forky":{"status":"open","repositories":{"forky":"3.5.2+dfsg-1"},"urgency":"unimportant"},"sid":{"status":"open","repositories":{"sid":"3.5.2+dfsg-1"},"urgency":"unimportant"},"trixie":{"status":"open","repositories":{"trixie":"3.5.2+dfsg-1"},"urgency":"unimportant"}}},"CVE-2018-7588":{"description":"An issue was discovered in CImg v.220. A heap-based buffer over-read in load_bmp in CImg.h occurs when loading a crafted bmp image.","debianbug":892780,"scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"3.2.1+dfsg-1"},"fixed_version":"2.3.6+dfsg-1","urgency":"low"},"bullseye":{"status":"resolved","repositories":{"bullseye":"2.9.4+dfsg-2"},"fixed_version":"2.3.6+dfsg-1","urgency":"low"},"forky":{"status":"resolved","repositories":{"forky":"3.5.2+dfsg-1"},"fixed_version":"2.3.6+dfsg-1","urgency":"low"},"sid":{"status":"resolved","repositories":{"sid":"3.5.2+dfsg-1"},"fixed_version":"2.3.6+dfsg-1","urgency":"low"},"trixie":{"status":"resolved","repositories":{"trixie":"3.5.2+dfsg-1"},"fixed_version":"2.3.6+dfsg-1","urgency":"low"}}},"CVE-2018-7589":{"description":"An issue was discovered in CImg v.220. A double free in load_bmp in CImg.h occurs when loading a crafted bmp image.","debianbug":892780,"scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"3.2.1+dfsg-1"},"fixed_version":"2.3.6+dfsg-1","urgency":"low"},"bullseye":{"status":"resolved","repositories":{"bullseye":"2.9.4+dfsg-2"},"fixed_version":"2.3.6+dfsg-1","urgency":"low"},"forky":{"status":"resolved","repositories":{"forky":"3.5.2+dfsg-1"},"fixed_version":"2.3.6+dfsg-1","urgency":"low"},"sid":{"status":"resolved","repositories":{"sid":"3.5.2+dfsg-1"},"fixed_version":"2.3.6+dfsg-1","urgency":"low"},"trixie":{"status":"resolved","repositories":{"trixie":"3.5.2+dfsg-1"},"fixed_version":"2.3.6+dfsg-1","urgency":"low"}}},"CVE-2018-7637":{"description":"An issue was discovered in CImg v.220. A heap-based buffer over-read in load_bmp in CImg.h occurs when loading a crafted bmp image, a different vulnerability than CVE-2018-7588. This is in a \"16 colors\" case, aka case 4.","debianbug":892780,"scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"3.2.1+dfsg-1"},"fixed_version":"2.3.6+dfsg-1","urgency":"low"},"bullseye":{"status":"resolved","repositories":{"bullseye":"2.9.4+dfsg-2"},"fixed_version":"2.3.6+dfsg-1","urgency":"low"},"forky":{"status":"resolved","repositories":{"forky":"3.5.2+dfsg-1"},"fixed_version":"2.3.6+dfsg-1","urgency":"low"},"sid":{"status":"resolved","repositories":{"sid":"3.5.2+dfsg-1"},"fixed_version":"2.3.6+dfsg-1","urgency":"low"},"trixie":{"status":"resolved","repositories":{"trixie":"3.5.2+dfsg-1"},"fixed_version":"2.3.6+dfsg-1","urgency":"low"}}},"CVE-2018-7638":{"description":"An issue was discovered in CImg v.220. A heap-based buffer over-read in load_bmp in CImg.h occurs when loading a crafted bmp image, a different vulnerability than CVE-2018-7588. This is in a \"256 colors\" case, aka case 8.","debianbug":892780,"scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"3.2.1+dfsg-1"},"fixed_version":"2.3.6+dfsg-1","urgency":"low"},"bullseye":{"status":"resolved","repositories":{"bullseye":"2.9.4+dfsg-2"},"fixed_version":"2.3.6+dfsg-1","urgency":"low"},"forky":{"status":"resolved","repositories":{"forky":"3.5.2+dfsg-1"},"fixed_version":"2.3.6+dfsg-1","urgency":"low"},"sid":{"status":"resolved","repositories":{"sid":"3.5.2+dfsg-1"},"fixed_version":"2.3.6+dfsg-1","urgency":"low"},"trixie":{"status":"resolved","repositories":{"trixie":"3.5.2+dfsg-1"},"fixed_version":"2.3.6+dfsg-1","urgency":"low"}}},"CVE-2018-7639":{"description":"An issue was discovered in CImg v.220. A heap-based buffer over-read in load_bmp in CImg.h occurs when loading a crafted bmp image, a different vulnerability than CVE-2018-7588. This is in a \"16 bits colors\" case, aka case 16.","debianbug":892780,"scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"3.2.1+dfsg-1"},"fixed_version":"2.3.6+dfsg-1","urgency":"low"},"bullseye":{"status":"resolved","repositories":{"bullseye":"2.9.4+dfsg-2"},"fixed_version":"2.3.6+dfsg-1","urgency":"low"},"forky":{"status":"resolved","repositories":{"forky":"3.5.2+dfsg-1"},"fixed_version":"2.3.6+dfsg-1","urgency":"low"},"sid":{"status":"resolved","repositories":{"sid":"3.5.2+dfsg-1"},"fixed_version":"2.3.6+dfsg-1","urgency":"low"},"trixie":{"status":"resolved","repositories":{"trixie":"3.5.2+dfsg-1"},"fixed_version":"2.3.6+dfsg-1","urgency":"low"}}},"CVE-2018-7640":{"description":"An issue was discovered in CImg v.220. A heap-based buffer over-read in load_bmp in CImg.h occurs when loading a crafted bmp image, a different vulnerability than CVE-2018-7588. This is in a Monochrome case, aka case 1.","debianbug":892780,"scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"3.2.1+dfsg-1"},"fixed_version":"2.3.6+dfsg-1","urgency":"low"},"bullseye":{"status":"resolved","repositories":{"bullseye":"2.9.4+dfsg-2"},"fixed_version":"2.3.6+dfsg-1","urgency":"low"},"forky":{"status":"resolved","repositories":{"forky":"3.5.2+dfsg-1"},"fixed_version":"2.3.6+dfsg-1","urgency":"low"},"sid":{"status":"resolved","repositories":{"sid":"3.5.2+dfsg-1"},"fixed_version":"2.3.6+dfsg-1","urgency":"low"},"trixie":{"status":"resolved","repositories":{"trixie":"3.5.2+dfsg-1"},"fixed_version":"2.3.6+dfsg-1","urgency":"low"}}},"CVE-2018-7641":{"description":"An issue was discovered in CImg v.220. A heap-based buffer over-read in load_bmp in CImg.h occurs when loading a crafted bmp image, a different vulnerability than CVE-2018-7588. This is in a \"32 bits colors\" case, aka case 32.","debianbug":892780,"scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"3.2.1+dfsg-1"},"fixed_version":"2.3.6+dfsg-1","urgency":"low"},"bullseye":{"status":"resolved","repositories":{"bullseye":"2.9.4+dfsg-2"},"fixed_version":"2.3.6+dfsg-1","urgency":"low"},"forky":{"status":"resolved","repositories":{"forky":"3.5.2+dfsg-1"},"fixed_version":"2.3.6+dfsg-1","urgency":"low"},"sid":{"status":"resolved","repositories":{"sid":"3.5.2+dfsg-1"},"fixed_version":"2.3.6+dfsg-1","urgency":"low"},"trixie":{"status":"resolved","repositories":{"trixie":"3.5.2+dfsg-1"},"fixed_version":"2.3.6+dfsg-1","urgency":"low"}}},"CVE-2019-1010174":{"description":"CImg The CImg Library v.2.3.3 and earlier is affected by: command injection. The impact is: RCE. The component is: load_network() function. The attack vector is: Loading an image from a user-controllable url can lead to command injection, because no string sanitization is done on the url. The fixed version is: v.2.3.4.","scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"3.2.1+dfsg-1"},"fixed_version":"2.3.6+dfsg-1","urgency":"not yet assigned"},"bullseye":{"status":"resolved","repositories":{"bullseye":"2.9.4+dfsg-2"},"fixed_version":"2.3.6+dfsg-1","urgency":"not yet assigned"},"forky":{"status":"resolved","repositories":{"forky":"3.5.2+dfsg-1"},"fixed_version":"2.3.6+dfsg-1","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"3.5.2+dfsg-1"},"fixed_version":"2.3.6+dfsg-1","urgency":"not yet assigned"},"trixie":{"status":"resolved","repositories":{"trixie":"3.5.2+dfsg-1"},"fixed_version":"2.3.6+dfsg-1","urgency":"not yet assigned"}}},"CVE-2019-13568":{"description":"CImg through 2.6.7 has a heap-based buffer overflow in _load_bmp in CImg.h because of erroneous memory allocation for a malformed BMP image.","debianbug":940952,"scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"3.2.1+dfsg-1"},"fixed_version":"2.8.4+dfsg-1","urgency":"not yet assigned"},"bullseye":{"status":"resolved","repositories":{"bullseye":"2.9.4+dfsg-2"},"fixed_version":"2.8.4+dfsg-1","urgency":"not yet assigned"},"forky":{"status":"resolved","repositories":{"forky":"3.5.2+dfsg-1"},"fixed_version":"2.8.4+dfsg-1","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"3.5.2+dfsg-1"},"fixed_version":"2.8.4+dfsg-1","urgency":"not yet assigned"},"trixie":{"status":"resolved","repositories":{"trixie":"3.5.2+dfsg-1"},"fixed_version":"2.8.4+dfsg-1","urgency":"not yet assigned"}}},"CVE-2020-25693":{"description":"A flaw was found in CImg in versions prior to 2.9.3. Integer overflows leading to heap buffer overflows in load_pnm() can be triggered by a specially crafted input file processed by CImg, which can lead to an impact to application availability or data integrity.","debianbug":973770,"scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"3.2.1+dfsg-1"},"fixed_version":"2.9.4+dfsg-2","urgency":"not yet assigned"},"bullseye":{"status":"resolved","repositories":{"bullseye":"2.9.4+dfsg-2"},"fixed_version":"2.9.4+dfsg-2","urgency":"not yet assigned"},"forky":{"status":"resolved","repositories":{"forky":"3.5.2+dfsg-1"},"fixed_version":"2.9.4+dfsg-2","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"3.5.2+dfsg-1"},"fixed_version":"2.9.4+dfsg-2","urgency":"not yet assigned"},"trixie":{"status":"resolved","repositories":{"trixie":"3.5.2+dfsg-1"},"fixed_version":"2.9.4+dfsg-2","urgency":"not yet assigned"}}},"CVE-2022-1325":{"description":"A flaw was found in Clmg, where with the help of a maliciously crafted pandore or bmp file with modified dx and dy header field values it is possible to trick the application into allocating huge buffer sizes like 64 Gigabyte upon reading the file from disk or from a virtual buffer.","debianbug":1018941,"scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"3.2.1+dfsg-1"},"fixed_version":"3.1.6+dfsg-1","urgency":"not yet assigned"},"bullseye":{"status":"open","repositories":{"bullseye":"2.9.4+dfsg-2"},"urgency":"not yet assigned","nodsa":"Minor issue","nodsa_reason":""},"forky":{"status":"resolved","repositories":{"forky":"3.5.2+dfsg-1"},"fixed_version":"3.1.6+dfsg-1","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"3.5.2+dfsg-1"},"fixed_version":"3.1.6+dfsg-1","urgency":"not yet assigned"},"trixie":{"status":"resolved","repositories":{"trixie":"3.5.2+dfsg-1"},"fixed_version":"3.1.6+dfsg-1","urgency":"not yet assigned"}}},"CVE-2024-26540":{"description":"A heap-based buffer overflow in Clmg before 3.3.3 can occur via a crafted file to cimg_library::CImg<unsigned char>::_load_analyze.","debianbug":1068153,"scope":"local","releases":{"bookworm":{"status":"open","repositories":{"bookworm":"3.2.1+dfsg-1"},"urgency":"not yet assigned","nodsa":"Minor issue","nodsa_reason":""},"bullseye":{"status":"open","repositories":{"bullseye":"2.9.4+dfsg-2"},"urgency":"not yet assigned","nodsa":"Minor issue","nodsa_reason":""},"forky":{"status":"resolved","repositories":{"forky":"3.5.2+dfsg-1"},"fixed_version":"3.5.0+dfsg-1","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"3.5.2+dfsg-1"},"fixed_version":"3.5.0+dfsg-1","urgency":"not yet assigned"},"trixie":{"status":"resolved","repositories":{"trixie":"3.5.2+dfsg-1"},"fixed_version":"3.5.0+dfsg-1","urgency":"not yet assigned"}}}},"cinder":{"CVE-2013-1068":{"description":"The OpenStack Nova (python-nova) package 1:2013.2.3-0 before 1:2013.2.3-0ubuntu1.2 and 1:2014.1-0 before 1:2014.1-0ubuntu1.2 and Openstack Cinder (python-cinder) package 1:2013.2.3-0 before 1:2013.2.3-0ubuntu1.1 and 1:2014.1-0 before 1:2014.1-0ubuntu1.1 for Ubuntu 13.10 and 14.04 LTS does not properly set the sudo configuration, which makes it easier for attackers to gain privileges by leveraging another vulnerability.","debianbug":753585,"scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"2:21.3.1-1~deb12u1","bookworm-security":"2:21.3.1-1~deb12u1"},"fixed_version":"2014.1.1-3","urgency":"not yet assigned"},"bullseye":{"status":"resolved","repositories":{"bullseye":"2:17.0.1-1+deb11u1","bullseye-security":"2:17.4.0-1~deb11u2"},"fixed_version":"2014.1.1-3","urgency":"not yet assigned"},"forky":{"status":"resolved","repositories":{"forky":"2:27.0.0-6"},"fixed_version":"2014.1.1-3","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"2:27.0.0-6"},"fixed_version":"2014.1.1-3","urgency":"not yet assigned"},"trixie":{"status":"resolved","repositories":{"trixie":"2:26.0.0-2"},"fixed_version":"2014.1.1-3","urgency":"not yet assigned"}}},"CVE-2013-1664":{"description":"The XML libraries for Python 3.4, 3.3, 3.2, 3.1, 2.7, and 2.6, as used in OpenStack Keystone Essex, Folsom, and Grizzly; Compute (Nova) Essex and Folsom; Cinder Folsom; Django; and possibly other products allow remote attackers to cause a denial of service (resource consumption and crash) via an XML Entity Expansion (XEE) attack.","debianbug":700950,"scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"2:21.3.1-1~deb12u1","bookworm-security":"2:21.3.1-1~deb12u1"},"fixed_version":"2012.2.3-1","urgency":"not yet assigned"},"bullseye":{"status":"resolved","repositories":{"bullseye":"2:17.0.1-1+deb11u1","bullseye-security":"2:17.4.0-1~deb11u2"},"fixed_version":"2012.2.3-1","urgency":"not yet assigned"},"forky":{"status":"resolved","repositories":{"forky":"2:27.0.0-6"},"fixed_version":"2012.2.3-1","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"2:27.0.0-6"},"fixed_version":"2012.2.3-1","urgency":"not yet assigned"},"trixie":{"status":"resolved","repositories":{"trixie":"2:26.0.0-2"},"fixed_version":"2012.2.3-1","urgency":"not yet assigned"}}},"CVE-2013-4183":{"description":"The clear_volume function in LVMVolumeDriver driver in OpenStack Cinder 2013.1.1 through 2013.1.2 does not properly clear data when deleting a snapshot, which allows local users to obtain sensitive information via unspecified vectors.","debianbug":719010,"scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"2:21.3.1-1~deb12u1","bookworm-security":"2:21.3.1-1~deb12u1"},"fixed_version":"2013.1.2-4","urgency":"not yet assigned"},"bullseye":{"status":"resolved","repositories":{"bullseye":"2:17.0.1-1+deb11u1","bullseye-security":"2:17.4.0-1~deb11u2"},"fixed_version":"2013.1.2-4","urgency":"not yet assigned"},"forky":{"status":"resolved","repositories":{"forky":"2:27.0.0-6"},"fixed_version":"2013.1.2-4","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"2:27.0.0-6"},"fixed_version":"2013.1.2-4","urgency":"not yet assigned"},"trixie":{"status":"resolved","repositories":{"trixie":"2:26.0.0-2"},"fixed_version":"2013.1.2-4","urgency":"not yet assigned"}}},"CVE-2013-4202":{"description":"The (1) backup (api/contrib/backups.py) and (2) volume transfer (contrib/volume_transfer.py) APIs in OpenStack Cinder Grizzly 2013.1.3 and earlier allows remote attackers to cause a denial of service (resource consumption and crash) via an XML Entity Expansion (XEE) attack.  NOTE: this issue is due to an incomplete fix for CVE-2013-1664.","debianbug":719118,"scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"2:21.3.1-1~deb12u1","bookworm-security":"2:21.3.1-1~deb12u1"},"fixed_version":"2013.1.2-4","urgency":"not yet assigned"},"bullseye":{"status":"resolved","repositories":{"bullseye":"2:17.0.1-1+deb11u1","bullseye-security":"2:17.4.0-1~deb11u2"},"fixed_version":"2013.1.2-4","urgency":"not yet assigned"},"forky":{"status":"resolved","repositories":{"forky":"2:27.0.0-6"},"fixed_version":"2013.1.2-4","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"2:27.0.0-6"},"fixed_version":"2013.1.2-4","urgency":"not yet assigned"},"trixie":{"status":"resolved","repositories":{"trixie":"2:26.0.0-2"},"fixed_version":"2013.1.2-4","urgency":"not yet assigned"}}},"CVE-2014-3641":{"description":"The (1) GlusterFS and (2) Linux Smbfs drivers in OpenStack Cinder before 2014.1.3 allows remote authenticated users to obtain file data from the Cinder-volume host by cloning and attaching a volume with a crafted qcow2 header.","scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"2:21.3.1-1~deb12u1","bookworm-security":"2:21.3.1-1~deb12u1"},"fixed_version":"2014.1.3-1","urgency":"not yet assigned"},"bullseye":{"status":"resolved","repositories":{"bullseye":"2:17.0.1-1+deb11u1","bullseye-security":"2:17.4.0-1~deb11u2"},"fixed_version":"2014.1.3-1","urgency":"not yet assigned"},"forky":{"status":"resolved","repositories":{"forky":"2:27.0.0-6"},"fixed_version":"2014.1.3-1","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"2:27.0.0-6"},"fixed_version":"2014.1.3-1","urgency":"not yet assigned"},"trixie":{"status":"resolved","repositories":{"trixie":"2:26.0.0-2"},"fixed_version":"2014.1.3-1","urgency":"not yet assigned"}}},"CVE-2014-7230":{"description":"The processutils.execute function in OpenStack oslo-incubator, Cinder, Nova, and Trove before 2013.2.4 and 2014.1 before 2014.1.3 allows local users to obtain passwords from commands that cause a ProcessExecutionError by reading the log.","debianbug":765704,"scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"2:21.3.1-1~deb12u1","bookworm-security":"2:21.3.1-1~deb12u1"},"fixed_version":"2014.1.3-4","urgency":"low"},"bullseye":{"status":"resolved","repositories":{"bullseye":"2:17.0.1-1+deb11u1","bullseye-security":"2:17.4.0-1~deb11u2"},"fixed_version":"2014.1.3-4","urgency":"low"},"forky":{"status":"resolved","repositories":{"forky":"2:27.0.0-6"},"fixed_version":"2014.1.3-4","urgency":"low"},"sid":{"status":"resolved","repositories":{"sid":"2:27.0.0-6"},"fixed_version":"2014.1.3-4","urgency":"low"},"trixie":{"status":"resolved","repositories":{"trixie":"2:26.0.0-2"},"fixed_version":"2014.1.3-4","urgency":"low"}}},"CVE-2015-1851":{"description":"OpenStack Cinder before 2014.1.5 (icehouse), 2014.2.x before 2014.2.4 (juno), and 2015.1.x before 2015.1.1 (kilo) allows remote authenticated users to read arbitrary files via a crafted qcow2 signature in an image to the upload-to-image command.","debianbug":788996,"scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"2:21.3.1-1~deb12u1","bookworm-security":"2:21.3.1-1~deb12u1"},"fixed_version":"2015.1.0+2015.06.16.git26.9634b76ba5-1","urgency":"not yet assigned"},"bullseye":{"status":"resolved","repositories":{"bullseye":"2:17.0.1-1+deb11u1","bullseye-security":"2:17.4.0-1~deb11u2"},"fixed_version":"2015.1.0+2015.06.16.git26.9634b76ba5-1","urgency":"not yet assigned"},"forky":{"status":"resolved","repositories":{"forky":"2:27.0.0-6"},"fixed_version":"2015.1.0+2015.06.16.git26.9634b76ba5-1","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"2:27.0.0-6"},"fixed_version":"2015.1.0+2015.06.16.git26.9634b76ba5-1","urgency":"not yet assigned"},"trixie":{"status":"resolved","repositories":{"trixie":"2:26.0.0-2"},"fixed_version":"2015.1.0+2015.06.16.git26.9634b76ba5-1","urgency":"not yet assigned"}}},"CVE-2015-5162":{"description":"The image parser in OpenStack Cinder 7.0.2 and 8.0.0 through 8.1.1; Glance before 11.0.1 and 12.0.0; and Nova before 12.0.4 and 13.0.0 does not properly limit qemu-img calls, which might allow attackers to cause a denial of service (memory and disk consumption) via a crafted disk image.","scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"2:21.3.1-1~deb12u1","bookworm-security":"2:21.3.1-1~deb12u1"},"fixed_version":"2:8.0.0-1","urgency":"not yet assigned"},"bullseye":{"status":"resolved","repositories":{"bullseye":"2:17.0.1-1+deb11u1","bullseye-security":"2:17.4.0-1~deb11u2"},"fixed_version":"2:8.0.0-1","urgency":"not yet assigned"},"forky":{"status":"resolved","repositories":{"forky":"2:27.0.0-6"},"fixed_version":"2:8.0.0-1","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"2:27.0.0-6"},"fixed_version":"2:8.0.0-1","urgency":"not yet assigned"},"trixie":{"status":"resolved","repositories":{"trixie":"2:26.0.0-2"},"fixed_version":"2:8.0.0-1","urgency":"not yet assigned"}}},"CVE-2017-15139":{"description":"A vulnerability was found in openstack-cinder releases up to and including Queens, allowing newly created volumes in certain storage volume configurations to contain previous data. It specifically affects ScaleIO volumes using thin volumes and zero padding. This could lead to leakage of sensitive information between tenants.","scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"2:21.3.1-1~deb12u1","bookworm-security":"2:21.3.1-1~deb12u1"},"fixed_version":"2:13.0.0-2","urgency":"not yet assigned"},"bullseye":{"status":"resolved","repositories":{"bullseye":"2:17.0.1-1+deb11u1","bullseye-security":"2:17.4.0-1~deb11u2"},"fixed_version":"2:13.0.0-2","urgency":"not yet assigned"},"forky":{"status":"resolved","repositories":{"forky":"2:27.0.0-6"},"fixed_version":"2:13.0.0-2","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"2:27.0.0-6"},"fixed_version":"2:13.0.0-2","urgency":"not yet assigned"},"trixie":{"status":"resolved","repositories":{"trixie":"2:26.0.0-2"},"fixed_version":"2:13.0.0-2","urgency":"not yet assigned"}}},"CVE-2020-10755":{"description":"An insecure-credentials flaw was found in all openstack-cinder versions before openstack-cinder 14.1.0, all openstack-cinder 15.x.x versions before openstack-cinder 15.2.0 and all openstack-cinder 16.x.x versions before openstack-cinder 16.1.0. When using openstack-cinder with the Dell EMC ScaleIO or VxFlex OS backend storage driver, credentials for the entire backend are exposed in the ``connection_info`` element in all Block Storage v3 Attachments API calls containing that element. This flaw enables an end-user to create a volume, make an API call to show the attachment detail information, and retrieve a username and password that may be used to connect to another user's volume. Additionally, these credentials are valid for the ScaleIO or VxFlex OS Management API, should an attacker discover the Management API endpoint. Source: OpenStack project","scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"2:21.3.1-1~deb12u1","bookworm-security":"2:21.3.1-1~deb12u1"},"fixed_version":"2:16.1.0-1","urgency":"low"},"bullseye":{"status":"resolved","repositories":{"bullseye":"2:17.0.1-1+deb11u1","bullseye-security":"2:17.4.0-1~deb11u2"},"fixed_version":"2:16.1.0-1","urgency":"low"},"forky":{"status":"resolved","repositories":{"forky":"2:27.0.0-6"},"fixed_version":"2:16.1.0-1","urgency":"low"},"sid":{"status":"resolved","repositories":{"sid":"2:27.0.0-6"},"fixed_version":"2:16.1.0-1","urgency":"low"},"trixie":{"status":"resolved","repositories":{"trixie":"2:26.0.0-2"},"fixed_version":"2:16.1.0-1","urgency":"low"}}},"CVE-2022-47951":{"description":"An issue was discovered in OpenStack Cinder before 19.1.2, 20.x before 20.0.2, and 21.0.0; Glance before 23.0.1, 24.x before 24.1.1, and 25.0.0; and Nova before 24.1.2, 25.x before 25.0.2, and 26.0.0. By supplying a specially created VMDK flat image that references a specific backing file path, an authenticated user may convince systems to return a copy of that file's contents from the server, resulting in unauthorized access to potentially sensitive data.","debianbug":1029562,"scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"2:21.3.1-1~deb12u1","bookworm-security":"2:21.3.1-1~deb12u1"},"fixed_version":"2:21.0.0-3","urgency":"not yet assigned"},"bullseye":{"status":"resolved","repositories":{"bullseye":"2:17.0.1-1+deb11u1","bullseye-security":"2:17.4.0-1~deb11u2"},"fixed_version":"2:17.0.1-1+deb11u1","urgency":"not yet assigned"},"forky":{"status":"resolved","repositories":{"forky":"2:27.0.0-6"},"fixed_version":"2:21.0.0-3","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"2:27.0.0-6"},"fixed_version":"2:21.0.0-3","urgency":"not yet assigned"},"trixie":{"status":"resolved","repositories":{"trixie":"2:26.0.0-2"},"fixed_version":"2:21.0.0-3","urgency":"not yet assigned"}}},"CVE-2023-2088":{"description":"A flaw was found in OpenStack due to an inconsistency between Cinder and Nova. This issue can be triggered intentionally or by accident. A remote, authenticated attacker could exploit this vulnerability by detaching one of their volumes from Cinder. The highest impact is to confidentiality.","debianbug":1035961,"scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"2:21.3.1-1~deb12u1","bookworm-security":"2:21.3.1-1~deb12u1"},"fixed_version":"2:21.1.0-3","urgency":"not yet assigned"},"bullseye":{"status":"resolved","repositories":{"bullseye":"2:17.0.1-1+deb11u1","bullseye-security":"2:17.4.0-1~deb11u2"},"fixed_version":"2:17.4.0-1~deb11u2","urgency":"not yet assigned"},"forky":{"status":"resolved","repositories":{"forky":"2:27.0.0-6"},"fixed_version":"2:21.1.0-3","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"2:27.0.0-6"},"fixed_version":"2:21.1.0-3","urgency":"not yet assigned"},"trixie":{"status":"resolved","repositories":{"trixie":"2:26.0.0-2"},"fixed_version":"2:21.1.0-3","urgency":"not yet assigned"}}},"CVE-2024-32498":{"description":"An issue was discovered in OpenStack Cinder through 24.0.0, Glance before 28.0.2, and Nova before 29.0.3. Arbitrary file access can occur via custom QCOW2 external data. By supplying a crafted QCOW2 image that references a specific data file path, an authenticated user may convince systems to return a copy of that file's contents from the server, resulting in unauthorized access to potentially sensitive data. All Cinder and Nova deployments are affected; only Glance deployments with image conversion enabled are affected.","debianbug":1074763,"scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"2:21.3.1-1~deb12u1","bookworm-security":"2:21.3.1-1~deb12u1"},"fixed_version":"2:21.3.1-1~deb12u1","urgency":"not yet assigned"},"bullseye":{"status":"resolved","repositories":{"bullseye":"2:17.0.1-1+deb11u1","bullseye-security":"2:17.4.0-1~deb11u2"},"fixed_version":"2:17.4.0-1~deb11u2","urgency":"not yet assigned"},"forky":{"status":"resolved","repositories":{"forky":"2:27.0.0-6"},"fixed_version":"2:24.0.0-5","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"2:27.0.0-6"},"fixed_version":"2:24.0.0-5","urgency":"not yet assigned"},"trixie":{"status":"resolved","repositories":{"trixie":"2:26.0.0-2"},"fixed_version":"2:24.0.0-5","urgency":"not yet assigned"}}}},"cinnamon":{"CVE-2014-1949":{"description":"GTK+ 3.10.9 and earlier, as used in cinnamon-screensaver, gnome-screensaver, and other applications, allows physically proximate attackers to bypass the lock screen by pressing the menu button.","debianbug":738828,"scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"5.6.8-1"},"fixed_version":"2.2.14-1","urgency":"not yet assigned"},"bullseye":{"status":"resolved","repositories":{"bullseye":"4.8.6-2+deb11u1"},"fixed_version":"2.2.14-1","urgency":"not yet assigned"},"forky":{"status":"resolved","repositories":{"forky":"6.4.13-2"},"fixed_version":"2.2.14-1","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"6.4.13-2"},"fixed_version":"2.2.14-1","urgency":"not yet assigned"},"trixie":{"status":"resolved","repositories":{"trixie":"6.4.10-2"},"fixed_version":"2.2.14-1","urgency":"not yet assigned"}}},"CVE-2018-13054":{"description":"An issue was discovered in Cinnamon 1.9.2 through 3.8.6. The cinnamon-settings-users.py GUI runs as root and allows configuration of (for example) other users' icon files in _on_face_browse_menuitem_activated and _on_face_menuitem_activated. These icon files are written to the respective user's $HOME/.face location. If an unprivileged user prepares a symlink pointing to an arbitrary location, then this location will be overwritten with the icon content.","debianbug":903201,"scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"5.6.8-1"},"fixed_version":"3.8.8-1","urgency":"not yet assigned"},"bullseye":{"status":"resolved","repositories":{"bullseye":"4.8.6-2+deb11u1"},"fixed_version":"3.8.8-1","urgency":"not yet assigned"},"forky":{"status":"resolved","repositories":{"forky":"6.4.13-2"},"fixed_version":"3.8.8-1","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"6.4.13-2"},"fixed_version":"3.8.8-1","urgency":"not yet assigned"},"trixie":{"status":"resolved","repositories":{"trixie":"6.4.10-2"},"fixed_version":"3.8.8-1","urgency":"not yet assigned"}}}},"cinnamon-settings-daemon":{"TEMP-0000000-D41D8C":{"releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"5.6.2-2"},"fixed_version":"2.8.3-1","urgency":"low"},"bullseye":{"status":"resolved","repositories":{"bullseye":"4.8.5-1"},"fixed_version":"2.8.3-1","urgency":"low"},"forky":{"status":"resolved","repositories":{"forky":"6.4.3-1"},"fixed_version":"2.8.3-1","urgency":"low"},"sid":{"status":"resolved","repositories":{"sid":"6.4.3-1"},"fixed_version":"2.8.3-1","urgency":"low"},"trixie":{"status":"resolved","repositories":{"trixie":"6.4.3-1"},"fixed_version":"2.8.3-1","urgency":"low"}}}},"civetweb":{"CVE-2018-12684":{"description":"Out-of-bounds Read in the send_ssi_file function in civetweb.c in CivetWeb through 1.10 allows attackers to cause a Denial of Service or Information Disclosure via a crafted SSI file.","scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"1.15+dfsg-4"},"fixed_version":"0","urgency":"unimportant"},"bullseye":{"status":"resolved","repositories":{"bullseye":"1.13+dfsg-5"},"fixed_version":"0","urgency":"unimportant"},"forky":{"status":"resolved","repositories":{"forky":"1.16+dfsg-4"},"fixed_version":"0","urgency":"unimportant"},"sid":{"status":"resolved","repositories":{"sid":"1.16+dfsg-4"},"fixed_version":"0","urgency":"unimportant"},"trixie":{"status":"resolved","repositories":{"trixie":"1.16+dfsg-2"},"fixed_version":"0","urgency":"unimportant"}}},"CVE-2020-27304":{"description":"The CivetWeb web library does not validate uploaded filepaths when running on an OS other than Windows, when using the built-in HTTP form-based file upload mechanism, via the mg_handle_form_request API. Web applications that use the file upload form handler, and use parts of the user-controlled filename in the output path, are susceptible to directory traversal","scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"1.15+dfsg-4"},"fixed_version":"1.15+dfsg-1","urgency":"unimportant"},"bullseye":{"status":"open","repositories":{"bullseye":"1.13+dfsg-5"},"urgency":"unimportant"},"forky":{"status":"resolved","repositories":{"forky":"1.16+dfsg-4"},"fixed_version":"1.15+dfsg-1","urgency":"unimportant"},"sid":{"status":"resolved","repositories":{"sid":"1.16+dfsg-4"},"fixed_version":"1.15+dfsg-1","urgency":"unimportant"},"trixie":{"status":"resolved","repositories":{"trixie":"1.16+dfsg-2"},"fixed_version":"1.15+dfsg-1","urgency":"unimportant"}}},"CVE-2025-55763":{"description":"Buffer Overflow in the URI parser of CivetWeb 1.14 through 1.16 (latest) allows a remote attacker to achieve remote code execution via a crafted HTTP request. This vulnerability is triggered during request processing and may allow an attacker to corrupt heap memory, potentially leading to denial of service or arbitrary code execution.","debianbug":1112507,"scope":"local","releases":{"bookworm":{"status":"open","repositories":{"bookworm":"1.15+dfsg-4"},"urgency":"not yet assigned","nodsa":"Minor issue","nodsa_reason":""},"bullseye":{"status":"open","repositories":{"bullseye":"1.13+dfsg-5"},"urgency":"not yet assigned","nodsa":"Minor issue","nodsa_reason":"postponed"},"forky":{"status":"resolved","repositories":{"forky":"1.16+dfsg-4"},"fixed_version":"1.16+dfsg-3","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"1.16+dfsg-4"},"fixed_version":"1.16+dfsg-3","urgency":"not yet assigned"},"trixie":{"status":"open","repositories":{"trixie":"1.16+dfsg-2"},"urgency":"not yet assigned","nodsa":"Minor issue","nodsa_reason":"","next_point_update":true}}},"CVE-2025-9648":{"description":"A vulnerability in the CivetWeb library's function mg_handle_form_request allows remote attackers to trigger a denial of service (DoS) condition. By sending a specially crafted HTTP POST request containing a null byte in the payload, the server enters an infinite loop during form data parsing. Multiple malicious requests will result in complete CPU exhaustion and render the service unresponsive to further requests.  This issue was fixed in commit 782e189. This issue affects only the library, standalone executable pre-built by vendor is not affected.","debianbug":1118285,"scope":"local","releases":{"bookworm":{"status":"open","repositories":{"bookworm":"1.15+dfsg-4"},"urgency":"not yet assigned","nodsa":"Minor issue","nodsa_reason":""},"bullseye":{"status":"open","repositories":{"bullseye":"1.13+dfsg-5"},"urgency":"not yet assigned","nodsa":"minor issue; DoS","nodsa_reason":"postponed"},"forky":{"status":"resolved","repositories":{"forky":"1.16+dfsg-4"},"fixed_version":"1.16+dfsg-4","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"1.16+dfsg-4"},"fixed_version":"1.16+dfsg-4","urgency":"not yet assigned"},"trixie":{"status":"open","repositories":{"trixie":"1.16+dfsg-2"},"urgency":"not yet assigned","nodsa":"Minor issue","nodsa_reason":"","next_point_update":true}}}},"civicrm":{"CVE-2011-5239":{"description":"CiviCRM 4.0.5 and 4.1.1 does not verify that the server hostname matches a domain name in the subject's Common Name (CN) or subjectAltName field of the X.509 certificate, which allows man-in-the-middle attackers to spoof SSL servers via an arbitrary valid certificate.","scope":"local","releases":{"bullseye":{"status":"resolved","repositories":{"bullseye":"5.33.2+dfsg1-1"},"fixed_version":"0","urgency":"unimportant"}}},"CVE-2013-4661":{"description":"CiviCRM 2.0.0 through 4.2.9 and 4.3.0 through 4.3.3 does not properly enforce role-based access control (RBAC) restrictions for default custom searches, which allows remote authenticated users with the \"access CiviCRM\" permission to bypass intended access restrictions, as demonstrated by accessing custom contribution data without having the \"access CiviContribute\" permission.","scope":"local","releases":{"bullseye":{"status":"resolved","repositories":{"bullseye":"5.33.2+dfsg1-1"},"fixed_version":"0","urgency":"unimportant"}}},"CVE-2013-4662":{"description":"The Quick Search API in CiviCRM 4.2.0 through 4.2.9 and 4.3.0 through 4.3.3 allows remote authenticated users to bypass the validation layer and conduct SQL injection attacks via a direct request to the \"second layer\" of the API, related to contact.getquick.","scope":"local","releases":{"bullseye":{"status":"resolved","repositories":{"bullseye":"5.33.2+dfsg1-1"},"fixed_version":"0","urgency":"unimportant"}}},"CVE-2013-5957":{"description":"Multiple SQL injection vulnerabilities in CRM/Core/Page/AJAX/Location.php in CiviCRM before 4.2.12, 4.3.x before 4.3.7, and 4.4.x before 4.4.beta4 allow remote attackers to execute arbitrary SQL commands via the _value parameter to (1) ajax/jqState or (2) ajax/jqcounty.","scope":"local","releases":{"bullseye":{"status":"resolved","repositories":{"bullseye":"5.33.2+dfsg1-1"},"fixed_version":"0","urgency":"unimportant"}}},"CVE-2018-1999022":{"description":"PEAR HTML_QuickForm version 3.2.14 contains an eval injection (CWE-95) vulnerability in HTML_QuickForm's getSubmitValue method, HTML_QuickForm's validate method, HTML_QuickForm_hierselect's _setOptions method, HTML_QuickForm_element's _findValue method, HTML_QuickForm_element's _prepareValue method. that can result in Possible information disclosure, possible impact on data integrity and execution of arbitrary code. This attack appear to be exploitable via A specially crafted query string could be utilised, e.g. http://www.example.com/admin/add_practice_type_id[1]=fubar%27])%20OR%20die(%27OOK!%27);%20//&mode=live. This vulnerability appears to have been fixed in 3.2.15.","debianbug":904215,"scope":"local","releases":{"bullseye":{"status":"resolved","repositories":{"bullseye":"5.33.2+dfsg1-1"},"fixed_version":"5.3.1+dfsg-1","urgency":"not yet assigned"}}},"CVE-2020-36388":{"description":"In CiviCRM before 5.21.3 and 5.22.x through 5.24.x before 5.24.3, users may be able to upload and execute a crafted PHAR archive.","scope":"local","releases":{"bullseye":{"status":"resolved","repositories":{"bullseye":"5.33.2+dfsg1-1"},"fixed_version":"5.24.5+dfsg1-1","urgency":"not yet assigned"}}},"CVE-2020-36389":{"description":"In CiviCRM before 5.28.1 and CiviCRM ESR before 5.27.5 ESR, the CKEditor configuration form allows CSRF.","scope":"local","releases":{"bullseye":{"status":"resolved","repositories":{"bullseye":"5.33.2+dfsg1-1"},"fixed_version":"5.28.4+dfsg1-1","urgency":"not yet assigned"}}},"CVE-2021-21252":{"description":"The jQuery Validation Plugin provides drop-in validation for your existing forms. It is published as an npm package \"jquery-validation\". jquery-validation before version 1.19.3 contains one or more regular expressions that are vulnerable to ReDoS (Regular Expression Denial of Service). This is fixed in 1.19.3.","debianbug":980892,"scope":"local","releases":{"bullseye":{"status":"open","repositories":{"bullseye":"5.33.2+dfsg1-1"},"urgency":"not yet assigned","nodsa":"Minor issue","nodsa_reason":""}}},"CVE-2023-25440":{"description":"Stored Cross Site Scripting (XSS) vulnerability in the add contact function CiviCRM 5.59.alpha1, allows attackers to execute arbitrary code in first/second name field.","debianbug":1036695,"scope":"local","releases":{"bullseye":{"status":"open","repositories":{"bullseye":"5.33.2+dfsg1-1"},"urgency":"not yet assigned","nodsa":"Minor issue","nodsa_reason":""}}},"CVE-2023-28115":{"description":"Snappy is a PHP library allowing thumbnail, snapshot or PDF generation from a url or a html page. Prior to version 1.4.2, Snappy is vulnerable to PHAR deserialization due to a lack of checking on the protocol before passing it into the `file_exists()` function. If an attacker can upload files of any type to the server he can pass in the phar:// protocol to unserialize the uploaded file and instantiate arbitrary PHP objects. This can lead to remote code execution especially when snappy is used with frameworks with documented POP chains like Laravel/Symfony vulnerable developer code. If a user can control the output file from the `generateFromHtml()` function, it will invoke deserialization. This vulnerability is capable of remote code execution if Snappy is used with frameworks or developer code with vulnerable POP chains. It has been fixed in version 1.4.2.","debianbug":1036284,"scope":"local","releases":{"bullseye":{"status":"open","repositories":{"bullseye":"5.33.2+dfsg1-1"},"urgency":"not yet assigned","nodsa":"Minor issue","nodsa_reason":""}}},"CVE-2025-3573":{"description":"Versions of the package jquery-validation before 1.20.0 are vulnerable to Cross-site Scripting (XSS) in the showLabel() function, which may take input from a user-controlled placeholder value. This value will populate a message via $.validator.messages in a user localizable dictionary.","debianbug":1103445,"scope":"local","releases":{"bullseye":{"status":"open","repositories":{"bullseye":"5.33.2+dfsg1-1"},"urgency":"not yet assigned","nodsa":"Minor Issue; XSS","nodsa_reason":"postponed"}}},"CVE-2025-65187":{"description":"A Stored Cross Site Scripting vulnerability exists in CiviCRM before v6.7 in the Accounting Batches field. An authenticated user can inject malicious JavaScript into this field and it executes whenever the page is viewed.","scope":"local","releases":{"bullseye":{"status":"open","repositories":{"bullseye":"5.33.2+dfsg1-1"},"urgency":"not yet assigned","nodsa":"Reevaluate when fixed upstream","nodsa_reason":"postponed"}}},"TEMP-0887330-0F8779":{"debianbug":887330,"releases":{"bullseye":{"status":"resolved","repositories":{"bullseye":"5.33.2+dfsg1-1"},"fixed_version":"4.7.30+dfsg-1","urgency":"not yet assigned"}}}},"cjose":{"CVE-2023-37464":{"description":"OpenIDC/cjose is a C library implementing the Javascript Object Signing and Encryption (JOSE). The AES GCM decryption routine incorrectly uses the Tag length from the actual Authentication Tag provided in the JWE. The spec  says that a fixed length of 16 octets must be applied. Therefore this bug allows an attacker to provide a truncated Authentication Tag and to modify the JWE accordingly. Users should upgrade to a version >= 0.6.2.2. Users unable to upgrade should avoid using AES GCM encryption and replace it with another encryption algorithm (e.g. AES CBC).","debianbug":1041423,"scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"0.6.2.1-1+deb12u1","bookworm-security":"0.6.2.1-1+deb12u1"},"fixed_version":"0.6.2.1-1+deb12u1","urgency":"not yet assigned"},"bullseye":{"status":"resolved","repositories":{"bullseye":"0.6.1+dfsg1-1+deb11u1","bullseye-security":"0.6.1+dfsg1-1+deb11u1"},"fixed_version":"0.6.1+dfsg1-1+deb11u1","urgency":"not yet assigned"},"forky":{"status":"resolved","repositories":{"forky":"0.6.2.4-1"},"fixed_version":"0.6.2.2-1","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"0.6.2.4-1"},"fixed_version":"0.6.2.2-1","urgency":"not yet assigned"},"trixie":{"status":"resolved","repositories":{"trixie":"0.6.2.3-1"},"fixed_version":"0.6.2.2-1","urgency":"not yet assigned"}}}},"cjson":{"CVE-2016-10749":{"description":"parse_string in cJSON.c in cJSON before 2016-10-02 has a buffer over-read, as demonstrated by a string that begins with a \" character and ends with a \\ character.","scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"1.7.15-1+deb12u4","bookworm-security":"1.7.15-1+deb12u4"},"fixed_version":"0","urgency":"unimportant"},"bullseye":{"status":"resolved","repositories":{"bullseye":"1.7.14-1+deb11u1","bullseye-security":"1.7.14-1+deb11u3"},"fixed_version":"0","urgency":"unimportant"},"forky":{"status":"resolved","repositories":{"forky":"1.7.19-2"},"fixed_version":"0","urgency":"unimportant"},"sid":{"status":"resolved","repositories":{"sid":"1.7.19-2"},"fixed_version":"0","urgency":"unimportant"},"trixie":{"status":"resolved","repositories":{"trixie":"1.7.18-3.1+deb13u1","trixie-security":"1.7.18-3.1+deb13u1"},"fixed_version":"0","urgency":"unimportant"}}},"CVE-2018-1000215":{"description":"Dave Gamble cJSON version 1.7.6 and earlier contains a CWE-772 vulnerability in cJSON library that can result in Denial of Service (DoS). This attack appear to be exploitable via If the attacker can force the data to be printed and the system is in low memory it can force a leak of memory. This vulnerability appears to have been fixed in 1.7.7.","scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"1.7.15-1+deb12u4","bookworm-security":"1.7.15-1+deb12u4"},"fixed_version":"1.7.7-1","urgency":"not yet assigned"},"bullseye":{"status":"resolved","repositories":{"bullseye":"1.7.14-1+deb11u1","bullseye-security":"1.7.14-1+deb11u3"},"fixed_version":"1.7.7-1","urgency":"not yet assigned"},"forky":{"status":"resolved","repositories":{"forky":"1.7.19-2"},"fixed_version":"1.7.7-1","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"1.7.19-2"},"fixed_version":"1.7.7-1","urgency":"not yet assigned"},"trixie":{"status":"resolved","repositories":{"trixie":"1.7.18-3.1+deb13u1","trixie-security":"1.7.18-3.1+deb13u1"},"fixed_version":"1.7.7-1","urgency":"not yet assigned"}}},"CVE-2018-1000216":{"description":"Dave Gamble cJSON version 1.7.2 and earlier contains a CWE-415: Double Free vulnerability in cJSON library that can result in Possible crash or RCE. This attack appear to be exploitable via Attacker must be able to force victim to print JSON data, depending on how cJSON library is used this could be either local or over a network. This vulnerability appears to have been fixed in 1.7.3.","scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"1.7.15-1+deb12u4","bookworm-security":"1.7.15-1+deb12u4"},"fixed_version":"0","urgency":"unimportant"},"bullseye":{"status":"resolved","repositories":{"bullseye":"1.7.14-1+deb11u1","bullseye-security":"1.7.14-1+deb11u3"},"fixed_version":"0","urgency":"unimportant"},"forky":{"status":"resolved","repositories":{"forky":"1.7.19-2"},"fixed_version":"0","urgency":"unimportant"},"sid":{"status":"resolved","repositories":{"sid":"1.7.19-2"},"fixed_version":"0","urgency":"unimportant"},"trixie":{"status":"resolved","repositories":{"trixie":"1.7.18-3.1+deb13u1","trixie-security":"1.7.18-3.1+deb13u1"},"fixed_version":"0","urgency":"unimportant"}}},"CVE-2018-1000217":{"description":"Dave Gamble cJSON version 1.7.3 and earlier contains a CWE-416: Use After Free vulnerability in cJSON library that can result in Possible crash, corruption of data or even RCE. This attack appear to be exploitable via Depends on how application uses cJSON library. If application provides network interface then can be exploited over a network, otherwise just local.. This vulnerability appears to have been fixed in 1.7.4.","scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"1.7.15-1+deb12u4","bookworm-security":"1.7.15-1+deb12u4"},"fixed_version":"0","urgency":"unimportant"},"bullseye":{"status":"resolved","repositories":{"bullseye":"1.7.14-1+deb11u1","bullseye-security":"1.7.14-1+deb11u3"},"fixed_version":"0","urgency":"unimportant"},"forky":{"status":"resolved","repositories":{"forky":"1.7.19-2"},"fixed_version":"0","urgency":"unimportant"},"sid":{"status":"resolved","repositories":{"sid":"1.7.19-2"},"fixed_version":"0","urgency":"unimportant"},"trixie":{"status":"resolved","repositories":{"trixie":"1.7.18-3.1+deb13u1","trixie-security":"1.7.18-3.1+deb13u1"},"fixed_version":"0","urgency":"unimportant"}}},"CVE-2019-1010239":{"description":"DaveGamble/cJSON cJSON 1.7.8 is affected by: Improper Check for Unusual or Exceptional Conditions. The impact is: Null dereference, so attack can cause denial of service. The component is: cJSON_GetObjectItemCaseSensitive() function. The attack vector is: crafted json file. The fixed version is: 1.7.9 and later.","scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"1.7.15-1+deb12u4","bookworm-security":"1.7.15-1+deb12u4"},"fixed_version":"1.7.10-1","urgency":"not yet assigned"},"bullseye":{"status":"resolved","repositories":{"bullseye":"1.7.14-1+deb11u1","bullseye-security":"1.7.14-1+deb11u3"},"fixed_version":"1.7.10-1","urgency":"not yet assigned"},"forky":{"status":"resolved","repositories":{"forky":"1.7.19-2"},"fixed_version":"1.7.10-1","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"1.7.19-2"},"fixed_version":"1.7.10-1","urgency":"not yet assigned"},"trixie":{"status":"resolved","repositories":{"trixie":"1.7.18-3.1+deb13u1","trixie-security":"1.7.18-3.1+deb13u1"},"fixed_version":"1.7.10-1","urgency":"not yet assigned"}}},"CVE-2019-11834":{"description":"cJSON before 1.7.11 allows out-of-bounds access, related to \\x00 in a string literal.","debianbug":928726,"scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"1.7.15-1+deb12u4","bookworm-security":"1.7.15-1+deb12u4"},"fixed_version":"1.7.10-1.1","urgency":"not yet assigned"},"bullseye":{"status":"resolved","repositories":{"bullseye":"1.7.14-1+deb11u1","bullseye-security":"1.7.14-1+deb11u3"},"fixed_version":"1.7.10-1.1","urgency":"not yet assigned"},"forky":{"status":"resolved","repositories":{"forky":"1.7.19-2"},"fixed_version":"1.7.10-1.1","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"1.7.19-2"},"fixed_version":"1.7.10-1.1","urgency":"not yet assigned"},"trixie":{"status":"resolved","repositories":{"trixie":"1.7.18-3.1+deb13u1","trixie-security":"1.7.18-3.1+deb13u1"},"fixed_version":"1.7.10-1.1","urgency":"not yet assigned"}}},"CVE-2019-11835":{"description":"cJSON before 1.7.11 allows out-of-bounds access, related to multiline comments.","debianbug":928726,"scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"1.7.15-1+deb12u4","bookworm-security":"1.7.15-1+deb12u4"},"fixed_version":"1.7.10-1.1","urgency":"not yet assigned"},"bullseye":{"status":"resolved","repositories":{"bullseye":"1.7.14-1+deb11u1","bullseye-security":"1.7.14-1+deb11u3"},"fixed_version":"1.7.10-1.1","urgency":"not yet assigned"},"forky":{"status":"resolved","repositories":{"forky":"1.7.19-2"},"fixed_version":"1.7.10-1.1","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"1.7.19-2"},"fixed_version":"1.7.10-1.1","urgency":"not yet assigned"},"trixie":{"status":"resolved","repositories":{"trixie":"1.7.18-3.1+deb13u1","trixie-security":"1.7.18-3.1+deb13u1"},"fixed_version":"1.7.10-1.1","urgency":"not yet assigned"}}},"CVE-2023-26819":{"description":"cJSON 1.7.15 might allow a denial of service via a crafted JSON document such as {\"a\": true, \"b\": [ null,9999999999999999999999999999999999999999999999912345678901234567]}.","debianbug":1103687,"scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"1.7.15-1+deb12u4","bookworm-security":"1.7.15-1+deb12u4"},"fixed_version":"1.7.15-1+deb12u3","urgency":"not yet assigned"},"bullseye":{"status":"resolved","repositories":{"bullseye":"1.7.14-1+deb11u1","bullseye-security":"1.7.14-1+deb11u3"},"fixed_version":"1.7.14-1+deb11u2","urgency":"not yet assigned"},"forky":{"status":"resolved","repositories":{"forky":"1.7.19-2"},"fixed_version":"1.7.18-3.1","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"1.7.19-2"},"fixed_version":"1.7.18-3.1","urgency":"not yet assigned"},"trixie":{"status":"resolved","repositories":{"trixie":"1.7.18-3.1+deb13u1","trixie-security":"1.7.18-3.1+deb13u1"},"fixed_version":"1.7.18-3.1","urgency":"not yet assigned"}}},"CVE-2023-50471":{"description":"cJSON v1.7.16 was discovered to contain a segmentation violation via the function cJSON_InsertItemInArray at cJSON.c.","debianbug":1059287,"scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"1.7.15-1+deb12u4","bookworm-security":"1.7.15-1+deb12u4"},"fixed_version":"1.7.15-1+deb12u1","urgency":"not yet assigned"},"bullseye":{"status":"resolved","repositories":{"bullseye":"1.7.14-1+deb11u1","bullseye-security":"1.7.14-1+deb11u3"},"fixed_version":"1.7.14-1+deb11u1","urgency":"not yet assigned"},"forky":{"status":"resolved","repositories":{"forky":"1.7.19-2"},"fixed_version":"1.7.17-1","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"1.7.19-2"},"fixed_version":"1.7.17-1","urgency":"not yet assigned"},"trixie":{"status":"resolved","repositories":{"trixie":"1.7.18-3.1+deb13u1","trixie-security":"1.7.18-3.1+deb13u1"},"fixed_version":"1.7.17-1","urgency":"not yet assigned"}}},"CVE-2023-50472":{"description":"cJSON v1.7.16 was discovered to contain a segmentation violation via the function cJSON_SetValuestring at cJSON.c.","debianbug":1059287,"scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"1.7.15-1+deb12u4","bookworm-security":"1.7.15-1+deb12u4"},"fixed_version":"1.7.15-1+deb12u1","urgency":"not yet assigned"},"bullseye":{"status":"resolved","repositories":{"bullseye":"1.7.14-1+deb11u1","bullseye-security":"1.7.14-1+deb11u3"},"fixed_version":"1.7.14-1+deb11u1","urgency":"not yet assigned"},"forky":{"status":"resolved","repositories":{"forky":"1.7.19-2"},"fixed_version":"1.7.17-1","urgency":"unimportant"},"sid":{"status":"resolved","repositories":{"sid":"1.7.19-2"},"fixed_version":"1.7.17-1","urgency":"unimportant"},"trixie":{"status":"resolved","repositories":{"trixie":"1.7.18-3.1+deb13u1","trixie-security":"1.7.18-3.1+deb13u1"},"fixed_version":"1.7.17-1","urgency":"unimportant"}}},"CVE-2023-53154":{"description":"parse_string in cJSON before 1.7.18 has a heap-based buffer over-read via {\"1\":1, with no trailing newline if cJSON_ParseWithLength is called.","scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"1.7.15-1+deb12u4","bookworm-security":"1.7.15-1+deb12u4"},"fixed_version":"1.7.15-1+deb12u3","urgency":"not yet assigned"},"bullseye":{"status":"resolved","repositories":{"bullseye":"1.7.14-1+deb11u1","bullseye-security":"1.7.14-1+deb11u3"},"fixed_version":"1.7.14-1+deb11u2","urgency":"not yet assigned"},"forky":{"status":"resolved","repositories":{"forky":"1.7.19-2"},"fixed_version":"1.7.18-1","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"1.7.19-2"},"fixed_version":"1.7.18-1","urgency":"not yet assigned"},"trixie":{"status":"resolved","repositories":{"trixie":"1.7.18-3.1+deb13u1","trixie-security":"1.7.18-3.1+deb13u1"},"fixed_version":"1.7.18-1","urgency":"not yet assigned"}}},"CVE-2024-31755":{"description":"cJSON v1.7.17 was discovered to contain a segmentation violation, which can trigger through the second parameter of function cJSON_SetValuestring at cJSON.c.","debianbug":1071742,"scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"1.7.15-1+deb12u4","bookworm-security":"1.7.15-1+deb12u4"},"fixed_version":"1.7.15-1+deb12u2","urgency":"not yet assigned"},"bullseye":{"status":"resolved","repositories":{"bullseye":"1.7.14-1+deb11u1","bullseye-security":"1.7.14-1+deb11u3"},"fixed_version":"1.7.14-1+deb11u1","urgency":"not yet assigned"},"forky":{"status":"resolved","repositories":{"forky":"1.7.19-2"},"fixed_version":"1.7.18-1","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"1.7.19-2"},"fixed_version":"1.7.18-1","urgency":"not yet assigned"},"trixie":{"status":"resolved","repositories":{"trixie":"1.7.18-3.1+deb13u1","trixie-security":"1.7.18-3.1+deb13u1"},"fixed_version":"1.7.18-1","urgency":"not yet assigned"}}},"CVE-2025-57052":{"description":"cJSON 1.5.0 through 1.7.18 allows out-of-bounds access via the decode_array_index_from_pointer function in cJSON_Utils.c, allowing remote attackers to bypass array bounds checking and access restricted data via malformed JSON pointer strings containing alphanumeric characters.","debianbug":1114757,"scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"1.7.15-1+deb12u4","bookworm-security":"1.7.15-1+deb12u4"},"fixed_version":"1.7.15-1+deb12u4","urgency":"not yet assigned"},"bullseye":{"status":"resolved","repositories":{"bullseye":"1.7.14-1+deb11u1","bullseye-security":"1.7.14-1+deb11u3"},"fixed_version":"1.7.14-1+deb11u3","urgency":"not yet assigned"},"forky":{"status":"resolved","repositories":{"forky":"1.7.19-2"},"fixed_version":"1.7.19-1","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"1.7.19-2"},"fixed_version":"1.7.19-1","urgency":"not yet assigned"},"trixie":{"status":"resolved","repositories":{"trixie":"1.7.18-3.1+deb13u1","trixie-security":"1.7.18-3.1+deb13u1"},"fixed_version":"1.7.18-3.1+deb13u1","urgency":"not yet assigned"}}}},"ckeditor":{"CVE-2014-5191":{"description":"Cross-site scripting (XSS) vulnerability in the Preview plugin before 4.4.3 in CKEditor allows remote attackers to inject arbitrary web script or HTML via unspecified vectors.","debianbug":760736,"scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"4.19.1+dfsg-1"},"fixed_version":"4.4.4+dfsg1-1","urgency":"not yet assigned"},"bullseye":{"status":"resolved","repositories":{"bullseye":"4.16.0+dfsg-2"},"fixed_version":"4.4.4+dfsg1-1","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"4.22.1+dfsg1-2"},"fixed_version":"4.4.4+dfsg1-1","urgency":"not yet assigned"}}},"CVE-2018-17960":{"description":"CKEditor 4.x before 4.11.0 allows user-assisted XSS involving a source-mode paste.","scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"4.19.1+dfsg-1"},"fixed_version":"4.11.1+dfsg-1","urgency":"unimportant"},"bullseye":{"status":"resolved","repositories":{"bullseye":"4.16.0+dfsg-2"},"fixed_version":"4.11.1+dfsg-1","urgency":"unimportant"},"sid":{"status":"resolved","repositories":{"sid":"4.22.1+dfsg1-2"},"fixed_version":"4.11.1+dfsg-1","urgency":"unimportant"}}},"CVE-2021-26271":{"description":"It was possible to execute a ReDoS-type attack inside CKEditor 4 before 4.16 by persuading a victim to paste crafted text into the Styles input of specific dialogs (in the Advanced Tab for Dialogs plugin).","debianbug":982587,"scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"4.19.1+dfsg-1"},"fixed_version":"4.16.0+dfsg-1","urgency":"not yet assigned"},"bullseye":{"status":"resolved","repositories":{"bullseye":"4.16.0+dfsg-2"},"fixed_version":"4.16.0+dfsg-1","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"4.22.1+dfsg1-2"},"fixed_version":"4.16.0+dfsg-1","urgency":"not yet assigned"}}},"CVE-2021-26272":{"description":"It was possible to execute a ReDoS-type attack inside CKEditor 4 before 4.16 by persuading a victim to paste crafted URL-like text into the editor, and then press Enter or Space (in the Autolink plugin).","debianbug":982587,"scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"4.19.1+dfsg-1"},"fixed_version":"4.16.0+dfsg-1","urgency":"not yet assigned"},"bullseye":{"status":"resolved","repositories":{"bullseye":"4.16.0+dfsg-2"},"fixed_version":"4.16.0+dfsg-1","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"4.22.1+dfsg1-2"},"fixed_version":"4.16.0+dfsg-1","urgency":"not yet assigned"}}},"CVE-2021-32808":{"description":"ckeditor is an open source WYSIWYG HTML editor with rich content support. A vulnerability has been discovered in the clipboard Widget plugin if used alongside the undo feature. The vulnerability allows a user to abuse undo functionality using malformed widget HTML, which could result in executing JavaScript code. It affects all users using the CKEditor 4 plugins listed above at version >= 4.13.0. The problem has been recognized and patched. The fix will be available in version 4.16.2.","debianbug":992292,"scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"4.19.1+dfsg-1"},"fixed_version":"4.16.2+dfsg-1","urgency":"not yet assigned"},"bullseye":{"status":"open","repositories":{"bullseye":"4.16.0+dfsg-2"},"urgency":"not yet assigned","nodsa":"Minor issue","nodsa_reason":""},"sid":{"status":"resolved","repositories":{"sid":"4.22.1+dfsg1-2"},"fixed_version":"4.16.2+dfsg-1","urgency":"not yet assigned"}}},"CVE-2021-32809":{"description":"ckeditor is an open source WYSIWYG HTML editor with rich content support. A potential vulnerability has been discovered in CKEditor 4 [Clipboard](https://ckeditor.com/cke4/addon/clipboard) package. The vulnerability allowed to abuse paste functionality using malformed HTML, which could result in injecting arbitrary HTML into the editor. It affects all users using the CKEditor 4 plugins listed above at version >= 4.5.2. The problem has been recognized and patched. The fix will be available in version 4.16.2.","debianbug":992291,"scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"4.19.1+dfsg-1"},"fixed_version":"4.16.2+dfsg-1","urgency":"not yet assigned"},"bullseye":{"status":"open","repositories":{"bullseye":"4.16.0+dfsg-2"},"urgency":"not yet assigned","nodsa":"Minor issue","nodsa_reason":""},"sid":{"status":"resolved","repositories":{"sid":"4.22.1+dfsg1-2"},"fixed_version":"4.16.2+dfsg-1","urgency":"not yet assigned"}}},"CVE-2021-33829":{"description":"A cross-site scripting (XSS) vulnerability in the HTML Data Processor in CKEditor 4 4.14.0 through 4.16.x before 4.16.1 allows remote attackers to inject executable JavaScript code through a crafted comment because --!> is mishandled.","scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"4.19.1+dfsg-1"},"fixed_version":"4.16.0+dfsg-2","urgency":"not yet assigned"},"bullseye":{"status":"resolved","repositories":{"bullseye":"4.16.0+dfsg-2"},"fixed_version":"4.16.0+dfsg-2","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"4.22.1+dfsg1-2"},"fixed_version":"4.16.0+dfsg-2","urgency":"not yet assigned"}}},"CVE-2021-37695":{"description":"ckeditor is an open source WYSIWYG HTML editor with rich content support. A potential vulnerability has been discovered in CKEditor 4 [Fake Objects](https://ckeditor.com/cke4/addon/fakeobjects) package. The vulnerability allowed to inject malformed Fake Objects HTML, which could result in executing JavaScript code. It affects all users using the CKEditor 4 plugins listed above at version < 4.16.2. The problem has been recognized and patched. The fix will be available in version 4.16.2.","debianbug":992290,"scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"4.19.1+dfsg-1"},"fixed_version":"4.16.2+dfsg-1","urgency":"not yet assigned"},"bullseye":{"status":"open","repositories":{"bullseye":"4.16.0+dfsg-2"},"urgency":"not yet assigned","nodsa":"Minor issue","nodsa_reason":""},"sid":{"status":"resolved","repositories":{"sid":"4.22.1+dfsg1-2"},"fixed_version":"4.16.2+dfsg-1","urgency":"not yet assigned"}}},"CVE-2021-41164":{"description":"CKEditor4 is an open source WYSIWYG HTML editor. In affected versions a vulnerability has been discovered in the Advanced Content Filter (ACF) module and may affect all plugins used by CKEditor 4. The vulnerability allowed to inject malformed HTML bypassing content sanitization, which could result in executing JavaScript code. It affects all users using the CKEditor 4 at version < 4.17.0. The problem has been recognized and patched. The fix will be available in version 4.17.0.","debianbug":999909,"scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"4.19.1+dfsg-1"},"fixed_version":"4.19.0+dfsg-1","urgency":"not yet assigned"},"bullseye":{"status":"open","repositories":{"bullseye":"4.16.0+dfsg-2"},"urgency":"not yet assigned","nodsa":"Minor issue","nodsa_reason":""},"sid":{"status":"resolved","repositories":{"sid":"4.22.1+dfsg1-2"},"fixed_version":"4.19.0+dfsg-1","urgency":"not yet assigned"}}},"CVE-2021-41165":{"description":"CKEditor4 is an open source WYSIWYG HTML editor. In affected version a vulnerability has been discovered in the core HTML processing module and may affect all plugins used by CKEditor 4. The vulnerability allowed to inject malformed comments HTML bypassing content sanitization, which could result in executing JavaScript code. It affects all users using the CKEditor 4 at version < 4.17.0. The problem has been recognized and patched. The fix will be available in version 4.17.0.","debianbug":999909,"scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"4.19.1+dfsg-1"},"fixed_version":"4.19.0+dfsg-1","urgency":"not yet assigned"},"bullseye":{"status":"open","repositories":{"bullseye":"4.16.0+dfsg-2"},"urgency":"not yet assigned","nodsa":"Minor issue","nodsa_reason":""},"sid":{"status":"resolved","repositories":{"sid":"4.22.1+dfsg1-2"},"fixed_version":"4.19.0+dfsg-1","urgency":"not yet assigned"}}},"CVE-2022-24728":{"description":"CKEditor4 is an open source what-you-see-is-what-you-get HTML editor. A vulnerability has been discovered in the core HTML processing module and may affect all plugins used by CKEditor 4 prior to version 4.18.0. The vulnerability allows someone to inject malformed HTML bypassing content sanitization, which could result in executing JavaScript code. This problem has been patched in version 4.18.0. There are currently no known workarounds.","scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"4.19.1+dfsg-1"},"fixed_version":"4.19.0+dfsg-1","urgency":"not yet assigned"},"bullseye":{"status":"open","repositories":{"bullseye":"4.16.0+dfsg-2"},"urgency":"not yet assigned","nodsa":"Minor issue","nodsa_reason":""},"sid":{"status":"resolved","repositories":{"sid":"4.22.1+dfsg1-2"},"fixed_version":"4.19.0+dfsg-1","urgency":"not yet assigned"}}},"CVE-2022-24729":{"description":"CKEditor4 is an open source what-you-see-is-what-you-get HTML editor. CKEditor4 prior to version 4.18.0 contains a vulnerability in the `dialog` plugin. The vulnerability allows abuse of a dialog input validator regular expression, which can cause a significant performance drop resulting in a browser tab freeze. A patch is available in version 4.18.0. There are currently no known workarounds.","scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"4.19.1+dfsg-1"},"fixed_version":"4.19.0+dfsg-1","urgency":"not yet assigned"},"bullseye":{"status":"open","repositories":{"bullseye":"4.16.0+dfsg-2"},"urgency":"not yet assigned","nodsa":"Minor issue","nodsa_reason":""},"sid":{"status":"resolved","repositories":{"sid":"4.22.1+dfsg1-2"},"fixed_version":"4.19.0+dfsg-1","urgency":"not yet assigned"}}},"CVE-2023-28439":{"description":"CKEditor4 is an open source what-you-see-is-what-you-get HTML editor. A cross-site scripting vulnerability has been discovered affecting Iframe Dialog and Media Embed packages. The vulnerability may trigger a JavaScript code after fulfilling special conditions: using one of the affected packages on a web page with missing proper Content Security Policy configuration; initializing the editor on an element and using an element other than `<textarea>` as a base; and destroying the editor instance. This vulnerability might affect a small percentage of integrators that depend on dynamic editor initialization/destroy mechanism.  A fix is available in CKEditor4 version 4.21.0. In some rare cases, a security fix may be considered a breaking change. Starting from version 4.21.0, the Iframe Dialog plugin applies the `sandbox` attribute by default, which restricts JavaScript code execution in the iframe element. To change this behavior, configure the `config.iframe_attributes` option. Also starting from version 4.21.0, the Media Embed plugin regenerates the entire content of the embed widget by default. To change this behavior, configure the `config.embed_keepOriginalContent` option. Those who choose to enable either of the more permissive options or who cannot upgrade to a patched version should properly configure Content Security Policy to avoid any potential security issues that may arise from embedding iframe elements on their web page.","debianbug":1034481,"scope":"local","releases":{"bookworm":{"status":"open","repositories":{"bookworm":"4.19.1+dfsg-1"},"urgency":"not yet assigned","nodsa":"Minor issue","nodsa_reason":""},"bullseye":{"status":"open","repositories":{"bullseye":"4.16.0+dfsg-2"},"urgency":"not yet assigned","nodsa":"Minor issue","nodsa_reason":""},"sid":{"status":"resolved","repositories":{"sid":"4.22.1+dfsg1-2"},"fixed_version":"4.22.1+dfsg-1","urgency":"not yet assigned"}}},"CVE-2023-4771":{"description":"A Cross-Site scripting vulnerability has been found in CKSource CKEditor affecting versions 4.15.1 and earlier. An attacker could send malicious javascript code through the /ckeditor/samples/old/ajax.html file and retrieve an authorized user's information.","scope":"local","releases":{"bookworm":{"status":"open","repositories":{"bookworm":"4.19.1+dfsg-1"},"urgency":"unimportant"},"bullseye":{"status":"open","repositories":{"bullseye":"4.16.0+dfsg-2"},"urgency":"unimportant"},"sid":{"status":"open","repositories":{"sid":"4.22.1+dfsg1-2"},"urgency":"unimportant"}}},"CVE-2024-24815":{"description":"CKEditor4 is an open source what-you-see-is-what-you-get HTML editor. A cross-site scripting vulnerability has been discovered in the core HTML parsing module in versions of CKEditor4 prior to 4.24.0-lts. It may affect all editor instances that enabled full-page editing mode or enabled CDATA elements in Advanced Content Filtering configuration (defaults to `script` and `style` elements). The vulnerability allows attackers to inject malformed HTML content bypassing Advanced Content Filtering mechanism, which could result in executing JavaScript code. An attacker could abuse faulty CDATA content detection and use it to prepare an intentional attack on the editor. A fix is available in version 4.24.0-lts.","debianbug":1063536,"scope":"local","releases":{"bookworm":{"status":"open","repositories":{"bookworm":"4.19.1+dfsg-1"},"urgency":"not yet assigned","nodsa":"Minor issue","nodsa_reason":""},"bullseye":{"status":"open","repositories":{"bullseye":"4.16.0+dfsg-2"},"urgency":"not yet assigned","nodsa":"Minor issue","nodsa_reason":""},"sid":{"status":"open","repositories":{"sid":"4.22.1+dfsg1-2"},"urgency":"not yet assigned"}}},"CVE-2024-24816":{"description":"CKEditor4 is an open source what-you-see-is-what-you-get HTML editor. A cross-site scripting vulnerability vulnerability has been discovered in versions prior to 4.24.0-lts in samples that use the `preview` feature. All integrators that use these samples in the production code can be affected. The vulnerability allows an attacker to execute JavaScript code by abusing the misconfigured preview feature. It affects all users using the CKEditor 4 at version < 4.24.0-lts with affected samples used in a production environment. A fix is available in version 4.24.0-lts.","debianbug":1063536,"scope":"local","releases":{"bookworm":{"status":"open","repositories":{"bookworm":"4.19.1+dfsg-1"},"urgency":"not yet assigned","nodsa":"Minor issue, only affects shipped example files","nodsa_reason":"ignored"},"bullseye":{"status":"open","repositories":{"bullseye":"4.16.0+dfsg-2"},"urgency":"not yet assigned","nodsa":"Minor issue","nodsa_reason":""},"sid":{"status":"open","repositories":{"sid":"4.22.1+dfsg1-2"},"urgency":"not yet assigned"}}},"CVE-2024-43407":{"description":"CKEditor4 is an open source what-you-see-is-what-you-get HTML editor. A potential vulnerability has been discovered in CKEditor 4 Code Snippet GeSHi plugin. The vulnerability allowed a reflected XSS attack by exploiting a flaw in the GeSHi syntax highlighter library hosted by the victim. The GeSHi library was included as a vendor dependency in CKEditor 4 source files. In a specific scenario, an attacker could craft a malicious script that could be executed by sending a request to the GeSHi library hosted on a PHP web server. The GeSHi library is no longer actively maintained. Due to the lack of ongoing support and updates, potential security vulnerabilities have been identified with its continued use. To mitigate these risks and enhance the overall security of the CKEditor 4, we have decided to completely remove the GeSHi library as a dependency. This change aims to maintain a secure environment and reduce the risk of any security incidents related to outdated or unsupported software. The fix is be available in version 4.25.0-lts.","debianbug":1083192,"scope":"local","releases":{"bookworm":{"status":"open","repositories":{"bookworm":"4.19.1+dfsg-1"},"urgency":"not yet assigned","nodsa":"Minor issue","nodsa_reason":""},"bullseye":{"status":"open","repositories":{"bullseye":"4.16.0+dfsg-2"},"urgency":"not yet assigned","nodsa":"Minor issue","nodsa_reason":"postponed"},"sid":{"status":"open","repositories":{"sid":"4.22.1+dfsg1-2"},"urgency":"not yet assigned"}}},"CVE-2024-43411":{"description":"CKEditor4 is an open source what-you-see-is-what-you-get HTML editor. A theoretical vulnerability has been identified in CKEditor 4.22 (and above). In a highly unlikely scenario where an attacker gains control over the https://cke4.ckeditor.com domain, they could potentially execute an attack on CKEditor 4 instances. The issue impacts only editor instances with enabled version notifications. Please note that this feature is disabled by default in all CKEditor 4 LTS versions. Therefore, if you use CKEditor 4 LTS, it is highly unlikely that you are affected by this vulnerability. If you are unsure, please contact us. The fix is available in version 4.25.0-lts.","scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"4.19.1+dfsg-1"},"fixed_version":"0","urgency":"unimportant"},"bullseye":{"status":"resolved","repositories":{"bullseye":"4.16.0+dfsg-2"},"fixed_version":"0","urgency":"unimportant"},"sid":{"status":"open","repositories":{"sid":"4.22.1+dfsg1-2"},"urgency":"unimportant"}}},"CVE-2024-45613":{"description":"CKEditor 5 is a JavaScript rich-text editor. Starting in version 40.0.0 and prior to version 43.1.1, a Cross-Site Scripting (XSS) vulnerability is present in the CKEditor 5 clipboard package. This vulnerability could be triggered by a specific user action, leading to unauthorized JavaScript code execution, if the attacker managed to insert a malicious content into the editor, which might happen with a very specific editor configuration. This vulnerability only affects installations where the Block Toolbar plugin is enabled and either the General HTML Support (with a configuration that permits unsafe markup) or the HTML Embed plugin is also enabled. A fix for the problem is available in version 43.1.1. As a workaround, one may disable the block toolbar plugin.","scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"4.19.1+dfsg-1"},"fixed_version":"0","urgency":"unimportant"},"bullseye":{"status":"resolved","repositories":{"bullseye":"4.16.0+dfsg-2"},"fixed_version":"0","urgency":"unimportant"},"sid":{"status":"resolved","repositories":{"sid":"4.22.1+dfsg1-2"},"fixed_version":"0","urgency":"unimportant"}}},"CVE-2025-25299":{"description":"CKEditor 5 is a modern JavaScript rich-text editor with an MVC architecture. During a recent internal audit, a Cross-Site Scripting (XSS) vulnerability was discovered in the CKEditor 5 real-time collaboration package. This vulnerability affects user markers, which represent users' positions within the document. It can lead to unauthorized JavaScript code execution, which might happen with a very specific editor and token endpoint configuration. This vulnerability affects only installations with Real-time collaborative editing enabled. The problem has been recognized and patched. The fix is available in version 44.2.1 (and above). Users are advised to upgrade. There are no known workarounds for this vulnerability.","scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"4.19.1+dfsg-1"},"fixed_version":"0","urgency":"unimportant"},"bullseye":{"status":"resolved","repositories":{"bullseye":"4.16.0+dfsg-2"},"fixed_version":"0","urgency":"unimportant"},"sid":{"status":"resolved","repositories":{"sid":"4.22.1+dfsg1-2"},"fixed_version":"0","urgency":"unimportant"}}}},"ckeditor3":{"CVE-2014-5191":{"description":"Cross-site scripting (XSS) vulnerability in the Preview plugin before 4.4.3 in CKEditor allows remote attackers to inject arbitrary web script or HTML via unspecified vectors.","debianbug":1015217,"scope":"local","releases":{"bookworm":{"status":"open","repositories":{"bookworm":"3.6.6.1+dfsg-7"},"urgency":"not yet assigned","nodsa":"Minor issue, only used by Horde editor","nodsa_reason":"ignored"},"bullseye":{"status":"open","repositories":{"bullseye":"3.6.6.1+dfsg-7"},"urgency":"not yet assigned","nodsa":"Minor issue","nodsa_reason":""}}},"CVE-2018-17960":{"description":"CKEditor 4.x before 4.11.0 allows user-assisted XSS involving a source-mode paste.","debianbug":1015217,"scope":"local","releases":{"bookworm":{"status":"open","repositories":{"bookworm":"3.6.6.1+dfsg-7"},"urgency":"unimportant"},"bullseye":{"status":"open","repositories":{"bullseye":"3.6.6.1+dfsg-7"},"urgency":"unimportant"}}},"CVE-2021-26271":{"description":"It was possible to execute a ReDoS-type attack inside CKEditor 4 before 4.16 by persuading a victim to paste crafted text into the Styles input of specific dialogs (in the Advanced Tab for Dialogs plugin).","scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"3.6.6.1+dfsg-7"},"fixed_version":"0","urgency":"unimportant"},"bullseye":{"status":"resolved","repositories":{"bullseye":"3.6.6.1+dfsg-7"},"fixed_version":"0","urgency":"unimportant"}}},"CVE-2021-26272":{"description":"It was possible to execute a ReDoS-type attack inside CKEditor 4 before 4.16 by persuading a victim to paste crafted URL-like text into the editor, and then press Enter or Space (in the Autolink plugin).","scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"3.6.6.1+dfsg-7"},"fixed_version":"0","urgency":"unimportant"},"bullseye":{"status":"resolved","repositories":{"bullseye":"3.6.6.1+dfsg-7"},"fixed_version":"0","urgency":"unimportant"}}},"CVE-2021-33829":{"description":"A cross-site scripting (XSS) vulnerability in the HTML Data Processor in CKEditor 4 4.14.0 through 4.16.x before 4.16.1 allows remote attackers to inject executable JavaScript code through a crafted comment because --!> is mishandled.","debianbug":1015217,"scope":"local","releases":{"bookworm":{"status":"open","repositories":{"bookworm":"3.6.6.1+dfsg-7"},"urgency":"not yet assigned","nodsa":"Minor issue, only used by Horde editor","nodsa_reason":"ignored"},"bullseye":{"status":"open","repositories":{"bullseye":"3.6.6.1+dfsg-7"},"urgency":"not yet assigned","nodsa":"Minor issue","nodsa_reason":""}}},"CVE-2021-37695":{"description":"ckeditor is an open source WYSIWYG HTML editor with rich content support. A potential vulnerability has been discovered in CKEditor 4 [Fake Objects](https://ckeditor.com/cke4/addon/fakeobjects) package. The vulnerability allowed to inject malformed Fake Objects HTML, which could result in executing JavaScript code. It affects all users using the CKEditor 4 plugins listed above at version < 4.16.2. The problem has been recognized and patched. The fix will be available in version 4.16.2.","scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"3.6.6.1+dfsg-7"},"fixed_version":"0","urgency":"unimportant"},"bullseye":{"status":"resolved","repositories":{"bullseye":"3.6.6.1+dfsg-7"},"fixed_version":"0","urgency":"unimportant"}}},"CVE-2021-41164":{"description":"CKEditor4 is an open source WYSIWYG HTML editor. In affected versions a vulnerability has been discovered in the Advanced Content Filter (ACF) module and may affect all plugins used by CKEditor 4. The vulnerability allowed to inject malformed HTML bypassing content sanitization, which could result in executing JavaScript code. It affects all users using the CKEditor 4 at version < 4.17.0. The problem has been recognized and patched. The fix will be available in version 4.17.0.","scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"3.6.6.1+dfsg-7"},"fixed_version":"0","urgency":"unimportant"},"bullseye":{"status":"resolved","repositories":{"bullseye":"3.6.6.1+dfsg-7"},"fixed_version":"0","urgency":"unimportant"}}},"CVE-2021-41165":{"description":"CKEditor4 is an open source WYSIWYG HTML editor. In affected version a vulnerability has been discovered in the core HTML processing module and may affect all plugins used by CKEditor 4. The vulnerability allowed to inject malformed comments HTML bypassing content sanitization, which could result in executing JavaScript code. It affects all users using the CKEditor 4 at version < 4.17.0. The problem has been recognized and patched. The fix will be available in version 4.17.0.","debianbug":1015217,"scope":"local","releases":{"bookworm":{"status":"open","repositories":{"bookworm":"3.6.6.1+dfsg-7"},"urgency":"not yet assigned","nodsa":"Minor issue, only used by Horde editor","nodsa_reason":"ignored"},"bullseye":{"status":"open","repositories":{"bullseye":"3.6.6.1+dfsg-7"},"urgency":"not yet assigned","nodsa":"Minor issue","nodsa_reason":""}}},"CVE-2022-24728":{"description":"CKEditor4 is an open source what-you-see-is-what-you-get HTML editor. A vulnerability has been discovered in the core HTML processing module and may affect all plugins used by CKEditor 4 prior to version 4.18.0. The vulnerability allows someone to inject malformed HTML bypassing content sanitization, which could result in executing JavaScript code. This problem has been patched in version 4.18.0. There are currently no known workarounds.","debianbug":1015217,"scope":"local","releases":{"bookworm":{"status":"open","repositories":{"bookworm":"3.6.6.1+dfsg-7"},"urgency":"not yet assigned","nodsa":"Minor issue, only used by Horde editor","nodsa_reason":"ignored"},"bullseye":{"status":"open","repositories":{"bullseye":"3.6.6.1+dfsg-7"},"urgency":"not yet assigned","nodsa":"Minor issue","nodsa_reason":""}}},"CVE-2022-24729":{"description":"CKEditor4 is an open source what-you-see-is-what-you-get HTML editor. CKEditor4 prior to version 4.18.0 contains a vulnerability in the `dialog` plugin. The vulnerability allows abuse of a dialog input validator regular expression, which can cause a significant performance drop resulting in a browser tab freeze. A patch is available in version 4.18.0. There are currently no known workarounds.","scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"3.6.6.1+dfsg-7"},"fixed_version":"0","urgency":"unimportant"},"bullseye":{"status":"resolved","repositories":{"bullseye":"3.6.6.1+dfsg-7"},"fixed_version":"0","urgency":"unimportant"}}},"CVE-2023-28439":{"description":"CKEditor4 is an open source what-you-see-is-what-you-get HTML editor. A cross-site scripting vulnerability has been discovered affecting Iframe Dialog and Media Embed packages. The vulnerability may trigger a JavaScript code after fulfilling special conditions: using one of the affected packages on a web page with missing proper Content Security Policy configuration; initializing the editor on an element and using an element other than `<textarea>` as a base; and destroying the editor instance. This vulnerability might affect a small percentage of integrators that depend on dynamic editor initialization/destroy mechanism.  A fix is available in CKEditor4 version 4.21.0. In some rare cases, a security fix may be considered a breaking change. Starting from version 4.21.0, the Iframe Dialog plugin applies the `sandbox` attribute by default, which restricts JavaScript code execution in the iframe element. To change this behavior, configure the `config.iframe_attributes` option. Also starting from version 4.21.0, the Media Embed plugin regenerates the entire content of the embed widget by default. To change this behavior, configure the `config.embed_keepOriginalContent` option. Those who choose to enable either of the more permissive options or who cannot upgrade to a patched version should properly configure Content Security Policy to avoid any potential security issues that may arise from embedding iframe elements on their web page.","debianbug":1059301,"scope":"local","releases":{"bookworm":{"status":"open","repositories":{"bookworm":"3.6.6.1+dfsg-7"},"urgency":"not yet assigned","nodsa":"Minor issue, only used by Horde editor","nodsa_reason":"ignored"},"bullseye":{"status":"open","repositories":{"bullseye":"3.6.6.1+dfsg-7"},"urgency":"not yet assigned","nodsa":"Minor issue","nodsa_reason":""}}},"CVE-2024-24815":{"description":"CKEditor4 is an open source what-you-see-is-what-you-get HTML editor. A cross-site scripting vulnerability has been discovered in the core HTML parsing module in versions of CKEditor4 prior to 4.24.0-lts. It may affect all editor instances that enabled full-page editing mode or enabled CDATA elements in Advanced Content Filtering configuration (defaults to `script` and `style` elements). The vulnerability allows attackers to inject malformed HTML content bypassing Advanced Content Filtering mechanism, which could result in executing JavaScript code. An attacker could abuse faulty CDATA content detection and use it to prepare an intentional attack on the editor. A fix is available in version 4.24.0-lts.","debianbug":1063537,"scope":"local","releases":{"bookworm":{"status":"open","repositories":{"bookworm":"3.6.6.1+dfsg-7"},"urgency":"not yet assigned","nodsa":"Minor issue, only used by Horde editor","nodsa_reason":"ignored"},"bullseye":{"status":"open","repositories":{"bullseye":"3.6.6.1+dfsg-7"},"urgency":"not yet assigned","nodsa":"Minor issue","nodsa_reason":""}}},"CVE-2024-24816":{"description":"CKEditor4 is an open source what-you-see-is-what-you-get HTML editor. A cross-site scripting vulnerability vulnerability has been discovered in versions prior to 4.24.0-lts in samples that use the `preview` feature. All integrators that use these samples in the production code can be affected. The vulnerability allows an attacker to execute JavaScript code by abusing the misconfigured preview feature. It affects all users using the CKEditor 4 at version < 4.24.0-lts with affected samples used in a production environment. A fix is available in version 4.24.0-lts.","debianbug":1063537,"scope":"local","releases":{"bookworm":{"status":"open","repositories":{"bookworm":"3.6.6.1+dfsg-7"},"urgency":"unimportant","nodsa":"Minor issue","nodsa_reason":""},"bullseye":{"status":"open","repositories":{"bullseye":"3.6.6.1+dfsg-7"},"urgency":"unimportant","nodsa":"Minor issue","nodsa_reason":""}}},"CVE-2024-45613":{"description":"CKEditor 5 is a JavaScript rich-text editor. Starting in version 40.0.0 and prior to version 43.1.1, a Cross-Site Scripting (XSS) vulnerability is present in the CKEditor 5 clipboard package. This vulnerability could be triggered by a specific user action, leading to unauthorized JavaScript code execution, if the attacker managed to insert a malicious content into the editor, which might happen with a very specific editor configuration. This vulnerability only affects installations where the Block Toolbar plugin is enabled and either the General HTML Support (with a configuration that permits unsafe markup) or the HTML Embed plugin is also enabled. A fix for the problem is available in version 43.1.1. As a workaround, one may disable the block toolbar plugin.","scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"3.6.6.1+dfsg-7"},"fixed_version":"0","urgency":"unimportant"},"bullseye":{"status":"resolved","repositories":{"bullseye":"3.6.6.1+dfsg-7"},"fixed_version":"0","urgency":"unimportant"}}}},"ckermit":{"CVE-2025-68920":{"description":"C-Kermit (aka ckermit) through 10.0 Beta.12 (aka 416-beta12) before 244644d allows a remote Kermit system to overwrite files on the local system, or retrieve arbitrary files from the local system.","debianbug":1123025,"scope":"local","releases":{"bookworm":{"status":"open","repositories":{"bookworm":"402~beta08-1"},"urgency":"not yet assigned","nodsa":"Minor issue; documented; can be fixed via point release","nodsa_reason":""},"bullseye":{"status":"open","repositories":{"bullseye":"305~alpha02-1"},"urgency":"not yet assigned","nodsa":"Minor issue; documented","nodsa_reason":"postponed"},"forky":{"status":"resolved","repositories":{"forky":"416~beta12-5"},"fixed_version":"416~beta12-5","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"416~beta12-5"},"fixed_version":"416~beta12-5","urgency":"not yet assigned"},"trixie":{"status":"open","repositories":{"trixie":"416~beta12-1"},"urgency":"not yet assigned","nodsa":"Minor issue; documented; can be fixed via point release","nodsa_reason":"","next_point_update":true}}}},"clamav":{"CVE-2003-0946":{"description":"Format string vulnerability in clamav-milter for Clam AntiVirus 0.60 through 0.60p, and other versions before 0.65, allows remote attackers to cause a denial of service and possibly execute arbitrary code via format string specifiers in the email address argument of a \"MAIL FROM\" command.","scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"1.4.3+dfsg-1~deb12u2"},"fixed_version":"0.65","urgency":"not yet assigned"},"bullseye":{"status":"resolved","repositories":{"bullseye":"0.103.10+dfsg-0+deb11u1","bullseye-security":"1.4.3+dfsg-1~deb11u1"},"fixed_version":"0.65","urgency":"not yet assigned"},"forky":{"status":"resolved","repositories":{"forky":"1.4.3+dfsg-2"},"fixed_version":"0.65","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"1.4.3+dfsg-2"},"fixed_version":"0.65","urgency":"not yet assigned"},"trixie":{"status":"resolved","repositories":{"trixie":"1.4.3+dfsg-1"},"fixed_version":"0.65","urgency":"not yet assigned"}}},"CVE-2004-0270":{"description":"libclamav in Clam AntiVirus 0.65 allows remote attackers to cause a denial of service (crash) via a uuencoded e-mail message with an invalid line length (e.g., a lowercase character), which causes an assert error in clamd that terminates the calling program.","scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"1.4.3+dfsg-1~deb12u2"},"fixed_version":"0.80","urgency":"not yet assigned"},"bullseye":{"status":"resolved","repositories":{"bullseye":"0.103.10+dfsg-0+deb11u1","bullseye-security":"1.4.3+dfsg-1~deb11u1"},"fixed_version":"0.80","urgency":"not yet assigned"},"forky":{"status":"resolved","repositories":{"forky":"1.4.3+dfsg-2"},"fixed_version":"0.80","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"1.4.3+dfsg-2"},"fixed_version":"0.80","urgency":"not yet assigned"},"trixie":{"status":"resolved","repositories":{"trixie":"1.4.3+dfsg-1"},"fixed_version":"0.80","urgency":"not yet assigned"}}},"CVE-2004-1876":{"description":"The \"%f\" feature in the VirusEvent directive in Clam AntiVirus daemon (clamd) before 0.70 allows local users to execute arbitrary commands via shell metacharacters in a file name.","scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"1.4.3+dfsg-1~deb12u2"},"fixed_version":"0.70-1","urgency":"not yet assigned"},"bullseye":{"status":"resolved","repositories":{"bullseye":"0.103.10+dfsg-0+deb11u1","bullseye-security":"1.4.3+dfsg-1~deb11u1"},"fixed_version":"0.70-1","urgency":"not yet assigned"},"forky":{"status":"resolved","repositories":{"forky":"1.4.3+dfsg-2"},"fixed_version":"0.70-1","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"1.4.3+dfsg-2"},"fixed_version":"0.70-1","urgency":"not yet assigned"},"trixie":{"status":"resolved","repositories":{"trixie":"1.4.3+dfsg-1"},"fixed_version":"0.70-1","urgency":"not yet assigned"}}},"CVE-2004-1909":{"description":"Claim Anti-Virus (ClamAV) 0.68 and earlier allows remote attackers to cause a denial of service (crash) via certain RAR archives, such as those generated by the Beagle/Bagle worm.","scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"1.4.3+dfsg-1~deb12u2"},"fixed_version":"0.68.1","urgency":"not yet assigned"},"bullseye":{"status":"resolved","repositories":{"bullseye":"0.103.10+dfsg-0+deb11u1","bullseye-security":"1.4.3+dfsg-1~deb11u1"},"fixed_version":"0.68.1","urgency":"not yet assigned"},"forky":{"status":"resolved","repositories":{"forky":"1.4.3+dfsg-2"},"fixed_version":"0.68.1","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"1.4.3+dfsg-2"},"fixed_version":"0.68.1","urgency":"not yet assigned"},"trixie":{"status":"resolved","repositories":{"trixie":"1.4.3+dfsg-1"},"fixed_version":"0.68.1","urgency":"not yet assigned"}}},"CVE-2005-0133":{"description":"ClamAV 0.80 and earlier allows remote attackers to cause a denial of service (clamd daemon crash) via a ZIP file with malformed headers.","scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"1.4.3+dfsg-1~deb12u2"},"fixed_version":"0.80-0.81rc1-1","urgency":"not yet assigned"},"bullseye":{"status":"resolved","repositories":{"bullseye":"0.103.10+dfsg-0+deb11u1","bullseye-security":"1.4.3+dfsg-1~deb11u1"},"fixed_version":"0.80-0.81rc1-1","urgency":"not yet assigned"},"forky":{"status":"resolved","repositories":{"forky":"1.4.3+dfsg-2"},"fixed_version":"0.80-0.81rc1-1","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"1.4.3+dfsg-2"},"fixed_version":"0.80-0.81rc1-1","urgency":"not yet assigned"},"trixie":{"status":"resolved","repositories":{"trixie":"1.4.3+dfsg-1"},"fixed_version":"0.80-0.81rc1-1","urgency":"not yet assigned"}}},"CVE-2005-0218":{"description":"ClamAV 0.80 and earlier allows remote attackers to bypass virus scanning via a base64 encoded image in a data: (RFC 2397) URL.","scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"1.4.3+dfsg-1~deb12u2"},"fixed_version":"0.81","urgency":"not yet assigned"},"bullseye":{"status":"resolved","repositories":{"bullseye":"0.103.10+dfsg-0+deb11u1","bullseye-security":"1.4.3+dfsg-1~deb11u1"},"fixed_version":"0.81","urgency":"not yet assigned"},"forky":{"status":"resolved","repositories":{"forky":"1.4.3+dfsg-2"},"fixed_version":"0.81","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"1.4.3+dfsg-2"},"fixed_version":"0.81","urgency":"not yet assigned"},"trixie":{"status":"resolved","repositories":{"trixie":"1.4.3+dfsg-1"},"fixed_version":"0.81","urgency":"not yet assigned"}}},"CVE-2005-1922":{"description":"The MS-Expand file handling in Clam AntiVirus (ClamAV) before 0.86 allows remote attackers to cause a denial of service (file descriptor and memory consumption) via a crafted file that causes repeated errors in the cli_msexpand function.","scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"1.4.3+dfsg-1~deb12u2"},"fixed_version":"0.86.1-1","urgency":"low"},"bullseye":{"status":"resolved","repositories":{"bullseye":"0.103.10+dfsg-0+deb11u1","bullseye-security":"1.4.3+dfsg-1~deb11u1"},"fixed_version":"0.86.1-1","urgency":"low"},"forky":{"status":"resolved","repositories":{"forky":"1.4.3+dfsg-2"},"fixed_version":"0.86.1-1","urgency":"low"},"sid":{"status":"resolved","repositories":{"sid":"1.4.3+dfsg-2"},"fixed_version":"0.86.1-1","urgency":"low"},"trixie":{"status":"resolved","repositories":{"trixie":"1.4.3+dfsg-1"},"fixed_version":"0.86.1-1","urgency":"low"}}},"CVE-2005-1923":{"description":"The ENSURE_BITS macro in mszipd.c for Clam AntiVirus (ClamAV) 0.83, and other versions vefore 0.86, allows remote attackers to cause a denial of service (CPU consumption by infinite loop) via a cabinet (CAB) file with the cffile_FolderOffset field set to 0xff, which causes a zero-length read.","debianbug":316401,"scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"1.4.3+dfsg-1~deb12u2"},"fixed_version":"0.86.1","urgency":"medium"},"bullseye":{"status":"resolved","repositories":{"bullseye":"0.103.10+dfsg-0+deb11u1","bullseye-security":"1.4.3+dfsg-1~deb11u1"},"fixed_version":"0.86.1","urgency":"medium"},"forky":{"status":"resolved","repositories":{"forky":"1.4.3+dfsg-2"},"fixed_version":"0.86.1","urgency":"medium"},"sid":{"status":"resolved","repositories":{"sid":"1.4.3+dfsg-2"},"fixed_version":"0.86.1","urgency":"medium"},"trixie":{"status":"resolved","repositories":{"trixie":"1.4.3+dfsg-1"},"fixed_version":"0.86.1","urgency":"medium"}}},"CVE-2005-2056":{"description":"The Quantum archive decompressor in Clam AntiVirus (ClamAV) before 0.86.1 allows remote attackers to cause a denial of service (application crash) via a crafted Quantum archive.","debianbug":318756,"scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"1.4.3+dfsg-1~deb12u2"},"fixed_version":"0.86.1-1","urgency":"medium"},"bullseye":{"status":"resolved","repositories":{"bullseye":"0.103.10+dfsg-0+deb11u1","bullseye-security":"1.4.3+dfsg-1~deb11u1"},"fixed_version":"0.86.1-1","urgency":"medium"},"forky":{"status":"resolved","repositories":{"forky":"1.4.3+dfsg-2"},"fixed_version":"0.86.1-1","urgency":"medium"},"sid":{"status":"resolved","repositories":{"sid":"1.4.3+dfsg-2"},"fixed_version":"0.86.1-1","urgency":"medium"},"trixie":{"status":"resolved","repositories":{"trixie":"1.4.3+dfsg-1"},"fixed_version":"0.86.1-1","urgency":"medium"}}},"CVE-2005-2070":{"description":"The ClamAV Mail fILTER (clamav-milter) 0.84 through 0.85d, when used in Sendmail using long timeouts, allows remote attackers to cause a denial of service by keeping an open connection, which prevents ClamAV from reloading.","debianbug":318755,"scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"1.4.3+dfsg-1~deb12u2"},"fixed_version":"0.86.1","urgency":"medium"},"bullseye":{"status":"resolved","repositories":{"bullseye":"0.103.10+dfsg-0+deb11u1","bullseye-security":"1.4.3+dfsg-1~deb11u1"},"fixed_version":"0.86.1","urgency":"medium"},"forky":{"status":"resolved","repositories":{"forky":"1.4.3+dfsg-2"},"fixed_version":"0.86.1","urgency":"medium"},"sid":{"status":"resolved","repositories":{"sid":"1.4.3+dfsg-2"},"fixed_version":"0.86.1","urgency":"medium"},"trixie":{"status":"resolved","repositories":{"trixie":"1.4.3+dfsg-1"},"fixed_version":"0.86.1","urgency":"medium"}}},"CVE-2005-2450":{"description":"Multiple integer overflows in the (1) TNEF, (2) CHM, or (3) FSG file format processors in libclamav for Clam AntiVirus (ClamAV) 0.86.1 and earlier allow remote attackers to gain privileges via a crafted e-mail message.","scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"1.4.3+dfsg-1~deb12u2"},"fixed_version":"0.86.2-1","urgency":"medium"},"bullseye":{"status":"resolved","repositories":{"bullseye":"0.103.10+dfsg-0+deb11u1","bullseye-security":"1.4.3+dfsg-1~deb11u1"},"fixed_version":"0.86.2-1","urgency":"medium"},"forky":{"status":"resolved","repositories":{"forky":"1.4.3+dfsg-2"},"fixed_version":"0.86.2-1","urgency":"medium"},"sid":{"status":"resolved","repositories":{"sid":"1.4.3+dfsg-2"},"fixed_version":"0.86.2-1","urgency":"medium"},"trixie":{"status":"resolved","repositories":{"trixie":"1.4.3+dfsg-1"},"fixed_version":"0.86.2-1","urgency":"medium"}}},"CVE-2005-2919":{"description":"libclamav/fsg.c in Clam AntiVirus (ClamAV) before 0.87 allows remote attackers to cause a denial of service (infinite loop) via a crafted FSG packed executable.","debianbug":328660,"scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"1.4.3+dfsg-1~deb12u2"},"fixed_version":"0.87-1","urgency":"medium"},"bullseye":{"status":"resolved","repositories":{"bullseye":"0.103.10+dfsg-0+deb11u1","bullseye-security":"1.4.3+dfsg-1~deb11u1"},"fixed_version":"0.87-1","urgency":"medium"},"forky":{"status":"resolved","repositories":{"forky":"1.4.3+dfsg-2"},"fixed_version":"0.87-1","urgency":"medium"},"sid":{"status":"resolved","repositories":{"sid":"1.4.3+dfsg-2"},"fixed_version":"0.87-1","urgency":"medium"},"trixie":{"status":"resolved","repositories":{"trixie":"1.4.3+dfsg-1"},"fixed_version":"0.87-1","urgency":"medium"}}},"CVE-2005-2920":{"description":"Buffer overflow in libclamav/upx.c in Clam AntiVirus (ClamAV) before 0.87 allows remote attackers to execute arbitrary code via a crafted UPX packed executable.","debianbug":328660,"scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"1.4.3+dfsg-1~deb12u2"},"fixed_version":"0.87-1","urgency":"medium"},"bullseye":{"status":"resolved","repositories":{"bullseye":"0.103.10+dfsg-0+deb11u1","bullseye-security":"1.4.3+dfsg-1~deb11u1"},"fixed_version":"0.87-1","urgency":"medium"},"forky":{"status":"resolved","repositories":{"forky":"1.4.3+dfsg-2"},"fixed_version":"0.87-1","urgency":"medium"},"sid":{"status":"resolved","repositories":{"sid":"1.4.3+dfsg-2"},"fixed_version":"0.87-1","urgency":"medium"},"trixie":{"status":"resolved","repositories":{"trixie":"1.4.3+dfsg-1"},"fixed_version":"0.87-1","urgency":"medium"}}},"CVE-2005-3229":{"description":"Multiple interpretation error in unspecified versions of ClamAV Antivirus allows remote attackers to bypass virus detection via a malicious executable in a specially crafted RAR file with malformed central and local headers, which can still be opened by products such as Winrar and PowerZip, even though they are rejected as corrupted by Winzip and BitZipper.","scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"1.4.3+dfsg-1~deb12u2"},"fixed_version":"0","urgency":"unimportant"},"bullseye":{"status":"resolved","repositories":{"bullseye":"0.103.10+dfsg-0+deb11u1","bullseye-security":"1.4.3+dfsg-1~deb11u1"},"fixed_version":"0","urgency":"unimportant"},"forky":{"status":"resolved","repositories":{"forky":"1.4.3+dfsg-2"},"fixed_version":"0","urgency":"unimportant"},"sid":{"status":"resolved","repositories":{"sid":"1.4.3+dfsg-2"},"fixed_version":"0","urgency":"unimportant"},"trixie":{"status":"resolved","repositories":{"trixie":"1.4.3+dfsg-1"},"fixed_version":"0","urgency":"unimportant"}}},"CVE-2005-3239":{"description":"The OLE2 unpacker in clamd in Clam AntiVirus (ClamAV) 0.87-1 allows remote attackers to cause a denial of service (segmentation fault) via a DOC file with an invalid property tree, which triggers an infinite recursion in the ole2_walk_property_tree function.","debianbug":333566,"scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"1.4.3+dfsg-1~deb12u2"},"fixed_version":"0.87.1-1","urgency":"medium"},"bullseye":{"status":"resolved","repositories":{"bullseye":"0.103.10+dfsg-0+deb11u1","bullseye-security":"1.4.3+dfsg-1~deb11u1"},"fixed_version":"0.87.1-1","urgency":"medium"},"forky":{"status":"resolved","repositories":{"forky":"1.4.3+dfsg-2"},"fixed_version":"0.87.1-1","urgency":"medium"},"sid":{"status":"resolved","repositories":{"sid":"1.4.3+dfsg-2"},"fixed_version":"0.87.1-1","urgency":"medium"},"trixie":{"status":"resolved","repositories":{"trixie":"1.4.3+dfsg-1"},"fixed_version":"0.87.1-1","urgency":"medium"}}},"CVE-2005-3303":{"description":"The FSG unpacker (fsg.c) in Clam AntiVirus (ClamAV) 0.80 through 0.87 allows remote attackers to cause \"memory corruption\" and execute arbitrary code via a crafted FSG 1.33 file.","scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"1.4.3+dfsg-1~deb12u2"},"fixed_version":"0.87.1-1","urgency":"high"},"bullseye":{"status":"resolved","repositories":{"bullseye":"0.103.10+dfsg-0+deb11u1","bullseye-security":"1.4.3+dfsg-1~deb11u1"},"fixed_version":"0.87.1-1","urgency":"high"},"forky":{"status":"resolved","repositories":{"forky":"1.4.3+dfsg-2"},"fixed_version":"0.87.1-1","urgency":"high"},"sid":{"status":"resolved","repositories":{"sid":"1.4.3+dfsg-2"},"fixed_version":"0.87.1-1","urgency":"high"},"trixie":{"status":"resolved","repositories":{"trixie":"1.4.3+dfsg-1"},"fixed_version":"0.87.1-1","urgency":"high"}}},"CVE-2005-3500":{"description":"The tnef_attachment function in tnef.c for Clam AntiVirus (ClamAV) before 0.87.1 allows remote attackers to cause a denial of service (infinite loop and memory exhaustion) via a crafted value in a CAB file that causes ClamAV to repeatedly scan the same block.","scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"1.4.3+dfsg-1~deb12u2"},"fixed_version":"0.87.1-1","urgency":"medium"},"bullseye":{"status":"resolved","repositories":{"bullseye":"0.103.10+dfsg-0+deb11u1","bullseye-security":"1.4.3+dfsg-1~deb11u1"},"fixed_version":"0.87.1-1","urgency":"medium"},"forky":{"status":"resolved","repositories":{"forky":"1.4.3+dfsg-2"},"fixed_version":"0.87.1-1","urgency":"medium"},"sid":{"status":"resolved","repositories":{"sid":"1.4.3+dfsg-2"},"fixed_version":"0.87.1-1","urgency":"medium"},"trixie":{"status":"resolved","repositories":{"trixie":"1.4.3+dfsg-1"},"fixed_version":"0.87.1-1","urgency":"medium"}}},"CVE-2005-3501":{"description":"The cabd_find function in cabd.c of the libmspack library (mspack) for Clam AntiVirus (ClamAV) before 0.87.1 allows remote attackers to cause a denial of service (infinite loop) via a crafted CAB file that causes cabd_find to be called with a zero length.","scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"1.4.3+dfsg-1~deb12u2"},"fixed_version":"0.87.1-1","urgency":"medium"},"bullseye":{"status":"resolved","repositories":{"bullseye":"0.103.10+dfsg-0+deb11u1","bullseye-security":"1.4.3+dfsg-1~deb11u1"},"fixed_version":"0.87.1-1","urgency":"medium"},"forky":{"status":"resolved","repositories":{"forky":"1.4.3+dfsg-2"},"fixed_version":"0.87.1-1","urgency":"medium"},"sid":{"status":"resolved","repositories":{"sid":"1.4.3+dfsg-2"},"fixed_version":"0.87.1-1","urgency":"medium"},"trixie":{"status":"resolved","repositories":{"trixie":"1.4.3+dfsg-1"},"fixed_version":"0.87.1-1","urgency":"medium"}}},"CVE-2005-3587":{"description":"Improper boundary checks in petite.c in Clam AntiVirus (ClamAV) before 0.87.1 allows attackers to perform unknown attacks via unknown vectors.","scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"1.4.3+dfsg-1~deb12u2"},"fixed_version":"0.87.1-1","urgency":"medium"},"bullseye":{"status":"resolved","repositories":{"bullseye":"0.103.10+dfsg-0+deb11u1","bullseye-security":"1.4.3+dfsg-1~deb11u1"},"fixed_version":"0.87.1-1","urgency":"medium"},"forky":{"status":"resolved","repositories":{"forky":"1.4.3+dfsg-2"},"fixed_version":"0.87.1-1","urgency":"medium"},"sid":{"status":"resolved","repositories":{"sid":"1.4.3+dfsg-2"},"fixed_version":"0.87.1-1","urgency":"medium"},"trixie":{"status":"resolved","repositories":{"trixie":"1.4.3+dfsg-1"},"fixed_version":"0.87.1-1","urgency":"medium"}}},"CVE-2006-0162":{"description":"Heap-based buffer overflow in libclamav/upx.c in Clam Antivirus (ClamAV) before 0.88 allows remote attackers to cause a denial of service (crash) and possibly execute arbitrary code via crafted UPX files.","scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"1.4.3+dfsg-1~deb12u2"},"fixed_version":"0.88-1","urgency":"not yet assigned"},"bullseye":{"status":"resolved","repositories":{"bullseye":"0.103.10+dfsg-0+deb11u1","bullseye-security":"1.4.3+dfsg-1~deb11u1"},"fixed_version":"0.88-1","urgency":"not yet assigned"},"forky":{"status":"resolved","repositories":{"forky":"1.4.3+dfsg-2"},"fixed_version":"0.88-1","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"1.4.3+dfsg-2"},"fixed_version":"0.88-1","urgency":"not yet assigned"},"trixie":{"status":"resolved","repositories":{"trixie":"1.4.3+dfsg-1"},"fixed_version":"0.88-1","urgency":"not yet assigned"}}},"CVE-2006-1614":{"description":"Integer overflow in the cli_scanpe function in the PE header parser (libclamav/pe.c) in Clam AntiVirus (ClamAV) before 0.88.1, when ArchiveMaxFileSize is disabled, allows remote attackers to cause a denial of service and possibly execute arbitrary code.","scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"1.4.3+dfsg-1~deb12u2"},"fixed_version":"0.88.1-1","urgency":"not yet assigned"},"bullseye":{"status":"resolved","repositories":{"bullseye":"0.103.10+dfsg-0+deb11u1","bullseye-security":"1.4.3+dfsg-1~deb11u1"},"fixed_version":"0.88.1-1","urgency":"not yet assigned"},"forky":{"status":"resolved","repositories":{"forky":"1.4.3+dfsg-2"},"fixed_version":"0.88.1-1","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"1.4.3+dfsg-2"},"fixed_version":"0.88.1-1","urgency":"not yet assigned"},"trixie":{"status":"resolved","repositories":{"trixie":"1.4.3+dfsg-1"},"fixed_version":"0.88.1-1","urgency":"not yet assigned"}}},"CVE-2006-1615":{"description":"Multiple format string vulnerabilities in the logging code in Clam AntiVirus (ClamAV) before 0.88.1 might allow remote attackers to execute arbitrary code.  NOTE: as of 20060410, it is unclear whether this is a vulnerability, as there is some evidence that the arguments are actually being sanitized properly.","scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"1.4.3+dfsg-1~deb12u2"},"fixed_version":"0.88.1-1","urgency":"not yet assigned"},"bullseye":{"status":"resolved","repositories":{"bullseye":"0.103.10+dfsg-0+deb11u1","bullseye-security":"1.4.3+dfsg-1~deb11u1"},"fixed_version":"0.88.1-1","urgency":"not yet assigned"},"forky":{"status":"resolved","repositories":{"forky":"1.4.3+dfsg-2"},"fixed_version":"0.88.1-1","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"1.4.3+dfsg-2"},"fixed_version":"0.88.1-1","urgency":"not yet assigned"},"trixie":{"status":"resolved","repositories":{"trixie":"1.4.3+dfsg-1"},"fixed_version":"0.88.1-1","urgency":"not yet assigned"}}},"CVE-2006-1630":{"description":"The cli_bitset_set function in libclamav/others.c in Clam AntiVirus (ClamAV) before 0.88.1 allows remote attackers to cause a denial of service via unspecified vectors that trigger an \"invalid memory access.\"","scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"1.4.3+dfsg-1~deb12u2"},"fixed_version":"0.88.1-1","urgency":"not yet assigned"},"bullseye":{"status":"resolved","repositories":{"bullseye":"0.103.10+dfsg-0+deb11u1","bullseye-security":"1.4.3+dfsg-1~deb11u1"},"fixed_version":"0.88.1-1","urgency":"not yet assigned"},"forky":{"status":"resolved","repositories":{"forky":"1.4.3+dfsg-2"},"fixed_version":"0.88.1-1","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"1.4.3+dfsg-2"},"fixed_version":"0.88.1-1","urgency":"not yet assigned"},"trixie":{"status":"resolved","repositories":{"trixie":"1.4.3+dfsg-1"},"fixed_version":"0.88.1-1","urgency":"not yet assigned"}}},"CVE-2006-1989":{"description":"Buffer overflow in the get_database function in the HTTP client in Freshclam in ClamAV 0.80 to 0.88.1 might allow remote web servers to execute arbitrary code via long HTTP headers.","scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"1.4.3+dfsg-1~deb12u2"},"fixed_version":"0.88.2","urgency":"not yet assigned"},"bullseye":{"status":"resolved","repositories":{"bullseye":"0.103.10+dfsg-0+deb11u1","bullseye-security":"1.4.3+dfsg-1~deb11u1"},"fixed_version":"0.88.2","urgency":"not yet assigned"},"forky":{"status":"resolved","repositories":{"forky":"1.4.3+dfsg-2"},"fixed_version":"0.88.2","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"1.4.3+dfsg-2"},"fixed_version":"0.88.2","urgency":"not yet assigned"},"trixie":{"status":"resolved","repositories":{"trixie":"1.4.3+dfsg-1"},"fixed_version":"0.88.2","urgency":"not yet assigned"}}},"CVE-2006-2427":{"description":"freshclam in (1) Clam Antivirus (ClamAV) 0.88 and (2) ClamXav 1.0.3h and earlier does not drop privileges before processing the config-file command line option, which allows local users to read portions of arbitrary files when an error message displays the first line of the target file.","scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"1.4.3+dfsg-1~deb12u2"},"fixed_version":"0","urgency":"unimportant"},"bullseye":{"status":"resolved","repositories":{"bullseye":"0.103.10+dfsg-0+deb11u1","bullseye-security":"1.4.3+dfsg-1~deb11u1"},"fixed_version":"0","urgency":"unimportant"},"forky":{"status":"resolved","repositories":{"forky":"1.4.3+dfsg-2"},"fixed_version":"0","urgency":"unimportant"},"sid":{"status":"resolved","repositories":{"sid":"1.4.3+dfsg-2"},"fixed_version":"0","urgency":"unimportant"},"trixie":{"status":"resolved","repositories":{"trixie":"1.4.3+dfsg-1"},"fixed_version":"0","urgency":"unimportant"}}},"CVE-2006-4018":{"description":"Heap-based buffer overflow in the pefromupx function in libclamav/upx.c in Clam AntiVirus (ClamAV) 0.81 through 0.88.3 allows remote attackers to execute arbitrary code via a crafted UPX packed file containing sections with large rsize values.","debianbug":382004,"scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"1.4.3+dfsg-1~deb12u2"},"fixed_version":"0.88.4-1","urgency":"high"},"bullseye":{"status":"resolved","repositories":{"bullseye":"0.103.10+dfsg-0+deb11u1","bullseye-security":"1.4.3+dfsg-1~deb11u1"},"fixed_version":"0.88.4-1","urgency":"high"},"forky":{"status":"resolved","repositories":{"forky":"1.4.3+dfsg-2"},"fixed_version":"0.88.4-1","urgency":"high"},"sid":{"status":"resolved","repositories":{"sid":"1.4.3+dfsg-2"},"fixed_version":"0.88.4-1","urgency":"high"},"trixie":{"status":"resolved","repositories":{"trixie":"1.4.3+dfsg-1"},"fixed_version":"0.88.4-1","urgency":"high"}}},"CVE-2006-4182":{"description":"Integer overflow in ClamAV 0.88.1 and 0.88.4, and other versions before 0.88.5, allows remote attackers to cause a denial of service (scanning service crash) and execute arbitrary code via a crafted Portable Executable (PE) file that leads to a heap-based buffer overflow when less memory is allocated than expected.","debianbug":393445,"scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"1.4.3+dfsg-1~deb12u2"},"fixed_version":"0.88.5-1","urgency":"high"},"bullseye":{"status":"resolved","repositories":{"bullseye":"0.103.10+dfsg-0+deb11u1","bullseye-security":"1.4.3+dfsg-1~deb11u1"},"fixed_version":"0.88.5-1","urgency":"high"},"forky":{"status":"resolved","repositories":{"forky":"1.4.3+dfsg-2"},"fixed_version":"0.88.5-1","urgency":"high"},"sid":{"status":"resolved","repositories":{"sid":"1.4.3+dfsg-2"},"fixed_version":"0.88.5-1","urgency":"high"},"trixie":{"status":"resolved","repositories":{"trixie":"1.4.3+dfsg-1"},"fixed_version":"0.88.5-1","urgency":"high"}}},"CVE-2006-5295":{"description":"Unspecified vulnerability in ClamAV before 0.88.5 allows remote attackers to cause a denial of service (scanning service crash) via a crafted Compressed HTML Help (CHM) file that causes ClamAV to \"read an invalid memory location.\"","debianbug":393445,"scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"1.4.3+dfsg-1~deb12u2"},"fixed_version":"0.88.5-1","urgency":"high"},"bullseye":{"status":"resolved","repositories":{"bullseye":"0.103.10+dfsg-0+deb11u1","bullseye-security":"1.4.3+dfsg-1~deb11u1"},"fixed_version":"0.88.5-1","urgency":"high"},"forky":{"status":"resolved","repositories":{"forky":"1.4.3+dfsg-2"},"fixed_version":"0.88.5-1","urgency":"high"},"sid":{"status":"resolved","repositories":{"sid":"1.4.3+dfsg-2"},"fixed_version":"0.88.5-1","urgency":"high"},"trixie":{"status":"resolved","repositories":{"trixie":"1.4.3+dfsg-1"},"fixed_version":"0.88.5-1","urgency":"high"}}},"CVE-2006-5874":{"description":"Clam AntiVirus (ClamAV) 0.88 and earlier allows remote attackers to cause a denial of service (crash) via a malformed base64-encoded MIME attachment that triggers a null pointer dereference.","scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"1.4.3+dfsg-1~deb12u2"},"fixed_version":"0.86-1","urgency":"not yet assigned"},"bullseye":{"status":"resolved","repositories":{"bullseye":"0.103.10+dfsg-0+deb11u1","bullseye-security":"1.4.3+dfsg-1~deb11u1"},"fixed_version":"0.86-1","urgency":"not yet assigned"},"forky":{"status":"resolved","repositories":{"forky":"1.4.3+dfsg-2"},"fixed_version":"0.86-1","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"1.4.3+dfsg-2"},"fixed_version":"0.86-1","urgency":"not yet assigned"},"trixie":{"status":"resolved","repositories":{"trixie":"1.4.3+dfsg-1"},"fixed_version":"0.86-1","urgency":"not yet assigned"}}},"CVE-2006-6406":{"description":"Clam AntiVirus (ClamAV) 0.88.6 allows remote attackers to bypass virus detection by inserting invalid characters into base64 encoded content in a multipart/mixed MIME file, as demonstrated with the EICAR test file.","debianbug":401873,"scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"1.4.3+dfsg-1~deb12u2"},"fixed_version":"0.88.7-1","urgency":"medium"},"bullseye":{"status":"resolved","repositories":{"bullseye":"0.103.10+dfsg-0+deb11u1","bullseye-security":"1.4.3+dfsg-1~deb11u1"},"fixed_version":"0.88.7-1","urgency":"medium"},"forky":{"status":"resolved","repositories":{"forky":"1.4.3+dfsg-2"},"fixed_version":"0.88.7-1","urgency":"medium"},"sid":{"status":"resolved","repositories":{"sid":"1.4.3+dfsg-2"},"fixed_version":"0.88.7-1","urgency":"medium"},"trixie":{"status":"resolved","repositories":{"trixie":"1.4.3+dfsg-1"},"fixed_version":"0.88.7-1","urgency":"medium"}}},"CVE-2006-6481":{"description":"Clam AntiVirus (ClamAV) 0.88.6 allows remote attackers to cause a denial of service (stack overflow and application crash) by wrapping many layers of multipart/mixed content around a document, a different vulnerability than CVE-2006-5874 and CVE-2006-6406.","debianbug":401874,"scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"1.4.3+dfsg-1~deb12u2"},"fixed_version":"0.88.7-1","urgency":"low"},"bullseye":{"status":"resolved","repositories":{"bullseye":"0.103.10+dfsg-0+deb11u1","bullseye-security":"1.4.3+dfsg-1~deb11u1"},"fixed_version":"0.88.7-1","urgency":"low"},"forky":{"status":"resolved","repositories":{"forky":"1.4.3+dfsg-2"},"fixed_version":"0.88.7-1","urgency":"low"},"sid":{"status":"resolved","repositories":{"sid":"1.4.3+dfsg-2"},"fixed_version":"0.88.7-1","urgency":"low"},"trixie":{"status":"resolved","repositories":{"trixie":"1.4.3+dfsg-1"},"fixed_version":"0.88.7-1","urgency":"low"}}},"CVE-2007-0897":{"description":"Clam AntiVirus ClamAV before 0.90 does not close open file descriptors under certain conditions, which allows remote attackers to cause a denial of service (file descriptor consumption and failed scans) via CAB archives with a cabinet header record length of zero, which causes a function to return without closing a file descriptor.","debianbug":411118,"scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"1.4.3+dfsg-1~deb12u2"},"fixed_version":"0.90-1","urgency":"not yet assigned"},"bullseye":{"status":"resolved","repositories":{"bullseye":"0.103.10+dfsg-0+deb11u1","bullseye-security":"1.4.3+dfsg-1~deb11u1"},"fixed_version":"0.90-1","urgency":"not yet assigned"},"forky":{"status":"resolved","repositories":{"forky":"1.4.3+dfsg-2"},"fixed_version":"0.90-1","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"1.4.3+dfsg-2"},"fixed_version":"0.90-1","urgency":"not yet assigned"},"trixie":{"status":"resolved","repositories":{"trixie":"1.4.3+dfsg-1"},"fixed_version":"0.90-1","urgency":"not yet assigned"}}},"CVE-2007-0898":{"description":"Directory traversal vulnerability in clamd in Clam AntiVirus ClamAV before 0.90 allows remote attackers to overwrite arbitrary files via a .. (dot dot) in the id MIME header parameter in a multi-part message.","debianbug":411117,"scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"1.4.3+dfsg-1~deb12u2"},"fixed_version":"0.90-1","urgency":"not yet assigned"},"bullseye":{"status":"resolved","repositories":{"bullseye":"0.103.10+dfsg-0+deb11u1","bullseye-security":"1.4.3+dfsg-1~deb11u1"},"fixed_version":"0.90-1","urgency":"not yet assigned"},"forky":{"status":"resolved","repositories":{"forky":"1.4.3+dfsg-2"},"fixed_version":"0.90-1","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"1.4.3+dfsg-2"},"fixed_version":"0.90-1","urgency":"not yet assigned"},"trixie":{"status":"resolved","repositories":{"trixie":"1.4.3+dfsg-1"},"fixed_version":"0.90-1","urgency":"not yet assigned"}}},"CVE-2007-0899":{"description":"There is a possible heap overflow in libclamav/fsg.c before 0.100.0.","scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"1.4.3+dfsg-1~deb12u2"},"fixed_version":"0.90-1","urgency":"not yet assigned"},"bullseye":{"status":"resolved","repositories":{"bullseye":"0.103.10+dfsg-0+deb11u1","bullseye-security":"1.4.3+dfsg-1~deb11u1"},"fixed_version":"0.90-1","urgency":"not yet assigned"},"forky":{"status":"resolved","repositories":{"forky":"1.4.3+dfsg-2"},"fixed_version":"0.90-1","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"1.4.3+dfsg-2"},"fixed_version":"0.90-1","urgency":"not yet assigned"},"trixie":{"status":"resolved","repositories":{"trixie":"1.4.3+dfsg-1"},"fixed_version":"0.90-1","urgency":"not yet assigned"}}},"CVE-2007-1745":{"description":"The chm_decompress_stream function in libclamav/chmunpack.c in Clam AntiVirus (ClamAV) before 0.90.2 leaks file descriptors, which has unknown impact and attack vectors involving a crafted CHM file, a different vulnerability than CVE-2007-0897.  NOTE: some of these details are obtained from third party information.","scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"1.4.3+dfsg-1~deb12u2"},"fixed_version":"0.90.2-1","urgency":"high"},"bullseye":{"status":"resolved","repositories":{"bullseye":"0.103.10+dfsg-0+deb11u1","bullseye-security":"1.4.3+dfsg-1~deb11u1"},"fixed_version":"0.90.2-1","urgency":"high"},"forky":{"status":"resolved","repositories":{"forky":"1.4.3+dfsg-2"},"fixed_version":"0.90.2-1","urgency":"high"},"sid":{"status":"resolved","repositories":{"sid":"1.4.3+dfsg-2"},"fixed_version":"0.90.2-1","urgency":"high"},"trixie":{"status":"resolved","repositories":{"trixie":"1.4.3+dfsg-1"},"fixed_version":"0.90.2-1","urgency":"high"}}},"CVE-2007-1997":{"description":"Integer signedness error in the (1) cab_unstore and (2) cab_extract functions in libclamav/cab.c in Clam AntiVirus (ClamAV) before 0.90.2 allow remote attackers to execute arbitrary code via a crafted CHM file that contains a negative integer, which passes a signed comparison and leads to a stack-based buffer overflow.","scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"1.4.3+dfsg-1~deb12u2"},"fixed_version":"0.90.2-1","urgency":"high"},"bullseye":{"status":"resolved","repositories":{"bullseye":"0.103.10+dfsg-0+deb11u1","bullseye-security":"1.4.3+dfsg-1~deb11u1"},"fixed_version":"0.90.2-1","urgency":"high"},"forky":{"status":"resolved","repositories":{"forky":"1.4.3+dfsg-2"},"fixed_version":"0.90.2-1","urgency":"high"},"sid":{"status":"resolved","repositories":{"sid":"1.4.3+dfsg-2"},"fixed_version":"0.90.2-1","urgency":"high"},"trixie":{"status":"resolved","repositories":{"trixie":"1.4.3+dfsg-1"},"fixed_version":"0.90.2-1","urgency":"high"}}},"CVE-2007-2029":{"description":"File descriptor leak in the PDF handler in Clam AntiVirus (ClamAV) allows remote attackers to cause a denial of service via a crafted PDF file.","debianbug":418849,"scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"1.4.3+dfsg-1~deb12u2"},"fixed_version":"0.90.2-1","urgency":"low"},"bullseye":{"status":"resolved","repositories":{"bullseye":"0.103.10+dfsg-0+deb11u1","bullseye-security":"1.4.3+dfsg-1~deb11u1"},"fixed_version":"0.90.2-1","urgency":"low"},"forky":{"status":"resolved","repositories":{"forky":"1.4.3+dfsg-2"},"fixed_version":"0.90.2-1","urgency":"low"},"sid":{"status":"resolved","repositories":{"sid":"1.4.3+dfsg-2"},"fixed_version":"0.90.2-1","urgency":"low"},"trixie":{"status":"resolved","repositories":{"trixie":"1.4.3+dfsg-1"},"fixed_version":"0.90.2-1","urgency":"low"}}},"CVE-2007-2650":{"description":"The OLE2 parser in Clam AntiVirus (ClamAV) allows remote attackers to cause a denial of service (resource consumption) via an OLE2 file with (1) a large property size or (2) a loop in the FAT file block chain that triggers an infinite loop, as demonstrated via a crafted DOC file.","scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"1.4.3+dfsg-1~deb12u2"},"fixed_version":"0.90.2-1","urgency":"not yet assigned"},"bullseye":{"status":"resolved","repositories":{"bullseye":"0.103.10+dfsg-0+deb11u1","bullseye-security":"1.4.3+dfsg-1~deb11u1"},"fixed_version":"0.90.2-1","urgency":"not yet assigned"},"forky":{"status":"resolved","repositories":{"forky":"1.4.3+dfsg-2"},"fixed_version":"0.90.2-1","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"1.4.3+dfsg-2"},"fixed_version":"0.90.2-1","urgency":"not yet assigned"},"trixie":{"status":"resolved","repositories":{"trixie":"1.4.3+dfsg-1"},"fixed_version":"0.90.2-1","urgency":"not yet assigned"}}},"CVE-2007-3023":{"description":"unsp.c in ClamAV before 0.90.3 and 0.91 before 0.91rc1 does not properly calculate the end of a certain buffer, with unknown impact and remote attack vectors.","scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"1.4.3+dfsg-1~deb12u2"},"fixed_version":"0.90.3-1","urgency":"not yet assigned"},"bullseye":{"status":"resolved","repositories":{"bullseye":"0.103.10+dfsg-0+deb11u1","bullseye-security":"1.4.3+dfsg-1~deb11u1"},"fixed_version":"0.90.3-1","urgency":"not yet assigned"},"forky":{"status":"resolved","repositories":{"forky":"1.4.3+dfsg-2"},"fixed_version":"0.90.3-1","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"1.4.3+dfsg-2"},"fixed_version":"0.90.3-1","urgency":"not yet assigned"},"trixie":{"status":"resolved","repositories":{"trixie":"1.4.3+dfsg-1"},"fixed_version":"0.90.3-1","urgency":"not yet assigned"}}},"CVE-2007-3024":{"description":"libclamav/others.c in ClamAV before 0.90.3 and 0.91 before 0.91rc1 uses insecure permissions for temporary files that are created by the cli_gentempstream function in clamd/clamdscan, which might allow local users to read sensitive files.","scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"1.4.3+dfsg-1~deb12u2"},"fixed_version":"0.90.3-1","urgency":"not yet assigned"},"bullseye":{"status":"resolved","repositories":{"bullseye":"0.103.10+dfsg-0+deb11u1","bullseye-security":"1.4.3+dfsg-1~deb11u1"},"fixed_version":"0.90.3-1","urgency":"not yet assigned"},"forky":{"status":"resolved","repositories":{"forky":"1.4.3+dfsg-2"},"fixed_version":"0.90.3-1","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"1.4.3+dfsg-2"},"fixed_version":"0.90.3-1","urgency":"not yet assigned"},"trixie":{"status":"resolved","repositories":{"trixie":"1.4.3+dfsg-1"},"fixed_version":"0.90.3-1","urgency":"not yet assigned"}}},"CVE-2007-3025":{"description":"Unspecified vulnerability in libclamav/phishcheck.c in ClamAV before 0.90.3 and 0.91 before 0.91rc1, when running on Solaris, allows remote attackers to cause a denial of service (hang) via unknown vectors related to the isURL function and regular expressions.","scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"1.4.3+dfsg-1~deb12u2"},"fixed_version":"0","urgency":"unimportant"},"bullseye":{"status":"resolved","repositories":{"bullseye":"0.103.10+dfsg-0+deb11u1","bullseye-security":"1.4.3+dfsg-1~deb11u1"},"fixed_version":"0","urgency":"unimportant"},"forky":{"status":"resolved","repositories":{"forky":"1.4.3+dfsg-2"},"fixed_version":"0","urgency":"unimportant"},"sid":{"status":"resolved","repositories":{"sid":"1.4.3+dfsg-2"},"fixed_version":"0","urgency":"unimportant"},"trixie":{"status":"resolved","repositories":{"trixie":"1.4.3+dfsg-1"},"fixed_version":"0","urgency":"unimportant"}}},"CVE-2007-3122":{"description":"The parsing engine in ClamAV before 0.90.3 and 0.91 before 0.91rc1 allows remote attackers to bypass scanning via a RAR file with a header flag value of 10, which can be processed by WinRAR.","scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"1.4.3+dfsg-1~deb12u2"},"fixed_version":"0.90.3-1","urgency":"not yet assigned"},"bullseye":{"status":"resolved","repositories":{"bullseye":"0.103.10+dfsg-0+deb11u1","bullseye-security":"1.4.3+dfsg-1~deb11u1"},"fixed_version":"0.90.3-1","urgency":"not yet assigned"},"forky":{"status":"resolved","repositories":{"forky":"1.4.3+dfsg-2"},"fixed_version":"0.90.3-1","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"1.4.3+dfsg-2"},"fixed_version":"0.90.3-1","urgency":"not yet assigned"},"trixie":{"status":"resolved","repositories":{"trixie":"1.4.3+dfsg-1"},"fixed_version":"0.90.3-1","urgency":"not yet assigned"}}},"CVE-2007-3123":{"description":"unrar.c in libclamav in ClamAV before 0.90.3 and 0.91 before 0.91rc1 allows remote attackers to cause a denial of service (core dump) via a crafted RAR file with a modified vm_codesize value, which triggers a heap-based buffer overflow.","scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"1.4.3+dfsg-1~deb12u2"},"fixed_version":"0.90.3-1","urgency":"not yet assigned"},"bullseye":{"status":"resolved","repositories":{"bullseye":"0.103.10+dfsg-0+deb11u1","bullseye-security":"1.4.3+dfsg-1~deb11u1"},"fixed_version":"0.90.3-1","urgency":"not yet assigned"},"forky":{"status":"resolved","repositories":{"forky":"1.4.3+dfsg-2"},"fixed_version":"0.90.3-1","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"1.4.3+dfsg-2"},"fixed_version":"0.90.3-1","urgency":"not yet assigned"},"trixie":{"status":"resolved","repositories":{"trixie":"1.4.3+dfsg-1"},"fixed_version":"0.90.3-1","urgency":"not yet assigned"}}},"CVE-2007-3725":{"description":"The RAR VM (unrarvm.c) in Clam Antivirus (ClamAV) before 0.91 allows user-assisted remote attackers to cause a denial of service (crash) via a crafted RAR archive, resulting in a NULL pointer dereference.","scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"1.4.3+dfsg-1~deb12u2"},"fixed_version":"0.91-1","urgency":"not yet assigned"},"bullseye":{"status":"resolved","repositories":{"bullseye":"0.103.10+dfsg-0+deb11u1","bullseye-security":"1.4.3+dfsg-1~deb11u1"},"fixed_version":"0.91-1","urgency":"not yet assigned"},"forky":{"status":"resolved","repositories":{"forky":"1.4.3+dfsg-2"},"fixed_version":"0.91-1","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"1.4.3+dfsg-2"},"fixed_version":"0.91-1","urgency":"not yet assigned"},"trixie":{"status":"resolved","repositories":{"trixie":"1.4.3+dfsg-1"},"fixed_version":"0.91-1","urgency":"not yet assigned"}}},"CVE-2007-4510":{"description":"ClamAV before 0.91.2, as used in Kolab Server 2.0 through 2.2beta1 and other products, allows remote attackers to cause a denial of service (application crash) via (1) a crafted RTF file, which triggers a NULL dereference in the cli_scanrtf function in libclamav/rtf.c; or (2) a crafted HTML document with a data: URI, which triggers a NULL dereference in the cli_html_normalise function in libclamav/htmlnorm.c.  NOTE: some of these details are obtained from third party information.","scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"1.4.3+dfsg-1~deb12u2"},"fixed_version":"0.91.2-1~volatile1","urgency":"not yet assigned"},"bullseye":{"status":"resolved","repositories":{"bullseye":"0.103.10+dfsg-0+deb11u1","bullseye-security":"1.4.3+dfsg-1~deb11u1"},"fixed_version":"0.91.2-1~volatile1","urgency":"not yet assigned"},"forky":{"status":"resolved","repositories":{"forky":"1.4.3+dfsg-2"},"fixed_version":"0.91.2-1~volatile1","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"1.4.3+dfsg-2"},"fixed_version":"0.91.2-1~volatile1","urgency":"not yet assigned"},"trixie":{"status":"resolved","repositories":{"trixie":"1.4.3+dfsg-1"},"fixed_version":"0.91.2-1~volatile1","urgency":"not yet assigned"}}},"CVE-2007-4560":{"description":"clamav-milter in ClamAV before 0.91.2, when run in black hole mode, allows remote attackers to execute arbitrary commands via shell metacharacters that are used in a certain popen call, involving the \"recipient field of sendmail.\"","scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"1.4.3+dfsg-1~deb12u2"},"fixed_version":"0.91.2-1~volatile1","urgency":"high"},"bullseye":{"status":"resolved","repositories":{"bullseye":"0.103.10+dfsg-0+deb11u1","bullseye-security":"1.4.3+dfsg-1~deb11u1"},"fixed_version":"0.91.2-1~volatile1","urgency":"high"},"forky":{"status":"resolved","repositories":{"forky":"1.4.3+dfsg-2"},"fixed_version":"0.91.2-1~volatile1","urgency":"high"},"sid":{"status":"resolved","repositories":{"sid":"1.4.3+dfsg-2"},"fixed_version":"0.91.2-1~volatile1","urgency":"high"},"trixie":{"status":"resolved","repositories":{"trixie":"1.4.3+dfsg-1"},"fixed_version":"0.91.2-1~volatile1","urgency":"high"}}},"CVE-2007-6335":{"description":"Integer overflow in libclamav in ClamAV before 0.92 allows remote attackers to execute arbitrary code via a crafted MEW packed PE file, which triggers a heap-based buffer overflow.","scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"1.4.3+dfsg-1~deb12u2"},"fixed_version":"0.92~dfsg-1~volatile2","urgency":"not yet assigned"},"bullseye":{"status":"resolved","repositories":{"bullseye":"0.103.10+dfsg-0+deb11u1","bullseye-security":"1.4.3+dfsg-1~deb11u1"},"fixed_version":"0.92~dfsg-1~volatile2","urgency":"not yet assigned"},"forky":{"status":"resolved","repositories":{"forky":"1.4.3+dfsg-2"},"fixed_version":"0.92~dfsg-1~volatile2","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"1.4.3+dfsg-2"},"fixed_version":"0.92~dfsg-1~volatile2","urgency":"not yet assigned"},"trixie":{"status":"resolved","repositories":{"trixie":"1.4.3+dfsg-1"},"fixed_version":"0.92~dfsg-1~volatile2","urgency":"not yet assigned"}}},"CVE-2007-6336":{"description":"Off-by-one error in ClamAV before 0.92 allows remote attackers to execute arbitrary code via a crafted MS-ZIP compressed CAB file.","scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"1.4.3+dfsg-1~deb12u2"},"fixed_version":"0.92~dfsg-1~volatile2","urgency":"not yet assigned"},"bullseye":{"status":"resolved","repositories":{"bullseye":"0.103.10+dfsg-0+deb11u1","bullseye-security":"1.4.3+dfsg-1~deb11u1"},"fixed_version":"0.92~dfsg-1~volatile2","urgency":"not yet assigned"},"forky":{"status":"resolved","repositories":{"forky":"1.4.3+dfsg-2"},"fixed_version":"0.92~dfsg-1~volatile2","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"1.4.3+dfsg-2"},"fixed_version":"0.92~dfsg-1~volatile2","urgency":"not yet assigned"},"trixie":{"status":"resolved","repositories":{"trixie":"1.4.3+dfsg-1"},"fixed_version":"0.92~dfsg-1~volatile2","urgency":"not yet assigned"}}},"CVE-2007-6337":{"description":"Unspecified vulnerability in the bzip2 decompression algorithm in nsis/bzlib_private.h in ClamAV before 0.92 has unknown impact and remote attack vectors.","scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"1.4.3+dfsg-1~deb12u2"},"fixed_version":"0.92~dfsg-1~volatile2","urgency":"not yet assigned"},"bullseye":{"status":"resolved","repositories":{"bullseye":"0.103.10+dfsg-0+deb11u1","bullseye-security":"1.4.3+dfsg-1~deb11u1"},"fixed_version":"0.92~dfsg-1~volatile2","urgency":"not yet assigned"},"forky":{"status":"resolved","repositories":{"forky":"1.4.3+dfsg-2"},"fixed_version":"0.92~dfsg-1~volatile2","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"1.4.3+dfsg-2"},"fixed_version":"0.92~dfsg-1~volatile2","urgency":"not yet assigned"},"trixie":{"status":"resolved","repositories":{"trixie":"1.4.3+dfsg-1"},"fixed_version":"0.92~dfsg-1~volatile2","urgency":"not yet assigned"}}},"CVE-2007-6595":{"description":"ClamAV 0.92 allows local users to overwrite arbitrary files via a symlink attack on (1) temporary files used by the cli_gentempfd function in libclamav/others.c or on (2) .ascii files used by sigtool, when utf16-decode is enabled.","debianbug":458532,"scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"1.4.3+dfsg-1~deb12u2"},"fixed_version":"0.92.1~dfsg-1","urgency":"low"},"bullseye":{"status":"resolved","repositories":{"bullseye":"0.103.10+dfsg-0+deb11u1","bullseye-security":"1.4.3+dfsg-1~deb11u1"},"fixed_version":"0.92.1~dfsg-1","urgency":"low"},"forky":{"status":"resolved","repositories":{"forky":"1.4.3+dfsg-2"},"fixed_version":"0.92.1~dfsg-1","urgency":"low"},"sid":{"status":"resolved","repositories":{"sid":"1.4.3+dfsg-2"},"fixed_version":"0.92.1~dfsg-1","urgency":"low"},"trixie":{"status":"resolved","repositories":{"trixie":"1.4.3+dfsg-1"},"fixed_version":"0.92.1~dfsg-1","urgency":"low"}}},"CVE-2007-6596":{"description":"ClamAV 0.92 does not recognize Base64 UUEncoded archives, which allows remote attackers to bypass the scanner via a Base64-UUEncoded file.","debianbug":458532,"scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"1.4.3+dfsg-1~deb12u2"},"fixed_version":"0.92.1~dfsg-1","urgency":"unimportant"},"bullseye":{"status":"resolved","repositories":{"bullseye":"0.103.10+dfsg-0+deb11u1","bullseye-security":"1.4.3+dfsg-1~deb11u1"},"fixed_version":"0.92.1~dfsg-1","urgency":"unimportant"},"forky":{"status":"resolved","repositories":{"forky":"1.4.3+dfsg-2"},"fixed_version":"0.92.1~dfsg-1","urgency":"unimportant"},"sid":{"status":"resolved","repositories":{"sid":"1.4.3+dfsg-2"},"fixed_version":"0.92.1~dfsg-1","urgency":"unimportant"},"trixie":{"status":"resolved","repositories":{"trixie":"1.4.3+dfsg-1"},"fixed_version":"0.92.1~dfsg-1","urgency":"unimportant"}}},"CVE-2007-6745":{"description":"clamav 0.91.2 suffers from a floating point exception when using ScanOLE2.","scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"1.4.3+dfsg-1~deb12u2"},"fixed_version":"0.91.2-1~volatile1","urgency":"not yet assigned"},"bullseye":{"status":"resolved","repositories":{"bullseye":"0.103.10+dfsg-0+deb11u1","bullseye-security":"1.4.3+dfsg-1~deb11u1"},"fixed_version":"0.91.2-1~volatile1","urgency":"not yet assigned"},"forky":{"status":"resolved","repositories":{"forky":"1.4.3+dfsg-2"},"fixed_version":"0.91.2-1~volatile1","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"1.4.3+dfsg-2"},"fixed_version":"0.91.2-1~volatile1","urgency":"not yet assigned"},"trixie":{"status":"resolved","repositories":{"trixie":"1.4.3+dfsg-1"},"fixed_version":"0.91.2-1~volatile1","urgency":"not yet assigned"}}},"CVE-2008-0314":{"description":"Heap-based buffer overflow in spin.c in libclamav in ClamAV 0.92.1 allows remote attackers to execute arbitrary code via a crafted PeSpin packed PE binary with a modified length value.","scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"1.4.3+dfsg-1~deb12u2"},"fixed_version":"0.92.1~dfsg2-1","urgency":"medium"},"bullseye":{"status":"resolved","repositories":{"bullseye":"0.103.10+dfsg-0+deb11u1","bullseye-security":"1.4.3+dfsg-1~deb11u1"},"fixed_version":"0.92.1~dfsg2-1","urgency":"medium"},"forky":{"status":"resolved","repositories":{"forky":"1.4.3+dfsg-2"},"fixed_version":"0.92.1~dfsg2-1","urgency":"medium"},"sid":{"status":"resolved","repositories":{"sid":"1.4.3+dfsg-2"},"fixed_version":"0.92.1~dfsg2-1","urgency":"medium"},"trixie":{"status":"resolved","repositories":{"trixie":"1.4.3+dfsg-1"},"fixed_version":"0.92.1~dfsg2-1","urgency":"medium"}}},"CVE-2008-0318":{"description":"Integer overflow in the cli_scanpe function in libclamav in ClamAV before 0.92.1, as used in clamd, allows remote attackers to cause a denial of service and possibly execute arbitrary code via a crafted Petite packed PE file, which triggers a heap-based buffer overflow.","scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"1.4.3+dfsg-1~deb12u2"},"fixed_version":"0.92.1~dfsg-1","urgency":"medium"},"bullseye":{"status":"resolved","repositories":{"bullseye":"0.103.10+dfsg-0+deb11u1","bullseye-security":"1.4.3+dfsg-1~deb11u1"},"fixed_version":"0.92.1~dfsg-1","urgency":"medium"},"forky":{"status":"resolved","repositories":{"forky":"1.4.3+dfsg-2"},"fixed_version":"0.92.1~dfsg-1","urgency":"medium"},"sid":{"status":"resolved","repositories":{"sid":"1.4.3+dfsg-2"},"fixed_version":"0.92.1~dfsg-1","urgency":"medium"},"trixie":{"status":"resolved","repositories":{"trixie":"1.4.3+dfsg-1"},"fixed_version":"0.92.1~dfsg-1","urgency":"medium"}}},"CVE-2008-0728":{"description":"The unmew11 function in libclamav/mew.c in libclamav in ClamAV before 0.92.1 has unknown impact and attack vectors that trigger \"heap corruption.\"","scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"1.4.3+dfsg-1~deb12u2"},"fixed_version":"0.92.1~dfsg-1","urgency":"not yet assigned"},"bullseye":{"status":"resolved","repositories":{"bullseye":"0.103.10+dfsg-0+deb11u1","bullseye-security":"1.4.3+dfsg-1~deb11u1"},"fixed_version":"0.92.1~dfsg-1","urgency":"not yet assigned"},"forky":{"status":"resolved","repositories":{"forky":"1.4.3+dfsg-2"},"fixed_version":"0.92.1~dfsg-1","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"1.4.3+dfsg-2"},"fixed_version":"0.92.1~dfsg-1","urgency":"not yet assigned"},"trixie":{"status":"resolved","repositories":{"trixie":"1.4.3+dfsg-1"},"fixed_version":"0.92.1~dfsg-1","urgency":"not yet assigned"}}},"CVE-2008-1100":{"description":"Buffer overflow in the cli_scanpe function in libclamav (libclamav/pe.c) for ClamAV 0.92 and 0.92.1 allows remote attackers to execute arbitrary code via a crafted Upack PE file.","scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"1.4.3+dfsg-1~deb12u2"},"fixed_version":"0.92.1~dfsg2-1","urgency":"not yet assigned"},"bullseye":{"status":"resolved","repositories":{"bullseye":"0.103.10+dfsg-0+deb11u1","bullseye-security":"1.4.3+dfsg-1~deb11u1"},"fixed_version":"0.92.1~dfsg2-1","urgency":"not yet assigned"},"forky":{"status":"resolved","repositories":{"forky":"1.4.3+dfsg-2"},"fixed_version":"0.92.1~dfsg2-1","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"1.4.3+dfsg-2"},"fixed_version":"0.92.1~dfsg2-1","urgency":"not yet assigned"},"trixie":{"status":"resolved","repositories":{"trixie":"1.4.3+dfsg-1"},"fixed_version":"0.92.1~dfsg2-1","urgency":"not yet assigned"}}},"CVE-2008-1387":{"description":"ClamAV before 0.93 allows remote attackers to cause a denial of service (CPU consumption) via a crafted ARJ archive, as demonstrated by the PROTOS GENOME test suite for Archive Formats.","scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"1.4.3+dfsg-1~deb12u2"},"fixed_version":"0.92.1~dfsg2-1","urgency":"not yet assigned"},"bullseye":{"status":"resolved","repositories":{"bullseye":"0.103.10+dfsg-0+deb11u1","bullseye-security":"1.4.3+dfsg-1~deb11u1"},"fixed_version":"0.92.1~dfsg2-1","urgency":"not yet assigned"},"forky":{"status":"resolved","repositories":{"forky":"1.4.3+dfsg-2"},"fixed_version":"0.92.1~dfsg2-1","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"1.4.3+dfsg-2"},"fixed_version":"0.92.1~dfsg2-1","urgency":"not yet assigned"},"trixie":{"status":"resolved","repositories":{"trixie":"1.4.3+dfsg-1"},"fixed_version":"0.92.1~dfsg2-1","urgency":"not yet assigned"}}},"CVE-2008-1389":{"description":"libclamav/chmunpack.c in the chm-parser in ClamAV before 0.94 allows remote attackers to cause a denial of service (application crash) via a malformed CHM file, related to an \"invalid memory access.\"","scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"1.4.3+dfsg-1~deb12u2"},"fixed_version":"0.94.dfsg-1","urgency":"not yet assigned"},"bullseye":{"status":"resolved","repositories":{"bullseye":"0.103.10+dfsg-0+deb11u1","bullseye-security":"1.4.3+dfsg-1~deb11u1"},"fixed_version":"0.94.dfsg-1","urgency":"not yet assigned"},"forky":{"status":"resolved","repositories":{"forky":"1.4.3+dfsg-2"},"fixed_version":"0.94.dfsg-1","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"1.4.3+dfsg-2"},"fixed_version":"0.94.dfsg-1","urgency":"not yet assigned"},"trixie":{"status":"resolved","repositories":{"trixie":"1.4.3+dfsg-1"},"fixed_version":"0.94.dfsg-1","urgency":"not yet assigned"}}},"CVE-2008-1833":{"description":"Heap-based buffer overflow in pe.c in libclamav in ClamAV 0.92.1 allows remote attackers to execute arbitrary code via a crafted WWPack compressed PE binary.","debianbug":476694,"scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"1.4.3+dfsg-1~deb12u2"},"fixed_version":"0.92.1~dfsg2-1.1","urgency":"medium"},"bullseye":{"status":"resolved","repositories":{"bullseye":"0.103.10+dfsg-0+deb11u1","bullseye-security":"1.4.3+dfsg-1~deb11u1"},"fixed_version":"0.92.1~dfsg2-1.1","urgency":"medium"},"forky":{"status":"resolved","repositories":{"forky":"1.4.3+dfsg-2"},"fixed_version":"0.92.1~dfsg2-1.1","urgency":"medium"},"sid":{"status":"resolved","repositories":{"sid":"1.4.3+dfsg-2"},"fixed_version":"0.92.1~dfsg2-1.1","urgency":"medium"},"trixie":{"status":"resolved","repositories":{"trixie":"1.4.3+dfsg-1"},"fixed_version":"0.92.1~dfsg2-1.1","urgency":"medium"}}},"CVE-2008-1835":{"description":"ClamAV before 0.93 allows remote attackers to bypass the scanning enging via a RAR file with an invalid version number, which cannot be parsed by ClamAV but can be extracted by Winrar.","scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"1.4.3+dfsg-1~deb12u2"},"fixed_version":"0","urgency":"unimportant"},"bullseye":{"status":"resolved","repositories":{"bullseye":"0.103.10+dfsg-0+deb11u1","bullseye-security":"1.4.3+dfsg-1~deb11u1"},"fixed_version":"0","urgency":"unimportant"},"forky":{"status":"resolved","repositories":{"forky":"1.4.3+dfsg-2"},"fixed_version":"0","urgency":"unimportant"},"sid":{"status":"resolved","repositories":{"sid":"1.4.3+dfsg-2"},"fixed_version":"0","urgency":"unimportant"},"trixie":{"status":"resolved","repositories":{"trixie":"1.4.3+dfsg-1"},"fixed_version":"0","urgency":"unimportant"}}},"CVE-2008-1836":{"description":"The rfc2231 function in message.c in libclamav in ClamAV before 0.93 allows remote attackers to cause a denial of service (crash) via a crafted message that produces a string that is not null terminated, which triggers a buffer over-read.","scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"1.4.3+dfsg-1~deb12u2"},"fixed_version":"0","urgency":"unimportant"},"bullseye":{"status":"resolved","repositories":{"bullseye":"0.103.10+dfsg-0+deb11u1","bullseye-security":"1.4.3+dfsg-1~deb11u1"},"fixed_version":"0","urgency":"unimportant"},"forky":{"status":"resolved","repositories":{"forky":"1.4.3+dfsg-2"},"fixed_version":"0","urgency":"unimportant"},"sid":{"status":"resolved","repositories":{"sid":"1.4.3+dfsg-2"},"fixed_version":"0","urgency":"unimportant"},"trixie":{"status":"resolved","repositories":{"trixie":"1.4.3+dfsg-1"},"fixed_version":"0","urgency":"unimportant"}}},"CVE-2008-1837":{"description":"libclamunrar in ClamAV before 0.93 allows remote attackers to cause a denial of service (crash) via crafted RAR files that trigger \"memory problems,\" as demonstrated by the PROTOS GENOME test suite for Archive Formats.","scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"1.4.3+dfsg-1~deb12u2"},"fixed_version":"0","urgency":"unimportant"},"bullseye":{"status":"resolved","repositories":{"bullseye":"0.103.10+dfsg-0+deb11u1","bullseye-security":"1.4.3+dfsg-1~deb11u1"},"fixed_version":"0","urgency":"unimportant"},"forky":{"status":"resolved","repositories":{"forky":"1.4.3+dfsg-2"},"fixed_version":"0","urgency":"unimportant"},"sid":{"status":"resolved","repositories":{"sid":"1.4.3+dfsg-2"},"fixed_version":"0","urgency":"unimportant"},"trixie":{"status":"resolved","repositories":{"trixie":"1.4.3+dfsg-1"},"fixed_version":"0","urgency":"unimportant"}}},"CVE-2008-2713":{"description":"libclamav/petite.c in ClamAV before 0.93.1 allows remote attackers to cause a denial of service via a crafted Petite file that triggers an out-of-bounds read.","debianbug":490925,"scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"1.4.3+dfsg-1~deb12u2"},"fixed_version":"0.93.1.dfsg-1.1","urgency":"low"},"bullseye":{"status":"resolved","repositories":{"bullseye":"0.103.10+dfsg-0+deb11u1","bullseye-security":"1.4.3+dfsg-1~deb11u1"},"fixed_version":"0.93.1.dfsg-1.1","urgency":"low"},"forky":{"status":"resolved","repositories":{"forky":"1.4.3+dfsg-2"},"fixed_version":"0.93.1.dfsg-1.1","urgency":"low"},"sid":{"status":"resolved","repositories":{"sid":"1.4.3+dfsg-2"},"fixed_version":"0.93.1.dfsg-1.1","urgency":"low"},"trixie":{"status":"resolved","repositories":{"trixie":"1.4.3+dfsg-1"},"fixed_version":"0.93.1.dfsg-1.1","urgency":"low"}}},"CVE-2008-3215":{"description":"libclamav/petite.c in ClamAV before 0.93.3 allows remote attackers to cause a denial of service via a malformed Petite file that triggers an out-of-bounds memory access.  NOTE: this issue exists because of an incomplete fix for CVE-2008-2713.","scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"1.4.3+dfsg-1~deb12u2"},"fixed_version":"0.93.1.dfsg-1.1","urgency":"medium"},"bullseye":{"status":"resolved","repositories":{"bullseye":"0.103.10+dfsg-0+deb11u1","bullseye-security":"1.4.3+dfsg-1~deb11u1"},"fixed_version":"0.93.1.dfsg-1.1","urgency":"medium"},"forky":{"status":"resolved","repositories":{"forky":"1.4.3+dfsg-2"},"fixed_version":"0.93.1.dfsg-1.1","urgency":"medium"},"sid":{"status":"resolved","repositories":{"sid":"1.4.3+dfsg-2"},"fixed_version":"0.93.1.dfsg-1.1","urgency":"medium"},"trixie":{"status":"resolved","repositories":{"trixie":"1.4.3+dfsg-1"},"fixed_version":"0.93.1.dfsg-1.1","urgency":"medium"}}},"CVE-2008-3912":{"description":"libclamav in ClamAV before 0.94 allows attackers to cause a denial of service (NULL pointer dereference and application crash) via vectors related to an out-of-memory condition.","scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"1.4.3+dfsg-1~deb12u2"},"fixed_version":"0.94.dfsg-1","urgency":"not yet assigned"},"bullseye":{"status":"resolved","repositories":{"bullseye":"0.103.10+dfsg-0+deb11u1","bullseye-security":"1.4.3+dfsg-1~deb11u1"},"fixed_version":"0.94.dfsg-1","urgency":"not yet assigned"},"forky":{"status":"resolved","repositories":{"forky":"1.4.3+dfsg-2"},"fixed_version":"0.94.dfsg-1","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"1.4.3+dfsg-2"},"fixed_version":"0.94.dfsg-1","urgency":"not yet assigned"},"trixie":{"status":"resolved","repositories":{"trixie":"1.4.3+dfsg-1"},"fixed_version":"0.94.dfsg-1","urgency":"not yet assigned"}}},"CVE-2008-3913":{"description":"Multiple memory leaks in freshclam/manager.c in ClamAV before 0.94 might allow attackers to cause a denial of service (memory consumption) via unspecified vectors related to \"error handling logic\".","scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"1.4.3+dfsg-1~deb12u2"},"fixed_version":"0.94.dfsg-1","urgency":"not yet assigned"},"bullseye":{"status":"resolved","repositories":{"bullseye":"0.103.10+dfsg-0+deb11u1","bullseye-security":"1.4.3+dfsg-1~deb11u1"},"fixed_version":"0.94.dfsg-1","urgency":"not yet assigned"},"forky":{"status":"resolved","repositories":{"forky":"1.4.3+dfsg-2"},"fixed_version":"0.94.dfsg-1","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"1.4.3+dfsg-2"},"fixed_version":"0.94.dfsg-1","urgency":"not yet assigned"},"trixie":{"status":"resolved","repositories":{"trixie":"1.4.3+dfsg-1"},"fixed_version":"0.94.dfsg-1","urgency":"not yet assigned"}}},"CVE-2008-3914":{"description":"Multiple unspecified vulnerabilities in ClamAV before 0.94 have unknown impact and attack vectors related to file descriptor leaks on the \"error path\" in (1) libclamav/others.c and (2) libclamav/sis.c.","scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"1.4.3+dfsg-1~deb12u2"},"fixed_version":"0.94.dfsg-1","urgency":"not yet assigned"},"bullseye":{"status":"resolved","repositories":{"bullseye":"0.103.10+dfsg-0+deb11u1","bullseye-security":"1.4.3+dfsg-1~deb11u1"},"fixed_version":"0.94.dfsg-1","urgency":"not yet assigned"},"forky":{"status":"resolved","repositories":{"forky":"1.4.3+dfsg-2"},"fixed_version":"0.94.dfsg-1","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"1.4.3+dfsg-2"},"fixed_version":"0.94.dfsg-1","urgency":"not yet assigned"},"trixie":{"status":"resolved","repositories":{"trixie":"1.4.3+dfsg-1"},"fixed_version":"0.94.dfsg-1","urgency":"not yet assigned"}}},"CVE-2008-5050":{"description":"Off-by-one error in the get_unicode_name function (libclamav/vba_extract.c) in Clam Anti-Virus (ClamAV) before 0.94.1 allows remote attackers to cause a denial of service (crash) or possibly execute arbitrary code via a crafted VBA project file, which triggers a heap-based buffer overflow.","debianbug":505134,"scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"1.4.3+dfsg-1~deb12u2"},"fixed_version":"0.94.dfsg.1-1","urgency":"not yet assigned"},"bullseye":{"status":"resolved","repositories":{"bullseye":"0.103.10+dfsg-0+deb11u1","bullseye-security":"1.4.3+dfsg-1~deb11u1"},"fixed_version":"0.94.dfsg.1-1","urgency":"not yet assigned"},"forky":{"status":"resolved","repositories":{"forky":"1.4.3+dfsg-2"},"fixed_version":"0.94.dfsg.1-1","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"1.4.3+dfsg-2"},"fixed_version":"0.94.dfsg.1-1","urgency":"not yet assigned"},"trixie":{"status":"resolved","repositories":{"trixie":"1.4.3+dfsg-1"},"fixed_version":"0.94.dfsg.1-1","urgency":"not yet assigned"}}},"CVE-2008-5314":{"description":"Stack consumption vulnerability in libclamav/special.c in ClamAV before 0.94.2 allows remote attackers to cause a denial of service (daemon crash) via a crafted JPEG file, related to the cli_check_jpeg_exploit, jpeg_check_photoshop, and jpeg_check_photoshop_8bim functions.","debianbug":507624,"scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"1.4.3+dfsg-1~deb12u2"},"fixed_version":"0.94.dfsg.2-1","urgency":"medium"},"bullseye":{"status":"resolved","repositories":{"bullseye":"0.103.10+dfsg-0+deb11u1","bullseye-security":"1.4.3+dfsg-1~deb11u1"},"fixed_version":"0.94.dfsg.2-1","urgency":"medium"},"forky":{"status":"resolved","repositories":{"forky":"1.4.3+dfsg-2"},"fixed_version":"0.94.dfsg.2-1","urgency":"medium"},"sid":{"status":"resolved","repositories":{"sid":"1.4.3+dfsg-2"},"fixed_version":"0.94.dfsg.2-1","urgency":"medium"},"trixie":{"status":"resolved","repositories":{"trixie":"1.4.3+dfsg-1"},"fixed_version":"0.94.dfsg.2-1","urgency":"medium"}}},"CVE-2008-5525":{"description":"ClamAV 0.94.1 and possibly 0.93.1, when Internet Explorer 6 or 7 is used, allows remote attackers to bypass detection of malware in an HTML document by placing an MZ header (aka \"EXE info\") at the beginning, and modifying the filename to have (1) no extension, (2) a .txt extension, or (3) a .jpg extension, as demonstrated by a document containing a CVE-2006-5745 exploit.","scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"1.4.3+dfsg-1~deb12u2"},"fixed_version":"0","urgency":"unimportant"},"bullseye":{"status":"resolved","repositories":{"bullseye":"0.103.10+dfsg-0+deb11u1","bullseye-security":"1.4.3+dfsg-1~deb11u1"},"fixed_version":"0","urgency":"unimportant"},"forky":{"status":"resolved","repositories":{"forky":"1.4.3+dfsg-2"},"fixed_version":"0","urgency":"unimportant"},"sid":{"status":"resolved","repositories":{"sid":"1.4.3+dfsg-2"},"fixed_version":"0","urgency":"unimportant"},"trixie":{"status":"resolved","repositories":{"trixie":"1.4.3+dfsg-1"},"fixed_version":"0","urgency":"unimportant"}}},"CVE-2008-6680":{"description":"libclamav/pe.c in ClamAV before 0.95 allows remote attackers to cause a denial of service (crash) via a crafted EXE file that triggers a divide-by-zero error.","debianbug":523016,"scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"1.4.3+dfsg-1~deb12u2"},"fixed_version":"0.95.1+dfsg-1","urgency":"medium"},"bullseye":{"status":"resolved","repositories":{"bullseye":"0.103.10+dfsg-0+deb11u1","bullseye-security":"1.4.3+dfsg-1~deb11u1"},"fixed_version":"0.95.1+dfsg-1","urgency":"medium"},"forky":{"status":"resolved","repositories":{"forky":"1.4.3+dfsg-2"},"fixed_version":"0.95.1+dfsg-1","urgency":"medium"},"sid":{"status":"resolved","repositories":{"sid":"1.4.3+dfsg-2"},"fixed_version":"0.95.1+dfsg-1","urgency":"medium"},"trixie":{"status":"resolved","repositories":{"trixie":"1.4.3+dfsg-1"},"fixed_version":"0.95.1+dfsg-1","urgency":"medium"}}},"CVE-2008-6845":{"description":"The unpack feature in ClamAV 0.93.3 and earlier allows remote attackers to cause a denial of service (segmentation fault) via a corrupted LZH file.","scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"1.4.3+dfsg-1~deb12u2"},"fixed_version":"0.94.dfsg-1","urgency":"not yet assigned"},"bullseye":{"status":"resolved","repositories":{"bullseye":"0.103.10+dfsg-0+deb11u1","bullseye-security":"1.4.3+dfsg-1~deb11u1"},"fixed_version":"0.94.dfsg-1","urgency":"not yet assigned"},"forky":{"status":"resolved","repositories":{"forky":"1.4.3+dfsg-2"},"fixed_version":"0.94.dfsg-1","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"1.4.3+dfsg-2"},"fixed_version":"0.94.dfsg-1","urgency":"not yet assigned"},"trixie":{"status":"resolved","repositories":{"trixie":"1.4.3+dfsg-1"},"fixed_version":"0.94.dfsg-1","urgency":"not yet assigned"}}},"CVE-2009-1241":{"description":"Unspecified vulnerability in ClamAV before 0.95 allows remote attackers to bypass detection of malware via a modified RAR archive.","debianbug":526042,"scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"1.4.3+dfsg-1~deb12u2"},"fixed_version":"0.95+dfsg-1","urgency":"medium"},"bullseye":{"status":"resolved","repositories":{"bullseye":"0.103.10+dfsg-0+deb11u1","bullseye-security":"1.4.3+dfsg-1~deb11u1"},"fixed_version":"0.95+dfsg-1","urgency":"medium"},"forky":{"status":"resolved","repositories":{"forky":"1.4.3+dfsg-2"},"fixed_version":"0.95+dfsg-1","urgency":"medium"},"sid":{"status":"resolved","repositories":{"sid":"1.4.3+dfsg-2"},"fixed_version":"0.95+dfsg-1","urgency":"medium"},"trixie":{"status":"resolved","repositories":{"trixie":"1.4.3+dfsg-1"},"fixed_version":"0.95+dfsg-1","urgency":"medium"}}},"CVE-2009-1270":{"description":"libclamav/untar.c in ClamAV before 0.95 allows remote attackers to cause a denial of service (infinite loop) via a crafted TAR file that causes (1) clamd and (2) clamscan to hang.","debianbug":523016,"scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"1.4.3+dfsg-1~deb12u2"},"fixed_version":"0.95.1+dfsg-1","urgency":"medium"},"bullseye":{"status":"resolved","repositories":{"bullseye":"0.103.10+dfsg-0+deb11u1","bullseye-security":"1.4.3+dfsg-1~deb11u1"},"fixed_version":"0.95.1+dfsg-1","urgency":"medium"},"forky":{"status":"resolved","repositories":{"forky":"1.4.3+dfsg-2"},"fixed_version":"0.95.1+dfsg-1","urgency":"medium"},"sid":{"status":"resolved","repositories":{"sid":"1.4.3+dfsg-2"},"fixed_version":"0.95.1+dfsg-1","urgency":"medium"},"trixie":{"status":"resolved","repositories":{"trixie":"1.4.3+dfsg-1"},"fixed_version":"0.95.1+dfsg-1","urgency":"medium"}}},"CVE-2009-1371":{"description":"The CLI_ISCONTAINED macro in libclamav/others.h in ClamAV before 0.95.1 allows remote attackers to cause a denial of service (application crash) via a malformed file with UPack encoding.","scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"1.4.3+dfsg-1~deb12u2"},"fixed_version":"0.95.1+dfsg-1","urgency":"not yet assigned"},"bullseye":{"status":"resolved","repositories":{"bullseye":"0.103.10+dfsg-0+deb11u1","bullseye-security":"1.4.3+dfsg-1~deb11u1"},"fixed_version":"0.95.1+dfsg-1","urgency":"not yet assigned"},"forky":{"status":"resolved","repositories":{"forky":"1.4.3+dfsg-2"},"fixed_version":"0.95.1+dfsg-1","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"1.4.3+dfsg-2"},"fixed_version":"0.95.1+dfsg-1","urgency":"not yet assigned"},"trixie":{"status":"resolved","repositories":{"trixie":"1.4.3+dfsg-1"},"fixed_version":"0.95.1+dfsg-1","urgency":"not yet assigned"}}},"CVE-2009-1372":{"description":"Stack-based buffer overflow in the cli_url_canon function in libclamav/phishcheck.c in ClamAV before 0.95.1 allows remote attackers to cause a denial of service (application crash) and possibly execute arbitrary code via a crafted URL.","scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"1.4.3+dfsg-1~deb12u2"},"fixed_version":"0.95.1+dfsg-1","urgency":"not yet assigned"},"bullseye":{"status":"resolved","repositories":{"bullseye":"0.103.10+dfsg-0+deb11u1","bullseye-security":"1.4.3+dfsg-1~deb11u1"},"fixed_version":"0.95.1+dfsg-1","urgency":"not yet assigned"},"forky":{"status":"resolved","repositories":{"forky":"1.4.3+dfsg-2"},"fixed_version":"0.95.1+dfsg-1","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"1.4.3+dfsg-2"},"fixed_version":"0.95.1+dfsg-1","urgency":"not yet assigned"},"trixie":{"status":"resolved","repositories":{"trixie":"1.4.3+dfsg-1"},"fixed_version":"0.95.1+dfsg-1","urgency":"not yet assigned"}}},"CVE-2009-1601":{"description":"The Ubuntu clamav-milter.init script in clamav-milter before 0.95.1+dfsg-1ubuntu1.2 in Ubuntu 9.04 sets the ownership of the current working directory to the clamav account, which might allow local users to bypass intended access restrictions via read or write operations involving this directory.","scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"1.4.3+dfsg-1~deb12u2"},"fixed_version":"0","urgency":"unimportant"},"bullseye":{"status":"resolved","repositories":{"bullseye":"0.103.10+dfsg-0+deb11u1","bullseye-security":"1.4.3+dfsg-1~deb11u1"},"fixed_version":"0","urgency":"unimportant"},"forky":{"status":"resolved","repositories":{"forky":"1.4.3+dfsg-2"},"fixed_version":"0","urgency":"unimportant"},"sid":{"status":"resolved","repositories":{"sid":"1.4.3+dfsg-2"},"fixed_version":"0","urgency":"unimportant"},"trixie":{"status":"resolved","repositories":{"trixie":"1.4.3+dfsg-1"},"fixed_version":"0","urgency":"unimportant"}}},"CVE-2009-3736":{"description":"ltdl.c in libltdl in GNU Libtool 1.5.x, and 2.2.6 before 2.2.6b, as used in Ham Radio Control Libraries, Q, and possibly other products, attempts to open a .la file in the current working directory, which allows local users to gain privileges via a Trojan horse file.","debianbug":559832,"scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"1.4.3+dfsg-1~deb12u2"},"fixed_version":"0.95+dfsg-1","urgency":"low"},"bullseye":{"status":"resolved","repositories":{"bullseye":"0.103.10+dfsg-0+deb11u1","bullseye-security":"1.4.3+dfsg-1~deb11u1"},"fixed_version":"0.95+dfsg-1","urgency":"low"},"forky":{"status":"resolved","repositories":{"forky":"1.4.3+dfsg-2"},"fixed_version":"0.95+dfsg-1","urgency":"low"},"sid":{"status":"resolved","repositories":{"sid":"1.4.3+dfsg-2"},"fixed_version":"0.95+dfsg-1","urgency":"low"},"trixie":{"status":"resolved","repositories":{"trixie":"1.4.3+dfsg-1"},"fixed_version":"0.95+dfsg-1","urgency":"low"}}},"CVE-2010-0058":{"description":"freshclam in ClamAV in Apple Mac OS X 10.5.8 with Security Update 2009-005 has an incorrect launchd.plist ProgramArguments key and consequently does not run, which might allow remote attackers to introduce viruses into the system.","scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"1.4.3+dfsg-1~deb12u2"},"fixed_version":"0","urgency":"unimportant"},"bullseye":{"status":"resolved","repositories":{"bullseye":"0.103.10+dfsg-0+deb11u1","bullseye-security":"1.4.3+dfsg-1~deb11u1"},"fixed_version":"0","urgency":"unimportant"},"forky":{"status":"resolved","repositories":{"forky":"1.4.3+dfsg-2"},"fixed_version":"0","urgency":"unimportant"},"sid":{"status":"resolved","repositories":{"sid":"1.4.3+dfsg-2"},"fixed_version":"0","urgency":"unimportant"},"trixie":{"status":"resolved","repositories":{"trixie":"1.4.3+dfsg-1"},"fixed_version":"0","urgency":"unimportant"}}},"CVE-2010-0098":{"description":"ClamAV before 0.96 does not properly handle the (1) CAB and (2) 7z file formats, which allows remote attackers to bypass virus detection via a crafted archive that is compatible with standard archive utilities.","scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"1.4.3+dfsg-1~deb12u2"},"fixed_version":"0.96+dfsg-1","urgency":"not yet assigned"},"bullseye":{"status":"resolved","repositories":{"bullseye":"0.103.10+dfsg-0+deb11u1","bullseye-security":"1.4.3+dfsg-1~deb11u1"},"fixed_version":"0.96+dfsg-1","urgency":"not yet assigned"},"forky":{"status":"resolved","repositories":{"forky":"1.4.3+dfsg-2"},"fixed_version":"0.96+dfsg-1","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"1.4.3+dfsg-2"},"fixed_version":"0.96+dfsg-1","urgency":"not yet assigned"},"trixie":{"status":"resolved","repositories":{"trixie":"1.4.3+dfsg-1"},"fixed_version":"0.96+dfsg-1","urgency":"not yet assigned"}}},"CVE-2010-0405":{"description":"Integer overflow in the BZ2_decompress function in decompress.c in bzip2 and libbzip2 before 1.0.6 allows context-dependent attackers to cause a denial of service (application crash) or possibly execute arbitrary code via a crafted compressed file.","scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"1.4.3+dfsg-1~deb12u2"},"fixed_version":"0.96.3+dfsg-1","urgency":"not yet assigned"},"bullseye":{"status":"resolved","repositories":{"bullseye":"0.103.10+dfsg-0+deb11u1","bullseye-security":"1.4.3+dfsg-1~deb11u1"},"fixed_version":"0.96.3+dfsg-1","urgency":"not yet assigned"},"forky":{"status":"resolved","repositories":{"forky":"1.4.3+dfsg-2"},"fixed_version":"0.96.3+dfsg-1","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"1.4.3+dfsg-2"},"fixed_version":"0.96.3+dfsg-1","urgency":"not yet assigned"},"trixie":{"status":"resolved","repositories":{"trixie":"1.4.3+dfsg-1"},"fixed_version":"0.96.3+dfsg-1","urgency":"not yet assigned"}}},"CVE-2010-1311":{"description":"The qtm_decompress function in libclamav/mspack.c in ClamAV before 0.96 allows remote attackers to cause a denial of service (memory corruption and application crash) via a crafted CAB archive that uses the Quantum (aka .Q) compression format.  NOTE: some of these details are obtained from third party information.","debianbug":577462,"scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"1.4.3+dfsg-1~deb12u2"},"fixed_version":"0.96+dfsg-2","urgency":"low"},"bullseye":{"status":"resolved","repositories":{"bullseye":"0.103.10+dfsg-0+deb11u1","bullseye-security":"1.4.3+dfsg-1~deb11u1"},"fixed_version":"0.96+dfsg-2","urgency":"low"},"forky":{"status":"resolved","repositories":{"forky":"1.4.3+dfsg-2"},"fixed_version":"0.96+dfsg-2","urgency":"low"},"sid":{"status":"resolved","repositories":{"sid":"1.4.3+dfsg-2"},"fixed_version":"0.96+dfsg-2","urgency":"low"},"trixie":{"status":"resolved","repositories":{"trixie":"1.4.3+dfsg-1"},"fixed_version":"0.96+dfsg-2","urgency":"low"}}},"CVE-2010-1639":{"description":"The cli_pdf function in libclamav/pdf.c in ClamAV before 0.96.1 allows remote attackers to cause a denial of service (crash) via a malformed PDF file, related to an inconsistency in the calculated stream length and the real stream length.","debianbug":584183,"scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"1.4.3+dfsg-1~deb12u2"},"fixed_version":"0.96.1+dfsg-1","urgency":"not yet assigned"},"bullseye":{"status":"resolved","repositories":{"bullseye":"0.103.10+dfsg-0+deb11u1","bullseye-security":"1.4.3+dfsg-1~deb11u1"},"fixed_version":"0.96.1+dfsg-1","urgency":"not yet assigned"},"forky":{"status":"resolved","repositories":{"forky":"1.4.3+dfsg-2"},"fixed_version":"0.96.1+dfsg-1","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"1.4.3+dfsg-2"},"fixed_version":"0.96.1+dfsg-1","urgency":"not yet assigned"},"trixie":{"status":"resolved","repositories":{"trixie":"1.4.3+dfsg-1"},"fixed_version":"0.96.1+dfsg-1","urgency":"not yet assigned"}}},"CVE-2010-1640":{"description":"Off-by-one error in the parseicon function in libclamav/pe_icons.c in ClamAV 0.96 allows remote attackers to cause a denial of service (crash) via a crafted PE icon that triggers an out-of-bounds read, related to improper rounding during scaling.","debianbug":584183,"scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"1.4.3+dfsg-1~deb12u2"},"fixed_version":"0.96.1+dfsg-1","urgency":"not yet assigned"},"bullseye":{"status":"resolved","repositories":{"bullseye":"0.103.10+dfsg-0+deb11u1","bullseye-security":"1.4.3+dfsg-1~deb11u1"},"fixed_version":"0.96.1+dfsg-1","urgency":"not yet assigned"},"forky":{"status":"resolved","repositories":{"forky":"1.4.3+dfsg-2"},"fixed_version":"0.96.1+dfsg-1","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"1.4.3+dfsg-2"},"fixed_version":"0.96.1+dfsg-1","urgency":"not yet assigned"},"trixie":{"status":"resolved","repositories":{"trixie":"1.4.3+dfsg-1"},"fixed_version":"0.96.1+dfsg-1","urgency":"not yet assigned"}}},"CVE-2010-3434":{"description":"Buffer overflow in the find_stream_bounds function in pdf.c in libclamav in ClamAV before 0.96.3 allows remote attackers to cause a denial of service (application crash) or possibly execute arbitrary code via a crafted PDF document.  NOTE: some of these details are obtained from third party information.","scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"1.4.3+dfsg-1~deb12u2"},"fixed_version":"0.96.3+dfsg-1","urgency":"not yet assigned"},"bullseye":{"status":"resolved","repositories":{"bullseye":"0.103.10+dfsg-0+deb11u1","bullseye-security":"1.4.3+dfsg-1~deb11u1"},"fixed_version":"0.96.3+dfsg-1","urgency":"not yet assigned"},"forky":{"status":"resolved","repositories":{"forky":"1.4.3+dfsg-2"},"fixed_version":"0.96.3+dfsg-1","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"1.4.3+dfsg-2"},"fixed_version":"0.96.3+dfsg-1","urgency":"not yet assigned"},"trixie":{"status":"resolved","repositories":{"trixie":"1.4.3+dfsg-1"},"fixed_version":"0.96.3+dfsg-1","urgency":"not yet assigned"}}},"CVE-2010-4260":{"description":"Multiple unspecified vulnerabilities in pdf.c in libclamav in ClamAV before 0.96.5 allow remote attackers to cause a denial of service (application crash) or possibly execute arbitrary code via a crafted PDF document, aka (1) \"bb #2358\" and (2) \"bb #2396.\"","scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"1.4.3+dfsg-1~deb12u2"},"fixed_version":"0.96.5+dfsg-1","urgency":"not yet assigned"},"bullseye":{"status":"resolved","repositories":{"bullseye":"0.103.10+dfsg-0+deb11u1","bullseye-security":"1.4.3+dfsg-1~deb11u1"},"fixed_version":"0.96.5+dfsg-1","urgency":"not yet assigned"},"forky":{"status":"resolved","repositories":{"forky":"1.4.3+dfsg-2"},"fixed_version":"0.96.5+dfsg-1","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"1.4.3+dfsg-2"},"fixed_version":"0.96.5+dfsg-1","urgency":"not yet assigned"},"trixie":{"status":"resolved","repositories":{"trixie":"1.4.3+dfsg-1"},"fixed_version":"0.96.5+dfsg-1","urgency":"not yet assigned"}}},"CVE-2010-4261":{"description":"Off-by-one error in the icon_cb function in pe_icons.c in libclamav in ClamAV before 0.96.5 allows remote attackers to cause a denial of service (memory corruption and application crash) or possibly execute arbitrary code via unspecified vectors.  NOTE: some of these details are obtained from third party information.","scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"1.4.3+dfsg-1~deb12u2"},"fixed_version":"0.96.5+dfsg-1","urgency":"not yet assigned"},"bullseye":{"status":"resolved","repositories":{"bullseye":"0.103.10+dfsg-0+deb11u1","bullseye-security":"1.4.3+dfsg-1~deb11u1"},"fixed_version":"0.96.5+dfsg-1","urgency":"not yet assigned"},"forky":{"status":"resolved","repositories":{"forky":"1.4.3+dfsg-2"},"fixed_version":"0.96.5+dfsg-1","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"1.4.3+dfsg-2"},"fixed_version":"0.96.5+dfsg-1","urgency":"not yet assigned"},"trixie":{"status":"resolved","repositories":{"trixie":"1.4.3+dfsg-1"},"fixed_version":"0.96.5+dfsg-1","urgency":"not yet assigned"}}},"CVE-2010-4479":{"description":"Unspecified vulnerability in pdf.c in libclamav in ClamAV before 0.96.5 allows remote attackers to cause a denial of service (application crash) or possibly execute arbitrary code via a crafted PDF document, aka \"bb #2380,\" a different vulnerability than CVE-2010-4260.","scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"1.4.3+dfsg-1~deb12u2"},"fixed_version":"0.96.5+dfsg-1","urgency":"not yet assigned"},"bullseye":{"status":"resolved","repositories":{"bullseye":"0.103.10+dfsg-0+deb11u1","bullseye-security":"1.4.3+dfsg-1~deb11u1"},"fixed_version":"0.96.5+dfsg-1","urgency":"not yet assigned"},"forky":{"status":"resolved","repositories":{"forky":"1.4.3+dfsg-2"},"fixed_version":"0.96.5+dfsg-1","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"1.4.3+dfsg-2"},"fixed_version":"0.96.5+dfsg-1","urgency":"not yet assigned"},"trixie":{"status":"resolved","repositories":{"trixie":"1.4.3+dfsg-1"},"fixed_version":"0.96.5+dfsg-1","urgency":"not yet assigned"}}},"CVE-2011-1003":{"description":"Double free vulnerability in the vba_read_project_strings function in vba_extract.c in libclamav in ClamAV before 0.97 might allow remote attackers to execute arbitrary code via crafted Visual Basic for Applications (VBA) data in a Microsoft Office document.  NOTE: some of these details are obtained from third party information.","debianbug":617444,"scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"1.4.3+dfsg-1~deb12u2"},"fixed_version":"0.97+dfsg-1","urgency":"low"},"bullseye":{"status":"resolved","repositories":{"bullseye":"0.103.10+dfsg-0+deb11u1","bullseye-security":"1.4.3+dfsg-1~deb11u1"},"fixed_version":"0.97+dfsg-1","urgency":"low"},"forky":{"status":"resolved","repositories":{"forky":"1.4.3+dfsg-2"},"fixed_version":"0.97+dfsg-1","urgency":"low"},"sid":{"status":"resolved","repositories":{"sid":"1.4.3+dfsg-2"},"fixed_version":"0.97+dfsg-1","urgency":"low"},"trixie":{"status":"resolved","repositories":{"trixie":"1.4.3+dfsg-1"},"fixed_version":"0.97+dfsg-1","urgency":"low"}}},"CVE-2011-2721":{"description":"Off-by-one error in the cli_hm_scan function in matcher-hash.c in libclamav in ClamAV before 0.97.2 allows remote attackers to cause a denial of service (daemon crash) via an e-mail message that is not properly handled during certain hash calculations.","debianbug":635599,"scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"1.4.3+dfsg-1~deb12u2"},"fixed_version":"0.97.2+dfsg-1","urgency":"not yet assigned"},"bullseye":{"status":"resolved","repositories":{"bullseye":"0.103.10+dfsg-0+deb11u1","bullseye-security":"1.4.3+dfsg-1~deb11u1"},"fixed_version":"0.97.2+dfsg-1","urgency":"not yet assigned"},"forky":{"status":"resolved","repositories":{"forky":"1.4.3+dfsg-2"},"fixed_version":"0.97.2+dfsg-1","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"1.4.3+dfsg-2"},"fixed_version":"0.97.2+dfsg-1","urgency":"not yet assigned"},"trixie":{"status":"resolved","repositories":{"trixie":"1.4.3+dfsg-1"},"fixed_version":"0.97.2+dfsg-1","urgency":"not yet assigned"}}},"CVE-2011-3627":{"description":"The bytecode engine in ClamAV before 0.97.3 allows remote attackers to cause a denial of service (crash) via vectors related to \"recursion level\" and (1) libclamav/bytecode.c and (2) libclamav/bytecode_api.c.","scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"1.4.3+dfsg-1~deb12u2"},"fixed_version":"0.97.3+dfsg-1","urgency":"low"},"bullseye":{"status":"resolved","repositories":{"bullseye":"0.103.10+dfsg-0+deb11u1","bullseye-security":"1.4.3+dfsg-1~deb11u1"},"fixed_version":"0.97.3+dfsg-1","urgency":"low"},"forky":{"status":"resolved","repositories":{"forky":"1.4.3+dfsg-2"},"fixed_version":"0.97.3+dfsg-1","urgency":"low"},"sid":{"status":"resolved","repositories":{"sid":"1.4.3+dfsg-2"},"fixed_version":"0.97.3+dfsg-1","urgency":"low"},"trixie":{"status":"resolved","repositories":{"trixie":"1.4.3+dfsg-1"},"fixed_version":"0.97.3+dfsg-1","urgency":"low"}}},"CVE-2012-1419":{"description":"The TAR file parser in ClamAV 0.96.4 and Quick Heal (aka Cat QuickHeal) 11.00 allows remote attackers to bypass malware detection via a POSIX TAR file with an initial [aliases] character sequence. NOTE: this may later be SPLIT into multiple CVEs if additional information is published showing that the error occurred independently in different TAR parser implementations.","debianbug":668273,"scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"1.4.3+dfsg-1~deb12u2"},"fixed_version":"0.97.5+dfsg-1","urgency":"low"},"bullseye":{"status":"resolved","repositories":{"bullseye":"0.103.10+dfsg-0+deb11u1","bullseye-security":"1.4.3+dfsg-1~deb11u1"},"fixed_version":"0.97.5+dfsg-1","urgency":"low"},"forky":{"status":"resolved","repositories":{"forky":"1.4.3+dfsg-2"},"fixed_version":"0.97.5+dfsg-1","urgency":"low"},"sid":{"status":"resolved","repositories":{"sid":"1.4.3+dfsg-2"},"fixed_version":"0.97.5+dfsg-1","urgency":"low"},"trixie":{"status":"resolved","repositories":{"trixie":"1.4.3+dfsg-1"},"fixed_version":"0.97.5+dfsg-1","urgency":"low"}}},"CVE-2012-1457":{"description":"The TAR file parser in Avira AntiVir 7.11.1.163, Antiy Labs AVL SDK 2.0.3.7, avast! Antivirus 4.8.1351.0 and 5.0.677.0, AVG Anti-Virus 10.0.0.1190, Bitdefender 7.2, Quick Heal (aka Cat QuickHeal) 11.00, ClamAV 0.96.4, Command Antivirus 5.2.11.5, Emsisoft Anti-Malware 5.1.0.1, eSafe 7.0.17.0, F-Prot Antivirus 4.6.2.117, G Data AntiVirus 21, Ikarus Virus Utilities T3 Command Line Scanner 1.1.97.0, Jiangmin Antivirus 13.0.900, K7 AntiVirus 9.77.3565, Kaspersky Anti-Virus 7.0.0.125, McAfee Anti-Virus Scanning Engine 5.400.0.1158, McAfee Gateway (formerly Webwasher) 2010.1C, Antimalware Engine 1.1.6402.0 in Microsoft Security Essentials 2.0, NOD32 Antivirus 5795, Norman Antivirus 6.06.12, PC Tools AntiVirus 7.0.3.5, Rising Antivirus 22.83.00.03, AVEngine 20101.3.0.103 in Symantec Endpoint Protection 11, Trend Micro AntiVirus 9.120.0.1004, Trend Micro HouseCall 9.120.0.1004, VBA32 3.12.14.2, and VirusBuster 13.6.151.0 allows remote attackers to bypass malware detection via a TAR archive entry with a length field that exceeds the total TAR file size.  NOTE: this may later be SPLIT into multiple CVEs if additional information is published showing that the error occurred independently in different TAR parser implementations.","debianbug":668273,"scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"1.4.3+dfsg-1~deb12u2"},"fixed_version":"0.97.5+dfsg-1","urgency":"low"},"bullseye":{"status":"resolved","repositories":{"bullseye":"0.103.10+dfsg-0+deb11u1","bullseye-security":"1.4.3+dfsg-1~deb11u1"},"fixed_version":"0.97.5+dfsg-1","urgency":"low"},"forky":{"status":"resolved","repositories":{"forky":"1.4.3+dfsg-2"},"fixed_version":"0.97.5+dfsg-1","urgency":"low"},"sid":{"status":"resolved","repositories":{"sid":"1.4.3+dfsg-2"},"fixed_version":"0.97.5+dfsg-1","urgency":"low"},"trixie":{"status":"resolved","repositories":{"trixie":"1.4.3+dfsg-1"},"fixed_version":"0.97.5+dfsg-1","urgency":"low"}}},"CVE-2012-1458":{"description":"The Microsoft CHM file parser in ClamAV 0.96.4 and Sophos Anti-Virus 4.61.0 allows remote attackers to bypass malware detection via a crafted reset interval in the LZXC header of a CHM file.  NOTE: this may later be SPLIT into multiple CVEs if additional information is published showing that the error occurred independently in different CHM parser implementations.","debianbug":668273,"scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"1.4.3+dfsg-1~deb12u2"},"fixed_version":"0.97.5+dfsg-1","urgency":"low"},"bullseye":{"status":"resolved","repositories":{"bullseye":"0.103.10+dfsg-0+deb11u1","bullseye-security":"1.4.3+dfsg-1~deb11u1"},"fixed_version":"0.97.5+dfsg-1","urgency":"low"},"forky":{"status":"resolved","repositories":{"forky":"1.4.3+dfsg-2"},"fixed_version":"0.97.5+dfsg-1","urgency":"low"},"sid":{"status":"resolved","repositories":{"sid":"1.4.3+dfsg-2"},"fixed_version":"0.97.5+dfsg-1","urgency":"low"},"trixie":{"status":"resolved","repositories":{"trixie":"1.4.3+dfsg-1"},"fixed_version":"0.97.5+dfsg-1","urgency":"low"}}},"CVE-2012-1459":{"description":"The TAR file parser in AhnLab V3 Internet Security 2011.01.18.00, Avira AntiVir 7.11.1.163, Antiy Labs AVL SDK 2.0.3.7, avast! Antivirus 4.8.1351.0 and 5.0.677.0, AVG Anti-Virus 10.0.0.1190, Bitdefender 7.2, Quick Heal (aka Cat QuickHeal) 11.00, ClamAV 0.96.4, Command Antivirus 5.2.11.5, Comodo Antivirus 7424, Emsisoft Anti-Malware 5.1.0.1, F-Prot Antivirus 4.6.2.117, F-Secure Anti-Virus 9.0.16160.0, Fortinet Antivirus 4.2.254.0, G Data AntiVirus 21, Ikarus Virus Utilities T3 Command Line Scanner 1.1.97.0, Jiangmin Antivirus 13.0.900, K7 AntiVirus 9.77.3565, Kaspersky Anti-Virus 7.0.0.125, McAfee Anti-Virus Scanning Engine 5.400.0.1158, McAfee Gateway (formerly Webwasher) 2010.1C, Antimalware Engine 1.1.6402.0 in Microsoft Security Essentials 2.0, NOD32 Antivirus 5795, Norman Antivirus 6.06.12, nProtect Anti-Virus 2011-01-17.01, Panda Antivirus 10.0.2.7, PC Tools AntiVirus 7.0.3.5, Rising Antivirus 22.83.00.03, Sophos Anti-Virus 4.61.0, AVEngine 20101.3.0.103 in Symantec Endpoint Protection 11, Trend Micro AntiVirus 9.120.0.1004, Trend Micro HouseCall 9.120.0.1004, VBA32 3.12.14.2, and VirusBuster 13.6.151.0 allows remote attackers to bypass malware detection via a TAR archive entry with a length field corresponding to that entire entry, plus part of the header of the next entry.  NOTE: this may later be SPLIT into multiple CVEs if additional information is published showing that the error occurred independently in different TAR parser implementations.","debianbug":668273,"scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"1.4.3+dfsg-1~deb12u2"},"fixed_version":"0.97.5+dfsg-1","urgency":"low"},"bullseye":{"status":"resolved","repositories":{"bullseye":"0.103.10+dfsg-0+deb11u1","bullseye-security":"1.4.3+dfsg-1~deb11u1"},"fixed_version":"0.97.5+dfsg-1","urgency":"low"},"forky":{"status":"resolved","repositories":{"forky":"1.4.3+dfsg-2"},"fixed_version":"0.97.5+dfsg-1","urgency":"low"},"sid":{"status":"resolved","repositories":{"sid":"1.4.3+dfsg-2"},"fixed_version":"0.97.5+dfsg-1","urgency":"low"},"trixie":{"status":"resolved","repositories":{"trixie":"1.4.3+dfsg-1"},"fixed_version":"0.97.5+dfsg-1","urgency":"low"}}},"CVE-2013-2020":{"description":"Integer underflow in the cli_scanpe function in pe.c in ClamAV before 0.97.8 allows remote attackers to cause a denial of service (crash) via a skewed offset larger than the size of the PE section in a UPX packed executable, which triggers an out-of-bounds read.","scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"1.4.3+dfsg-1~deb12u2"},"fixed_version":"0.97.8+dfsg-1","urgency":"not yet assigned"},"bullseye":{"status":"resolved","repositories":{"bullseye":"0.103.10+dfsg-0+deb11u1","bullseye-security":"1.4.3+dfsg-1~deb11u1"},"fixed_version":"0.97.8+dfsg-1","urgency":"not yet assigned"},"forky":{"status":"resolved","repositories":{"forky":"1.4.3+dfsg-2"},"fixed_version":"0.97.8+dfsg-1","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"1.4.3+dfsg-2"},"fixed_version":"0.97.8+dfsg-1","urgency":"not yet assigned"},"trixie":{"status":"resolved","repositories":{"trixie":"1.4.3+dfsg-1"},"fixed_version":"0.97.8+dfsg-1","urgency":"not yet assigned"}}},"CVE-2013-2021":{"description":"pdf.c in ClamAV 0.97.1 through 0.97.7 allows remote attackers to cause a denial of service (out-of-bounds-read) via a crafted length value in an encrypted PDF file.","scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"1.4.3+dfsg-1~deb12u2"},"fixed_version":"0.97.8+dfsg-1","urgency":"not yet assigned"},"bullseye":{"status":"resolved","repositories":{"bullseye":"0.103.10+dfsg-0+deb11u1","bullseye-security":"1.4.3+dfsg-1~deb11u1"},"fixed_version":"0.97.8+dfsg-1","urgency":"not yet assigned"},"forky":{"status":"resolved","repositories":{"forky":"1.4.3+dfsg-2"},"fixed_version":"0.97.8+dfsg-1","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"1.4.3+dfsg-2"},"fixed_version":"0.97.8+dfsg-1","urgency":"not yet assigned"},"trixie":{"status":"resolved","repositories":{"trixie":"1.4.3+dfsg-1"},"fixed_version":"0.97.8+dfsg-1","urgency":"not yet assigned"}}},"CVE-2013-6497":{"description":"clamscan in ClamAV before 0.98.5, when using -a option, allows remote attackers to cause a denial of service (crash) as demonstrated by the jwplayer.js file.","scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"1.4.3+dfsg-1~deb12u2"},"fixed_version":"0.98.5+dfsg-1","urgency":"not yet assigned"},"bullseye":{"status":"resolved","repositories":{"bullseye":"0.103.10+dfsg-0+deb11u1","bullseye-security":"1.4.3+dfsg-1~deb11u1"},"fixed_version":"0.98.5+dfsg-1","urgency":"not yet assigned"},"forky":{"status":"resolved","repositories":{"forky":"1.4.3+dfsg-2"},"fixed_version":"0.98.5+dfsg-1","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"1.4.3+dfsg-2"},"fixed_version":"0.98.5+dfsg-1","urgency":"not yet assigned"},"trixie":{"status":"resolved","repositories":{"trixie":"1.4.3+dfsg-1"},"fixed_version":"0.98.5+dfsg-1","urgency":"not yet assigned"}}},"CVE-2013-7087":{"description":"ClamAV before 0.97.7 has WWPack corrupt heap memory","scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"1.4.3+dfsg-1~deb12u2"},"fixed_version":"0.97.7+dfsg-1","urgency":"not yet assigned"},"bullseye":{"status":"resolved","repositories":{"bullseye":"0.103.10+dfsg-0+deb11u1","bullseye-security":"1.4.3+dfsg-1~deb11u1"},"fixed_version":"0.97.7+dfsg-1","urgency":"not yet assigned"},"forky":{"status":"resolved","repositories":{"forky":"1.4.3+dfsg-2"},"fixed_version":"0.97.7+dfsg-1","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"1.4.3+dfsg-2"},"fixed_version":"0.97.7+dfsg-1","urgency":"not yet assigned"},"trixie":{"status":"resolved","repositories":{"trixie":"1.4.3+dfsg-1"},"fixed_version":"0.97.7+dfsg-1","urgency":"not yet assigned"}}},"CVE-2013-7088":{"description":"ClamAV before 0.97.7 has buffer overflow in the libclamav component","scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"1.4.3+dfsg-1~deb12u2"},"fixed_version":"0.97.7+dfsg-1","urgency":"not yet assigned"},"bullseye":{"status":"resolved","repositories":{"bullseye":"0.103.10+dfsg-0+deb11u1","bullseye-security":"1.4.3+dfsg-1~deb11u1"},"fixed_version":"0.97.7+dfsg-1","urgency":"not yet assigned"},"forky":{"status":"resolved","repositories":{"forky":"1.4.3+dfsg-2"},"fixed_version":"0.97.7+dfsg-1","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"1.4.3+dfsg-2"},"fixed_version":"0.97.7+dfsg-1","urgency":"not yet assigned"},"trixie":{"status":"resolved","repositories":{"trixie":"1.4.3+dfsg-1"},"fixed_version":"0.97.7+dfsg-1","urgency":"not yet assigned"}}},"CVE-2013-7089":{"description":"ClamAV before 0.97.7: dbg_printhex possible information leak","scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"1.4.3+dfsg-1~deb12u2"},"fixed_version":"0.97.7+dfsg-1","urgency":"not yet assigned"},"bullseye":{"status":"resolved","repositories":{"bullseye":"0.103.10+dfsg-0+deb11u1","bullseye-security":"1.4.3+dfsg-1~deb11u1"},"fixed_version":"0.97.7+dfsg-1","urgency":"not yet assigned"},"forky":{"status":"resolved","repositories":{"forky":"1.4.3+dfsg-2"},"fixed_version":"0.97.7+dfsg-1","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"1.4.3+dfsg-2"},"fixed_version":"0.97.7+dfsg-1","urgency":"not yet assigned"},"trixie":{"status":"resolved","repositories":{"trixie":"1.4.3+dfsg-1"},"fixed_version":"0.97.7+dfsg-1","urgency":"not yet assigned"}}},"CVE-2014-9050":{"description":"Heap-based buffer overflow in the cli_scanpe function in libclamav/pe.c in ClamAV before 0.98.5 allows remote attackers to cause a denial of service (crash) via a crafted y0da Crypter PE file.","debianbug":770985,"scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"1.4.3+dfsg-1~deb12u2"},"fixed_version":"0.98.5+dfsg-1","urgency":"not yet assigned"},"bullseye":{"status":"resolved","repositories":{"bullseye":"0.103.10+dfsg-0+deb11u1","bullseye-security":"1.4.3+dfsg-1~deb11u1"},"fixed_version":"0.98.5+dfsg-1","urgency":"not yet assigned"},"forky":{"status":"resolved","repositories":{"forky":"1.4.3+dfsg-2"},"fixed_version":"0.98.5+dfsg-1","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"1.4.3+dfsg-2"},"fixed_version":"0.98.5+dfsg-1","urgency":"not yet assigned"},"trixie":{"status":"resolved","repositories":{"trixie":"1.4.3+dfsg-1"},"fixed_version":"0.98.5+dfsg-1","urgency":"not yet assigned"}}},"CVE-2014-9328":{"description":"ClamAV before 0.98.6 allows remote attackers to have unspecified impact via a crafted upack packer file, related to a \"heap out of bounds condition.\"","scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"1.4.3+dfsg-1~deb12u2"},"fixed_version":"0.98.6+dfsg-1","urgency":"not yet assigned"},"bullseye":{"status":"resolved","repositories":{"bullseye":"0.103.10+dfsg-0+deb11u1","bullseye-security":"1.4.3+dfsg-1~deb11u1"},"fixed_version":"0.98.6+dfsg-1","urgency":"not yet assigned"},"forky":{"status":"resolved","repositories":{"forky":"1.4.3+dfsg-2"},"fixed_version":"0.98.6+dfsg-1","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"1.4.3+dfsg-2"},"fixed_version":"0.98.6+dfsg-1","urgency":"not yet assigned"},"trixie":{"status":"resolved","repositories":{"trixie":"1.4.3+dfsg-1"},"fixed_version":"0.98.6+dfsg-1","urgency":"not yet assigned"}}},"CVE-2015-1461":{"description":"ClamAV before 0.98.6 allows remote attackers to have unspecified impact via a crafted (1) Yoda's crypter or (2) mew packer file, related to a \"heap out of bounds condition.\"","scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"1.4.3+dfsg-1~deb12u2"},"fixed_version":"0.98.6+dfsg-1","urgency":"not yet assigned"},"bullseye":{"status":"resolved","repositories":{"bullseye":"0.103.10+dfsg-0+deb11u1","bullseye-security":"1.4.3+dfsg-1~deb11u1"},"fixed_version":"0.98.6+dfsg-1","urgency":"not yet assigned"},"forky":{"status":"resolved","repositories":{"forky":"1.4.3+dfsg-2"},"fixed_version":"0.98.6+dfsg-1","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"1.4.3+dfsg-2"},"fixed_version":"0.98.6+dfsg-1","urgency":"not yet assigned"},"trixie":{"status":"resolved","repositories":{"trixie":"1.4.3+dfsg-1"},"fixed_version":"0.98.6+dfsg-1","urgency":"not yet assigned"}}},"CVE-2015-1462":{"description":"ClamAV before 0.98.6 allows remote attackers to have unspecified impact via a crafted upx packer file, related to a \"heap out of bounds condition.\"","scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"1.4.3+dfsg-1~deb12u2"},"fixed_version":"0.98.6+dfsg-1","urgency":"not yet assigned"},"bullseye":{"status":"resolved","repositories":{"bullseye":"0.103.10+dfsg-0+deb11u1","bullseye-security":"1.4.3+dfsg-1~deb11u1"},"fixed_version":"0.98.6+dfsg-1","urgency":"not yet assigned"},"forky":{"status":"resolved","repositories":{"forky":"1.4.3+dfsg-2"},"fixed_version":"0.98.6+dfsg-1","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"1.4.3+dfsg-2"},"fixed_version":"0.98.6+dfsg-1","urgency":"not yet assigned"},"trixie":{"status":"resolved","repositories":{"trixie":"1.4.3+dfsg-1"},"fixed_version":"0.98.6+dfsg-1","urgency":"not yet assigned"}}},"CVE-2015-1463":{"description":"ClamAV before 0.98.6 allows remote attackers to cause a denial of service (crash) via a crafted petite packer file, related to an \"incorrect compiler optimization.\"","scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"1.4.3+dfsg-1~deb12u2"},"fixed_version":"0.98.6+dfsg-1","urgency":"not yet assigned"},"bullseye":{"status":"resolved","repositories":{"bullseye":"0.103.10+dfsg-0+deb11u1","bullseye-security":"1.4.3+dfsg-1~deb11u1"},"fixed_version":"0.98.6+dfsg-1","urgency":"not yet assigned"},"forky":{"status":"resolved","repositories":{"forky":"1.4.3+dfsg-2"},"fixed_version":"0.98.6+dfsg-1","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"1.4.3+dfsg-2"},"fixed_version":"0.98.6+dfsg-1","urgency":"not yet assigned"},"trixie":{"status":"resolved","repositories":{"trixie":"1.4.3+dfsg-1"},"fixed_version":"0.98.6+dfsg-1","urgency":"not yet assigned"}}},"CVE-2015-2170":{"description":"The upx decoder in ClamAV before 0.98.7 allows remote attackers to cause a denial of service (crash) via a crafted file.","scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"1.4.3+dfsg-1~deb12u2"},"fixed_version":"0.98.7+dfsg-1","urgency":"not yet assigned"},"bullseye":{"status":"resolved","repositories":{"bullseye":"0.103.10+dfsg-0+deb11u1","bullseye-security":"1.4.3+dfsg-1~deb11u1"},"fixed_version":"0.98.7+dfsg-1","urgency":"not yet assigned"},"forky":{"status":"resolved","repositories":{"forky":"1.4.3+dfsg-2"},"fixed_version":"0.98.7+dfsg-1","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"1.4.3+dfsg-2"},"fixed_version":"0.98.7+dfsg-1","urgency":"not yet assigned"},"trixie":{"status":"resolved","repositories":{"trixie":"1.4.3+dfsg-1"},"fixed_version":"0.98.7+dfsg-1","urgency":"not yet assigned"}}},"CVE-2015-2221":{"description":"ClamAV before 0.98.7 allows remote attackers to cause a denial of service (infinite loop) via a crafted y0da cryptor file.","scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"1.4.3+dfsg-1~deb12u2"},"fixed_version":"0.98.7+dfsg-1","urgency":"not yet assigned"},"bullseye":{"status":"resolved","repositories":{"bullseye":"0.103.10+dfsg-0+deb11u1","bullseye-security":"1.4.3+dfsg-1~deb11u1"},"fixed_version":"0.98.7+dfsg-1","urgency":"not yet assigned"},"forky":{"status":"resolved","repositories":{"forky":"1.4.3+dfsg-2"},"fixed_version":"0.98.7+dfsg-1","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"1.4.3+dfsg-2"},"fixed_version":"0.98.7+dfsg-1","urgency":"not yet assigned"},"trixie":{"status":"resolved","repositories":{"trixie":"1.4.3+dfsg-1"},"fixed_version":"0.98.7+dfsg-1","urgency":"not yet assigned"}}},"CVE-2015-2222":{"description":"ClamAV before 0.98.7 allows remote attackers to cause a denial of service (crash) via a crafted petite packed file.","scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"1.4.3+dfsg-1~deb12u2"},"fixed_version":"0.98.7+dfsg-1","urgency":"not yet assigned"},"bullseye":{"status":"resolved","repositories":{"bullseye":"0.103.10+dfsg-0+deb11u1","bullseye-security":"1.4.3+dfsg-1~deb11u1"},"fixed_version":"0.98.7+dfsg-1","urgency":"not yet assigned"},"forky":{"status":"resolved","repositories":{"forky":"1.4.3+dfsg-2"},"fixed_version":"0.98.7+dfsg-1","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"1.4.3+dfsg-2"},"fixed_version":"0.98.7+dfsg-1","urgency":"not yet assigned"},"trixie":{"status":"resolved","repositories":{"trixie":"1.4.3+dfsg-1"},"fixed_version":"0.98.7+dfsg-1","urgency":"not yet assigned"}}},"CVE-2015-2305":{"description":"Integer overflow in the regcomp implementation in the Henry Spencer BSD regex library (aka rxspencer) alpha3.8.g5 on 32-bit platforms, as used in NetBSD through 6.1.5 and other products, might allow context-dependent attackers to execute arbitrary code via a large regular expression that leads to a heap-based buffer overflow.","debianbug":778406,"scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"1.4.3+dfsg-1~deb12u2"},"fixed_version":"0.98.7+dfsg-1","urgency":"unimportant"},"bullseye":{"status":"resolved","repositories":{"bullseye":"0.103.10+dfsg-0+deb11u1","bullseye-security":"1.4.3+dfsg-1~deb11u1"},"fixed_version":"0.98.7+dfsg-1","urgency":"unimportant"},"forky":{"status":"resolved","repositories":{"forky":"1.4.3+dfsg-2"},"fixed_version":"0.98.7+dfsg-1","urgency":"unimportant"},"sid":{"status":"resolved","repositories":{"sid":"1.4.3+dfsg-2"},"fixed_version":"0.98.7+dfsg-1","urgency":"unimportant"},"trixie":{"status":"resolved","repositories":{"trixie":"1.4.3+dfsg-1"},"fixed_version":"0.98.7+dfsg-1","urgency":"unimportant"}}},"CVE-2015-2668":{"description":"ClamAV before 0.98.7 allows remote attackers to cause a denial of service (infinite loop) via a crafted xz archive file.","scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"1.4.3+dfsg-1~deb12u2"},"fixed_version":"0.98.7+dfsg-1","urgency":"not yet assigned"},"bullseye":{"status":"resolved","repositories":{"bullseye":"0.103.10+dfsg-0+deb11u1","bullseye-security":"1.4.3+dfsg-1~deb11u1"},"fixed_version":"0.98.7+dfsg-1","urgency":"not yet assigned"},"forky":{"status":"resolved","repositories":{"forky":"1.4.3+dfsg-2"},"fixed_version":"0.98.7+dfsg-1","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"1.4.3+dfsg-2"},"fixed_version":"0.98.7+dfsg-1","urgency":"not yet assigned"},"trixie":{"status":"resolved","repositories":{"trixie":"1.4.3+dfsg-1"},"fixed_version":"0.98.7+dfsg-1","urgency":"not yet assigned"}}},"CVE-2016-1371":{"description":"ClamAV (aka Clam AntiVirus) before 0.99.2 allows remote attackers to cause a denial of service (application crash) via a crafted mew packer executable.","scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"1.4.3+dfsg-1~deb12u2"},"fixed_version":"0.99.2+dfsg-1","urgency":"not yet assigned"},"bullseye":{"status":"resolved","repositories":{"bullseye":"0.103.10+dfsg-0+deb11u1","bullseye-security":"1.4.3+dfsg-1~deb11u1"},"fixed_version":"0.99.2+dfsg-1","urgency":"not yet assigned"},"forky":{"status":"resolved","repositories":{"forky":"1.4.3+dfsg-2"},"fixed_version":"0.99.2+dfsg-1","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"1.4.3+dfsg-2"},"fixed_version":"0.99.2+dfsg-1","urgency":"not yet assigned"},"trixie":{"status":"resolved","repositories":{"trixie":"1.4.3+dfsg-1"},"fixed_version":"0.99.2+dfsg-1","urgency":"not yet assigned"}}},"CVE-2016-1372":{"description":"ClamAV (aka Clam AntiVirus) before 0.99.2 allows remote attackers to cause a denial of service (application crash) via a crafted 7z file.","scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"1.4.3+dfsg-1~deb12u2"},"fixed_version":"0.99.2+dfsg-1","urgency":"not yet assigned"},"bullseye":{"status":"resolved","repositories":{"bullseye":"0.103.10+dfsg-0+deb11u1","bullseye-security":"1.4.3+dfsg-1~deb11u1"},"fixed_version":"0.99.2+dfsg-1","urgency":"not yet assigned"},"forky":{"status":"resolved","repositories":{"forky":"1.4.3+dfsg-2"},"fixed_version":"0.99.2+dfsg-1","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"1.4.3+dfsg-2"},"fixed_version":"0.99.2+dfsg-1","urgency":"not yet assigned"},"trixie":{"status":"resolved","repositories":{"trixie":"1.4.3+dfsg-1"},"fixed_version":"0.99.2+dfsg-1","urgency":"not yet assigned"}}},"CVE-2016-1405":{"description":"libclamav in ClamAV (aka Clam AntiVirus), as used in Advanced Malware Protection (AMP) on Cisco Email Security Appliance (ESA) devices before 9.7.0-125 and Web Security Appliance (WSA) devices before 9.0.1-135 and 9.1.x before 9.1.1-041, allows remote attackers to cause a denial of service (AMP process restart) via a crafted document, aka Bug IDs CSCuv78533 and CSCuw60503.","scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"1.4.3+dfsg-1~deb12u2"},"fixed_version":"0.99+dfsg-1","urgency":"not yet assigned"},"bullseye":{"status":"resolved","repositories":{"bullseye":"0.103.10+dfsg-0+deb11u1","bullseye-security":"1.4.3+dfsg-1~deb11u1"},"fixed_version":"0.99+dfsg-1","urgency":"not yet assigned"},"forky":{"status":"resolved","repositories":{"forky":"1.4.3+dfsg-2"},"fixed_version":"0.99+dfsg-1","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"1.4.3+dfsg-2"},"fixed_version":"0.99+dfsg-1","urgency":"not yet assigned"},"trixie":{"status":"resolved","repositories":{"trixie":"1.4.3+dfsg-1"},"fixed_version":"0.99+dfsg-1","urgency":"not yet assigned"}}},"CVE-2017-11423":{"description":"The cabd_read_string function in mspack/cabd.c in libmspack 0.5alpha, as used in ClamAV 0.99.2 and other products, allows remote attackers to cause a denial of service (stack-based buffer over-read and application crash) via a crafted CAB file.","scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"1.4.3+dfsg-1~deb12u2"},"fixed_version":"0.99.3~beta1+dfsg-1","urgency":"unimportant"},"bullseye":{"status":"resolved","repositories":{"bullseye":"0.103.10+dfsg-0+deb11u1","bullseye-security":"1.4.3+dfsg-1~deb11u1"},"fixed_version":"0.99.3~beta1+dfsg-1","urgency":"unimportant"},"forky":{"status":"resolved","repositories":{"forky":"1.4.3+dfsg-2"},"fixed_version":"0.99.3~beta1+dfsg-1","urgency":"unimportant"},"sid":{"status":"resolved","repositories":{"sid":"1.4.3+dfsg-2"},"fixed_version":"0.99.3~beta1+dfsg-1","urgency":"unimportant"},"trixie":{"status":"resolved","repositories":{"trixie":"1.4.3+dfsg-1"},"fixed_version":"0.99.3~beta1+dfsg-1","urgency":"unimportant"}}},"CVE-2017-12374":{"description":"The ClamAV AntiVirus software versions 0.99.2 and prior contain a vulnerability that could allow an unauthenticated, remote attacker to cause a denial of service (DoS) condition on an affected device. The vulnerability is due to a lack of input validation checking mechanisms during certain mail parsing operations (mbox.c operations on bounce messages). If successfully exploited, the ClamAV software could allow a variable pointing to the mail body which could cause a used after being free (use-after-free) instance which may lead to a disruption of services on an affected device to include a denial of service condition.","debianbug":888484,"scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"1.4.3+dfsg-1~deb12u2"},"fixed_version":"0.99.3~beta2+dfsg-1","urgency":"not yet assigned"},"bullseye":{"status":"resolved","repositories":{"bullseye":"0.103.10+dfsg-0+deb11u1","bullseye-security":"1.4.3+dfsg-1~deb11u1"},"fixed_version":"0.99.3~beta2+dfsg-1","urgency":"not yet assigned"},"forky":{"status":"resolved","repositories":{"forky":"1.4.3+dfsg-2"},"fixed_version":"0.99.3~beta2+dfsg-1","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"1.4.3+dfsg-2"},"fixed_version":"0.99.3~beta2+dfsg-1","urgency":"not yet assigned"},"trixie":{"status":"resolved","repositories":{"trixie":"1.4.3+dfsg-1"},"fixed_version":"0.99.3~beta2+dfsg-1","urgency":"not yet assigned"}}},"CVE-2017-12375":{"description":"The ClamAV AntiVirus software versions 0.99.2 and prior contain a vulnerability that could allow an unauthenticated, remote attacker to cause a denial of service (DoS) condition on an affected device. The vulnerability is due to a lack of input validation checking mechanisms during certain mail parsing functions (the rfc2047 function in mbox.c). An unauthenticated, remote attacker could exploit this vulnerability by sending a crafted email to the affected device. This action could cause a buffer overflow condition when ClamAV scans the malicious email, allowing the attacker to potentially cause a DoS condition on an affected device.","debianbug":888484,"scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"1.4.3+dfsg-1~deb12u2"},"fixed_version":"0.99.3~beta2+dfsg-1","urgency":"not yet assigned"},"bullseye":{"status":"resolved","repositories":{"bullseye":"0.103.10+dfsg-0+deb11u1","bullseye-security":"1.4.3+dfsg-1~deb11u1"},"fixed_version":"0.99.3~beta2+dfsg-1","urgency":"not yet assigned"},"forky":{"status":"resolved","repositories":{"forky":"1.4.3+dfsg-2"},"fixed_version":"0.99.3~beta2+dfsg-1","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"1.4.3+dfsg-2"},"fixed_version":"0.99.3~beta2+dfsg-1","urgency":"not yet assigned"},"trixie":{"status":"resolved","repositories":{"trixie":"1.4.3+dfsg-1"},"fixed_version":"0.99.3~beta2+dfsg-1","urgency":"not yet assigned"}}},"CVE-2017-12376":{"description":"ClamAV AntiVirus software versions 0.99.2 and prior contain a vulnerability that could allow an unauthenticated, remote attacker to cause a denial of service (DoS) condition or potentially execute arbitrary code on an affected device. The vulnerability is due to improper input validation checking mechanisms when handling Portable Document Format (.pdf) files sent to an affected device. An unauthenticated, remote attacker could exploit this vulnerability by sending a crafted .pdf file to an affected device. This action could cause a handle_pdfname (in pdf.c) buffer overflow when ClamAV scans the malicious file, allowing the attacker to cause a DoS condition or potentially execute arbitrary code.","debianbug":888484,"scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"1.4.3+dfsg-1~deb12u2"},"fixed_version":"0.99.3~beta2+dfsg-1","urgency":"not yet assigned"},"bullseye":{"status":"resolved","repositories":{"bullseye":"0.103.10+dfsg-0+deb11u1","bullseye-security":"1.4.3+dfsg-1~deb11u1"},"fixed_version":"0.99.3~beta2+dfsg-1","urgency":"not yet assigned"},"forky":{"status":"resolved","repositories":{"forky":"1.4.3+dfsg-2"},"fixed_version":"0.99.3~beta2+dfsg-1","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"1.4.3+dfsg-2"},"fixed_version":"0.99.3~beta2+dfsg-1","urgency":"not yet assigned"},"trixie":{"status":"resolved","repositories":{"trixie":"1.4.3+dfsg-1"},"fixed_version":"0.99.3~beta2+dfsg-1","urgency":"not yet assigned"}}},"CVE-2017-12377":{"description":"ClamAV AntiVirus software versions 0.99.2 and prior contain a vulnerability that could allow an unauthenticated, remote attacker to cause a denial of service (DoS) condition or potentially execute arbitrary code on an affected device. The vulnerability is due to improper input validation checking mechanisms in mew packet files sent to an affected device. A successful exploit could cause a heap-based buffer over-read condition in mew.c when ClamAV scans the malicious file, allowing the attacker to cause a DoS condition or potentially execute arbitrary code on the affected device.","debianbug":888484,"scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"1.4.3+dfsg-1~deb12u2"},"fixed_version":"0.99.3~beta2+dfsg-1","urgency":"not yet assigned"},"bullseye":{"status":"resolved","repositories":{"bullseye":"0.103.10+dfsg-0+deb11u1","bullseye-security":"1.4.3+dfsg-1~deb11u1"},"fixed_version":"0.99.3~beta2+dfsg-1","urgency":"not yet assigned"},"forky":{"status":"resolved","repositories":{"forky":"1.4.3+dfsg-2"},"fixed_version":"0.99.3~beta2+dfsg-1","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"1.4.3+dfsg-2"},"fixed_version":"0.99.3~beta2+dfsg-1","urgency":"not yet assigned"},"trixie":{"status":"resolved","repositories":{"trixie":"1.4.3+dfsg-1"},"fixed_version":"0.99.3~beta2+dfsg-1","urgency":"not yet assigned"}}},"CVE-2017-12378":{"description":"ClamAV AntiVirus software versions 0.99.2 and prior contain a vulnerability that could allow an unauthenticated, remote attacker to cause a denial of service (DoS) condition on an affected device. The vulnerability is due to improper input validation checking mechanisms of .tar (Tape Archive) files sent to an affected device. A successful exploit could cause a checksum buffer over-read condition when ClamAV scans the malicious .tar file, potentially allowing the attacker to cause a DoS condition on the affected device.","debianbug":888484,"scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"1.4.3+dfsg-1~deb12u2"},"fixed_version":"0.99.3~beta2+dfsg-1","urgency":"not yet assigned"},"bullseye":{"status":"resolved","repositories":{"bullseye":"0.103.10+dfsg-0+deb11u1","bullseye-security":"1.4.3+dfsg-1~deb11u1"},"fixed_version":"0.99.3~beta2+dfsg-1","urgency":"not yet assigned"},"forky":{"status":"resolved","repositories":{"forky":"1.4.3+dfsg-2"},"fixed_version":"0.99.3~beta2+dfsg-1","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"1.4.3+dfsg-2"},"fixed_version":"0.99.3~beta2+dfsg-1","urgency":"not yet assigned"},"trixie":{"status":"resolved","repositories":{"trixie":"1.4.3+dfsg-1"},"fixed_version":"0.99.3~beta2+dfsg-1","urgency":"not yet assigned"}}},"CVE-2017-12379":{"description":"ClamAV AntiVirus software versions 0.99.2 and prior contain a vulnerability that could allow an unauthenticated, remote attacker to cause a denial of service (DoS) condition or potentially execute arbitrary code on an affected device. The vulnerability is due to improper input validation checking mechanisms in the message parsing function on an affected system. An unauthenticated, remote attacker could exploit this vulnerability by sending a crafted email to the affected device. This action could cause a messageAddArgument (in message.c) buffer overflow condition when ClamAV scans the malicious email, allowing the attacker to potentially cause a DoS condition or execute arbitrary code on an affected device.","debianbug":888484,"scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"1.4.3+dfsg-1~deb12u2"},"fixed_version":"0.99.3~beta2+dfsg-1","urgency":"not yet assigned"},"bullseye":{"status":"resolved","repositories":{"bullseye":"0.103.10+dfsg-0+deb11u1","bullseye-security":"1.4.3+dfsg-1~deb11u1"},"fixed_version":"0.99.3~beta2+dfsg-1","urgency":"not yet assigned"},"forky":{"status":"resolved","repositories":{"forky":"1.4.3+dfsg-2"},"fixed_version":"0.99.3~beta2+dfsg-1","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"1.4.3+dfsg-2"},"fixed_version":"0.99.3~beta2+dfsg-1","urgency":"not yet assigned"},"trixie":{"status":"resolved","repositories":{"trixie":"1.4.3+dfsg-1"},"fixed_version":"0.99.3~beta2+dfsg-1","urgency":"not yet assigned"}}},"CVE-2017-12380":{"description":"ClamAV AntiVirus software versions 0.99.2 and prior contain a vulnerability that could allow an unauthenticated, remote attacker to cause a denial of service (DoS) condition on an affected device. The vulnerability is due to improper input validation checking mechanisms in mbox.c during certain mail parsing functions of the ClamAV software. An unauthenticated, remote attacker could exploit this vulnerability by sending a crafted email to the affected device. An exploit could trigger a NULL pointer dereference condition when ClamAV scans the malicious email, which may result in a DoS condition.","debianbug":888484,"scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"1.4.3+dfsg-1~deb12u2"},"fixed_version":"0.99.3~beta2+dfsg-1","urgency":"not yet assigned"},"bullseye":{"status":"resolved","repositories":{"bullseye":"0.103.10+dfsg-0+deb11u1","bullseye-security":"1.4.3+dfsg-1~deb11u1"},"fixed_version":"0.99.3~beta2+dfsg-1","urgency":"not yet assigned"},"forky":{"status":"resolved","repositories":{"forky":"1.4.3+dfsg-2"},"fixed_version":"0.99.3~beta2+dfsg-1","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"1.4.3+dfsg-2"},"fixed_version":"0.99.3~beta2+dfsg-1","urgency":"not yet assigned"},"trixie":{"status":"resolved","repositories":{"trixie":"1.4.3+dfsg-1"},"fixed_version":"0.99.3~beta2+dfsg-1","urgency":"not yet assigned"}}},"CVE-2017-6418":{"description":"libclamav/message.c in ClamAV 0.99.2 allows remote attackers to cause a denial of service (out-of-bounds read) via a crafted e-mail message.","scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"1.4.3+dfsg-1~deb12u2"},"fixed_version":"0.99.3~beta1+dfsg-1","urgency":"not yet assigned"},"bullseye":{"status":"resolved","repositories":{"bullseye":"0.103.10+dfsg-0+deb11u1","bullseye-security":"1.4.3+dfsg-1~deb11u1"},"fixed_version":"0.99.3~beta1+dfsg-1","urgency":"not yet assigned"},"forky":{"status":"resolved","repositories":{"forky":"1.4.3+dfsg-2"},"fixed_version":"0.99.3~beta1+dfsg-1","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"1.4.3+dfsg-2"},"fixed_version":"0.99.3~beta1+dfsg-1","urgency":"not yet assigned"},"trixie":{"status":"resolved","repositories":{"trixie":"1.4.3+dfsg-1"},"fixed_version":"0.99.3~beta1+dfsg-1","urgency":"not yet assigned"}}},"CVE-2017-6419":{"description":"mspack/lzxd.c in libmspack 0.5alpha, as used in ClamAV 0.99.2, allows remote attackers to cause a denial of service (heap-based buffer overflow and application crash) or possibly have unspecified other impact via a crafted CHM file.","scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"1.4.3+dfsg-1~deb12u2"},"fixed_version":"0.99.3~beta1+dfsg-1","urgency":"unimportant"},"bullseye":{"status":"resolved","repositories":{"bullseye":"0.103.10+dfsg-0+deb11u1","bullseye-security":"1.4.3+dfsg-1~deb11u1"},"fixed_version":"0.99.3~beta1+dfsg-1","urgency":"unimportant"},"forky":{"status":"resolved","repositories":{"forky":"1.4.3+dfsg-2"},"fixed_version":"0.99.3~beta1+dfsg-1","urgency":"unimportant"},"sid":{"status":"resolved","repositories":{"sid":"1.4.3+dfsg-2"},"fixed_version":"0.99.3~beta1+dfsg-1","urgency":"unimportant"},"trixie":{"status":"resolved","repositories":{"trixie":"1.4.3+dfsg-1"},"fixed_version":"0.99.3~beta1+dfsg-1","urgency":"unimportant"}}},"CVE-2017-6420":{"description":"The wwunpack function in libclamav/wwunpack.c in ClamAV 0.99.2 allows remote attackers to cause a denial of service (use-after-free) via a crafted PE file with WWPack compression.","scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"1.4.3+dfsg-1~deb12u2"},"fixed_version":"0.99.3~beta1+dfsg-1","urgency":"not yet assigned"},"bullseye":{"status":"resolved","repositories":{"bullseye":"0.103.10+dfsg-0+deb11u1","bullseye-security":"1.4.3+dfsg-1~deb11u1"},"fixed_version":"0.99.3~beta1+dfsg-1","urgency":"not yet assigned"},"forky":{"status":"resolved","repositories":{"forky":"1.4.3+dfsg-2"},"fixed_version":"0.99.3~beta1+dfsg-1","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"1.4.3+dfsg-2"},"fixed_version":"0.99.3~beta1+dfsg-1","urgency":"not yet assigned"},"trixie":{"status":"resolved","repositories":{"trixie":"1.4.3+dfsg-1"},"fixed_version":"0.99.3~beta1+dfsg-1","urgency":"not yet assigned"}}},"CVE-2018-0202":{"description":"clamscan in ClamAV before 0.99.4 contains a vulnerability that could allow an unauthenticated, remote attacker to cause a denial of service (DoS) condition on an affected device. The vulnerability is due to improper input validation checking mechanisms when handling Portable Document Format (.pdf) files sent to an affected device. An unauthenticated, remote attacker could exploit this vulnerability by sending a crafted .pdf file to an affected device. This action could cause an out-of-bounds read when ClamAV scans the malicious file, allowing the attacker to cause a DoS condition. This concerns pdf_parse_array and pdf_parse_string in libclamav/pdfng.c. Cisco Bug IDs: CSCvh91380, CSCvh91400.","scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"1.4.3+dfsg-1~deb12u2"},"fixed_version":"0.100.0~beta+dfsg-2","urgency":"not yet assigned"},"bullseye":{"status":"resolved","repositories":{"bullseye":"0.103.10+dfsg-0+deb11u1","bullseye-security":"1.4.3+dfsg-1~deb11u1"},"fixed_version":"0.100.0~beta+dfsg-2","urgency":"not yet assigned"},"forky":{"status":"resolved","repositories":{"forky":"1.4.3+dfsg-2"},"fixed_version":"0.100.0~beta+dfsg-2","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"1.4.3+dfsg-2"},"fixed_version":"0.100.0~beta+dfsg-2","urgency":"not yet assigned"},"trixie":{"status":"resolved","repositories":{"trixie":"1.4.3+dfsg-1"},"fixed_version":"0.100.0~beta+dfsg-2","urgency":"not yet assigned"}}},"CVE-2018-0360":{"description":"ClamAV before 0.100.1 has an HWP integer overflow with a resultant infinite loop via a crafted Hangul Word Processor file. This is in parsehwp3_paragraph() in libclamav/hwp.c.","scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"1.4.3+dfsg-1~deb12u2"},"fixed_version":"0.100.1+dfsg-1","urgency":"not yet assigned"},"bullseye":{"status":"resolved","repositories":{"bullseye":"0.103.10+dfsg-0+deb11u1","bullseye-security":"1.4.3+dfsg-1~deb11u1"},"fixed_version":"0.100.1+dfsg-1","urgency":"not yet assigned"},"forky":{"status":"resolved","repositories":{"forky":"1.4.3+dfsg-2"},"fixed_version":"0.100.1+dfsg-1","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"1.4.3+dfsg-2"},"fixed_version":"0.100.1+dfsg-1","urgency":"not yet assigned"},"trixie":{"status":"resolved","repositories":{"trixie":"1.4.3+dfsg-1"},"fixed_version":"0.100.1+dfsg-1","urgency":"not yet assigned"}}},"CVE-2018-0361":{"description":"ClamAV before 0.100.1 lacks a PDF object length check, resulting in an unreasonably long time to parse a relatively small file.","scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"1.4.3+dfsg-1~deb12u2"},"fixed_version":"0.100.1+dfsg-1","urgency":"not yet assigned"},"bullseye":{"status":"resolved","repositories":{"bullseye":"0.103.10+dfsg-0+deb11u1","bullseye-security":"1.4.3+dfsg-1~deb11u1"},"fixed_version":"0.100.1+dfsg-1","urgency":"not yet assigned"},"forky":{"status":"resolved","repositories":{"forky":"1.4.3+dfsg-2"},"fixed_version":"0.100.1+dfsg-1","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"1.4.3+dfsg-2"},"fixed_version":"0.100.1+dfsg-1","urgency":"not yet assigned"},"trixie":{"status":"resolved","repositories":{"trixie":"1.4.3+dfsg-1"},"fixed_version":"0.100.1+dfsg-1","urgency":"not yet assigned"}}},"CVE-2018-1000085":{"description":"ClamAV version version 0.99.3 contains a Out of bounds heap memory read vulnerability in XAR parser, function xar_hash_check() that can result in Leaking of memory, may help in developing exploit chains.. This attack appear to be exploitable via The victim must scan a crafted XAR file. This vulnerability appears to have been fixed in after commit d96a6b8bcc7439fa7e3876207aa0a8e79c8451b6.","scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"1.4.3+dfsg-1~deb12u2"},"fixed_version":"0.99.3~beta1+dfsg-1","urgency":"not yet assigned"},"bullseye":{"status":"resolved","repositories":{"bullseye":"0.103.10+dfsg-0+deb11u1","bullseye-security":"1.4.3+dfsg-1~deb11u1"},"fixed_version":"0.99.3~beta1+dfsg-1","urgency":"not yet assigned"},"forky":{"status":"resolved","repositories":{"forky":"1.4.3+dfsg-2"},"fixed_version":"0.99.3~beta1+dfsg-1","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"1.4.3+dfsg-2"},"fixed_version":"0.99.3~beta1+dfsg-1","urgency":"not yet assigned"},"trixie":{"status":"resolved","repositories":{"trixie":"1.4.3+dfsg-1"},"fixed_version":"0.99.3~beta1+dfsg-1","urgency":"not yet assigned"}}},"CVE-2018-15378":{"description":"A vulnerability in ClamAV versions prior to 0.100.2 could allow an attacker to cause a denial of service (DoS) condition. The vulnerability is due to an error related to the MEW unpacker within the \"unmew11()\" function (libclamav/mew.c), which can be exploited to trigger an invalid read memory access via a specially crafted EXE file.","debianbug":910430,"scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"1.4.3+dfsg-1~deb12u2"},"fixed_version":"0.100.2+dfsg-1","urgency":"not yet assigned"},"bullseye":{"status":"resolved","repositories":{"bullseye":"0.103.10+dfsg-0+deb11u1","bullseye-security":"1.4.3+dfsg-1~deb11u1"},"fixed_version":"0.100.2+dfsg-1","urgency":"not yet assigned"},"forky":{"status":"resolved","repositories":{"forky":"1.4.3+dfsg-2"},"fixed_version":"0.100.2+dfsg-1","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"1.4.3+dfsg-2"},"fixed_version":"0.100.2+dfsg-1","urgency":"not yet assigned"},"trixie":{"status":"resolved","repositories":{"trixie":"1.4.3+dfsg-1"},"fixed_version":"0.100.2+dfsg-1","urgency":"not yet assigned"}}},"CVE-2019-12625":{"description":"ClamAV versions prior to 0.101.3 are susceptible to a zip bomb vulnerability where an unauthenticated attacker can cause a denial of service condition by sending crafted messages to an affected system.","debianbug":934359,"scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"1.4.3+dfsg-1~deb12u2"},"fixed_version":"0.101.4+dfsg-1","urgency":"not yet assigned"},"bullseye":{"status":"resolved","repositories":{"bullseye":"0.103.10+dfsg-0+deb11u1","bullseye-security":"1.4.3+dfsg-1~deb11u1"},"fixed_version":"0.101.4+dfsg-1","urgency":"not yet assigned"},"forky":{"status":"resolved","repositories":{"forky":"1.4.3+dfsg-2"},"fixed_version":"0.101.4+dfsg-1","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"1.4.3+dfsg-2"},"fixed_version":"0.101.4+dfsg-1","urgency":"not yet assigned"},"trixie":{"status":"resolved","repositories":{"trixie":"1.4.3+dfsg-1"},"fixed_version":"0.101.4+dfsg-1","urgency":"not yet assigned"}}},"CVE-2019-12900":{"description":"BZ2_decompress in decompress.c in bzip2 through 1.0.6 has an out-of-bounds write when there are many selectors.","debianbug":934359,"scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"1.4.3+dfsg-1~deb12u2"},"fixed_version":"0.101.4+dfsg-1","urgency":"not yet assigned"},"bullseye":{"status":"resolved","repositories":{"bullseye":"0.103.10+dfsg-0+deb11u1","bullseye-security":"1.4.3+dfsg-1~deb11u1"},"fixed_version":"0.101.4+dfsg-1","urgency":"not yet assigned"},"forky":{"status":"resolved","repositories":{"forky":"1.4.3+dfsg-2"},"fixed_version":"0.101.4+dfsg-1","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"1.4.3+dfsg-2"},"fixed_version":"0.101.4+dfsg-1","urgency":"not yet assigned"},"trixie":{"status":"resolved","repositories":{"trixie":"1.4.3+dfsg-1"},"fixed_version":"0.101.4+dfsg-1","urgency":"not yet assigned"}}},"CVE-2019-15961":{"description":"A vulnerability in the email parsing module Clam AntiVirus (ClamAV) Software versions 0.102.0, 0.101.4 and prior could allow an unauthenticated, remote attacker to cause a denial of service condition on an affected device. The vulnerability is due to inefficient MIME parsing routines that result in extremely long scan times of specially formatted email files. An attacker could exploit this vulnerability by sending a crafted email file to an affected device. An exploit could allow the attacker to cause the ClamAV scanning process to scan the crafted email file indefinitely, resulting in a denial of service condition.","debianbug":945265,"scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"1.4.3+dfsg-1~deb12u2"},"fixed_version":"0.102.1+dfsg-1","urgency":"not yet assigned"},"bullseye":{"status":"resolved","repositories":{"bullseye":"0.103.10+dfsg-0+deb11u1","bullseye-security":"1.4.3+dfsg-1~deb11u1"},"fixed_version":"0.102.1+dfsg-1","urgency":"not yet assigned"},"forky":{"status":"resolved","repositories":{"forky":"1.4.3+dfsg-2"},"fixed_version":"0.102.1+dfsg-1","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"1.4.3+dfsg-2"},"fixed_version":"0.102.1+dfsg-1","urgency":"not yet assigned"},"trixie":{"status":"resolved","repositories":{"trixie":"1.4.3+dfsg-1"},"fixed_version":"0.102.1+dfsg-1","urgency":"not yet assigned"}}},"CVE-2019-1785":{"description":"A vulnerability in the RAR file scanning functionality of Clam AntiVirus (ClamAV) Software versions 0.101.1 and 0.101.0 could allow an unauthenticated, remote attacker to cause a denial of service condition on an affected device. The vulnerability is due to a lack of proper error-handling mechanisms when processing nested RAR files sent to an affected device. An attacker could exploit this vulnerability by sending a crafted RAR file to an affected device. An exploit could allow the attacker to view or create arbitrary files on the targeted system.","scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"1.4.3+dfsg-1~deb12u2"},"fixed_version":"0.101.2+dfsg-1","urgency":"not yet assigned"},"bullseye":{"status":"resolved","repositories":{"bullseye":"0.103.10+dfsg-0+deb11u1","bullseye-security":"1.4.3+dfsg-1~deb11u1"},"fixed_version":"0.101.2+dfsg-1","urgency":"not yet assigned"},"forky":{"status":"resolved","repositories":{"forky":"1.4.3+dfsg-2"},"fixed_version":"0.101.2+dfsg-1","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"1.4.3+dfsg-2"},"fixed_version":"0.101.2+dfsg-1","urgency":"not yet assigned"},"trixie":{"status":"resolved","repositories":{"trixie":"1.4.3+dfsg-1"},"fixed_version":"0.101.2+dfsg-1","urgency":"not yet assigned"}}},"CVE-2019-1786":{"description":"A vulnerability in the Portable Document Format (PDF) scanning functionality of Clam AntiVirus (ClamAV) Software versions 0.101.1 and 0.101.0 could allow an unauthenticated, remote attacker to cause a denial of service (DoS) condition on an affected device. The vulnerability is due to a lack of proper data handling mechanisms within the device buffer while indexing remaining file data on an affected device. An attacker could exploit this vulnerability by sending crafted PDF files to an affected device. A successful exploit could allow the attacker to cause an out-of-bounds read condition, resulting in a crash that could result in a denial of service condition on an affected device.","scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"1.4.3+dfsg-1~deb12u2"},"fixed_version":"0.101.2+dfsg-1","urgency":"not yet assigned"},"bullseye":{"status":"resolved","repositories":{"bullseye":"0.103.10+dfsg-0+deb11u1","bullseye-security":"1.4.3+dfsg-1~deb11u1"},"fixed_version":"0.101.2+dfsg-1","urgency":"not yet assigned"},"forky":{"status":"resolved","repositories":{"forky":"1.4.3+dfsg-2"},"fixed_version":"0.101.2+dfsg-1","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"1.4.3+dfsg-2"},"fixed_version":"0.101.2+dfsg-1","urgency":"not yet assigned"},"trixie":{"status":"resolved","repositories":{"trixie":"1.4.3+dfsg-1"},"fixed_version":"0.101.2+dfsg-1","urgency":"not yet assigned"}}},"CVE-2019-1787":{"description":"A vulnerability in the Portable Document Format (PDF) scanning functionality of Clam AntiVirus (ClamAV) Software versions 0.101.1 and prior could allow an unauthenticated, remote attacker to cause a denial of service (DoS) condition on an affected device. The vulnerability is due to a lack of proper data handling mechanisms within the device buffer while indexing remaining file data on an affected device. An attacker could exploit this vulnerability by sending crafted PDF files to an affected device. A successful exploit could allow the attacker to cause a heap buffer out-of-bounds read condition, resulting in a crash that could result in a denial of service condition on an affected device.","scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"1.4.3+dfsg-1~deb12u2"},"fixed_version":"0.101.2+dfsg-1","urgency":"not yet assigned"},"bullseye":{"status":"resolved","repositories":{"bullseye":"0.103.10+dfsg-0+deb11u1","bullseye-security":"1.4.3+dfsg-1~deb11u1"},"fixed_version":"0.101.2+dfsg-1","urgency":"not yet assigned"},"forky":{"status":"resolved","repositories":{"forky":"1.4.3+dfsg-2"},"fixed_version":"0.101.2+dfsg-1","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"1.4.3+dfsg-2"},"fixed_version":"0.101.2+dfsg-1","urgency":"not yet assigned"},"trixie":{"status":"resolved","repositories":{"trixie":"1.4.3+dfsg-1"},"fixed_version":"0.101.2+dfsg-1","urgency":"not yet assigned"}}},"CVE-2019-1788":{"description":"A vulnerability in the Object Linking & Embedding (OLE2) file scanning functionality of Clam AntiVirus (ClamAV) Software versions 0.101.1 and prior could allow an unauthenticated, remote attacker to cause a denial of service condition on an affected device. The vulnerability is due to a lack of proper input and validation checking mechanisms for OLE2 files sent an affected device. An attacker could exploit this vulnerability by sending malformed OLE2 files to the device running an affected version ClamAV Software. An exploit could allow the attacker to cause an out-of-bounds write condition, resulting in a crash that could result in a denial of service condition on an affected device.","scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"1.4.3+dfsg-1~deb12u2"},"fixed_version":"0.101.2+dfsg-1","urgency":"not yet assigned"},"bullseye":{"status":"resolved","repositories":{"bullseye":"0.103.10+dfsg-0+deb11u1","bullseye-security":"1.4.3+dfsg-1~deb11u1"},"fixed_version":"0.101.2+dfsg-1","urgency":"not yet assigned"},"forky":{"status":"resolved","repositories":{"forky":"1.4.3+dfsg-2"},"fixed_version":"0.101.2+dfsg-1","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"1.4.3+dfsg-2"},"fixed_version":"0.101.2+dfsg-1","urgency":"not yet assigned"},"trixie":{"status":"resolved","repositories":{"trixie":"1.4.3+dfsg-1"},"fixed_version":"0.101.2+dfsg-1","urgency":"not yet assigned"}}},"CVE-2019-1789":{"description":"ClamAV versions prior to 0.101.2 are susceptible to a denial of service (DoS) vulnerability. An out-of-bounds heap read condition may occur when scanning PE files. An example is Windows EXE and DLL files that have been packed using Aspack as a result of inadequate bound-checking.","scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"1.4.3+dfsg-1~deb12u2"},"fixed_version":"0.101.2+dfsg-1","urgency":"not yet assigned"},"bullseye":{"status":"resolved","repositories":{"bullseye":"0.103.10+dfsg-0+deb11u1","bullseye-security":"1.4.3+dfsg-1~deb11u1"},"fixed_version":"0.101.2+dfsg-1","urgency":"not yet assigned"},"forky":{"status":"resolved","repositories":{"forky":"1.4.3+dfsg-2"},"fixed_version":"0.101.2+dfsg-1","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"1.4.3+dfsg-2"},"fixed_version":"0.101.2+dfsg-1","urgency":"not yet assigned"},"trixie":{"status":"resolved","repositories":{"trixie":"1.4.3+dfsg-1"},"fixed_version":"0.101.2+dfsg-1","urgency":"not yet assigned"}}},"CVE-2019-1798":{"description":"A vulnerability in the Portable Executable (PE) file scanning functionality of Clam AntiVirus (ClamAV) Software versions 0.101.1 and prior could allow an unauthenticated, remote attacker to cause a denial of service condition on an affected device. The vulnerability is due to a lack of proper input and validation checking mechanisms for PE files sent an affected device. An attacker could exploit this vulnerability by sending malformed PE files to the device running an affected version ClamAV Software. An exploit could allow the attacker to cause an out-of-bounds read condition, resulting in a crash that could result in a denial of service condition on an affected device.","scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"1.4.3+dfsg-1~deb12u2"},"fixed_version":"0.101.2+dfsg-1","urgency":"not yet assigned"},"bullseye":{"status":"resolved","repositories":{"bullseye":"0.103.10+dfsg-0+deb11u1","bullseye-security":"1.4.3+dfsg-1~deb11u1"},"fixed_version":"0.101.2+dfsg-1","urgency":"not yet assigned"},"forky":{"status":"resolved","repositories":{"forky":"1.4.3+dfsg-2"},"fixed_version":"0.101.2+dfsg-1","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"1.4.3+dfsg-2"},"fixed_version":"0.101.2+dfsg-1","urgency":"not yet assigned"},"trixie":{"status":"resolved","repositories":{"trixie":"1.4.3+dfsg-1"},"fixed_version":"0.101.2+dfsg-1","urgency":"not yet assigned"}}},"CVE-2020-3123":{"description":"A vulnerability in the Data-Loss-Prevention (DLP) module in Clam AntiVirus (ClamAV) Software versions 0.102.1 and 0.102.0 could allow an unauthenticated, remote attacker to cause a denial of service condition on an affected device. The vulnerability is due to an out-of-bounds read affecting users that have enabled the optional DLP feature. An attacker could exploit this vulnerability by sending a crafted email file to an affected device. An exploit could allow the attacker to cause the ClamAV scanning process crash, resulting in a denial of service condition.","debianbug":950944,"scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"1.4.3+dfsg-1~deb12u2"},"fixed_version":"0.102.2+dfsg-1","urgency":"not yet assigned"},"bullseye":{"status":"resolved","repositories":{"bullseye":"0.103.10+dfsg-0+deb11u1","bullseye-security":"1.4.3+dfsg-1~deb11u1"},"fixed_version":"0.102.2+dfsg-1","urgency":"not yet assigned"},"forky":{"status":"resolved","repositories":{"forky":"1.4.3+dfsg-2"},"fixed_version":"0.102.2+dfsg-1","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"1.4.3+dfsg-2"},"fixed_version":"0.102.2+dfsg-1","urgency":"not yet assigned"},"trixie":{"status":"resolved","repositories":{"trixie":"1.4.3+dfsg-1"},"fixed_version":"0.102.2+dfsg-1","urgency":"not yet assigned"}}},"CVE-2020-3327":{"description":"A vulnerability in the ARJ archive parsing module in Clam AntiVirus (ClamAV) Software versions 0.102.2 could allow an unauthenticated, remote attacker to cause a denial of service condition on an affected device. The vulnerability is due to a heap buffer overflow read. An attacker could exploit this vulnerability by sending a crafted ARJ file to an affected device. An exploit could allow the attacker to cause the ClamAV scanning process crash, resulting in a denial of service condition.","scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"1.4.3+dfsg-1~deb12u2"},"fixed_version":"0.102.4+dfsg-1","urgency":"not yet assigned"},"bullseye":{"status":"resolved","repositories":{"bullseye":"0.103.10+dfsg-0+deb11u1","bullseye-security":"1.4.3+dfsg-1~deb11u1"},"fixed_version":"0.102.4+dfsg-1","urgency":"not yet assigned"},"forky":{"status":"resolved","repositories":{"forky":"1.4.3+dfsg-2"},"fixed_version":"0.102.4+dfsg-1","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"1.4.3+dfsg-2"},"fixed_version":"0.102.4+dfsg-1","urgency":"not yet assigned"},"trixie":{"status":"resolved","repositories":{"trixie":"1.4.3+dfsg-1"},"fixed_version":"0.102.4+dfsg-1","urgency":"not yet assigned"}}},"CVE-2020-3341":{"description":"A vulnerability in the PDF archive parsing module in Clam AntiVirus (ClamAV) Software versions 0.101 - 0.102.2 could allow an unauthenticated, remote attacker to cause a denial of service condition on an affected device. The vulnerability is due to a stack buffer overflow read. An attacker could exploit this vulnerability by sending a crafted PDF file to an affected device. An exploit could allow the attacker to cause the ClamAV scanning process crash, resulting in a denial of service condition.","scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"1.4.3+dfsg-1~deb12u2"},"fixed_version":"0.102.3+dfsg-1","urgency":"not yet assigned"},"bullseye":{"status":"resolved","repositories":{"bullseye":"0.103.10+dfsg-0+deb11u1","bullseye-security":"1.4.3+dfsg-1~deb11u1"},"fixed_version":"0.102.3+dfsg-1","urgency":"not yet assigned"},"forky":{"status":"resolved","repositories":{"forky":"1.4.3+dfsg-2"},"fixed_version":"0.102.3+dfsg-1","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"1.4.3+dfsg-2"},"fixed_version":"0.102.3+dfsg-1","urgency":"not yet assigned"},"trixie":{"status":"resolved","repositories":{"trixie":"1.4.3+dfsg-1"},"fixed_version":"0.102.3+dfsg-1","urgency":"not yet assigned"}}},"CVE-2020-3350":{"description":"A vulnerability in the endpoint software of Cisco AMP for Endpoints and Clam AntiVirus could allow an authenticated, local attacker to cause the running software to delete arbitrary files on the system. The vulnerability is due to a race condition that could occur when scanning malicious files. An attacker with local shell access could exploit this vulnerability by executing a script that could trigger the race condition. A successful exploit could allow the attacker to delete arbitrary files on the system that the attacker would not normally have privileges to delete, producing system instability or causing the endpoint software to stop working.","scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"1.4.3+dfsg-1~deb12u2"},"fixed_version":"0.102.4+dfsg-1","urgency":"not yet assigned"},"bullseye":{"status":"resolved","repositories":{"bullseye":"0.103.10+dfsg-0+deb11u1","bullseye-security":"1.4.3+dfsg-1~deb11u1"},"fixed_version":"0.102.4+dfsg-1","urgency":"not yet assigned"},"forky":{"status":"resolved","repositories":{"forky":"1.4.3+dfsg-2"},"fixed_version":"0.102.4+dfsg-1","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"1.4.3+dfsg-2"},"fixed_version":"0.102.4+dfsg-1","urgency":"not yet assigned"},"trixie":{"status":"resolved","repositories":{"trixie":"1.4.3+dfsg-1"},"fixed_version":"0.102.4+dfsg-1","urgency":"not yet assigned"}}},"CVE-2020-3481":{"description":"A vulnerability in the EGG archive parsing module in Clam AntiVirus (ClamAV) Software versions 0.102.0 - 0.102.3 could allow an unauthenticated, remote attacker to cause a denial of service condition on an affected device. The vulnerability is due to a null pointer dereference. An attacker could exploit this vulnerability by sending a crafted EGG file to an affected device. An exploit could allow the attacker to cause the ClamAV scanning process crash, resulting in a denial of service condition.","scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"1.4.3+dfsg-1~deb12u2"},"fixed_version":"0.102.4+dfsg-1","urgency":"not yet assigned"},"bullseye":{"status":"resolved","repositories":{"bullseye":"0.103.10+dfsg-0+deb11u1","bullseye-security":"1.4.3+dfsg-1~deb11u1"},"fixed_version":"0.102.4+dfsg-1","urgency":"not yet assigned"},"forky":{"status":"resolved","repositories":{"forky":"1.4.3+dfsg-2"},"fixed_version":"0.102.4+dfsg-1","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"1.4.3+dfsg-2"},"fixed_version":"0.102.4+dfsg-1","urgency":"not yet assigned"},"trixie":{"status":"resolved","repositories":{"trixie":"1.4.3+dfsg-1"},"fixed_version":"0.102.4+dfsg-1","urgency":"not yet assigned"}}},"CVE-2020-37167":{"description":"ClamAV versions prior to 0.103.0-rc contain a vulnerability in function name processing through the\u00a0ClamBC bytecode interpreter that allows attackers to manipulate bytecode function names. Attackers can exploit the weak input validation in function name encoding to potentially execute malicious bytecode or cause unexpected behavior in the ClamAV engine.","scope":"local","releases":{"bookworm":{"status":"undetermined","repositories":{"bookworm":"1.4.3+dfsg-1~deb12u2"},"urgency":"not yet assigned"},"bullseye":{"status":"undetermined","repositories":{"bullseye":"0.103.10+dfsg-0+deb11u1","bullseye-security":"1.4.3+dfsg-1~deb11u1"},"urgency":"not yet assigned"},"forky":{"status":"undetermined","repositories":{"forky":"1.4.3+dfsg-2"},"urgency":"not yet assigned"},"sid":{"status":"undetermined","repositories":{"sid":"1.4.3+dfsg-2"},"urgency":"not yet assigned"},"trixie":{"status":"undetermined","repositories":{"trixie":"1.4.3+dfsg-1"},"urgency":"not yet assigned"}}},"CVE-2021-1252":{"description":"A vulnerability in the Excel XLM macro parsing module in Clam AntiVirus (ClamAV) Software versions 0.103.0 and 0.103.1 could allow an unauthenticated, remote attacker to cause a denial of service condition on an affected device. The vulnerability is due to improper error handling that may result in an infinite loop. An attacker could exploit this vulnerability by sending a crafted Excel file to an affected device. An exploit could allow the attacker to cause the ClamAV scanning process hang, resulting in a denial of service condition.","debianbug":986622,"scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"1.4.3+dfsg-1~deb12u2"},"fixed_version":"0.103.2+dfsg-1","urgency":"not yet assigned"},"bullseye":{"status":"resolved","repositories":{"bullseye":"0.103.10+dfsg-0+deb11u1","bullseye-security":"1.4.3+dfsg-1~deb11u1"},"fixed_version":"0.103.2+dfsg-1","urgency":"not yet assigned"},"forky":{"status":"resolved","repositories":{"forky":"1.4.3+dfsg-2"},"fixed_version":"0.103.2+dfsg-1","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"1.4.3+dfsg-2"},"fixed_version":"0.103.2+dfsg-1","urgency":"not yet assigned"},"trixie":{"status":"resolved","repositories":{"trixie":"1.4.3+dfsg-1"},"fixed_version":"0.103.2+dfsg-1","urgency":"not yet assigned"}}},"CVE-2021-1404":{"description":"A vulnerability in the PDF parsing module in Clam AntiVirus (ClamAV) Software versions 0.103.0 and 0.103.1 could allow an unauthenticated, remote attacker to cause a denial of service condition on an affected device. The vulnerability is due to improper buffer size tracking that may result in a heap buffer over-read. An attacker could exploit this vulnerability by sending a crafted PDF file to an affected device. An exploit could allow the attacker to cause the ClamAV scanning process to crash, resulting in a denial of service condition.","debianbug":986622,"scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"1.4.3+dfsg-1~deb12u2"},"fixed_version":"0.103.2+dfsg-1","urgency":"not yet assigned"},"bullseye":{"status":"resolved","repositories":{"bullseye":"0.103.10+dfsg-0+deb11u1","bullseye-security":"1.4.3+dfsg-1~deb11u1"},"fixed_version":"0.103.2+dfsg-1","urgency":"not yet assigned"},"forky":{"status":"resolved","repositories":{"forky":"1.4.3+dfsg-2"},"fixed_version":"0.103.2+dfsg-1","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"1.4.3+dfsg-2"},"fixed_version":"0.103.2+dfsg-1","urgency":"not yet assigned"},"trixie":{"status":"resolved","repositories":{"trixie":"1.4.3+dfsg-1"},"fixed_version":"0.103.2+dfsg-1","urgency":"not yet assigned"}}},"CVE-2021-1405":{"description":"A vulnerability in the email parsing module in Clam AntiVirus (ClamAV) Software version 0.103.1 and all prior versions could allow an unauthenticated, remote attacker to cause a denial of service condition on an affected device. The vulnerability is due to improper variable initialization that may result in an NULL pointer read. An attacker could exploit this vulnerability by sending a crafted email to an affected device. An exploit could allow the attacker to cause the ClamAV scanning process crash, resulting in a denial of service condition.","debianbug":986622,"scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"1.4.3+dfsg-1~deb12u2"},"fixed_version":"0.103.2+dfsg-1","urgency":"not yet assigned"},"bullseye":{"status":"resolved","repositories":{"bullseye":"0.103.10+dfsg-0+deb11u1","bullseye-security":"1.4.3+dfsg-1~deb11u1"},"fixed_version":"0.103.2+dfsg-1","urgency":"not yet assigned"},"forky":{"status":"resolved","repositories":{"forky":"1.4.3+dfsg-2"},"fixed_version":"0.103.2+dfsg-1","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"1.4.3+dfsg-2"},"fixed_version":"0.103.2+dfsg-1","urgency":"not yet assigned"},"trixie":{"status":"resolved","repositories":{"trixie":"1.4.3+dfsg-1"},"fixed_version":"0.103.2+dfsg-1","urgency":"not yet assigned"}}},"CVE-2022-20698":{"description":"A vulnerability in the OOXML parsing module in Clam AntiVirus (ClamAV) Software version 0.104.1 and LTS version 0.103.4 and prior versions could allow an unauthenticated, remote attacker to cause a denial of service condition on an affected device. The vulnerability is due to improper checks that may result in an invalid pointer read. An attacker could exploit this vulnerability by sending a crafted OOXML file to an affected device. An exploit could allow the attacker to cause the ClamAV scanning process to crash, resulting in a denial of service condition.","scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"1.4.3+dfsg-1~deb12u2"},"fixed_version":"0.103.5+dfsg-1","urgency":"not yet assigned"},"bullseye":{"status":"resolved","repositories":{"bullseye":"0.103.10+dfsg-0+deb11u1","bullseye-security":"1.4.3+dfsg-1~deb11u1"},"fixed_version":"0.103.5+dfsg-0+deb11u1","urgency":"not yet assigned"},"forky":{"status":"resolved","repositories":{"forky":"1.4.3+dfsg-2"},"fixed_version":"0.103.5+dfsg-1","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"1.4.3+dfsg-2"},"fixed_version":"0.103.5+dfsg-1","urgency":"not yet assigned"},"trixie":{"status":"resolved","repositories":{"trixie":"1.4.3+dfsg-1"},"fixed_version":"0.103.5+dfsg-1","urgency":"not yet assigned"}}},"CVE-2022-20770":{"description":"On April 20, 2022, the following vulnerability in the ClamAV scanning library versions 0.103.5 and earlier and 0.104.2 and earlier was disclosed: A vulnerability in CHM file parser of Clam AntiVirus (ClamAV) versions 0.104.0 through 0.104.2 and LTS version 0.103.5 and prior versions could allow an unauthenticated, remote attacker to cause a denial of service condition on an affected device. For a description of this vulnerability, see the ClamAV blog. This advisory will be updated as additional information becomes available.","scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"1.4.3+dfsg-1~deb12u2"},"fixed_version":"0.103.6+dfsg-1","urgency":"not yet assigned"},"bullseye":{"status":"resolved","repositories":{"bullseye":"0.103.10+dfsg-0+deb11u1","bullseye-security":"1.4.3+dfsg-1~deb11u1"},"fixed_version":"0.103.6+dfsg-0+deb11u1","urgency":"not yet assigned"},"forky":{"status":"resolved","repositories":{"forky":"1.4.3+dfsg-2"},"fixed_version":"0.103.6+dfsg-1","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"1.4.3+dfsg-2"},"fixed_version":"0.103.6+dfsg-1","urgency":"not yet assigned"},"trixie":{"status":"resolved","repositories":{"trixie":"1.4.3+dfsg-1"},"fixed_version":"0.103.6+dfsg-1","urgency":"not yet assigned"}}},"CVE-2022-20771":{"description":"On April 20, 2022, the following vulnerability in the ClamAV scanning library versions 0.103.5 and earlier and 0.104.2 and earlier was disclosed: A vulnerability in the TIFF file parser of Clam AntiVirus (ClamAV) versions 0.104.0 through 0.104.2 and LTS version 0.103.5 and prior versions could allow an unauthenticated, remote attacker to cause a denial of service condition on an affected device. For a description of this vulnerability, see the ClamAV blog. This advisory will be updated as additional information becomes available.","scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"1.4.3+dfsg-1~deb12u2"},"fixed_version":"0.103.6+dfsg-1","urgency":"not yet assigned"},"bullseye":{"status":"resolved","repositories":{"bullseye":"0.103.10+dfsg-0+deb11u1","bullseye-security":"1.4.3+dfsg-1~deb11u1"},"fixed_version":"0.103.6+dfsg-0+deb11u1","urgency":"not yet assigned"},"forky":{"status":"resolved","repositories":{"forky":"1.4.3+dfsg-2"},"fixed_version":"0.103.6+dfsg-1","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"1.4.3+dfsg-2"},"fixed_version":"0.103.6+dfsg-1","urgency":"not yet assigned"},"trixie":{"status":"resolved","repositories":{"trixie":"1.4.3+dfsg-1"},"fixed_version":"0.103.6+dfsg-1","urgency":"not yet assigned"}}},"CVE-2022-20785":{"description":"On April 20, 2022, the following vulnerability in the ClamAV scanning library versions 0.103.5 and earlier and 0.104.2 and earlier was disclosed: A vulnerability in HTML file parser of Clam AntiVirus (ClamAV) versions 0.104.0 through 0.104.2 and LTS version 0.103.5 and prior versions could allow an unauthenticated, remote attacker to cause a denial of service condition on an affected device. For a description of this vulnerability, see the ClamAV blog. This advisory will be updated as additional information becomes available.","scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"1.4.3+dfsg-1~deb12u2"},"fixed_version":"0.103.6+dfsg-1","urgency":"not yet assigned"},"bullseye":{"status":"resolved","repositories":{"bullseye":"0.103.10+dfsg-0+deb11u1","bullseye-security":"1.4.3+dfsg-1~deb11u1"},"fixed_version":"0.103.6+dfsg-0+deb11u1","urgency":"not yet assigned"},"forky":{"status":"resolved","repositories":{"forky":"1.4.3+dfsg-2"},"fixed_version":"0.103.6+dfsg-1","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"1.4.3+dfsg-2"},"fixed_version":"0.103.6+dfsg-1","urgency":"not yet assigned"},"trixie":{"status":"resolved","repositories":{"trixie":"1.4.3+dfsg-1"},"fixed_version":"0.103.6+dfsg-1","urgency":"not yet assigned"}}},"CVE-2022-20792":{"description":"A vulnerability in the regex module used by the signature database load module of Clam AntiVirus (ClamAV) versions 0.104.0 through 0.104.2 and LTS version 0.103.5 and prior versions could allow an authenticated, local attacker to crash ClamAV at database load time, and possibly gain code execution. The vulnerability is due to improper bounds checking that may result in a multi-byte heap buffer overwflow write. An attacker could exploit this vulnerability by placing a crafted CDB ClamAV signature database file in the ClamAV database directory. An exploit could allow the attacker to run code as the clamav user.","scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"1.4.3+dfsg-1~deb12u2"},"fixed_version":"0.103.6+dfsg-1","urgency":"not yet assigned"},"bullseye":{"status":"resolved","repositories":{"bullseye":"0.103.10+dfsg-0+deb11u1","bullseye-security":"1.4.3+dfsg-1~deb11u1"},"fixed_version":"0.103.6+dfsg-0+deb11u1","urgency":"not yet assigned"},"forky":{"status":"resolved","repositories":{"forky":"1.4.3+dfsg-2"},"fixed_version":"0.103.6+dfsg-1","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"1.4.3+dfsg-2"},"fixed_version":"0.103.6+dfsg-1","urgency":"not yet assigned"},"trixie":{"status":"resolved","repositories":{"trixie":"1.4.3+dfsg-1"},"fixed_version":"0.103.6+dfsg-1","urgency":"not yet assigned"}}},"CVE-2022-20796":{"description":"On May 4, 2022, the following vulnerability in the ClamAV scanning library versions 0.103.5 and earlier and 0.104.2 and earlier was disclosed: A vulnerability in Clam AntiVirus (ClamAV) versions 0.103.4, 0.103.5, 0.104.1, and 0.104.2 could allow an authenticated, local attacker to cause a denial of service condition on an affected device. For a description of this vulnerability, see the ClamAV blog.","scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"1.4.3+dfsg-1~deb12u2"},"fixed_version":"0.103.6+dfsg-1","urgency":"not yet assigned"},"bullseye":{"status":"resolved","repositories":{"bullseye":"0.103.10+dfsg-0+deb11u1","bullseye-security":"1.4.3+dfsg-1~deb11u1"},"fixed_version":"0.103.6+dfsg-0+deb11u1","urgency":"not yet assigned"},"forky":{"status":"resolved","repositories":{"forky":"1.4.3+dfsg-2"},"fixed_version":"0.103.6+dfsg-1","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"1.4.3+dfsg-2"},"fixed_version":"0.103.6+dfsg-1","urgency":"not yet assigned"},"trixie":{"status":"resolved","repositories":{"trixie":"1.4.3+dfsg-1"},"fixed_version":"0.103.6+dfsg-1","urgency":"not yet assigned"}}},"CVE-2022-20803":{"description":"A vulnerability in the OLE2 file parser of Clam AntiVirus (ClamAV) versions 0.104.0 through 0.104.2 could allow an unauthenticated, remote attacker to cause a denial of service condition on an affected device.The vulnerability is due to incorrect use of the realloc function that may result in a double-free. An attacker could exploit this vulnerability by submitting a crafted OLE2 file to be scanned by ClamAV on the affected device. An exploit could allow the attacker to cause the ClamAV scanning process to crash, resulting in a denial of service condition.","scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"1.4.3+dfsg-1~deb12u2"},"fixed_version":"0","urgency":"unimportant"},"bullseye":{"status":"resolved","repositories":{"bullseye":"0.103.10+dfsg-0+deb11u1","bullseye-security":"1.4.3+dfsg-1~deb11u1"},"fixed_version":"0","urgency":"unimportant"},"forky":{"status":"resolved","repositories":{"forky":"1.4.3+dfsg-2"},"fixed_version":"0","urgency":"unimportant"},"sid":{"status":"resolved","repositories":{"sid":"1.4.3+dfsg-2"},"fixed_version":"0","urgency":"unimportant"},"trixie":{"status":"resolved","repositories":{"trixie":"1.4.3+dfsg-1"},"fixed_version":"0","urgency":"unimportant"}}},"CVE-2023-20032":{"description":"On Feb 15, 2023, the following vulnerability in the ClamAV scanning library was disclosed:\r \r \r A vulnerability in the HFS+ partition file parser of ClamAV versions 1.0.0 and earlier, 0.105.1 and earlier, and 0.103.7 and earlier could allow an unauthenticated, remote attacker to execute arbitrary code.\r \r \r This vulnerability is due to a missing buffer size check that may result in a heap buffer overflow write. An attacker could exploit this vulnerability by submitting a crafted HFS+ partition file to be scanned by ClamAV on an affected device. A successful exploit could allow the attacker to execute arbitrary code with the privileges of the ClamAV scanning process, or else crash the process, resulting in a denial of service (DoS) condition.\r \r For a description of this vulnerability, see the ClamAV blog [\"https://blog.clamav.net/\"].","debianbug":1031509,"scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"1.4.3+dfsg-1~deb12u2"},"fixed_version":"1.0.1+dfsg-1","urgency":"not yet assigned"},"bullseye":{"status":"resolved","repositories":{"bullseye":"0.103.10+dfsg-0+deb11u1","bullseye-security":"1.4.3+dfsg-1~deb11u1"},"fixed_version":"0.103.8+dfsg-0+deb11u1","urgency":"not yet assigned"},"forky":{"status":"resolved","repositories":{"forky":"1.4.3+dfsg-2"},"fixed_version":"1.0.1+dfsg-1","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"1.4.3+dfsg-2"},"fixed_version":"1.0.1+dfsg-1","urgency":"not yet assigned"},"trixie":{"status":"resolved","repositories":{"trixie":"1.4.3+dfsg-1"},"fixed_version":"1.0.1+dfsg-1","urgency":"not yet assigned"}}},"CVE-2023-20052":{"description":"On Feb 15, 2023, the following vulnerability in the ClamAV scanning library was disclosed:\r \r \r A vulnerability in the DMG file parser of ClamAV versions 1.0.0 and earlier, 0.105.1 and earlier, and 0.103.7 and earlier could allow an unauthenticated, remote attacker to access sensitive information on an affected device.\r \r \r This vulnerability is due to enabling XML entity substitution that may result in XML external entity injection. An attacker could exploit this vulnerability by submitting a crafted DMG file to be scanned by ClamAV on an affected device. A successful exploit could allow the attacker to leak bytes from any file that may be read by the ClamAV scanning process.","debianbug":1031509,"scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"1.4.3+dfsg-1~deb12u2"},"fixed_version":"1.0.1+dfsg-1","urgency":"not yet assigned"},"bullseye":{"status":"resolved","repositories":{"bullseye":"0.103.10+dfsg-0+deb11u1","bullseye-security":"1.4.3+dfsg-1~deb11u1"},"fixed_version":"0.103.8+dfsg-0+deb11u1","urgency":"not yet assigned"},"forky":{"status":"resolved","repositories":{"forky":"1.4.3+dfsg-2"},"fixed_version":"1.0.1+dfsg-1","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"1.4.3+dfsg-2"},"fixed_version":"1.0.1+dfsg-1","urgency":"not yet assigned"},"trixie":{"status":"resolved","repositories":{"trixie":"1.4.3+dfsg-1"},"fixed_version":"1.0.1+dfsg-1","urgency":"not yet assigned"}}},"CVE-2023-20197":{"description":"A vulnerability in the filesystem image parser for Hierarchical File System Plus (HFS+) of ClamAV could allow an unauthenticated, remote attacker to cause a denial of service (DoS) condition on an affected device.\r \r This vulnerability is due to an incorrect check for completion when a file is decompressed, which may result in a loop condition that could cause the affected software to stop responding. An attacker could exploit this vulnerability by submitting a crafted HFS+ filesystem image to be scanned by ClamAV on an affected device. A successful exploit could allow the attacker to cause the ClamAV scanning process to stop responding, resulting in a DoS condition on the affected software and consuming available system resources.\r \r For a description of this vulnerability, see the ClamAV blog .","debianbug":1050057,"scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"1.4.3+dfsg-1~deb12u2"},"fixed_version":"1.0.2+dfsg-1~deb12u1","urgency":"not yet assigned"},"bullseye":{"status":"resolved","repositories":{"bullseye":"0.103.10+dfsg-0+deb11u1","bullseye-security":"1.4.3+dfsg-1~deb11u1"},"fixed_version":"0.103.9+dfsg-0+deb11u1","urgency":"not yet assigned"},"forky":{"status":"resolved","repositories":{"forky":"1.4.3+dfsg-2"},"fixed_version":"1.0.2+dfsg-1","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"1.4.3+dfsg-2"},"fixed_version":"1.0.2+dfsg-1","urgency":"not yet assigned"},"trixie":{"status":"resolved","repositories":{"trixie":"1.4.3+dfsg-1"},"fixed_version":"1.0.2+dfsg-1","urgency":"not yet assigned"}}},"CVE-2023-20212":{"description":"A vulnerability in the AutoIt module of ClamAV could allow an unauthenticated, remote attacker to cause a denial of service (DoS) condition on an affected device. \r \r This vulnerability is due to a logic error in the memory management of an affected device. An attacker could exploit this vulnerability by submitting a crafted AutoIt file to be scanned by ClamAV on the affected device. A successful exploit could allow the attacker to cause the ClamAV scanning process to restart unexpectedly, resulting in a DoS condition.","debianbug":1050057,"scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"1.4.3+dfsg-1~deb12u2"},"fixed_version":"1.0.2+dfsg-1~deb12u1","urgency":"not yet assigned"},"bullseye":{"status":"resolved","repositories":{"bullseye":"0.103.10+dfsg-0+deb11u1","bullseye-security":"1.4.3+dfsg-1~deb11u1"},"fixed_version":"0","urgency":"unimportant"},"forky":{"status":"resolved","repositories":{"forky":"1.4.3+dfsg-2"},"fixed_version":"1.0.2+dfsg-1","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"1.4.3+dfsg-2"},"fixed_version":"1.0.2+dfsg-1","urgency":"not yet assigned"},"trixie":{"status":"resolved","repositories":{"trixie":"1.4.3+dfsg-1"},"fixed_version":"1.0.2+dfsg-1","urgency":"not yet assigned"}}},"CVE-2024-20290":{"description":"A vulnerability in the OLE2 file format parser of ClamAV could allow an unauthenticated, remote attacker to cause a denial of service (DoS) condition on an affected device.\r \r This vulnerability is due to an incorrect check for end-of-string values during scanning, which may result in a heap buffer over-read. An attacker could exploit this vulnerability by submitting a crafted file containing OLE2 content to be scanned by ClamAV on an affected device. A successful exploit could allow the attacker to cause the ClamAV scanning process to terminate, resulting in a DoS condition on the affected software and consuming available system resources.\r \r For a description of this vulnerability, see the ClamAV blog .","debianbug":1063479,"scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"1.4.3+dfsg-1~deb12u2"},"fixed_version":"1.0.5+dfsg-1~deb12u1","urgency":"not yet assigned"},"bullseye":{"status":"resolved","repositories":{"bullseye":"0.103.10+dfsg-0+deb11u1","bullseye-security":"1.4.3+dfsg-1~deb11u1"},"fixed_version":"0","urgency":"unimportant"},"forky":{"status":"resolved","repositories":{"forky":"1.4.3+dfsg-2"},"fixed_version":"1.0.5+dfsg-1","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"1.4.3+dfsg-2"},"fixed_version":"1.0.5+dfsg-1","urgency":"not yet assigned"},"trixie":{"status":"resolved","repositories":{"trixie":"1.4.3+dfsg-1"},"fixed_version":"1.0.5+dfsg-1","urgency":"not yet assigned"}}},"CVE-2024-20328":{"description":"A vulnerability in the VirusEvent feature of ClamAV could allow a local attacker to inject arbitrary commands with the privileges of the application service account.The vulnerability is due to unsafe handling of file names. A local attacker could exploit this vulnerability by supplying a file name containing command-line sequences. When processed on a system using configuration options for the VirusEvent feature, the attacker could cause the application to execute arbitrary commands. ClamAV has released software updates that address this vulnerability. There are no workarounds that address this vulnerability.","debianbug":1063479,"scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"1.4.3+dfsg-1~deb12u2"},"fixed_version":"1.0.5+dfsg-1~deb12u1","urgency":"not yet assigned"},"bullseye":{"status":"resolved","repositories":{"bullseye":"0.103.10+dfsg-0+deb11u1","bullseye-security":"1.4.3+dfsg-1~deb11u1"},"fixed_version":"0","urgency":"unimportant"},"forky":{"status":"resolved","repositories":{"forky":"1.4.3+dfsg-2"},"fixed_version":"1.0.5+dfsg-1","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"1.4.3+dfsg-2"},"fixed_version":"1.0.5+dfsg-1","urgency":"not yet assigned"},"trixie":{"status":"resolved","repositories":{"trixie":"1.4.3+dfsg-1"},"fixed_version":"1.0.5+dfsg-1","urgency":"not yet assigned"}}},"CVE-2024-20380":{"description":"A vulnerability in the HTML parser of ClamAV could allow an unauthenticated, remote attacker to cause a denial of service (DoS) condition on an affected device.\r The vulnerability is due to an issue in the C to Rust foreign function interface. An attacker could exploit this vulnerability by submitting a crafted file containing HTML content to be scanned by ClamAV on an affected device. An exploit could allow the attacker to cause the ClamAV scanning process to terminate, resulting in a DoS condition on the affected software.","scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"1.4.3+dfsg-1~deb12u2"},"fixed_version":"0","urgency":"unimportant"},"bullseye":{"status":"resolved","repositories":{"bullseye":"0.103.10+dfsg-0+deb11u1","bullseye-security":"1.4.3+dfsg-1~deb11u1"},"fixed_version":"0","urgency":"unimportant"},"forky":{"status":"resolved","repositories":{"forky":"1.4.3+dfsg-2"},"fixed_version":"0","urgency":"unimportant"},"sid":{"status":"resolved","repositories":{"sid":"1.4.3+dfsg-2"},"fixed_version":"0","urgency":"unimportant"},"trixie":{"status":"resolved","repositories":{"trixie":"1.4.3+dfsg-1"},"fixed_version":"0","urgency":"unimportant"}}},"CVE-2024-20505":{"description":"A vulnerability in the PDF parsing module of Clam AntiVirus (ClamAV) versions 1.4.0, 1.3.2 and prior versions, all 1.2.x versions, 1.0.6 and prior versions, all 0.105.x versions, all 0.104.x versions, and 0.103.11 and all prior versions could allow an unauthenticated, remote attacker to cause a denial of service (DoS) condition on an affected device.\r \r The vulnerability is due to an out of bounds read. An attacker could exploit this vulnerability by submitting a crafted PDF file to be scanned by ClamAV on an affected device. An exploit could allow the attacker to terminate the scanning process.","debianbug":1080962,"scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"1.4.3+dfsg-1~deb12u2"},"fixed_version":"1.0.7+dfsg-1~deb12u1","urgency":"not yet assigned"},"bullseye":{"status":"resolved","repositories":{"bullseye":"0.103.10+dfsg-0+deb11u1","bullseye-security":"1.4.3+dfsg-1~deb11u1"},"fixed_version":"1.0.7+dfsg-1~deb11u1","urgency":"not yet assigned"},"forky":{"status":"resolved","repositories":{"forky":"1.4.3+dfsg-2"},"fixed_version":"1.4.1+dfsg-1","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"1.4.3+dfsg-2"},"fixed_version":"1.4.1+dfsg-1","urgency":"not yet assigned"},"trixie":{"status":"resolved","repositories":{"trixie":"1.4.3+dfsg-1"},"fixed_version":"1.4.1+dfsg-1","urgency":"not yet assigned"}}},"CVE-2024-20506":{"description":"A vulnerability in the ClamD service module of Clam AntiVirus (ClamAV) versions 1.4.0, 1.3.2 and prior versions, all 1.2.x versions, 1.0.6 and prior versions, all 0.105.x versions, all 0.104.x versions, and 0.103.11 and all prior versions could allow an authenticated, local attacker to corrupt critical system files.\r \r The vulnerability is due to allowing the ClamD process to write to its log file while privileged without checking if the logfile has been replaced with a symbolic link. An attacker could exploit this vulnerability if they replace the ClamD log file with a symlink to a critical system file and then find a way to restart the ClamD process. An exploit could allow the attacker to corrupt a critical system file by appending ClamD log messages after restart.","debianbug":1080962,"scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"1.4.3+dfsg-1~deb12u2"},"fixed_version":"1.0.7+dfsg-1~deb12u1","urgency":"not yet assigned"},"bullseye":{"status":"resolved","repositories":{"bullseye":"0.103.10+dfsg-0+deb11u1","bullseye-security":"1.4.3+dfsg-1~deb11u1"},"fixed_version":"1.0.7+dfsg-1~deb11u1","urgency":"not yet assigned"},"forky":{"status":"resolved","repositories":{"forky":"1.4.3+dfsg-2"},"fixed_version":"1.4.1+dfsg-1","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"1.4.3+dfsg-2"},"fixed_version":"1.4.1+dfsg-1","urgency":"not yet assigned"},"trixie":{"status":"resolved","repositories":{"trixie":"1.4.3+dfsg-1"},"fixed_version":"1.4.1+dfsg-1","urgency":"not yet assigned"}}},"CVE-2025-20128":{"description":"A vulnerability in the Object Linking and Embedding 2 (OLE2) decryption routine of ClamAV could allow an unauthenticated, remote attacker to cause a denial of service (DoS) condition on an affected device.\r \r This vulnerability is due to an integer underflow in a bounds check that allows for a heap buffer overflow read. An attacker could exploit this vulnerability by submitting a crafted file containing OLE2 content to be scanned by ClamAV on an affected device. A successful exploit could allow the attacker to terminate the ClamAV scanning process, resulting in a DoS condition on the affected software.\r For a description of this vulnerability, see the .\r Cisco has released software updates that address this vulnerability. There are no workarounds that address this vulnerability.","debianbug":1093880,"scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"1.4.3+dfsg-1~deb12u2"},"fixed_version":"1.0.9+dfsg-1~deb12u1","urgency":"not yet assigned"},"bullseye":{"status":"resolved","repositories":{"bullseye":"0.103.10+dfsg-0+deb11u1","bullseye-security":"1.4.3+dfsg-1~deb11u1"},"fixed_version":"1.0.9+dfsg-1~deb11u1","urgency":"not yet assigned"},"forky":{"status":"resolved","repositories":{"forky":"1.4.3+dfsg-2"},"fixed_version":"1.4.2+dfsg-1","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"1.4.3+dfsg-2"},"fixed_version":"1.4.2+dfsg-1","urgency":"not yet assigned"},"trixie":{"status":"resolved","repositories":{"trixie":"1.4.3+dfsg-1"},"fixed_version":"1.4.2+dfsg-1","urgency":"not yet assigned"}}},"CVE-2025-20234":{"description":"A vulnerability in Universal Disk Format (UDF) processing of ClamAV could allow an unauthenticated, remote attacker to cause a denial of service (DoS) condition on an affected device.\r \r This vulnerability is due to a memory overread during UDF file scanning. An attacker could exploit this vulnerability by submitting a crafted file containing UDF content to be scanned by ClamAV on an affected device. A successful exploit could allow the attacker to terminate the ClamAV scanning process, resulting in a DoS condition on the affected software.\r For a description of this vulnerability, see the .","debianbug":1108045,"scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"1.4.3+dfsg-1~deb12u2"},"fixed_version":"0","urgency":"unimportant"},"bullseye":{"status":"resolved","repositories":{"bullseye":"0.103.10+dfsg-0+deb11u1","bullseye-security":"1.4.3+dfsg-1~deb11u1"},"fixed_version":"0","urgency":"unimportant"},"forky":{"status":"resolved","repositories":{"forky":"1.4.3+dfsg-2"},"fixed_version":"1.4.3+dfsg-1","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"1.4.3+dfsg-2"},"fixed_version":"1.4.3+dfsg-1","urgency":"not yet assigned"},"trixie":{"status":"resolved","repositories":{"trixie":"1.4.3+dfsg-1"},"fixed_version":"1.4.3+dfsg-1","urgency":"not yet assigned"}}},"CVE-2025-20260":{"description":"A vulnerability in the PDF scanning processes of ClamAV could allow an unauthenticated, remote attacker to cause a buffer overflow condition, cause a denial of service (DoS) condition, or execute arbitrary code on an affected device.\r \r This vulnerability exists because memory buffers are allocated incorrectly when PDF files are processed. An attacker could exploit this vulnerability by submitting a crafted PDF file to be scanned by ClamAV on an affected device. A successful exploit could allow the attacker to trigger a buffer overflow, likely resulting in the termination of the ClamAV scanning process and a DoS condition on the affected software. Although unproven, there is also a possibility that an attacker could leverage the buffer overflow to execute arbitrary code with the privileges of the ClamAV process.","debianbug":1108046,"scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"1.4.3+dfsg-1~deb12u2"},"fixed_version":"1.0.9+dfsg-1~deb12u1","urgency":"not yet assigned"},"bullseye":{"status":"resolved","repositories":{"bullseye":"0.103.10+dfsg-0+deb11u1","bullseye-security":"1.4.3+dfsg-1~deb11u1"},"fixed_version":"1.0.9+dfsg-1~deb11u1","urgency":"not yet assigned"},"forky":{"status":"resolved","repositories":{"forky":"1.4.3+dfsg-2"},"fixed_version":"1.4.3+dfsg-1","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"1.4.3+dfsg-2"},"fixed_version":"1.4.3+dfsg-1","urgency":"not yet assigned"},"trixie":{"status":"resolved","repositories":{"trixie":"1.4.3+dfsg-1"},"fixed_version":"1.4.3+dfsg-1","urgency":"not yet assigned"}}},"TEMP-0000000-604AC4":{"releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"1.4.3+dfsg-1~deb12u2"},"fixed_version":"0.98.7+dfsg-1","urgency":"not yet assigned"},"bullseye":{"status":"resolved","repositories":{"bullseye":"0.103.10+dfsg-0+deb11u1","bullseye-security":"1.4.3+dfsg-1~deb11u1"},"fixed_version":"0.98.7+dfsg-1","urgency":"not yet assigned"},"forky":{"status":"resolved","repositories":{"forky":"1.4.3+dfsg-2"},"fixed_version":"0.98.7+dfsg-1","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"1.4.3+dfsg-2"},"fixed_version":"0.98.7+dfsg-1","urgency":"not yet assigned"},"trixie":{"status":"resolved","repositories":{"trixie":"1.4.3+dfsg-1"},"fixed_version":"0.98.7+dfsg-1","urgency":"not yet assigned"}}},"TEMP-0000000-84AA65":{"releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"1.4.3+dfsg-1~deb12u2"},"fixed_version":"0.86.2-1","urgency":"low"},"bullseye":{"status":"resolved","repositories":{"bullseye":"0.103.10+dfsg-0+deb11u1","bullseye-security":"1.4.3+dfsg-1~deb11u1"},"fixed_version":"0.86.2-1","urgency":"low"},"forky":{"status":"resolved","repositories":{"forky":"1.4.3+dfsg-2"},"fixed_version":"0.86.2-1","urgency":"low"},"sid":{"status":"resolved","repositories":{"sid":"1.4.3+dfsg-2"},"fixed_version":"0.86.2-1","urgency":"low"},"trixie":{"status":"resolved","repositories":{"trixie":"1.4.3+dfsg-1"},"fixed_version":"0.86.2-1","urgency":"low"}}},"TEMP-0000000-DAE756":{"releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"1.4.3+dfsg-1~deb12u2"},"fixed_version":"0.85.1-1","urgency":"low"},"bullseye":{"status":"resolved","repositories":{"bullseye":"0.103.10+dfsg-0+deb11u1","bullseye-security":"1.4.3+dfsg-1~deb11u1"},"fixed_version":"0.85.1-1","urgency":"low"},"forky":{"status":"resolved","repositories":{"forky":"1.4.3+dfsg-2"},"fixed_version":"0.85.1-1","urgency":"low"},"sid":{"status":"resolved","repositories":{"sid":"1.4.3+dfsg-2"},"fixed_version":"0.85.1-1","urgency":"low"},"trixie":{"status":"resolved","repositories":{"trixie":"1.4.3+dfsg-1"},"fixed_version":"0.85.1-1","urgency":"low"}}},"TEMP-0000000-DD8D83":{"releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"1.4.3+dfsg-1~deb12u2"},"fixed_version":"0.98.7+dfsg-1","urgency":"not yet assigned"},"bullseye":{"status":"resolved","repositories":{"bullseye":"0.103.10+dfsg-0+deb11u1","bullseye-security":"1.4.3+dfsg-1~deb11u1"},"fixed_version":"0.98.7+dfsg-1","urgency":"not yet assigned"},"forky":{"status":"resolved","repositories":{"forky":"1.4.3+dfsg-2"},"fixed_version":"0.98.7+dfsg-1","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"1.4.3+dfsg-2"},"fixed_version":"0.98.7+dfsg-1","urgency":"not yet assigned"},"trixie":{"status":"resolved","repositories":{"trixie":"1.4.3+dfsg-1"},"fixed_version":"0.98.7+dfsg-1","urgency":"not yet assigned"}}},"TEMP-0535881-957F77":{"debianbug":535881,"releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"1.4.3+dfsg-1~deb12u2"},"fixed_version":"0.95.2+dfsg-1","urgency":"low"},"bullseye":{"status":"resolved","repositories":{"bullseye":"0.103.10+dfsg-0+deb11u1","bullseye-security":"1.4.3+dfsg-1~deb11u1"},"fixed_version":"0.95.2+dfsg-1","urgency":"low"},"forky":{"status":"resolved","repositories":{"forky":"1.4.3+dfsg-2"},"fixed_version":"0.95.2+dfsg-1","urgency":"low"},"sid":{"status":"resolved","repositories":{"sid":"1.4.3+dfsg-2"},"fixed_version":"0.95.2+dfsg-1","urgency":"low"},"trixie":{"status":"resolved","repositories":{"trixie":"1.4.3+dfsg-1"},"fixed_version":"0.95.2+dfsg-1","urgency":"low"}}}},"claws-mail":{"CVE-2007-1558":{"description":"The APOP protocol allows remote attackers to guess the first 3 characters of a password via man-in-the-middle (MITM) attacks that use crafted message IDs and MD5 collisions.  NOTE: this design-level issue potentially affects all products that use APOP, including (1) Thunderbird 1.x before 1.5.0.12 and 2.x before 2.0.0.4, (2) Evolution, (3) mutt, (4) fetchmail before 6.3.8, (5) SeaMonkey 1.0.x before 1.0.9 and 1.1.x before 1.1.2, (6) Balsa 2.3.16 and earlier, (7) Mailfilter before 0.8.2, and possibly other products.","scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"4.1.1-2"},"fixed_version":"2.9.1-1","urgency":"unimportant"},"bullseye":{"status":"resolved","repositories":{"bullseye":"3.17.8-1"},"fixed_version":"2.9.1-1","urgency":"unimportant"},"forky":{"status":"resolved","repositories":{"forky":"4.3.1-1"},"fixed_version":"2.9.1-1","urgency":"unimportant"},"sid":{"status":"resolved","repositories":{"sid":"4.3.1-1"},"fixed_version":"2.9.1-1","urgency":"unimportant"},"trixie":{"status":"resolved","repositories":{"trixie":"4.3.1-1"},"fixed_version":"2.9.1-1","urgency":"unimportant"}}},"CVE-2007-6208":{"description":"sylprint.pl in claws mail tools (claws-mail-tools) allows local users to overwrite arbitrary files via a symlink attack on the sylprint.[USER].[PID] temporary file.","debianbug":454089,"scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"4.1.1-2"},"fixed_version":"3.1.0-2","urgency":"low"},"bullseye":{"status":"resolved","repositories":{"bullseye":"3.17.8-1"},"fixed_version":"3.1.0-2","urgency":"low"},"forky":{"status":"resolved","repositories":{"forky":"4.3.1-1"},"fixed_version":"3.1.0-2","urgency":"low"},"sid":{"status":"resolved","repositories":{"sid":"4.3.1-1"},"fixed_version":"3.1.0-2","urgency":"low"},"trixie":{"status":"resolved","repositories":{"trixie":"4.3.1-1"},"fixed_version":"3.1.0-2","urgency":"low"}}},"CVE-2010-5109":{"description":"Off-by-one error in the DecompressRTF function in ytnef.c in Yerase's TNEF Stream Reader allows remote attackers to cause a denial of service (crash) via a crafted TNEF file, which triggers a buffer overflow.","debianbug":771360,"scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"4.1.1-2"},"fixed_version":"3.11.1-2","urgency":"not yet assigned"},"bullseye":{"status":"resolved","repositories":{"bullseye":"3.17.8-1"},"fixed_version":"3.11.1-2","urgency":"not yet assigned"},"forky":{"status":"resolved","repositories":{"forky":"4.3.1-1"},"fixed_version":"3.11.1-2","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"4.3.1-1"},"fixed_version":"3.11.1-2","urgency":"not yet assigned"},"trixie":{"status":"resolved","repositories":{"trixie":"4.3.1-1"},"fixed_version":"3.11.1-2","urgency":"not yet assigned"}}},"CVE-2012-4507":{"description":"The strchr function in procmime.c in Claws Mail (aka claws-mail) 3.8.1 allows remote attackers to cause a denial of service (NULL pointer dereference and crash) via a crafted email.","debianbug":690151,"scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"4.1.1-2"},"fixed_version":"3.8.1-2","urgency":"low"},"bullseye":{"status":"resolved","repositories":{"bullseye":"3.17.8-1"},"fixed_version":"3.8.1-2","urgency":"low"},"forky":{"status":"resolved","repositories":{"forky":"4.3.1-1"},"fixed_version":"3.8.1-2","urgency":"low"},"sid":{"status":"resolved","repositories":{"sid":"4.3.1-1"},"fixed_version":"3.8.1-2","urgency":"low"},"trixie":{"status":"resolved","repositories":{"trixie":"4.3.1-1"},"fixed_version":"3.8.1-2","urgency":"low"}}},"CVE-2014-2576":{"description":"plugins/rssyl/feed.c in Claws Mail before 3.10.0 disables the CURLOPT_SSL_VERIFYHOST check for CN or SAN host name fields, which makes it easier for remote attackers to spoof servers and conduct man-in-the-middle (MITM) attacks.","debianbug":742695,"scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"4.1.1-2"},"fixed_version":"3.10.1-1","urgency":"not yet assigned"},"bullseye":{"status":"resolved","repositories":{"bullseye":"3.17.8-1"},"fixed_version":"3.10.1-1","urgency":"not yet assigned"},"forky":{"status":"resolved","repositories":{"forky":"4.3.1-1"},"fixed_version":"3.10.1-1","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"4.3.1-1"},"fixed_version":"3.10.1-1","urgency":"not yet assigned"},"trixie":{"status":"resolved","repositories":{"trixie":"4.3.1-1"},"fixed_version":"3.10.1-1","urgency":"not yet assigned"}}},"CVE-2015-8614":{"description":"Multiple stack-based buffer overflows in the (1) conv_jistoeuc, (2) conv_euctojis, and (3) conv_sjistoeuc functions in codeconv.c in Claws Mail before 3.13.1 allow remote attackers to have unspecified impact via a crafted email, involving Japanese character set conversion.","scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"4.1.1-2"},"fixed_version":"3.13.1-1","urgency":"not yet assigned"},"bullseye":{"status":"resolved","repositories":{"bullseye":"3.17.8-1"},"fixed_version":"3.13.1-1","urgency":"not yet assigned"},"forky":{"status":"resolved","repositories":{"forky":"4.3.1-1"},"fixed_version":"3.13.1-1","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"4.3.1-1"},"fixed_version":"3.13.1-1","urgency":"not yet assigned"},"trixie":{"status":"resolved","repositories":{"trixie":"4.3.1-1"},"fixed_version":"3.13.1-1","urgency":"not yet assigned"}}},"CVE-2015-8708":{"description":"Stack-based buffer overflow in the conv_euctojis function in codeconv.c in Claws Mail 3.13.1 allows remote attackers to have unspecified impact via a crafted email, involving Japanese character set conversion.  NOTE: this vulnerability exists because of an incomplete fix for CVE-2015-8614.","debianbug":811048,"scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"4.1.1-2"},"fixed_version":"3.13.1-1.1","urgency":"not yet assigned"},"bullseye":{"status":"resolved","repositories":{"bullseye":"3.17.8-1"},"fixed_version":"3.13.1-1.1","urgency":"not yet assigned"},"forky":{"status":"resolved","repositories":{"forky":"4.3.1-1"},"fixed_version":"3.13.1-1.1","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"4.3.1-1"},"fixed_version":"3.13.1-1.1","urgency":"not yet assigned"},"trixie":{"status":"resolved","repositories":{"trixie":"4.3.1-1"},"fixed_version":"3.13.1-1.1","urgency":"not yet assigned"}}},"CVE-2019-10735":{"description":"In Claws Mail 3.14.1, an attacker in possession of S/MIME or PGP encrypted emails can wrap them as sub-parts within a crafted multipart email. The encrypted part(s) can further be hidden using HTML/CSS or ASCII newline characters. This modified multipart email can be re-sent by the attacker to the intended receiver. If the receiver replies to this (benign looking) email, they unknowingly leak the plaintext of the encrypted message part(s) back to the attacker.","debianbug":926705,"scope":"local","releases":{"bookworm":{"status":"open","repositories":{"bookworm":"4.1.1-2"},"urgency":"low","nodsa":"Minor issue, revisit when fixed upstream","nodsa_reason":"postponed"},"bullseye":{"status":"open","repositories":{"bullseye":"3.17.8-1"},"urgency":"low","nodsa":"Minor issue","nodsa_reason":""},"forky":{"status":"open","repositories":{"forky":"4.3.1-1"},"urgency":"low"},"sid":{"status":"open","repositories":{"sid":"4.3.1-1"},"urgency":"low"},"trixie":{"status":"open","repositories":{"trixie":"4.3.1-1"},"urgency":"low","nodsa":"Minor issue, revisit when fixed upstream","nodsa_reason":"postponed"}}},"CVE-2020-15917":{"description":"common/session.c in Claws Mail before 3.17.6 has a protocol violation because suffix data after STARTTLS is mishandled.","scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"4.1.1-2"},"fixed_version":"3.17.6-1","urgency":"not yet assigned"},"bullseye":{"status":"resolved","repositories":{"bullseye":"3.17.8-1"},"fixed_version":"3.17.6-1","urgency":"not yet assigned"},"forky":{"status":"resolved","repositories":{"forky":"4.3.1-1"},"fixed_version":"3.17.6-1","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"4.3.1-1"},"fixed_version":"3.17.6-1","urgency":"not yet assigned"},"trixie":{"status":"resolved","repositories":{"trixie":"4.3.1-1"},"fixed_version":"3.17.6-1","urgency":"not yet assigned"}}},"CVE-2020-16094":{"description":"In imap_scan_tree_recursive in Claws Mail through 3.17.6, a malicious IMAP server can trigger stack consumption because of unlimited recursion into subdirectories during a rebuild of the folder tree.","debianbug":966630,"scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"4.1.1-2"},"fixed_version":"3.17.7-1","urgency":"not yet assigned"},"bullseye":{"status":"resolved","repositories":{"bullseye":"3.17.8-1"},"fixed_version":"3.17.7-1","urgency":"not yet assigned"},"forky":{"status":"resolved","repositories":{"forky":"4.3.1-1"},"fixed_version":"3.17.7-1","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"4.3.1-1"},"fixed_version":"3.17.7-1","urgency":"not yet assigned"},"trixie":{"status":"resolved","repositories":{"trixie":"4.3.1-1"},"fixed_version":"3.17.7-1","urgency":"not yet assigned"}}},"CVE-2021-37746":{"description":"textview_uri_security_check in textview.c in Claws Mail before 3.18.0, and Sylpheed through 3.7.0, does not have sufficient link checks before accepting a click.","debianbug":991722,"scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"4.1.1-2"},"fixed_version":"3.18.0-1","urgency":"not yet assigned","next_point_update":true},"bullseye":{"status":"open","repositories":{"bullseye":"3.17.8-1"},"urgency":"not yet assigned","nodsa":"Minor issue","nodsa_reason":""},"forky":{"status":"resolved","repositories":{"forky":"4.3.1-1"},"fixed_version":"3.18.0-1","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"4.3.1-1"},"fixed_version":"3.18.0-1","urgency":"not yet assigned"},"trixie":{"status":"resolved","repositories":{"trixie":"4.3.1-1"},"fixed_version":"3.18.0-1","urgency":"not yet assigned"}}}},"clearsilver":{"CVE-2011-4357":{"description":"Format string vulnerability in the p_cgi_error function in python/neo_cgi.c in the Python CGI Kit (neo_cgi) module for Clearsilver 0.10.5 and earlier allows remote attackers to cause a denial of service (crash) and possibly execute arbitrary code via format string specifiers that are not properly handled when creating CGI error messages using the cgi_error API function.","debianbug":649322,"scope":"local","releases":{"bookworm":{"status":"resolved","repositories":{"bookworm":"0.10.5-4"},"fixed_version":"0.10.5-1.3","urgency":"not yet assigned"},"bullseye":{"status":"resolved","repositories":{"bullseye":"0.10.5-4"},"fixed_version":"0.10.5-1.3","urgency":"not yet assigned"},"forky":{"status":"resolved","repositories":{"forky":"0.10.5-7"},"fixed_version":"0.10.5-1.3","urgency":"not yet assigned"},"sid":{"status":"resolved","repositories":{"sid":"0.10.5-7"},"fixed_version":"0.10.5-1.3","urgency":"not yet assigned"},"trixie":{"status":"resolved","repositories":{"trixie":"0.10.5-6"},"fixed_version":"0.10.5-1.3","urgency":"not yet assigned"}}}},"clementine":{"CVE-2018-14332":{"description":"An issue was discovered in Clementine Music Player 1.3.1. Clementine.exe is vulnerable to a user mode write access violation due to a NULL pointer dereference in the Init call in the MoodbarPipeline::NewPadCallback function in moodbar/moodbarpipeline.cpp. The vulnerability is triggered when the user opens a malformed mp3 file.","scope":"local","releases":{"bookworm":{"status":"open","repositories":{"bookworm":"1.4.0~rc1+git867-g9ef681b0e+dfsg-1"},"urgency":"unimportant"},"bullseye":{"status":"open","repositories":{"bullseye":"1.4.0~rc1+git347-gfc4cb6fc7+dfsg-1+deb11u1"},"urgency":"unimportant"},"forky":{"status":"open","repositories":{"forky":"1.4.1+git27-g658f34ec4+dfsg-4"},"urgency":"unimportant"},"sid":{"status":"open","repositories":{"sid":"1.4.1+git27-g658f34ec4+dfsg-4"},"urgency":"unimportant"},"trixie":{"status":"open","repositories":{"trixie":"1.4.1+git27-g658f34ec4+dfsg-3"},"urgency":"unimportant"}}},"CVE-2021-40826":{"description":"Clementine Music Player t