| Bug | bookworm | trixie | forky | sid | Description |
|---|
| TEMP-1144106-D6004A | vulnerable (no DSA, postponed) | vulnerable (no DSA, postponed) | fixed | fixed | GHSA-xppc-j946-vcj7: buffer overflow on 32-bit systems |
| TEMP-1144105-8C4D6A | vulnerable (no DSA, postponed) | vulnerable (no DSA, postponed) | fixed | fixed | GHSA-7cgc-gp99-6jmm: resource exhaustion via LZMA decoding |
| TEMP-0000000-D6D9A8 | vulnerable | vulnerable (no DSA) | vulnerable | fixed | GHSA-cp2j-qv7x-wcw4: ostree: a crafted whiteout filename strips to .. so a --whiteouts checkout deletes the parent directory of the destination |
| TEMP-0000000-08A5CB | vulnerable | vulnerable (no DSA) | vulnerable | fixed | GHSA-7pq7-3pmj-9wp6: Union-mode checkout follows an attacker-planted symlink and writes outside the destination |