{ "meta": { "count": 56, "skipped_uncomparable": 0, "schema_version": "1.7.3" }, "advisories": { "augeas": [ { "schema_version": "1.7.3", "id": "BREW-augeas-CVE-2025-2588", "published": "2026-07-18T04:02:33Z", "modified": "2026-07-18T04:02:33Z", "upstream": [ "CVE-2025-2588" ], "affected": [ { "package": { "ecosystem": "Homebrew", "name": "augeas", "purl": "pkg:brew/augeas" }, "ranges": [ { "type": "ECOSYSTEM", "events": [ { "introduced": "0" }, { "fixed": "1.14.1_2" } ] } ], "ecosystem_specific": { "fix": "patch", "patches": [ { "type": "backport", "url": "https://github.com/hercules-team/augeas/commit/af2aa88ab37fc48167d8c5e43b1770a4ba2ff403.patch?full_index=1" } ] } } ], "database_specific": { "source": "generated" }, "summary": "Hercules Augeas fa.c re_case_expand null pointer dereference", "details": "A vulnerability has been found in Hercules Augeas 1.14.1 and classified as problematic. This vulnerability affects the function re_case_expand of the file src/fa.c. The manipulation of the argument re leads to null pointer dereference. Attacking locally is a requirement. The exploit has been disclosed to the public and may be used.", "severity": [ { "type": "CVSS_V4", "score": "CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N" } ], "references": [ { "type": "ADVISORY", "url": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2025/2xxx/CVE-2025-2588.json" }, { "type": "ADVISORY", "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-2588" }, { "type": "ADVISORY", "url": "https://vuldb.com/?id.300568" }, { "type": "ADVISORY", "url": "https://vuldb.com/?submit.517281" }, { "type": "REPORT", "url": "https://github.com/hercules-team/augeas/issues/852" }, { "type": "REPORT", "url": "https://github.com/hercules-team/augeas/issues/852#issue-2905999609" }, { "type": "REPORT", "url": "https://vuldb.com/?ctiid.300568" } ] } ], "glibc": [ { "schema_version": "1.7.3", "id": "BREW-glibc-CVE-2024-2961", "published": "2026-06-28T21:29:54Z", "modified": "2026-08-05T16:54:10Z", "upstream": [ "CVE-2024-2961" ], "affected": [ { "package": { "ecosystem": "Homebrew", "name": "glibc", "purl": "pkg:brew/glibc" }, "ranges": [ { "type": "ECOSYSTEM", "events": [ { "introduced": "0" }, { "fixed": "2.39" } ] } ], "ecosystem_specific": { "fix": "patch", "patches": [ { "type": "backport", "url": "https://archive.ubuntu.com/ubuntu/pool/main/g/glibc/glibc_2.39-0ubuntu8.8.debian.tar.xz", "apply": [ "patches/any/CVE-2024-2961.patch", "patches/any/CVE-2024-33599.patch", "patches/any/CVE-2024-33600_1.patch", "patches/any/CVE-2024-33600_2.patch", "patches/any/CVE-2024-33601_33602.patch", "patches/any/CVE-2025-0395.patch", "patches/any/CVE-2025-5702.patch", "patches/any/CVE-2025-8058.patch", "patches/CVE-2025-15281.patch", "patches/CVE-2026-0861.patch", "patches/CVE-2026-0915.patch", "patches/CVE-2026-4046.patch", "patches/CVE-2026-5450.patch", "patches/CVE-2026-5928.patch", "patches/CVE-2026-6238-pre1.patch", "patches/CVE-2026-6238-pre2.patch", "patches/CVE-2026-6238-pre3.patch", "patches/CVE-2026-6238-pre4.patch", "patches/CVE-2026-5435.patch", "patches/CVE-2026-6238-1.patch", "patches/CVE-2026-6238-2.patch", "patches/CVE-2026-443x.patch" ] } ] } } ], "database_specific": { "source": "generated" }, "details": "The iconv() function in the GNU C Library versions 2.39 and older may overflow the output buffer passed to it by up to 4 bytes when converting strings to the ISO-2022-CN-EXT character set, which may be used to crash an application or overwrite a neighbouring variable.", "severity": [ { "type": "CVSS_V3", "score": "CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:H" } ], "references": [ { "type": "WEB", "url": "http://www.openwall.com/lists/oss-security/2024/04/17/9" }, { "type": "WEB", "url": "http://www.openwall.com/lists/oss-security/2024/04/18/4" }, { "type": "WEB", "url": "http://www.openwall.com/lists/oss-security/2024/04/24/2" }, { "type": "WEB", "url": "http://www.openwall.com/lists/oss-security/2024/05/27/1" }, { "type": "WEB", "url": "http://www.openwall.com/lists/oss-security/2024/05/27/2" }, { "type": "WEB", "url": "http://www.openwall.com/lists/oss-security/2024/05/27/3" }, { "type": "WEB", "url": "http://www.openwall.com/lists/oss-security/2024/05/27/4" }, { "type": "WEB", "url": "http://www.openwall.com/lists/oss-security/2024/05/27/5" }, { "type": "WEB", "url": "http://www.openwall.com/lists/oss-security/2024/05/27/6" }, { "type": "WEB", "url": "http://www.openwall.com/lists/oss-security/2024/07/22/5" }, { "type": "WEB", "url": "https://cert-portal.siemens.com/productcert/html/ssa-082556.html" }, { "type": "WEB", "url": "https://lists.debian.org/debian-lts-announce/2024/05/msg00001.html" }, { "type": "WEB", "url": "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/BTJFBGHDYG5PEIFD5WSSSKSFZ2AZWC5N/" }, { "type": "WEB", "url": "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/P3I4KYS6EU6S7QZ47WFNTPVAHFIUQNEL/" }, { "type": "WEB", "url": "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/YAMJQI3Y6BHWV3CUTYBXOZONCUJNOB2Z/" }, { "type": "ADVISORY", "url": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2024/2xxx/CVE-2024-2961.json" }, { "type": "ADVISORY", "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-2961" }, { "type": "ADVISORY", "url": "https://security.netapp.com/advisory/ntap-20240531-0002/" }, { "type": "ADVISORY", "url": "https://sourceware.org/git/?p=glibc.git;a=blob;f=advisories/GLIBC-SA-2024-0004" }, { "type": "ARTICLE", "url": "https://www.ambionics.io/blog/iconv-cve-2024-2961-p1" }, { "type": "ARTICLE", "url": "https://www.ambionics.io/blog/iconv-cve-2024-2961-p2" }, { "type": "ARTICLE", "url": "https://www.ambionics.io/blog/iconv-cve-2024-2961-p3" } ] }, { "schema_version": "1.7.3", "id": "BREW-glibc-CVE-2024-33599", "published": "2026-06-28T21:29:54Z", "modified": "2026-08-05T16:54:10Z", "upstream": [ "CVE-2024-33599" ], "affected": [ { "package": { "ecosystem": "Homebrew", "name": "glibc", "purl": "pkg:brew/glibc" }, "ranges": [ { "type": "ECOSYSTEM", "events": [ { "introduced": "0" }, { "fixed": "2.39" } ] } ], "ecosystem_specific": { "fix": "patch", "patches": [ { "type": "backport", "url": "https://archive.ubuntu.com/ubuntu/pool/main/g/glibc/glibc_2.39-0ubuntu8.8.debian.tar.xz", "apply": [ "patches/any/CVE-2024-2961.patch", "patches/any/CVE-2024-33599.patch", "patches/any/CVE-2024-33600_1.patch", "patches/any/CVE-2024-33600_2.patch", "patches/any/CVE-2024-33601_33602.patch", "patches/any/CVE-2025-0395.patch", "patches/any/CVE-2025-5702.patch", "patches/any/CVE-2025-8058.patch", "patches/CVE-2025-15281.patch", "patches/CVE-2026-0861.patch", "patches/CVE-2026-0915.patch", "patches/CVE-2026-4046.patch", "patches/CVE-2026-5450.patch", "patches/CVE-2026-5928.patch", "patches/CVE-2026-6238-pre1.patch", "patches/CVE-2026-6238-pre2.patch", "patches/CVE-2026-6238-pre3.patch", "patches/CVE-2026-6238-pre4.patch", "patches/CVE-2026-5435.patch", "patches/CVE-2026-6238-1.patch", "patches/CVE-2026-6238-2.patch", "patches/CVE-2026-443x.patch" ] } ] } } ], "database_specific": { "source": "generated" }, "summary": "nscd: Stack-based buffer overflow in netgroup cache", "details": "nscd: Stack-based buffer overflow in netgroup cache\n\nIf the Name Service Cache Daemon's (nscd) fixed size cache is exhausted\nby client requests then a subsequent client request for netgroup data\nmay result in a stack-based buffer overflow. This flaw was introduced\nin glibc 2.15 when the cache was added to nscd.\n\nThis vulnerability is only present in the nscd binary.", "severity": [ { "type": "CVSS_V3", "score": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H" } ], "references": [ { "type": "WEB", "url": "http://www.openwall.com/lists/oss-security/2024/07/22/5" }, { "type": "WEB", "url": "https://cert-portal.siemens.com/productcert/html/ssa-082556.html" }, { "type": "WEB", "url": "https://lists.debian.org/debian-lts-announce/2024/06/msg00026.html" }, { "type": "ADVISORY", "url": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2024/33xxx/CVE-2024-33599.json" }, { "type": "ADVISORY", "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-33599" }, { "type": "ADVISORY", "url": "https://security.netapp.com/advisory/ntap-20240524-0011/" }, { "type": "ADVISORY", "url": "https://sourceware.org/git/?p=glibc.git;a=blob;f=advisories/GLIBC-SA-2024-0005" } ] }, { "schema_version": "1.7.3", "id": "BREW-glibc-CVE-2024-33600", "published": "2026-06-28T21:29:54Z", "modified": "2026-08-05T16:54:10Z", "upstream": [ "CVE-2024-33600" ], "affected": [ { "package": { "ecosystem": "Homebrew", "name": "glibc", "purl": "pkg:brew/glibc" }, "ranges": [ { "type": "ECOSYSTEM", "events": [ { "introduced": "0" }, { "fixed": "2.39" } ] } ], "ecosystem_specific": { "fix": "patch", "patches": [ { "type": "backport", "url": "https://archive.ubuntu.com/ubuntu/pool/main/g/glibc/glibc_2.39-0ubuntu8.8.debian.tar.xz", "apply": [ "patches/any/CVE-2024-2961.patch", "patches/any/CVE-2024-33599.patch", "patches/any/CVE-2024-33600_1.patch", "patches/any/CVE-2024-33600_2.patch", "patches/any/CVE-2024-33601_33602.patch", "patches/any/CVE-2025-0395.patch", "patches/any/CVE-2025-5702.patch", "patches/any/CVE-2025-8058.patch", "patches/CVE-2025-15281.patch", "patches/CVE-2026-0861.patch", "patches/CVE-2026-0915.patch", "patches/CVE-2026-4046.patch", "patches/CVE-2026-5450.patch", "patches/CVE-2026-5928.patch", "patches/CVE-2026-6238-pre1.patch", "patches/CVE-2026-6238-pre2.patch", "patches/CVE-2026-6238-pre3.patch", "patches/CVE-2026-6238-pre4.patch", "patches/CVE-2026-5435.patch", "patches/CVE-2026-6238-1.patch", "patches/CVE-2026-6238-2.patch", "patches/CVE-2026-443x.patch" ] } ] } } ], "database_specific": { "source": "generated" }, "summary": "nscd: Null pointer crashes after notfound response", "details": "nscd: Null pointer crashes after notfound response\n\nIf the Name Service Cache Daemon's (nscd) cache fails to add a not-found\nnetgroup response to the cache, the client request can result in a null\npointer dereference. This flaw was introduced in glibc 2.15 when the\ncache was added to nscd.\n\nThis vulnerability is only present in the nscd binary.", "severity": [ { "type": "CVSS_V3", "score": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H" } ], "references": [ { "type": "WEB", "url": "http://www.openwall.com/lists/oss-security/2024/07/22/5" }, { "type": "WEB", "url": "https://cert-portal.siemens.com/productcert/html/ssa-082556.html" }, { "type": "WEB", "url": "https://lists.debian.org/debian-lts-announce/2024/06/msg00026.html" }, { "type": "ADVISORY", "url": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2024/33xxx/CVE-2024-33600.json" }, { "type": "ADVISORY", "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-33600" }, { "type": "ADVISORY", "url": "https://security.netapp.com/advisory/ntap-20240524-0013/" }, { "type": "ADVISORY", "url": "https://sourceware.org/git/?p=glibc.git;a=blob;f=advisories/GLIBC-SA-2024-0006" } ] }, { "schema_version": "1.7.3", "id": "BREW-glibc-CVE-2024-33601", "published": "2026-06-28T21:29:54Z", "modified": "2026-08-05T16:54:10Z", "upstream": [ "CVE-2024-33601" ], "affected": [ { "package": { "ecosystem": "Homebrew", "name": "glibc", "purl": "pkg:brew/glibc" }, "ranges": [ { "type": "ECOSYSTEM", "events": [ { "introduced": "0" }, { "fixed": "2.39" } ] } ], "ecosystem_specific": { "fix": "patch", "patches": [ { "type": "backport", "url": "https://archive.ubuntu.com/ubuntu/pool/main/g/glibc/glibc_2.39-0ubuntu8.8.debian.tar.xz", "apply": [ "patches/any/CVE-2024-2961.patch", "patches/any/CVE-2024-33599.patch", "patches/any/CVE-2024-33600_1.patch", "patches/any/CVE-2024-33600_2.patch", "patches/any/CVE-2024-33601_33602.patch", "patches/any/CVE-2025-0395.patch", "patches/any/CVE-2025-5702.patch", "patches/any/CVE-2025-8058.patch", "patches/CVE-2025-15281.patch", "patches/CVE-2026-0861.patch", "patches/CVE-2026-0915.patch", "patches/CVE-2026-4046.patch", "patches/CVE-2026-5450.patch", "patches/CVE-2026-5928.patch", "patches/CVE-2026-6238-pre1.patch", "patches/CVE-2026-6238-pre2.patch", "patches/CVE-2026-6238-pre3.patch", "patches/CVE-2026-6238-pre4.patch", "patches/CVE-2026-5435.patch", "patches/CVE-2026-6238-1.patch", "patches/CVE-2026-6238-2.patch", "patches/CVE-2026-443x.patch" ] } ] } } ], "database_specific": { "source": "generated" }, "summary": "nscd: netgroup cache may terminate daemon on memory allocation failure", "details": "nscd: netgroup cache may terminate daemon on memory allocation failure\n\nThe Name Service Cache Daemon's (nscd) netgroup cache uses xmalloc or\nxrealloc and these functions may terminate the process due to a memory\nallocation failure resulting in a denial of service to the clients. The\nflaw was introduced in glibc 2.15 when the cache was added to nscd.\n\nThis vulnerability is only present in the nscd binary.", "severity": [ { "type": "CVSS_V3", "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L" } ], "references": [ { "type": "WEB", "url": "http://www.openwall.com/lists/oss-security/2024/07/22/5" }, { "type": "WEB", "url": "https://cert-portal.siemens.com/productcert/html/ssa-082556.html" }, { "type": "WEB", "url": "https://lists.debian.org/debian-lts-announce/2024/06/msg00026.html" }, { "type": "ADVISORY", "url": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2024/33xxx/CVE-2024-33601.json" }, { "type": "ADVISORY", "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-33601" }, { "type": "ADVISORY", "url": "https://security.netapp.com/advisory/ntap-20240524-0014/" }, { "type": "ADVISORY", "url": "https://sourceware.org/git/?p=glibc.git;a=blob;f=advisories/GLIBC-SA-2024-0007" } ] }, { "schema_version": "1.7.3", "id": "BREW-glibc-CVE-2024-33602", "published": "2026-08-05T16:54:10Z", "modified": "2026-08-05T16:54:10Z", "upstream": [ "CVE-2024-33602" ], "affected": [ { "package": { "ecosystem": "Homebrew", "name": "glibc", "purl": "pkg:brew/glibc" }, "ranges": [ { "type": "ECOSYSTEM", "events": [ { "introduced": "0" }, { "fixed": "2.39_1" } ] } ], "ecosystem_specific": { "fix": "patch", "patches": [ { "type": "backport", "url": "https://archive.ubuntu.com/ubuntu/pool/main/g/glibc/glibc_2.39-0ubuntu8.8.debian.tar.xz", "apply": [ "patches/any/CVE-2024-2961.patch", "patches/any/CVE-2024-33599.patch", "patches/any/CVE-2024-33600_1.patch", "patches/any/CVE-2024-33600_2.patch", "patches/any/CVE-2024-33601_33602.patch", "patches/any/CVE-2025-0395.patch", "patches/any/CVE-2025-5702.patch", "patches/any/CVE-2025-8058.patch", "patches/CVE-2025-15281.patch", "patches/CVE-2026-0861.patch", "patches/CVE-2026-0915.patch", "patches/CVE-2026-4046.patch", "patches/CVE-2026-5450.patch", "patches/CVE-2026-5928.patch", "patches/CVE-2026-6238-pre1.patch", "patches/CVE-2026-6238-pre2.patch", "patches/CVE-2026-6238-pre3.patch", "patches/CVE-2026-6238-pre4.patch", "patches/CVE-2026-5435.patch", "patches/CVE-2026-6238-1.patch", "patches/CVE-2026-6238-2.patch", "patches/CVE-2026-443x.patch" ] } ] } } ], "database_specific": { "source": "generated" }, "summary": "nscd: netgroup cache assumes NSS callback uses in-buffer strings", "details": "nscd: netgroup cache assumes NSS callback uses in-buffer strings\n\nThe Name Service Cache Daemon's (nscd) netgroup cache can corrupt memory\nwhen the NSS callback does not store all strings in the provided buffer.\nThe flaw was introduced in glibc 2.15 when the cache was added to nscd.\n\nThis vulnerability is only present in the nscd binary.", "severity": [ { "type": "CVSS_V3", "score": "CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H" } ], "references": [ { "type": "WEB", "url": "http://www.openwall.com/lists/oss-security/2024/07/22/5" }, { "type": "WEB", "url": "https://cert-portal.siemens.com/productcert/html/ssa-082556.html" }, { "type": "WEB", "url": "https://lists.debian.org/debian-lts-announce/2024/06/msg00026.html" }, { "type": "ADVISORY", "url": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2024/33xxx/CVE-2024-33602.json" }, { "type": "ADVISORY", "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-33602" }, { "type": "ADVISORY", "url": "https://security.netapp.com/advisory/ntap-20240524-0012/" }, { "type": "ADVISORY", "url": "https://sourceware.org/git/?p=glibc.git;a=blob;f=advisories/GLIBC-SA-2024-0008" } ] }, { "schema_version": "1.7.3", "id": "BREW-glibc-CVE-2025-0395", "published": "2026-06-28T21:29:54Z", "modified": "2026-08-05T16:54:10Z", "upstream": [ "CVE-2025-0395" ], "affected": [ { "package": { "ecosystem": "Homebrew", "name": "glibc", "purl": "pkg:brew/glibc" }, "ranges": [ { "type": "ECOSYSTEM", "events": [ { "introduced": "0" }, { "fixed": "2.39" } ] } ], "ecosystem_specific": { "fix": "patch", "patches": [ { "type": "backport", "url": "https://archive.ubuntu.com/ubuntu/pool/main/g/glibc/glibc_2.39-0ubuntu8.8.debian.tar.xz", "apply": [ "patches/any/CVE-2024-2961.patch", "patches/any/CVE-2024-33599.patch", "patches/any/CVE-2024-33600_1.patch", "patches/any/CVE-2024-33600_2.patch", "patches/any/CVE-2024-33601_33602.patch", "patches/any/CVE-2025-0395.patch", "patches/any/CVE-2025-5702.patch", "patches/any/CVE-2025-8058.patch", "patches/CVE-2025-15281.patch", "patches/CVE-2026-0861.patch", "patches/CVE-2026-0915.patch", "patches/CVE-2026-4046.patch", "patches/CVE-2026-5450.patch", "patches/CVE-2026-5928.patch", "patches/CVE-2026-6238-pre1.patch", "patches/CVE-2026-6238-pre2.patch", "patches/CVE-2026-6238-pre3.patch", "patches/CVE-2026-6238-pre4.patch", "patches/CVE-2026-5435.patch", "patches/CVE-2026-6238-1.patch", "patches/CVE-2026-6238-2.patch", "patches/CVE-2026-443x.patch" ] } ] } } ], "database_specific": { "source": "generated" }, "details": "When the assert() function in the GNU C Library versions 2.13 to 2.40 fails, it does not allocate enough space for the assertion failure message string and size information, which may lead to a buffer overflow if the message string size aligns to page size.", "severity": [ { "type": "CVSS_V3", "score": "CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H" } ], "references": [ { "type": "WEB", "url": "http://www.openwall.com/lists/oss-security/2025/01/22/4" }, { "type": "WEB", "url": "http://www.openwall.com/lists/oss-security/2025/01/23/2" }, { "type": "WEB", "url": "http://www.openwall.com/lists/oss-security/2025/04/13/1" }, { "type": "WEB", "url": "http://www.openwall.com/lists/oss-security/2025/04/24/7" }, { "type": "WEB", "url": "https://cert-portal.siemens.com/productcert/html/ssa-398330.html" }, { "type": "WEB", "url": "https://cert-portal.siemens.com/productcert/html/ssa-577017.html" }, { "type": "WEB", "url": "https://lists.debian.org/debian-lts-announce/2025/04/msg00039.html" }, { "type": "WEB", "url": "https://sourceware.org/pipermail/libc-announce/2025/000044.html" }, { "type": "WEB", "url": "https://www.openwall.com/lists/oss-security/2025/01/22/4" }, { "type": "ADVISORY", "url": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2025/0xxx/CVE-2025-0395.json" }, { "type": "ADVISORY", "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-0395" }, { "type": "ADVISORY", "url": "https://security.netapp.com/advisory/ntap-20250228-0006/" }, { "type": "ADVISORY", "url": "https://sourceware.org/git/?p=glibc.git;a=blob;f=advisories/GLIBC-SA-2025-0001" }, { "type": "REPORT", "url": "https://sourceware.org/bugzilla/show_bug.cgi?id=32582" } ] }, { "schema_version": "1.7.3", "id": "BREW-glibc-CVE-2025-15281", "published": "2026-06-28T21:29:54Z", "modified": "2026-08-05T16:54:10Z", "upstream": [ "CVE-2025-15281" ], "affected": [ { "package": { "ecosystem": "Homebrew", "name": "glibc", "purl": "pkg:brew/glibc" }, "ranges": [ { "type": "ECOSYSTEM", "events": [ { "introduced": "0" }, { "fixed": "2.39" } ] } ], "ecosystem_specific": { "fix": "patch", "patches": [ { "type": "backport", "url": "https://archive.ubuntu.com/ubuntu/pool/main/g/glibc/glibc_2.39-0ubuntu8.8.debian.tar.xz", "apply": [ "patches/any/CVE-2024-2961.patch", "patches/any/CVE-2024-33599.patch", "patches/any/CVE-2024-33600_1.patch", "patches/any/CVE-2024-33600_2.patch", "patches/any/CVE-2024-33601_33602.patch", "patches/any/CVE-2025-0395.patch", "patches/any/CVE-2025-5702.patch", "patches/any/CVE-2025-8058.patch", "patches/CVE-2025-15281.patch", "patches/CVE-2026-0861.patch", "patches/CVE-2026-0915.patch", "patches/CVE-2026-4046.patch", "patches/CVE-2026-5450.patch", "patches/CVE-2026-5928.patch", "patches/CVE-2026-6238-pre1.patch", "patches/CVE-2026-6238-pre2.patch", "patches/CVE-2026-6238-pre3.patch", "patches/CVE-2026-6238-pre4.patch", "patches/CVE-2026-5435.patch", "patches/CVE-2026-6238-1.patch", "patches/CVE-2026-6238-2.patch", "patches/CVE-2026-443x.patch" ] } ] } } ], "database_specific": { "source": "generated" }, "summary": "wordexp with WRDE_REUSE and WRDE_APPEND may return uninitialized memory", "details": "Calling wordexp with WRDE_REUSE in conjunction with WRDE_APPEND in the GNU C Library version 2.0 to version 2.42 may cause the interface to return uninitialized memory in the we_wordv member, which on subsequent calls to wordfree may abort the process.", "severity": [ { "type": "CVSS_V3", "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H" } ], "references": [ { "type": "WEB", "url": "http://www.openwall.com/lists/oss-security/2026/01/20/3" }, { "type": "ADVISORY", "url": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2025/15xxx/CVE-2025-15281.json" }, { "type": "ADVISORY", "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-15281" }, { "type": "REPORT", "url": "https://sourceware.org/bugzilla/show_bug.cgi?id=33814" } ] }, { "schema_version": "1.7.3", "id": "BREW-glibc-CVE-2025-5702", "published": "2026-06-28T21:29:54Z", "modified": "2026-08-05T16:54:10Z", "upstream": [ "CVE-2025-5702" ], "affected": [ { "package": { "ecosystem": "Homebrew", "name": "glibc", "purl": "pkg:brew/glibc" }, "ranges": [ { "type": "ECOSYSTEM", "events": [ { "introduced": "0" }, { "fixed": "2.39" } ] } ], "ecosystem_specific": { "fix": "patch", "patches": [ { "type": "backport", "url": "https://archive.ubuntu.com/ubuntu/pool/main/g/glibc/glibc_2.39-0ubuntu8.8.debian.tar.xz", "apply": [ "patches/any/CVE-2024-2961.patch", "patches/any/CVE-2024-33599.patch", "patches/any/CVE-2024-33600_1.patch", "patches/any/CVE-2024-33600_2.patch", "patches/any/CVE-2024-33601_33602.patch", "patches/any/CVE-2025-0395.patch", "patches/any/CVE-2025-5702.patch", "patches/any/CVE-2025-8058.patch", "patches/CVE-2025-15281.patch", "patches/CVE-2026-0861.patch", "patches/CVE-2026-0915.patch", "patches/CVE-2026-4046.patch", "patches/CVE-2026-5450.patch", "patches/CVE-2026-5928.patch", "patches/CVE-2026-6238-pre1.patch", "patches/CVE-2026-6238-pre2.patch", "patches/CVE-2026-6238-pre3.patch", "patches/CVE-2026-6238-pre4.patch", "patches/CVE-2026-5435.patch", "patches/CVE-2026-6238-1.patch", "patches/CVE-2026-6238-2.patch", "patches/CVE-2026-443x.patch" ] } ] } } ], "database_specific": { "source": "generated" }, "details": "The strcmp implementation optimized for the Power10 processor in the GNU C Library version 2.39 and later writes to vector registers v20 to v31 without saving contents from the caller (those registers are defined as non-volatile registers by the powerpc64le ABI), resulting in overwriting of its contents and potentially altering control flow of the caller, or leaking the input strings to the function to other parts of the program.", "severity": [ { "type": "CVSS_V3", "score": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:L" } ], "references": [ { "type": "REPORT", "url": "https://sourceware.org/bugzilla/show_bug.cgi?id=33056" } ] }, { "schema_version": "1.7.3", "id": "BREW-glibc-CVE-2025-8058", "published": "2026-06-28T21:29:54Z", "modified": "2026-08-05T16:54:10Z", "upstream": [ "CVE-2025-8058" ], "affected": [ { "package": { "ecosystem": "Homebrew", "name": "glibc", "purl": "pkg:brew/glibc" }, "ranges": [ { "type": "ECOSYSTEM", "events": [ { "introduced": "0" }, { "fixed": "2.39" } ] } ], "ecosystem_specific": { "fix": "patch", "patches": [ { "type": "backport", "url": "https://archive.ubuntu.com/ubuntu/pool/main/g/glibc/glibc_2.39-0ubuntu8.8.debian.tar.xz", "apply": [ "patches/any/CVE-2024-2961.patch", "patches/any/CVE-2024-33599.patch", "patches/any/CVE-2024-33600_1.patch", "patches/any/CVE-2024-33600_2.patch", "patches/any/CVE-2024-33601_33602.patch", "patches/any/CVE-2025-0395.patch", "patches/any/CVE-2025-5702.patch", "patches/any/CVE-2025-8058.patch", "patches/CVE-2025-15281.patch", "patches/CVE-2026-0861.patch", "patches/CVE-2026-0915.patch", "patches/CVE-2026-4046.patch", "patches/CVE-2026-5450.patch", "patches/CVE-2026-5928.patch", "patches/CVE-2026-6238-pre1.patch", "patches/CVE-2026-6238-pre2.patch", "patches/CVE-2026-6238-pre3.patch", "patches/CVE-2026-6238-pre4.patch", "patches/CVE-2026-5435.patch", "patches/CVE-2026-6238-1.patch", "patches/CVE-2026-6238-2.patch", "patches/CVE-2026-443x.patch" ] } ] } } ], "database_specific": { "source": "generated" }, "details": "The regcomp function in the GNU C library version from 2.4 to 2.41 is \nsubject to a double free if some previous allocation fails. It can be \naccomplished either by a malloc failure or by using an interposed malloc\n that injects random malloc failures. The double free can allow buffer \nmanipulation depending of how the regex is constructed. This issue \naffects all architectures and ABIs supported by the GNU C library.", "severity": [ { "type": "CVSS_V4", "score": "CVSS:4.0/AV:L/AC:H/AT:P/PR:L/UI:P/VC:L/VI:L/VA:H/SC:L/SI:L/SA:H" } ], "references": [ { "type": "WEB", "url": "http://www.openwall.com/lists/oss-security/2025/07/23/1" }, { "type": "WEB", "url": "https://sourceware.org/git/?p=glibc.git;a=commit;h=3ff17af18c38727b88d9115e536c069e6b5d601f" }, { "type": "WEB", "url": "https://www.gnu.org/software/libc/" }, { "type": "ADVISORY", "url": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2025/8xxx/CVE-2025-8058.json" }, { "type": "ADVISORY", "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-8058" }, { "type": "REPORT", "url": "https://sourceware.org/bugzilla/show_bug.cgi?id=33185" }, { "type": "PACKAGE", "url": "https://sourceware.org/git/?p=glibc.git" } ] }, { "schema_version": "1.7.3", "id": "BREW-glibc-CVE-2026-0861", "published": "2026-06-28T21:29:54Z", "modified": "2026-08-05T16:54:10Z", "upstream": [ "CVE-2026-0861" ], "affected": [ { "package": { "ecosystem": "Homebrew", "name": "glibc", "purl": "pkg:brew/glibc" }, "ranges": [ { "type": "ECOSYSTEM", "events": [ { "introduced": "0" }, { "fixed": "2.39" } ] } ], "ecosystem_specific": { "fix": "patch", "patches": [ { "type": "backport", "url": "https://archive.ubuntu.com/ubuntu/pool/main/g/glibc/glibc_2.39-0ubuntu8.8.debian.tar.xz", "apply": [ "patches/any/CVE-2024-2961.patch", "patches/any/CVE-2024-33599.patch", "patches/any/CVE-2024-33600_1.patch", "patches/any/CVE-2024-33600_2.patch", "patches/any/CVE-2024-33601_33602.patch", "patches/any/CVE-2025-0395.patch", "patches/any/CVE-2025-5702.patch", "patches/any/CVE-2025-8058.patch", "patches/CVE-2025-15281.patch", "patches/CVE-2026-0861.patch", "patches/CVE-2026-0915.patch", "patches/CVE-2026-4046.patch", "patches/CVE-2026-5450.patch", "patches/CVE-2026-5928.patch", "patches/CVE-2026-6238-pre1.patch", "patches/CVE-2026-6238-pre2.patch", "patches/CVE-2026-6238-pre3.patch", "patches/CVE-2026-6238-pre4.patch", "patches/CVE-2026-5435.patch", "patches/CVE-2026-6238-1.patch", "patches/CVE-2026-6238-2.patch", "patches/CVE-2026-443x.patch" ] } ] } } ], "database_specific": { "source": "generated" }, "summary": "Integer overflow in memalign leads to heap corruption", "details": "Passing too large an alignment to the memalign suite of functions (memalign, posix_memalign, aligned_alloc) in the GNU C Library version 2.30 to 2.42 may result in an integer overflow, which could consequently result in a heap corruption.\n\nNote that the attacker must have control over both, the size as well as the alignment arguments of the memalign function to be able to exploit this. The size parameter must be close enough to PTRDIFF_MAX so as to overflow size_t along with the large alignment argument. This limits the malicious inputs for the alignment for memalign to the range [1<<62+ 1, 1<<63] and exactly 1<<63 for posix_memalign and aligned_alloc.\n\nTypically the alignment argument passed to such functions is a known constrained quantity (e.g. page size, block size, struct sizes) and is not attacker controlled, because of which this may not be easily exploitable in practice. An application bug could potentially result in the input alignment being too large, e.g. due to a different buffer overflow or integer overflow in the application or its dependent libraries, but that is again an uncommon usage pattern given typical sources of alignments.", "severity": [ { "type": "CVSS_V3", "score": "CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H" } ], "references": [ { "type": "WEB", "url": "http://www.openwall.com/lists/oss-security/2026/01/16/5" }, { "type": "ADVISORY", "url": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/0xxx/CVE-2026-0861.json" }, { "type": "ADVISORY", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-0861" }, { "type": "ADVISORY", "url": "https://sourceware.org/git/?p=glibc.git;a=blob_plain;f=advisories/GLIBC-SA-2026-0001" }, { "type": "REPORT", "url": "https://sourceware.org/bugzilla/show_bug.cgi?id=33796" } ] }, { "schema_version": "1.7.3", "id": "BREW-glibc-CVE-2026-0915", "published": "2026-06-28T21:29:54Z", "modified": "2026-08-05T16:54:10Z", "upstream": [ "CVE-2026-0915" ], "affected": [ { "package": { "ecosystem": "Homebrew", "name": "glibc", "purl": "pkg:brew/glibc" }, "ranges": [ { "type": "ECOSYSTEM", "events": [ { "introduced": "0" }, { "fixed": "2.39" } ] } ], "ecosystem_specific": { "fix": "patch", "patches": [ { "type": "backport", "url": "https://archive.ubuntu.com/ubuntu/pool/main/g/glibc/glibc_2.39-0ubuntu8.8.debian.tar.xz", "apply": [ "patches/any/CVE-2024-2961.patch", "patches/any/CVE-2024-33599.patch", "patches/any/CVE-2024-33600_1.patch", "patches/any/CVE-2024-33600_2.patch", "patches/any/CVE-2024-33601_33602.patch", "patches/any/CVE-2025-0395.patch", "patches/any/CVE-2025-5702.patch", "patches/any/CVE-2025-8058.patch", "patches/CVE-2025-15281.patch", "patches/CVE-2026-0861.patch", "patches/CVE-2026-0915.patch", "patches/CVE-2026-4046.patch", "patches/CVE-2026-5450.patch", "patches/CVE-2026-5928.patch", "patches/CVE-2026-6238-pre1.patch", "patches/CVE-2026-6238-pre2.patch", "patches/CVE-2026-6238-pre3.patch", "patches/CVE-2026-6238-pre4.patch", "patches/CVE-2026-5435.patch", "patches/CVE-2026-6238-1.patch", "patches/CVE-2026-6238-2.patch", "patches/CVE-2026-443x.patch" ] } ] } } ], "database_specific": { "source": "generated" }, "summary": "getnetbyaddr and getnetbyaddr_r leak stack contents to DNS resovler", "details": "Calling getnetbyaddr or getnetbyaddr_r with a configured nsswitch.conf that specifies the library's DNS backend for networks and queries for a zero-valued network in the GNU C Library version 2.0 to version 2.42 can leak stack contents to the configured DNS resolver.", "severity": [ { "type": "CVSS_V3", "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N" } ], "references": [ { "type": "WEB", "url": "http://www.openwall.com/lists/oss-security/2026/01/16/6" }, { "type": "ADVISORY", "url": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/0xxx/CVE-2026-0915.json" }, { "type": "ADVISORY", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-0915" }, { "type": "REPORT", "url": "https://sourceware.org/bugzilla/show_bug.cgi?id=33802" } ] }, { "schema_version": "1.7.3", "id": "BREW-glibc-CVE-2026-4046", "published": "2026-08-05T16:54:10Z", "modified": "2026-08-05T16:54:10Z", "upstream": [ "CVE-2026-4046" ], "affected": [ { "package": { "ecosystem": "Homebrew", "name": "glibc", "purl": "pkg:brew/glibc" }, "ranges": [ { "type": "ECOSYSTEM", "events": [ { "introduced": "0" }, { "fixed": "2.39_1" } ] } ], "ecosystem_specific": { "fix": "patch", "patches": [ { "type": "backport", "url": "https://archive.ubuntu.com/ubuntu/pool/main/g/glibc/glibc_2.39-0ubuntu8.8.debian.tar.xz", "apply": [ "patches/any/CVE-2024-2961.patch", "patches/any/CVE-2024-33599.patch", "patches/any/CVE-2024-33600_1.patch", "patches/any/CVE-2024-33600_2.patch", "patches/any/CVE-2024-33601_33602.patch", "patches/any/CVE-2025-0395.patch", "patches/any/CVE-2025-5702.patch", "patches/any/CVE-2025-8058.patch", "patches/CVE-2025-15281.patch", "patches/CVE-2026-0861.patch", "patches/CVE-2026-0915.patch", "patches/CVE-2026-4046.patch", "patches/CVE-2026-5450.patch", "patches/CVE-2026-5928.patch", "patches/CVE-2026-6238-pre1.patch", "patches/CVE-2026-6238-pre2.patch", "patches/CVE-2026-6238-pre3.patch", "patches/CVE-2026-6238-pre4.patch", "patches/CVE-2026-5435.patch", "patches/CVE-2026-6238-1.patch", "patches/CVE-2026-6238-2.patch", "patches/CVE-2026-443x.patch" ] } ] } } ], "database_specific": { "source": "generated" }, "summary": "iconv crash due to assertion failure with untrusted input", "details": "The iconv() function in the GNU C Library versions 2.43 and earlier may crash due to an assertion failure when converting inputs from the IBM1390 or IBM1399 character sets, which may be used to remotely crash an application.\n\n\n\nThis vulnerability can be trivially mitigated by removing the IBM1390 and IBM1399 character sets from systems that do not need them.", "severity": [ { "type": "CVSS_V3", "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H" } ], "references": [ { "type": "WEB", "url": "https://cert-portal.siemens.com/productcert/html/ssa-082556.html" }, { "type": "ADVISORY", "url": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/4xxx/CVE-2026-4046.json" }, { "type": "ADVISORY", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-4046" }, { "type": "ADVISORY", "url": "https://sourceware.org/git/?p=glibc.git;a=blob_plain;f=advisories/GLIBC-SA-2026-0007;hb=HEAD" }, { "type": "REPORT", "url": "https://sourceware.org/bugzilla/show_bug.cgi?id=33980" }, { "type": "ARTICLE", "url": "https://inbox.sourceware.org/libc-announce/76814edf-cf7f-47ec-979d-2dce0a2c76bf@gotplt.org/T/#u" } ] }, { "schema_version": "1.7.3", "id": "BREW-glibc-CVE-2026-4437", "published": "2026-08-05T16:54:10Z", "modified": "2026-08-05T16:54:10Z", "upstream": [ "CVE-2026-4437" ], "affected": [ { "package": { "ecosystem": "Homebrew", "name": "glibc", "purl": "pkg:brew/glibc" }, "ranges": [ { "type": "ECOSYSTEM", "events": [ { "introduced": "0" }, { "fixed": "2.39_1" } ] } ], "ecosystem_specific": { "fix": "patch", "patches": [ { "type": "backport", "url": "https://archive.ubuntu.com/ubuntu/pool/main/g/glibc/glibc_2.39-0ubuntu8.8.debian.tar.xz", "apply": [ "patches/any/CVE-2024-2961.patch", "patches/any/CVE-2024-33599.patch", "patches/any/CVE-2024-33600_1.patch", "patches/any/CVE-2024-33600_2.patch", "patches/any/CVE-2024-33601_33602.patch", "patches/any/CVE-2025-0395.patch", "patches/any/CVE-2025-5702.patch", "patches/any/CVE-2025-8058.patch", "patches/CVE-2025-15281.patch", "patches/CVE-2026-0861.patch", "patches/CVE-2026-0915.patch", "patches/CVE-2026-4046.patch", "patches/CVE-2026-5450.patch", "patches/CVE-2026-5928.patch", "patches/CVE-2026-6238-pre1.patch", "patches/CVE-2026-6238-pre2.patch", "patches/CVE-2026-6238-pre3.patch", "patches/CVE-2026-6238-pre4.patch", "patches/CVE-2026-5435.patch", "patches/CVE-2026-6238-1.patch", "patches/CVE-2026-6238-2.patch", "patches/CVE-2026-443x.patch" ] } ] } } ], "database_specific": { "source": "generated" }, "summary": "gethostbyaddr and gethostbyaddr_r may incorrectly handle DNS response", "details": "Calling gethostbyaddr or gethostbyaddr_r with a configured nsswitch.conf that specifies the library's DNS backend in the GNU C Library version 2.34 to version 2.43 could, with a crafted response from the configured DNS server, result in a violation of the DNS specification that causes the application to treat a non-answer section of the DNS response as a valid answer.", "severity": [ { "type": "CVSS_V3", "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H" } ], "references": [ { "type": "WEB", "url": "https://cert-portal.siemens.com/productcert/html/ssa-082556.html" }, { "type": "ADVISORY", "url": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/4xxx/CVE-2026-4437.json" }, { "type": "ADVISORY", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-4437" }, { "type": "REPORT", "url": "https://sourceware.org/bugzilla/show_bug.cgi?id=34014" } ] }, { "schema_version": "1.7.3", "id": "BREW-glibc-CVE-2026-4438", "published": "2026-08-05T16:54:10Z", "modified": "2026-08-05T16:54:10Z", "upstream": [ "CVE-2026-4438" ], "affected": [ { "package": { "ecosystem": "Homebrew", "name": "glibc", "purl": "pkg:brew/glibc" }, "ranges": [ { "type": "ECOSYSTEM", "events": [ { "introduced": "0" }, { "fixed": "2.39_1" } ] } ], "ecosystem_specific": { "fix": "patch", "patches": [ { "type": "backport", "url": "https://archive.ubuntu.com/ubuntu/pool/main/g/glibc/glibc_2.39-0ubuntu8.8.debian.tar.xz", "apply": [ "patches/any/CVE-2024-2961.patch", "patches/any/CVE-2024-33599.patch", "patches/any/CVE-2024-33600_1.patch", "patches/any/CVE-2024-33600_2.patch", "patches/any/CVE-2024-33601_33602.patch", "patches/any/CVE-2025-0395.patch", "patches/any/CVE-2025-5702.patch", "patches/any/CVE-2025-8058.patch", "patches/CVE-2025-15281.patch", "patches/CVE-2026-0861.patch", "patches/CVE-2026-0915.patch", "patches/CVE-2026-4046.patch", "patches/CVE-2026-5450.patch", "patches/CVE-2026-5928.patch", "patches/CVE-2026-6238-pre1.patch", "patches/CVE-2026-6238-pre2.patch", "patches/CVE-2026-6238-pre3.patch", "patches/CVE-2026-6238-pre4.patch", "patches/CVE-2026-5435.patch", "patches/CVE-2026-6238-1.patch", "patches/CVE-2026-6238-2.patch", "patches/CVE-2026-443x.patch" ] } ] } } ], "database_specific": { "source": "generated" }, "summary": "gethostbyaddr and gethostbyaddr_r return invalid DNS hostnames", "details": "Calling gethostbyaddr or gethostbyaddr_r with a configured nsswitch.conf that specifies the library's DNS backend in the GNU C library version 2.34 to version 2.43 could result in an invalid DNS hostname being returned to the caller in violation of the DNS specification.", "severity": [ { "type": "CVSS_V3", "score": "CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N" } ], "references": [ { "type": "WEB", "url": "https://cert-portal.siemens.com/productcert/html/ssa-082556.html" }, { "type": "ADVISORY", "url": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/4xxx/CVE-2026-4438.json" }, { "type": "ADVISORY", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-4438" }, { "type": "REPORT", "url": "https://sourceware.org/bugzilla/show_bug.cgi?id=34015" } ] }, { "schema_version": "1.7.3", "id": "BREW-glibc-CVE-2026-5435", "published": "2026-08-05T16:54:10Z", "modified": "2026-08-05T16:54:10Z", "upstream": [ "CVE-2026-5435" ], "affected": [ { "package": { "ecosystem": "Homebrew", "name": "glibc", "purl": "pkg:brew/glibc" }, "ranges": [ { "type": "ECOSYSTEM", "events": [ { "introduced": "0" }, { "fixed": "2.39_1" } ] } ], "ecosystem_specific": { "fix": "patch", "patches": [ { "type": "backport", "url": "https://archive.ubuntu.com/ubuntu/pool/main/g/glibc/glibc_2.39-0ubuntu8.8.debian.tar.xz", "apply": [ "patches/any/CVE-2024-2961.patch", "patches/any/CVE-2024-33599.patch", "patches/any/CVE-2024-33600_1.patch", "patches/any/CVE-2024-33600_2.patch", "patches/any/CVE-2024-33601_33602.patch", "patches/any/CVE-2025-0395.patch", "patches/any/CVE-2025-5702.patch", "patches/any/CVE-2025-8058.patch", "patches/CVE-2025-15281.patch", "patches/CVE-2026-0861.patch", "patches/CVE-2026-0915.patch", "patches/CVE-2026-4046.patch", "patches/CVE-2026-5450.patch", "patches/CVE-2026-5928.patch", "patches/CVE-2026-6238-pre1.patch", "patches/CVE-2026-6238-pre2.patch", "patches/CVE-2026-6238-pre3.patch", "patches/CVE-2026-6238-pre4.patch", "patches/CVE-2026-5435.patch", "patches/CVE-2026-6238-1.patch", "patches/CVE-2026-6238-2.patch", "patches/CVE-2026-443x.patch" ] } ] } } ], "database_specific": { "source": "generated" } }, { "schema_version": "1.7.3", "id": "BREW-glibc-CVE-2026-5450", "published": "2026-08-05T16:54:10Z", "modified": "2026-08-05T16:54:10Z", "upstream": [ "CVE-2026-5450" ], "affected": [ { "package": { "ecosystem": "Homebrew", "name": "glibc", "purl": "pkg:brew/glibc" }, "ranges": [ { "type": "ECOSYSTEM", "events": [ { "introduced": "0" }, { "fixed": "2.39_1" } ] } ], "ecosystem_specific": { "fix": "patch", "patches": [ { "type": "backport", "url": "https://archive.ubuntu.com/ubuntu/pool/main/g/glibc/glibc_2.39-0ubuntu8.8.debian.tar.xz", "apply": [ "patches/any/CVE-2024-2961.patch", "patches/any/CVE-2024-33599.patch", "patches/any/CVE-2024-33600_1.patch", "patches/any/CVE-2024-33600_2.patch", "patches/any/CVE-2024-33601_33602.patch", "patches/any/CVE-2025-0395.patch", "patches/any/CVE-2025-5702.patch", "patches/any/CVE-2025-8058.patch", "patches/CVE-2025-15281.patch", "patches/CVE-2026-0861.patch", "patches/CVE-2026-0915.patch", "patches/CVE-2026-4046.patch", "patches/CVE-2026-5450.patch", "patches/CVE-2026-5928.patch", "patches/CVE-2026-6238-pre1.patch", "patches/CVE-2026-6238-pre2.patch", "patches/CVE-2026-6238-pre3.patch", "patches/CVE-2026-6238-pre4.patch", "patches/CVE-2026-5435.patch", "patches/CVE-2026-6238-1.patch", "patches/CVE-2026-6238-2.patch", "patches/CVE-2026-443x.patch" ] } ] } } ], "database_specific": { "source": "generated" }, "summary": "scanf %mc off-by-one heap buffer overflow", "details": "Calling the scanf family of functions with a %mc (malloc'd character match) in the GNU C Library version 2.7 to version 2.43 with a format width specifier with an explicit width greater than 1024 could result in a one byte heap buffer overflow.", "severity": [ { "type": "CVSS_V3", "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H" } ], "references": [ { "type": "WEB", "url": "https://cert-portal.siemens.com/productcert/html/ssa-082556.html" }, { "type": "ADVISORY", "url": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/5xxx/CVE-2026-5450.json" }, { "type": "ADVISORY", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-5450" }, { "type": "REPORT", "url": "https://sourceware.org/bugzilla/show_bug.cgi?id=CVE-2026-5450" }, { "type": "ARTICLE", "url": "https://inbox.sourceware.org/libc-announce/b11f0003-6ec1-4bd6-b9de-9e38a4efeca3@redhat.com/T/#u" } ] }, { "schema_version": "1.7.3", "id": "BREW-glibc-CVE-2026-5928", "published": "2026-08-05T16:54:10Z", "modified": "2026-08-05T16:54:10Z", "upstream": [ "CVE-2026-5928" ], "affected": [ { "package": { "ecosystem": "Homebrew", "name": "glibc", "purl": "pkg:brew/glibc" }, "ranges": [ { "type": "ECOSYSTEM", "events": [ { "introduced": "0" }, { "fixed": "2.39_1" } ] } ], "ecosystem_specific": { "fix": "patch", "patches": [ { "type": "backport", "url": "https://archive.ubuntu.com/ubuntu/pool/main/g/glibc/glibc_2.39-0ubuntu8.8.debian.tar.xz", "apply": [ "patches/any/CVE-2024-2961.patch", "patches/any/CVE-2024-33599.patch", "patches/any/CVE-2024-33600_1.patch", "patches/any/CVE-2024-33600_2.patch", "patches/any/CVE-2024-33601_33602.patch", "patches/any/CVE-2025-0395.patch", "patches/any/CVE-2025-5702.patch", "patches/any/CVE-2025-8058.patch", "patches/CVE-2025-15281.patch", "patches/CVE-2026-0861.patch", "patches/CVE-2026-0915.patch", "patches/CVE-2026-4046.patch", "patches/CVE-2026-5450.patch", "patches/CVE-2026-5928.patch", "patches/CVE-2026-6238-pre1.patch", "patches/CVE-2026-6238-pre2.patch", "patches/CVE-2026-6238-pre3.patch", "patches/CVE-2026-6238-pre4.patch", "patches/CVE-2026-5435.patch", "patches/CVE-2026-6238-1.patch", "patches/CVE-2026-6238-2.patch", "patches/CVE-2026-443x.patch" ] } ] } } ], "database_specific": { "source": "generated" }, "summary": "Potential buffer under-read in ungetwc", "details": "Calling the ungetwc function on a FILE stream with wide characters encoded in a character set that has overlaps between its single byte and multi-byte character encodings, in the GNU C Library version 2.43 or earlier, may result in an attempt to read bytes before an allocated buffer, potentially resulting in unintentional disclosure of neighboring data in the heap, or a program crash.\n\nA bug in the wide character pushback implementation (_IO_wdefault_pbackfail in libio/wgenops.c) causes ungetwc() to operate on the regular character buffer (fp->_IO_read_ptr) instead of the actual wide-stream read pointer (fp->_wide_data->_IO_read_ptr). The program crash may happen in cases where fp->_IO_read_ptr is not initialized and hence points to NULL. The buffer under-read requires a special situation where the input character encoding is such that there are overlaps between single byte representations and multibyte representations in that encoding, resulting in spurious matches. The spurious match case is not possible in the standard Unicode character sets.", "severity": [ { "type": "CVSS_V3", "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H" } ], "references": [ { "type": "WEB", "url": "https://cert-portal.siemens.com/productcert/html/ssa-082556.html" }, { "type": "ADVISORY", "url": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/5xxx/CVE-2026-5928.json" }, { "type": "ADVISORY", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-5928" }, { "type": "REPORT", "url": "https://sourceware.org/bugzilla/show_bug.cgi?id=33998" } ] }, { "schema_version": "1.7.3", "id": "BREW-glibc-CVE-2026-6238", "published": "2026-08-05T16:54:10Z", "modified": "2026-08-05T16:54:10Z", "upstream": [ "CVE-2026-6238" ], "affected": [ { "package": { "ecosystem": "Homebrew", "name": "glibc", "purl": "pkg:brew/glibc" }, "ranges": [ { "type": "ECOSYSTEM", "events": [ { "introduced": "0" }, { "fixed": "2.39_1" } ] } ], "ecosystem_specific": { "fix": "patch", "patches": [ { "type": "backport", "url": "https://archive.ubuntu.com/ubuntu/pool/main/g/glibc/glibc_2.39-0ubuntu8.8.debian.tar.xz", "apply": [ "patches/any/CVE-2024-2961.patch", "patches/any/CVE-2024-33599.patch", "patches/any/CVE-2024-33600_1.patch", "patches/any/CVE-2024-33600_2.patch", "patches/any/CVE-2024-33601_33602.patch", "patches/any/CVE-2025-0395.patch", "patches/any/CVE-2025-5702.patch", "patches/any/CVE-2025-8058.patch", "patches/CVE-2025-15281.patch", "patches/CVE-2026-0861.patch", "patches/CVE-2026-0915.patch", "patches/CVE-2026-4046.patch", "patches/CVE-2026-5450.patch", "patches/CVE-2026-5928.patch", "patches/CVE-2026-6238-pre1.patch", "patches/CVE-2026-6238-pre2.patch", "patches/CVE-2026-6238-pre3.patch", "patches/CVE-2026-6238-pre4.patch", "patches/CVE-2026-5435.patch", "patches/CVE-2026-6238-1.patch", "patches/CVE-2026-6238-2.patch", "patches/CVE-2026-443x.patch" ] } ] } } ], "database_specific": { "source": "generated" } } ], "libquicktime": [ { "schema_version": "1.7.3", "id": "BREW-libquicktime-CVE-2016-2399", "published": "2026-06-28T21:29:54Z", "modified": "2026-07-27T14:59:08Z", "upstream": [ "CVE-2016-2399" ], "affected": [ { "package": { "ecosystem": "Homebrew", "name": "libquicktime", "purl": "pkg:brew/libquicktime" }, "ranges": [ { "type": "ECOSYSTEM", "events": [ { "introduced": "0" }, { "fixed": "1.2.4_3" } ] } ], "ecosystem_specific": { "fix": "patch", "patches": [ { "type": "backport", "url": "https://deb.debian.org/debian/pool/main/libq/libquicktime/libquicktime_1.2.4-12.debian.tar.xz", "apply": [ "patches/CVE-2016-2399.patch", "patches/CVE-2017-9122_et_al.patch" ] } ] } } ], "database_specific": { "source": "generated" }, "details": "Integer overflow in the quicktime_read_pascal function in libquicktime 1.2.4 and earlier allows remote attackers to cause a denial of service or possibly have other unspecified impact via a crafted hdlr MP4 atom.", "severity": [ { "type": "CVSS_V3", "score": "CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H" } ], "references": [ { "type": "WEB", "url": "https://www.exploit-db.com/exploits/39487/" }, { "type": "ADVISORY", "url": "http://www.debian.org/security/2017/dsa-3800" }, { "type": "ADVISORY", "url": "http://www.securityfocus.com/bid/95880" }, { "type": "EVIDENCE", "url": "http://www.nemux.org/2016/02/23/libquicktime-1-2-4/" }, { "type": "EVIDENCE", "url": "https://packetstormsecurity.com/files/135899/libquicktime-1.2.4-Integer-Overflow.html" } ] }, { "schema_version": "1.7.3", "id": "BREW-libquicktime-CVE-2017-9122", "published": "2026-06-28T21:29:54Z", "modified": "2026-07-27T14:59:08Z", "upstream": [ "CVE-2017-9122" ], "affected": [ { "package": { "ecosystem": "Homebrew", "name": "libquicktime", "purl": "pkg:brew/libquicktime" }, "ranges": [ { "type": "ECOSYSTEM", "events": [ { "introduced": "0" }, { "fixed": "1.2.4_4" } ] } ], "ecosystem_specific": { "fix": "patch", "patches": [ { "type": "backport", "url": "https://deb.debian.org/debian/pool/main/libq/libquicktime/libquicktime_1.2.4-12.debian.tar.xz", "apply": [ "patches/CVE-2016-2399.patch", "patches/CVE-2017-9122_et_al.patch" ] } ] } } ], "database_specific": { "source": "generated" }, "details": "The quicktime_read_moov function in moov.c in libquicktime 1.2.4 allows remote attackers to cause a denial of service (infinite loop and CPU consumption) via a crafted mp4 file.", "severity": [ { "type": "CVSS_V3", "score": "CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H" } ], "references": [ { "type": "WEB", "url": "https://usn.ubuntu.com/4545-1/" }, { "type": "ADVISORY", "url": "https://www.exploit-db.com/exploits/42148/" } ] }, { "schema_version": "1.7.3", "id": "BREW-libquicktime-CVE-2017-9123", "published": "2026-07-14T23:39:39Z", "modified": "2026-07-27T14:59:08Z", "upstream": [ "CVE-2017-9123" ], "affected": [ { "package": { "ecosystem": "Homebrew", "name": "libquicktime", "purl": "pkg:brew/libquicktime" }, "ranges": [ { "type": "ECOSYSTEM", "events": [ { "introduced": "0" }, { "fixed": "1.2.4_4" } ] } ], "ecosystem_specific": { "fix": "patch", "patches": [ { "type": "backport", "url": "https://deb.debian.org/debian/pool/main/libq/libquicktime/libquicktime_1.2.4-12.debian.tar.xz", "apply": [ "patches/CVE-2016-2399.patch", "patches/CVE-2017-9122_et_al.patch" ] } ] } } ], "database_specific": { "source": "generated" }, "details": "The lqt_frame_duration function in lqt_quicktime.c in libquicktime 1.2.4 allows remote attackers to cause a denial of service (invalid memory read and application crash) via a crafted mp4 file.", "severity": [ { "type": "CVSS_V3", "score": "CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H" } ], "references": [ { "type": "WEB", "url": "https://usn.ubuntu.com/4545-1/" }, { "type": "ADVISORY", "url": "https://www.exploit-db.com/exploits/42148/" } ] }, { "schema_version": "1.7.3", "id": "BREW-libquicktime-CVE-2017-9124", "published": "2026-07-14T23:39:39Z", "modified": "2026-07-27T14:59:08Z", "upstream": [ "CVE-2017-9124" ], "affected": [ { "package": { "ecosystem": "Homebrew", "name": "libquicktime", "purl": "pkg:brew/libquicktime" }, "ranges": [ { "type": "ECOSYSTEM", "events": [ { "introduced": "0" }, { "fixed": "1.2.4_4" } ] } ], "ecosystem_specific": { "fix": "patch", "patches": [ { "type": "backport", "url": "https://deb.debian.org/debian/pool/main/libq/libquicktime/libquicktime_1.2.4-12.debian.tar.xz", "apply": [ "patches/CVE-2016-2399.patch", "patches/CVE-2017-9122_et_al.patch" ] } ] } } ], "database_specific": { "source": "generated" }, "details": "The quicktime_match_32 function in util.c in libquicktime 1.2.4 allows remote attackers to cause a denial of service (NULL pointer dereference and application crash) via a crafted mp4 file.", "severity": [ { "type": "CVSS_V3", "score": "CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H" } ], "references": [ { "type": "WEB", "url": "https://usn.ubuntu.com/4545-1/" }, { "type": "ADVISORY", "url": "https://www.exploit-db.com/exploits/42148/" } ] }, { "schema_version": "1.7.3", "id": "BREW-libquicktime-CVE-2017-9125", "published": "2026-07-14T23:39:39Z", "modified": "2026-07-27T14:59:08Z", "upstream": [ "CVE-2017-9125" ], "affected": [ { "package": { "ecosystem": "Homebrew", "name": "libquicktime", "purl": "pkg:brew/libquicktime" }, "ranges": [ { "type": "ECOSYSTEM", "events": [ { "introduced": "0" }, { "fixed": "1.2.4_4" } ] } ], "ecosystem_specific": { "fix": "patch", "patches": [ { "type": "backport", "url": "https://deb.debian.org/debian/pool/main/libq/libquicktime/libquicktime_1.2.4-12.debian.tar.xz", "apply": [ "patches/CVE-2016-2399.patch", "patches/CVE-2017-9122_et_al.patch" ] } ] } } ], "database_specific": { "source": "generated" }, "details": "The lqt_frame_duration function in lqt_quicktime.c in libquicktime 1.2.4 allows remote attackers to cause a denial of service (heap-based buffer over-read) via a crafted mp4 file.", "severity": [ { "type": "CVSS_V3", "score": "CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H" } ], "references": [ { "type": "WEB", "url": "https://usn.ubuntu.com/4545-1/" }, { "type": "ADVISORY", "url": "https://www.exploit-db.com/exploits/42148/" } ] }, { "schema_version": "1.7.3", "id": "BREW-libquicktime-CVE-2017-9126", "published": "2026-07-14T23:39:39Z", "modified": "2026-07-27T14:59:08Z", "upstream": [ "CVE-2017-9126" ], "affected": [ { "package": { "ecosystem": "Homebrew", "name": "libquicktime", "purl": "pkg:brew/libquicktime" }, "ranges": [ { "type": "ECOSYSTEM", "events": [ { "introduced": "0" }, { "fixed": "1.2.4_4" } ] } ], "ecosystem_specific": { "fix": "patch", "patches": [ { "type": "backport", "url": "https://deb.debian.org/debian/pool/main/libq/libquicktime/libquicktime_1.2.4-12.debian.tar.xz", "apply": [ "patches/CVE-2016-2399.patch", "patches/CVE-2017-9122_et_al.patch" ] } ] } } ], "database_specific": { "source": "generated" }, "details": "The quicktime_read_dref_table function in dref.c in libquicktime 1.2.4 allows remote attackers to cause a denial of service (heap-based buffer overflow and application crash) via a crafted mp4 file.", "severity": [ { "type": "CVSS_V3", "score": "CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H" } ], "references": [ { "type": "WEB", "url": "https://usn.ubuntu.com/4545-1/" }, { "type": "ADVISORY", "url": "https://www.exploit-db.com/exploits/42148/" } ] }, { "schema_version": "1.7.3", "id": "BREW-libquicktime-CVE-2017-9127", "published": "2026-07-14T23:39:39Z", "modified": "2026-07-27T14:59:08Z", "upstream": [ "CVE-2017-9127" ], "affected": [ { "package": { "ecosystem": "Homebrew", "name": "libquicktime", "purl": "pkg:brew/libquicktime" }, "ranges": [ { "type": "ECOSYSTEM", "events": [ { "introduced": "0" }, { "fixed": "1.2.4_4" } ] } ], "ecosystem_specific": { "fix": "patch", "patches": [ { "type": "backport", "url": "https://deb.debian.org/debian/pool/main/libq/libquicktime/libquicktime_1.2.4-12.debian.tar.xz", "apply": [ "patches/CVE-2016-2399.patch", "patches/CVE-2017-9122_et_al.patch" ] } ] } } ], "database_specific": { "source": "generated" }, "details": "The quicktime_user_atoms_read_atom function in useratoms.c in libquicktime 1.2.4 allows remote attackers to cause a denial of service (heap-based buffer overflow and application crash) via a crafted mp4 file.", "severity": [ { "type": "CVSS_V3", "score": "CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H" } ], "references": [ { "type": "WEB", "url": "https://usn.ubuntu.com/4545-1/" }, { "type": "ADVISORY", "url": "https://www.exploit-db.com/exploits/42148/" } ] }, { "schema_version": "1.7.3", "id": "BREW-libquicktime-CVE-2017-9128", "published": "2026-07-14T23:39:39Z", "modified": "2026-07-27T14:59:08Z", "upstream": [ "CVE-2017-9128" ], "affected": [ { "package": { "ecosystem": "Homebrew", "name": "libquicktime", "purl": "pkg:brew/libquicktime" }, "ranges": [ { "type": "ECOSYSTEM", "events": [ { "introduced": "0" }, { "fixed": "1.2.4_4" } ] } ], "ecosystem_specific": { "fix": "patch", "patches": [ { "type": "backport", "url": "https://deb.debian.org/debian/pool/main/libq/libquicktime/libquicktime_1.2.4-12.debian.tar.xz", "apply": [ "patches/CVE-2016-2399.patch", "patches/CVE-2017-9122_et_al.patch" ] } ] } } ], "database_specific": { "source": "generated" }, "details": "The quicktime_video_width function in lqt_quicktime.c in libquicktime 1.2.4 allows remote attackers to cause a denial of service (heap-based buffer over-read and application crash) via a crafted mp4 file.", "severity": [ { "type": "CVSS_V3", "score": "CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H" } ], "references": [ { "type": "WEB", "url": "https://usn.ubuntu.com/4545-1/" }, { "type": "ADVISORY", "url": "https://www.exploit-db.com/exploits/42148/" } ] } ], "libssh2": [ { "schema_version": "1.7.3", "id": "BREW-libssh2-CVE-2025-15661", "published": "2026-07-18T04:02:33Z", "modified": "2026-07-18T04:02:33Z", "upstream": [ "CVE-2025-15661" ], "affected": [ { "package": { "ecosystem": "Homebrew", "name": "libssh2", "purl": "pkg:brew/libssh2" }, "ranges": [ { "type": "ECOSYSTEM", "events": [ { "introduced": "0" }, { "fixed": "1.11.1_3" } ] } ], "ecosystem_specific": { "fix": "patch", "patches": [ { "type": "backport", "file": "Patches/libssh2/CVE-2025-15661.patch" } ] } } ], "database_specific": { "source": "generated" }, "summary": "libssh2 - Heap Buffer Over-read via sftp_symlink() in sftp.c", "details": "libssh2 through 1.11.1, fixed in commit 2dae302, contains an out-of-bounds heap read vulnerability in the sftp_symlink() function in src/sftp.c that allows a malicious SSH server or man-in-the-middle attacker to disclose heap memory contents or cause a crash by sending a crafted SSH_FXP_NAME response. Attackers can supply a link_len value larger than the actual packet data in SSH_FXP_NAME responses for SFTP READLINK and REALPATH operations, triggering a heap buffer over-read of up to target_len minus one bytes due to the missing validation of available packet buffer size before the memcpy operation.", "severity": [ { "type": "CVSS_V4", "score": "CVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:N/VC:L/VI:N/VA:H/SC:N/SI:N/SA:N" } ], "references": [ { "type": "ADVISORY", "url": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2025/15xxx/CVE-2025-15661.json" }, { "type": "ADVISORY", "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-15661" }, { "type": "ADVISORY", "url": "https://www.vulncheck.com/advisories/libssh2-heap-buffer-over-read-via-sftp-symlink-in-sftp-c" }, { "type": "REPORT", "url": "https://github.com/libssh2/libssh2/pull/1705" }, { "type": "REPORT", "url": "https://github.com/libssh2/libssh2/pull/1717" }, { "type": "FIX", "url": "https://github.com/libssh2/libssh2/commit/2dae3024897e1898d389835151f4e9606227721d" }, { "type": "PACKAGE", "url": "https://github.com/libssh2/libssh2" } ] }, { "schema_version": "1.7.3", "id": "BREW-libssh2-CVE-2026-55199", "published": "2026-07-18T04:02:33Z", "modified": "2026-07-18T04:02:33Z", "upstream": [ "CVE-2026-55199" ], "affected": [ { "package": { "ecosystem": "Homebrew", "name": "libssh2", "purl": "pkg:brew/libssh2" }, "ranges": [ { "type": "ECOSYSTEM", "events": [ { "introduced": "0" }, { "fixed": "1.11.1_3" } ] } ], "ecosystem_specific": { "fix": "patch", "patches": [ { "type": "backport", "url": "https://github.com/libssh2/libssh2/commit/17626857d20b3c9a1addfa45979dadcee1cd84a4.patch?full_index=1" } ] } } ], "database_specific": { "source": "generated" }, "summary": "libssh2 - Pre-Authentication DoS via SSH_MSG_EXT_INFO Handler", "details": "libssh2 through 1.11.1, fixed in commit 1762685, contains a pre-authentication denial of service vulnerability in the SSH_MSG_EXT_INFO handler in src/packet.c that allows a malicious SSH server to cause a client CPU exhaustion loop by sending a crafted extension count value. A malicious server can set nr_extensions to 0xFFFFFFFF during key exchange, causing the client to spin in a tight CPU loop for over 60 seconds because return values from _libssh2_get_string() are unchecked and the session timeout does not apply to CPU-bound loops.", "severity": [ { "type": "CVSS_V4", "score": "CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N" } ], "references": [ { "type": "ADVISORY", "url": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/55xxx/CVE-2026-55199.json" }, { "type": "ADVISORY", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-55199" }, { "type": "ADVISORY", "url": "https://www.vulncheck.com/advisories/libssh2-pre-authentication-dos-via-ssh-msg-ext-info-handler" }, { "type": "REPORT", "url": "https://github.com/libssh2/libssh2/pull/1864" }, { "type": "FIX", "url": "https://github.com/libssh2/libssh2/commit/17626857d20b3c9a1addfa45979dadcee1cd84a4" }, { "type": "PACKAGE", "url": "https://github.com/libssh2/libssh2" } ] }, { "schema_version": "1.7.3", "id": "BREW-libssh2-CVE-2026-55200", "published": "2026-07-18T04:02:33Z", "modified": "2026-07-18T04:02:33Z", "upstream": [ "CVE-2026-55200" ], "affected": [ { "package": { "ecosystem": "Homebrew", "name": "libssh2", "purl": "pkg:brew/libssh2" }, "ranges": [ { "type": "ECOSYSTEM", "events": [ { "introduced": "0" }, { "fixed": "1.11.1_3" } ] } ], "ecosystem_specific": { "fix": "patch", "patches": [ { "type": "backport", "file": "Patches/libssh2/CVE-2026-55200.patch" } ] } } ], "database_specific": { "source": "generated" }, "summary": "libssh2 - Out-of-Bounds Write via Unchecked packet_length in transport.c", "details": "libssh2 through 1.11.1, fixed in commit 7acf3df contains an out-of-bounds write vulnerability in ssh2_transport_read() that fails to enforce upper bounds on packet_length field. Remote attackers can send crafted SSH packets with excessively large packet_length values to corrupt heap memory and achieve remote code execution.", "severity": [ { "type": "CVSS_V4", "score": "CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N" } ], "references": [ { "type": "ADVISORY", "url": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/55xxx/CVE-2026-55200.json" }, { "type": "ADVISORY", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-55200" }, { "type": "ADVISORY", "url": "https://www.vulncheck.com/advisories/libssh2-out-of-bounds-write-via-unchecked-packet-length-in-transport-c" }, { "type": "REPORT", "url": "https://github.com/libssh2/libssh2/pull/2052" }, { "type": "FIX", "url": "https://github.com/libssh2/libssh2/commit/97acf3dfda80c91c3a8c9f2372546301d4a1a7a8" }, { "type": "PACKAGE", "url": "https://github.com/libssh2/libssh2" }, { "type": "EVIDENCE", "url": "https://web.archive.org/web/20260623211210/https://github.com/bikini/exploitarium/tree/main/libssh2-cve-2026-55200-poc" } ] }, { "schema_version": "1.7.3", "id": "BREW-libssh2-CVE-2026-58050", "published": "2026-07-18T04:02:33Z", "modified": "2026-07-18T04:02:33Z", "upstream": [ "CVE-2026-58050" ], "affected": [ { "package": { "ecosystem": "Homebrew", "name": "libssh2", "purl": "pkg:brew/libssh2" }, "ranges": [ { "type": "ECOSYSTEM", "events": [ { "introduced": "0" }, { "fixed": "1.11.1_3" } ] } ], "ecosystem_specific": { "fix": "patch", "patches": [ { "type": "backport", "file": "Patches/libssh2/CVE-2026-58050.patch" } ] } } ], "database_specific": { "source": "generated" }, "summary": "libssh2 - Integer Overflow in publickey Subsystem Attribute Allocation", "details": "libssh2 through 1.11.1 reads an attacker-controlled 32-bit attribute count from a publickey-subsystem response and uses it in the allocation num_attrs * sizeof(libssh2_publickey_attribute) without bounds checking, so on 32-bit platforms the multiplication overflows to an undersized buffer. A malicious SSH server can then drive the attribute-parsing loop to write past the allocation, causing a heap buffer overflow in a connecting libssh2 client.", "severity": [ { "type": "CVSS_V4", "score": "CVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:N/VC:L/VI:L/VA:H/SC:N/SI:N/SA:N" } ], "references": [ { "type": "WEB", "url": "https://github.com/libssh2/libssh2/blob/master/src/publickey.c" }, { "type": "ADVISORY", "url": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/58xxx/CVE-2026-58050.json" }, { "type": "ADVISORY", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-58050" }, { "type": "ADVISORY", "url": "https://www.vulncheck.com/advisories/libssh2-integer-overflow-in-publickey-subsystem-attribute-allocation" }, { "type": "EVIDENCE", "url": "https://github.com/bikini/exploitarium/tree/main/libssh2-publickey-list-calc-poc" } ] }, { "schema_version": "1.7.3", "id": "BREW-libssh2-CVE-2026-58051", "published": "2026-07-18T04:02:33Z", "modified": "2026-07-18T04:02:33Z", "upstream": [ "CVE-2026-58051" ], "affected": [ { "package": { "ecosystem": "Homebrew", "name": "libssh2", "purl": "pkg:brew/libssh2" }, "ranges": [ { "type": "ECOSYSTEM", "events": [ { "introduced": "0" }, { "fixed": "1.11.1_3" } ] } ], "ecosystem_specific": { "fix": "patch", "patches": [ { "type": "backport", "url": "https://github.com/libssh2/libssh2/commit/a9758da45a52bc8c630ec9493804d0c6ea30b24a.patch?full_index=1" } ] } } ], "database_specific": { "source": "generated" }, "summary": "libssh2 - Free of Uninitialized Pointer in publickey List Cleanup", "details": "libssh2 through 1.11.1 grows its publickey list with SSH2_REALLOC but does not zero-initialize new entries before parsing populates them, so a parse failure reaching the cleanup path leaves libssh2_publickey_list_free operating on an uninitialized entry. A malicious SSH server offering the publickey subsystem can use a malformed response to make cleanup free an uninitialized, attacker-influenceable attrs pointer in a connecting libssh2 client.", "severity": [ { "type": "CVSS_V4", "score": "CVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:N/VC:N/VI:L/VA:H/SC:N/SI:N/SA:N" } ], "references": [ { "type": "WEB", "url": "https://github.com/libssh2/libssh2/blob/master/src/publickey.c" }, { "type": "ADVISORY", "url": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/58xxx/CVE-2026-58051.json" }, { "type": "ADVISORY", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-58051" }, { "type": "ADVISORY", "url": "https://www.vulncheck.com/advisories/libssh2-free-of-uninitialized-pointer-in-publickey-list-cleanup" }, { "type": "EVIDENCE", "url": "https://github.com/bikini/exploitarium/tree/main/libssh2-publickey-list-calc-poc" } ] }, { "schema_version": "1.7.3", "id": "BREW-libssh2-CVE-2026-66032", "published": "2026-08-05T16:54:10Z", "modified": "2026-08-05T16:54:10Z", "upstream": [ "CVE-2026-66032" ], "affected": [ { "package": { "ecosystem": "Homebrew", "name": "libssh2", "purl": "pkg:brew/libssh2" }, "ranges": [ { "type": "ECOSYSTEM", "events": [ { "introduced": "0" }, { "fixed": "1.11.1_4" } ] } ], "ecosystem_specific": { "fix": "patch", "patches": [ { "type": "backport", "file": "Patches/libssh2/CVE-2026-66032.patch" } ] } } ], "database_specific": { "source": "generated" }, "summary": "libssh2 Double-Free Heap Corruption via sftp_open()", "details": "libssh2 through 1.11.1, fixed in commit 5e47761, contains a double-free vulnerability in the sftp_open() function in src/sftp.c that allows a malicious SSH server to corrupt the heap of any authenticated client opening an SFTP session. When a server responds to SSH_FXP_OPEN with SSH_FXP_STATUS containing FX_OK, the response data buffer is freed, and if a subsequent sftp_packet_require() call returns a specific error such as LIBSSH2_ERROR_CHANNEL_PACKET_EXCEEDED, the same pointer is freed a second time, enabling tcache dup conditions on glibc systems that allow overlapping allocations and function pointer overwrites.", "severity": [ { "type": "CVSS_V4", "score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N" } ], "references": [ { "type": "ADVISORY", "url": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/66xxx/CVE-2026-66032.json" }, { "type": "ADVISORY", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-66032" }, { "type": "ADVISORY", "url": "https://www.vulncheck.com/advisories/libssh2-double-free-heap-corruption-via-sftp-open" }, { "type": "FIX", "url": "https://github.com/libssh2/libssh2/commit/5e4776146552d898b9c0e1b313cd093fa8dc92d0" }, { "type": "FIX", "url": "https://github.com/libssh2/libssh2/pull/2180" }, { "type": "PACKAGE", "url": "https://github.com/libssh2/libssh2" } ] }, { "schema_version": "1.7.3", "id": "BREW-libssh2-CVE-2026-66033", "published": "2026-08-05T16:54:10Z", "modified": "2026-08-05T16:54:10Z", "upstream": [ "CVE-2026-66033" ], "affected": [ { "package": { "ecosystem": "Homebrew", "name": "libssh2", "purl": "pkg:brew/libssh2" }, "ranges": [ { "type": "ECOSYSTEM", "events": [ { "introduced": "0" }, { "fixed": "1.11.1_4" } ] } ], "ecosystem_specific": { "fix": "patch", "patches": [ { "type": "backport", "url": "https://github.com/libssh2/libssh2/commit/a2ed82d40964bbc0d64cd717aa0a5a892117d2e6.patch?full_index=1" } ] } } ], "database_specific": { "source": "generated" }, "summary": "libssh2 Integer Underflow DoS via AES-GCM Cipher Negotiation", "details": "libssh2 through 1.11.1, fixed in commit a2ed82d, contains a pre-authentication integer underflow vulnerability in the ssh2_cipher_crypt() function in src/openssl.c that allows a malicious SSH server to crash any connecting client by negotiating AES-GCM ciphers during handshake. Attackers can exploit the underflow in the expression computing blocksize minus aadlen minus authentication tag length to trigger an out-of-bounds read and a memcpy call with a near-SIZE_MAX length argument, causing immediate process crash before any authentication occurs.", "severity": [ { "type": "CVSS_V4", "score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N" } ], "references": [ { "type": "ADVISORY", "url": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/66xxx/CVE-2026-66033.json" }, { "type": "ADVISORY", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-66033" }, { "type": "ADVISORY", "url": "https://www.vulncheck.com/advisories/libssh2-integer-underflow-dos-via-aes-gcm-cipher-negotiation" }, { "type": "FIX", "url": "https://github.com/libssh2/libssh2/commit/a2ed82d40964bbc0d64cd717aa0a5a892117d2e6" }, { "type": "FIX", "url": "https://github.com/libssh2/libssh2/pull/2401" }, { "type": "PACKAGE", "url": "https://github.com/libssh2/libssh2" } ] }, { "schema_version": "1.7.3", "id": "BREW-libssh2-CVE-2026-66034", "published": "2026-08-05T16:54:10Z", "modified": "2026-08-05T16:54:10Z", "upstream": [ "CVE-2026-66034" ], "affected": [ { "package": { "ecosystem": "Homebrew", "name": "libssh2", "purl": "pkg:brew/libssh2" }, "ranges": [ { "type": "ECOSYSTEM", "events": [ { "introduced": "0" }, { "fixed": "1.11.1_4" } ] } ], "ecosystem_specific": { "fix": "patch", "patches": [ { "type": "backport", "file": "Patches/libssh2/CVE-2026-66034.patch" } ] } } ], "database_specific": { "source": "generated" }, "summary": "libssh2 Heap Out-of-Bounds Read via publickey subsystem", "details": "libssh2 through 1.11.1, fixed in commit a13bb6c, contains a missing bounds check vulnerability that allows a malicious SSH server to trigger an arbitrary-length heap out-of-bounds read and a free of an uninitialized pointer via the publickey subsystem. In libssh2_publickey_list_fetch(), the version 1 response parser reads a server-controlled comment_len value and advances the parse pointer without verifying sufficient bytes remain in the buffer, causing the out-of-bounds read to leak heap pointers from adjacent allocations defeating ASLR, followed by heap allocator state corruption when the error cleanup path frees an uninitialized pointer from a non-zeroed realloc() region.", "severity": [ { "type": "CVSS_V4", "score": "CVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N" } ], "references": [ { "type": "ADVISORY", "url": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/66xxx/CVE-2026-66034.json" }, { "type": "ADVISORY", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-66034" }, { "type": "ADVISORY", "url": "https://www.vulncheck.com/advisories/libssh2-heap-out-of-bounds-read-via-publickey-subsystem" }, { "type": "FIX", "url": "https://github.com/libssh2/libssh2/commit/a13bb6c773f0d55ad1628cede57e99803cd898d9" }, { "type": "FIX", "url": "https://github.com/libssh2/libssh2/pull/2202" }, { "type": "PACKAGE", "url": "https://github.com/libssh2/libssh2" } ] }, { "schema_version": "1.7.3", "id": "BREW-libssh2-CVE-2026-66035", "published": "2026-08-05T16:54:10Z", "modified": "2026-08-05T16:54:10Z", "upstream": [ "CVE-2026-66035" ], "affected": [ { "package": { "ecosystem": "Homebrew", "name": "libssh2", "purl": "pkg:brew/libssh2" }, "ranges": [ { "type": "ECOSYSTEM", "events": [ { "introduced": "0" }, { "fixed": "1.11.1_4" } ] } ], "ecosystem_specific": { "fix": "patch", "patches": [ { "type": "backport", "file": "Patches/libssh2/CVE-2026-66035.patch" } ] } } ], "database_specific": { "source": "generated" }, "summary": "libssh2 Heap Buffer Overflow via ETM Cipher Negotiation", "details": "libssh2 through 1.11.1, fixed in commit 42e33d8, contains a pre-authentication heap buffer overflow vulnerability that allows a malicious SSH server to corrupt heap metadata in any connecting client by sending a packet with a packet_length smaller than the cipher's block size during Encrypt-then-MAC cipher negotiation. In the fullpacket() function in src/transport.c, the ETM path allocates a buffer of packet_length bytes but copies blocksize minus one bytes via memcpy, causing an overflow that on 32-bit glibc writes attacker-controlled bytes into an adjacent chunk's SIZE field, enabling tcache bin confusion, overlapping live objects, and function pointer overwrite during the session handshake before authentication.", "severity": [ { "type": "CVSS_V4", "score": "CVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N" } ], "references": [ { "type": "ADVISORY", "url": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/66xxx/CVE-2026-66035.json" }, { "type": "ADVISORY", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-66035" }, { "type": "ADVISORY", "url": "https://www.vulncheck.com/advisories/libssh2-heap-buffer-overflow-via-etm-cipher-negotiation" }, { "type": "FIX", "url": "https://github.com/libssh2/libssh2/commit/42e33d81577ed4b95d4b4f6f845e5ee8efe5eeb4" }, { "type": "FIX", "url": "https://github.com/libssh2/libssh2/pull/2198" }, { "type": "PACKAGE", "url": "https://github.com/libssh2/libssh2" } ] }, { "schema_version": "1.7.3", "id": "BREW-libssh2-CVE-2026-7598", "published": "2026-07-18T04:02:33Z", "modified": "2026-07-18T04:02:33Z", "upstream": [ "CVE-2026-7598" ], "affected": [ { "package": { "ecosystem": "Homebrew", "name": "libssh2", "purl": "pkg:brew/libssh2" }, "ranges": [ { "type": "ECOSYSTEM", "events": [ { "introduced": "0" }, { "fixed": "1.11.1_3" } ] } ], "ecosystem_specific": { "fix": "patch", "patches": [ { "type": "backport", "url": "https://github.com/libssh2/libssh2/commit/256d04b60d80bf1190e96b0ad1e91b2174d744b1.patch?full_index=1" } ] } } ], "database_specific": { "source": "generated" }, "summary": "libssh2 userauth.c userauth_password integer overflow", "details": "A security vulnerability has been detected in libssh2 up to 1.11.1. The impacted element is the function userauth_password of the file src/userauth.c. Such manipulation of the argument username_len/password_len leads to integer overflow. The attack may be launched remotely. The name of the patch is 256d04b60d80bf1190e96b0ad1e91b2174d744b1. A patch should be applied to remediate this issue.", "severity": [ { "type": "CVSS_V4", "score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:X" } ], "references": [ { "type": "WEB", "url": "https://github.com/libssh2/libssh2/" }, { "type": "WEB", "url": "https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-7598.json" }, { "type": "ADVISORY", "url": "https://access.redhat.com/errata/RHSA-2026:16736" }, { "type": "ADVISORY", "url": "https://access.redhat.com/errata/RHSA-2026:7021" }, { "type": "ADVISORY", "url": "https://access.redhat.com/security/cve/CVE-2026-7598" }, { "type": "ADVISORY", "url": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/7xxx/CVE-2026-7598.json" }, { "type": "ADVISORY", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-7598" }, { "type": "ADVISORY", "url": "https://vuldb.com/submit/805564" }, { "type": "ADVISORY", "url": "https://vuldb.com/vuln/360555" }, { "type": "REPORT", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2464597" }, { "type": "REPORT", "url": "https://vuldb.com/vuln/360555/cti" }, { "type": "FIX", "url": "https://github.com/libssh2/libssh2/commit/256d04b60d80bf1190e96b0ad1e91b2174d744b1" }, { "type": "FIX", "url": "https://github.com/libssh2/libssh2/pull/1858" } ] } ], "libtomcrypt": [ { "schema_version": "1.7.3", "id": "BREW-libtomcrypt-CVE-2019-17362", "published": "2026-07-27T07:36:55Z", "modified": "2026-07-28T07:20:23Z", "upstream": [ "CVE-2019-17362" ], "affected": [ { "package": { "ecosystem": "Homebrew", "name": "libtomcrypt", "purl": "pkg:brew/libtomcrypt" }, "ranges": [ { "type": "ECOSYSTEM", "events": [ { "introduced": "0" }, { "fixed": "1.18.2_1" } ] } ], "ecosystem_specific": { "fix": "patch", "patches": [ { "type": "backport", "url": "https://github.com/libtom/libtomcrypt/commit/64d1153e5a515740ab56f39c46baf4cf6991a9d3.patch?full_index=1" } ] } } ], "database_specific": { "source": "generated" }, "details": "In LibTomCrypt through 1.18.2, the der_decode_utf8_string function (in der_decode_utf8_string.c) does not properly detect certain invalid UTF-8 sequences. This allows context-dependent attackers to cause a denial of service (out-of-bounds read and crash) or read information from other memory locations via carefully crafted DER-encoded data.", "severity": [ { "type": "CVSS_V3", "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H" } ], "references": [ { "type": "WEB", "url": "http://lists.opensuse.org/opensuse-security-announce/2019-11/msg00020.html" }, { "type": "WEB", "url": "http://lists.opensuse.org/opensuse-security-announce/2019-11/msg00041.html" }, { "type": "WEB", "url": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/47YP5SXQ4RY6KMTK2HI5ZZR244XKRMCZ/" }, { "type": "WEB", "url": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/YU5OMCY3PX54YVI4FMNDEENHDJZJ3RJW/" }, { "type": "ADVISORY", "url": "https://lists.debian.org/debian-lts-announce/2019/10/msg00010.html" }, { "type": "REPORT", "url": "https://vuldb.com/?id.142995" }, { "type": "FIX", "url": "https://github.com/libtom/libtomcrypt/pull/508" }, { "type": "EVIDENCE", "url": "https://github.com/libtom/libtomcrypt/issues/507" } ] } ], "lrzsz": [ { "schema_version": "1.7.3", "id": "BREW-lrzsz-CVE-2018-10195", "published": "2026-06-28T21:29:54Z", "modified": "2026-07-14T23:39:39Z", "upstream": [ "CVE-2018-10195" ], "affected": [ { "package": { "ecosystem": "Homebrew", "name": "lrzsz", "purl": "pkg:brew/lrzsz" }, "ranges": [ { "type": "ECOSYSTEM", "events": [ { "introduced": "0" }, { "fixed": "0.12.20_1" } ] } ], "ecosystem_specific": { "fix": "patch", "patches": [ { "url": "https://raw.githubusercontent.com/macports/macports-ports/2319730/comms/lrzsz/files/patch-CVE-2018-10195.diff" } ] } } ], "database_specific": { "source": "generated" }, "details": "lrzsz before version 0.12.21~rc can leak information to the receiving side due to an incorrect length check in the function zsdata that causes a size_t to wrap around.", "severity": [ { "type": "CVSS_V3", "score": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:H" } ], "references": [ { "type": "ADVISORY", "url": "https://lists.suse.com/pipermail/sle-security-updates/2018-April/003955.html?_ga=2.81625751.1026327980.1622040648-1950393542.1547130931" }, { "type": "ADVISORY", "url": "https://lists.suse.com/pipermail/sle-security-updates/2018-April/003956.html?_ga=2.81625751.1026327980.1622040648-1950393542.1547130931" }, { "type": "ADVISORY", "url": "http://www.ohse.de/uwe/software/lrzsz.html" }, { "type": "REPORT", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1572058" }, { "type": "REPORT", "url": "https://lists.debian.org/debian-lts-announce/2022/01/msg00027.html" } ] } ], "nvi": [ { "schema_version": "1.7.3", "id": "BREW-nvi-CVE-2015-2305", "published": "2026-07-14T23:39:39Z", "modified": "2026-07-27T14:59:08Z", "upstream": [ "CVE-2015-2305" ], "affected": [ { "package": { "ecosystem": "Homebrew", "name": "nvi", "purl": "pkg:brew/nvi" }, "ranges": [ { "type": "ECOSYSTEM", "events": [ { "introduced": "0" }, { "fixed": "1.81.6_3" } ] } ], "ecosystem_specific": { "fix": "patch", "patches": [ { "type": "backport", "url": "https://deb.debian.org/debian/pool/main/n/nvi/nvi_1.81.6-17.debian.tar.xz", "apply": [ "patches/03db4.patch", "patches/19include_term_h.patch", "patches/20glibc_has_grantpt.patch", "patches/24fallback_to_dumb_term.patch", "patches/26trailing_tab_segv.patch", "patches/27support_C_locale.patch", "patches/31regex_heap_overflow.patch" ] } ] } } ], "database_specific": { "source": "generated" }, "details": "Integer overflow in the regcomp implementation in the Henry Spencer BSD regex library (aka rxspencer) alpha3.8.g5 on 32-bit platforms, as used in NetBSD through 6.1.5 and other products, might allow context-dependent attackers to execute arbitrary code via a large regular expression that leads to a heap-based buffer overflow.", "references": [ { "type": "ADVISORY", "url": "http://blog.clamav.net/2015/04/clamav-0987-has-been-released.html" }, { "type": "ADVISORY", "url": "http://lists.apple.com/archives/security-announce/2015/Sep/msg00008.html" }, { "type": "ADVISORY", "url": "http://lists.opensuse.org/opensuse-security-announce/2015-05/msg00005.html" }, { "type": "ADVISORY", "url": "http://lists.opensuse.org/opensuse-security-announce/2015-05/msg00026.html" }, { "type": "ADVISORY", "url": "http://lists.opensuse.org/opensuse-updates/2015-04/msg00002.html" }, { "type": "ADVISORY", "url": "http://lists.opensuse.org/opensuse-updates/2015-05/msg00024.html" }, { "type": "ADVISORY", "url": "http://marc.info/?l=bugtraq&m=143403519711434&w=2" }, { "type": "ADVISORY", "url": "http://openwall.com/lists/oss-security/2015/02/07/14" }, { "type": "ADVISORY", "url": "http://openwall.com/lists/oss-security/2015/03/11/8" }, { "type": "ADVISORY", "url": "http://php.net/ChangeLog-5.php" }, { "type": "ADVISORY", "url": "http://rhn.redhat.com/errata/RHSA-2015-1053.html" }, { "type": "ADVISORY", "url": "http://rhn.redhat.com/errata/RHSA-2015-1066.html" }, { "type": "ADVISORY", "url": "http://www.debian.org/security/2015/dsa-3195" }, { "type": "ADVISORY", "url": "http://www.kb.cert.org/vuls/id/695940" }, { "type": "ADVISORY", "url": "http://www.oracle.com/technetwork/topics/security/linuxbulletinjan2016-2867209.html" }, { "type": "ADVISORY", "url": "http://www.securityfocus.com/bid/72611" }, { "type": "ADVISORY", "url": "http://www.securitytracker.com/id/1031947" }, { "type": "ADVISORY", "url": "http://www.ubuntu.com/usn/USN-2572-1" }, { "type": "ADVISORY", "url": "http://www.ubuntu.com/usn/USN-2594-1" }, { "type": "ADVISORY", "url": "https://guidovranken.wordpress.com/2015/02/04/full-disclosure-heap-overflow-in-h-spencers-regex-library-on-32-bit-systems/" }, { "type": "ADVISORY", "url": "https://support.apple.com/HT205267" }, { "type": "ARTICLE", "url": "http://lists.apple.com/archives/security-announce/2015/Sep/msg00008.html" }, { "type": "ARTICLE", "url": "http://lists.opensuse.org/opensuse-security-announce/2015-05/msg00005.html" }, { "type": "ARTICLE", "url": "http://lists.opensuse.org/opensuse-security-announce/2015-05/msg00026.html" }, { "type": "ARTICLE", "url": "http://lists.opensuse.org/opensuse-updates/2015-04/msg00002.html" }, { "type": "ARTICLE", "url": "http://lists.opensuse.org/opensuse-updates/2015-05/msg00024.html" }, { "type": "ARTICLE", "url": "http://marc.info/?l=bugtraq&m=143403519711434&w=2" }, { "type": "ARTICLE", "url": "http://openwall.com/lists/oss-security/2015/02/07/14" }, { "type": "ARTICLE", "url": "http://openwall.com/lists/oss-security/2015/03/11/8" }, { "type": "EVIDENCE", "url": "https://guidovranken.wordpress.com/2015/02/04/full-disclosure-heap-overflow-in-h-spencers-regex-library-on-32-bit-systems/" }, { "type": "WEB", "url": "http://www.kb.cert.org/vuls/id/695940" } ] } ], "unzip": [ { "schema_version": "1.7.3", "id": "BREW-unzip-CVE-2014-8139", "published": "2026-06-28T21:29:54Z", "modified": "2026-07-27T14:59:08Z", "upstream": [ "CVE-2014-8139" ], "affected": [ { "package": { "ecosystem": "Homebrew", "name": "unzip", "purl": "pkg:brew/unzip" }, "ranges": [ { "type": "ECOSYSTEM", "events": [ { "introduced": "0" }, { "fixed": "6.0_1" } ] } ], "ecosystem_specific": { "fix": "patch", "patches": [ { "type": "unofficial", "url": "https://archive.ubuntu.com/ubuntu/pool/main/u/unzip/unzip_6.0-28ubuntu4.1.debian.tar.xz", "apply": [ "patches/01-manpages-in-section-1-not-in-section-1l.patch", "patches/02-this-is-debian-unzip.patch", "patches/03-include-unistd-for-kfreebsd.patch", "patches/04-handle-pkware-verification-bit.patch", "patches/05-fix-uid-gid-handling.patch", "patches/06-initialize-the-symlink-flag.patch", "patches/07-increase-size-of-cfactorstr.patch", "patches/08-allow-greater-hostver-values.patch", "patches/09-cve-2014-8139-crc-overflow.patch", "patches/10-cve-2014-8140-test-compr-eb.patch", "patches/11-cve-2014-8141-getzip64data.patch", "patches/12-cve-2014-9636-test-compr-eb.patch", "patches/13-remove-build-date.patch", "patches/14-cve-2015-7696.patch", "patches/15-cve-2015-7697.patch", "patches/16-fix-integer-underflow-csiz-decrypted.patch", "patches/17-restore-unix-timestamps-accurately.patch", "patches/18-cve-2014-9913-unzip-buffer-overflow.patch", "patches/19-cve-2016-9844-zipinfo-buffer-overflow.patch", "patches/20-cve-2018-1000035-unzip-buffer-overflow.patch", "patches/20-unzip60-alt-iconv-utf8.patch", "patches/21-fix-warning-messages-on-big-files.patch", "patches/22-cve-2019-13232-fix-bug-in-undefer-input.patch", "patches/23-cve-2019-13232-zip-bomb-with-overlapped-entries.patch", "patches/24-cve-2019-13232-do-not-raise-alert-for-misplaced-central-directory.patch", "patches/25-cve-2019-13232-fix-bug-in-uzbunzip2.patch", "patches/26-cve-2019-13232-fix-bug-in-uzinflate.patch", "patches/27-zipgrep-avoid-test-errors.patch", "patches/28-cve-2022-0529-and-cve-2022-0530.patch" ] } ] } } ], "database_specific": { "source": "generated" }, "details": "Heap-based buffer overflow in the CRC32 verification in Info-ZIP UnZip 6.0 and earlier allows remote attackers to execute arbitrary code via a crafted zip file in the -t command argument to the unzip command.", "severity": [ { "type": "CVSS_V3", "score": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H" } ], "references": [ { "type": "ADVISORY", "url": "http://www.ocert.org/advisories/ocert-2014-011.html" }, { "type": "ADVISORY", "url": "http://www.securitytracker.com/id/1031433" }, { "type": "ADVISORY", "url": "https://access.redhat.com/errata/RHSA-2015:0700" }, { "type": "ADVISORY", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1174844" }, { "type": "FIX", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1174844" }, { "type": "REPORT", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1174844" } ] }, { "schema_version": "1.7.3", "id": "BREW-unzip-CVE-2014-8140", "published": "2026-06-28T21:29:54Z", "modified": "2026-07-27T14:59:08Z", "upstream": [ "CVE-2014-8140" ], "affected": [ { "package": { "ecosystem": "Homebrew", "name": "unzip", "purl": "pkg:brew/unzip" }, "ranges": [ { "type": "ECOSYSTEM", "events": [ { "introduced": "0" }, { "fixed": "6.0_1" } ] } ], "ecosystem_specific": { "fix": "patch", "patches": [ { "type": "unofficial", "url": "https://archive.ubuntu.com/ubuntu/pool/main/u/unzip/unzip_6.0-28ubuntu4.1.debian.tar.xz", "apply": [ "patches/01-manpages-in-section-1-not-in-section-1l.patch", "patches/02-this-is-debian-unzip.patch", "patches/03-include-unistd-for-kfreebsd.patch", "patches/04-handle-pkware-verification-bit.patch", "patches/05-fix-uid-gid-handling.patch", "patches/06-initialize-the-symlink-flag.patch", "patches/07-increase-size-of-cfactorstr.patch", "patches/08-allow-greater-hostver-values.patch", "patches/09-cve-2014-8139-crc-overflow.patch", "patches/10-cve-2014-8140-test-compr-eb.patch", "patches/11-cve-2014-8141-getzip64data.patch", "patches/12-cve-2014-9636-test-compr-eb.patch", "patches/13-remove-build-date.patch", "patches/14-cve-2015-7696.patch", "patches/15-cve-2015-7697.patch", "patches/16-fix-integer-underflow-csiz-decrypted.patch", "patches/17-restore-unix-timestamps-accurately.patch", "patches/18-cve-2014-9913-unzip-buffer-overflow.patch", "patches/19-cve-2016-9844-zipinfo-buffer-overflow.patch", "patches/20-cve-2018-1000035-unzip-buffer-overflow.patch", "patches/20-unzip60-alt-iconv-utf8.patch", "patches/21-fix-warning-messages-on-big-files.patch", "patches/22-cve-2019-13232-fix-bug-in-undefer-input.patch", "patches/23-cve-2019-13232-zip-bomb-with-overlapped-entries.patch", "patches/24-cve-2019-13232-do-not-raise-alert-for-misplaced-central-directory.patch", "patches/25-cve-2019-13232-fix-bug-in-uzbunzip2.patch", "patches/26-cve-2019-13232-fix-bug-in-uzinflate.patch", "patches/27-zipgrep-avoid-test-errors.patch", "patches/28-cve-2022-0529-and-cve-2022-0530.patch" ] } ] } } ], "database_specific": { "source": "generated" }, "details": "Heap-based buffer overflow in the test_compr_eb function in Info-ZIP UnZip 6.0 and earlier allows remote attackers to execute arbitrary code via a crafted zip file in the -t command argument to the unzip command.", "severity": [ { "type": "CVSS_V3", "score": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H" } ], "references": [ { "type": "ADVISORY", "url": "http://www.ocert.org/advisories/ocert-2014-011.html" }, { "type": "ADVISORY", "url": "http://www.securitytracker.com/id/1031433" }, { "type": "ADVISORY", "url": "https://access.redhat.com/errata/RHSA-2015:0700" }, { "type": "ADVISORY", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1174851" }, { "type": "REPORT", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1174851" } ] }, { "schema_version": "1.7.3", "id": "BREW-unzip-CVE-2014-8141", "published": "2026-06-28T21:29:54Z", "modified": "2026-07-27T14:59:08Z", "upstream": [ "CVE-2014-8141" ], "affected": [ { "package": { "ecosystem": "Homebrew", "name": "unzip", "purl": "pkg:brew/unzip" }, "ranges": [ { "type": "ECOSYSTEM", "events": [ { "introduced": "0" }, { "fixed": "6.0_1" } ] } ], "ecosystem_specific": { "fix": "patch", "patches": [ { "type": "unofficial", "url": "https://archive.ubuntu.com/ubuntu/pool/main/u/unzip/unzip_6.0-28ubuntu4.1.debian.tar.xz", "apply": [ "patches/01-manpages-in-section-1-not-in-section-1l.patch", "patches/02-this-is-debian-unzip.patch", "patches/03-include-unistd-for-kfreebsd.patch", "patches/04-handle-pkware-verification-bit.patch", "patches/05-fix-uid-gid-handling.patch", "patches/06-initialize-the-symlink-flag.patch", "patches/07-increase-size-of-cfactorstr.patch", "patches/08-allow-greater-hostver-values.patch", "patches/09-cve-2014-8139-crc-overflow.patch", "patches/10-cve-2014-8140-test-compr-eb.patch", "patches/11-cve-2014-8141-getzip64data.patch", "patches/12-cve-2014-9636-test-compr-eb.patch", "patches/13-remove-build-date.patch", "patches/14-cve-2015-7696.patch", "patches/15-cve-2015-7697.patch", "patches/16-fix-integer-underflow-csiz-decrypted.patch", "patches/17-restore-unix-timestamps-accurately.patch", "patches/18-cve-2014-9913-unzip-buffer-overflow.patch", "patches/19-cve-2016-9844-zipinfo-buffer-overflow.patch", "patches/20-cve-2018-1000035-unzip-buffer-overflow.patch", "patches/20-unzip60-alt-iconv-utf8.patch", "patches/21-fix-warning-messages-on-big-files.patch", "patches/22-cve-2019-13232-fix-bug-in-undefer-input.patch", "patches/23-cve-2019-13232-zip-bomb-with-overlapped-entries.patch", "patches/24-cve-2019-13232-do-not-raise-alert-for-misplaced-central-directory.patch", "patches/25-cve-2019-13232-fix-bug-in-uzbunzip2.patch", "patches/26-cve-2019-13232-fix-bug-in-uzinflate.patch", "patches/27-zipgrep-avoid-test-errors.patch", "patches/28-cve-2022-0529-and-cve-2022-0530.patch" ] } ] } } ], "database_specific": { "source": "generated" }, "details": "Heap-based buffer overflow in the getZip64Data function in Info-ZIP UnZip 6.0 and earlier allows remote attackers to execute arbitrary code via a crafted zip file in the -t command argument to the unzip command.", "severity": [ { "type": "CVSS_V3", "score": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H" } ], "references": [ { "type": "ADVISORY", "url": "http://www.ocert.org/advisories/ocert-2014-011.html" }, { "type": "ADVISORY", "url": "http://www.securitytracker.com/id/1031433" }, { "type": "ADVISORY", "url": "https://access.redhat.com/errata/RHSA-2015:0700" }, { "type": "ADVISORY", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1174856" }, { "type": "FIX", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1174856" }, { "type": "REPORT", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1174856" } ] }, { "schema_version": "1.7.3", "id": "BREW-unzip-CVE-2014-9636", "published": "2026-06-28T21:29:54Z", "modified": "2026-07-27T14:59:08Z", "upstream": [ "CVE-2014-9636" ], "affected": [ { "package": { "ecosystem": "Homebrew", "name": "unzip", "purl": "pkg:brew/unzip" }, "ranges": [ { "type": "ECOSYSTEM", "events": [ { "introduced": "0" }, { "fixed": "6.0_1" } ] } ], "ecosystem_specific": { "fix": "patch", "patches": [ { "type": "unofficial", "url": "https://archive.ubuntu.com/ubuntu/pool/main/u/unzip/unzip_6.0-28ubuntu4.1.debian.tar.xz", "apply": [ "patches/01-manpages-in-section-1-not-in-section-1l.patch", "patches/02-this-is-debian-unzip.patch", "patches/03-include-unistd-for-kfreebsd.patch", "patches/04-handle-pkware-verification-bit.patch", "patches/05-fix-uid-gid-handling.patch", "patches/06-initialize-the-symlink-flag.patch", "patches/07-increase-size-of-cfactorstr.patch", "patches/08-allow-greater-hostver-values.patch", "patches/09-cve-2014-8139-crc-overflow.patch", "patches/10-cve-2014-8140-test-compr-eb.patch", "patches/11-cve-2014-8141-getzip64data.patch", "patches/12-cve-2014-9636-test-compr-eb.patch", "patches/13-remove-build-date.patch", "patches/14-cve-2015-7696.patch", "patches/15-cve-2015-7697.patch", "patches/16-fix-integer-underflow-csiz-decrypted.patch", "patches/17-restore-unix-timestamps-accurately.patch", "patches/18-cve-2014-9913-unzip-buffer-overflow.patch", "patches/19-cve-2016-9844-zipinfo-buffer-overflow.patch", "patches/20-cve-2018-1000035-unzip-buffer-overflow.patch", "patches/20-unzip60-alt-iconv-utf8.patch", "patches/21-fix-warning-messages-on-big-files.patch", "patches/22-cve-2019-13232-fix-bug-in-undefer-input.patch", "patches/23-cve-2019-13232-zip-bomb-with-overlapped-entries.patch", "patches/24-cve-2019-13232-do-not-raise-alert-for-misplaced-central-directory.patch", "patches/25-cve-2019-13232-fix-bug-in-uzbunzip2.patch", "patches/26-cve-2019-13232-fix-bug-in-uzinflate.patch", "patches/27-zipgrep-avoid-test-errors.patch", "patches/28-cve-2022-0529-and-cve-2022-0530.patch" ] } ] } } ], "database_specific": { "source": "generated" }, "details": "unzip 6.0 allows remote attackers to cause a denial of service (out-of-bounds read or write and crash) via an extra field with an uncompressed size smaller than the compressed field size in a zip archive that advertises STORED method compression.", "references": [ { "type": "ADVISORY", "url": "http://secunia.com/advisories/62738" }, { "type": "ADVISORY", "url": "http://secunia.com/advisories/62751" }, { "type": "ADVISORY", "url": "http://www.debian.org/security/2015/dsa-3152" }, { "type": "ADVISORY", "url": "http://www.info-zip.org/phpBB3/viewtopic.php?f=7&t=450" }, { "type": "ADVISORY", "url": "http://www.ubuntu.com/usn/USN-2489-1" }, { "type": "ADVISORY", "url": "https://security.gentoo.org/glsa/201611-01" }, { "type": "FIX", "url": "http://www.info-zip.org/phpBB3/viewtopic.php?f=7&t=450" }, { "type": "WEB", "url": "http://lists.fedoraproject.org/pipermail/package-announce/2015-January/148792.html" }, { "type": "WEB", "url": "http://lists.fedoraproject.org/pipermail/package-announce/2015-January/148849.html" }, { "type": "WEB", "url": "http://seclists.org/oss-sec/2014/q4/1131" }, { "type": "WEB", "url": "http://seclists.org/oss-sec/2014/q4/489" }, { "type": "WEB", "url": "http://seclists.org/oss-sec/2014/q4/496" }, { "type": "WEB", "url": "http://seclists.org/oss-sec/2015/q1/216" }, { "type": "WEB", "url": "http://www.oracle.com/technetwork/topics/security/bulletinapr2015-2511959.html" }, { "type": "WEB", "url": "http://www.securityfocus.com/bid/71825" } ] }, { "schema_version": "1.7.3", "id": "BREW-unzip-CVE-2014-9913", "published": "2026-06-28T21:29:54Z", "modified": "2026-07-27T14:59:08Z", "upstream": [ "CVE-2014-9913" ], "affected": [ { "package": { "ecosystem": "Homebrew", "name": "unzip", "purl": "pkg:brew/unzip" }, "ranges": [ { "type": "ECOSYSTEM", "events": [ { "introduced": "0" }, { "fixed": "6.0_3" } ] } ], "ecosystem_specific": { "fix": "patch", "patches": [ { "type": "unofficial", "url": "https://archive.ubuntu.com/ubuntu/pool/main/u/unzip/unzip_6.0-28ubuntu4.1.debian.tar.xz", "apply": [ "patches/01-manpages-in-section-1-not-in-section-1l.patch", "patches/02-this-is-debian-unzip.patch", "patches/03-include-unistd-for-kfreebsd.patch", "patches/04-handle-pkware-verification-bit.patch", "patches/05-fix-uid-gid-handling.patch", "patches/06-initialize-the-symlink-flag.patch", "patches/07-increase-size-of-cfactorstr.patch", "patches/08-allow-greater-hostver-values.patch", "patches/09-cve-2014-8139-crc-overflow.patch", "patches/10-cve-2014-8140-test-compr-eb.patch", "patches/11-cve-2014-8141-getzip64data.patch", "patches/12-cve-2014-9636-test-compr-eb.patch", "patches/13-remove-build-date.patch", "patches/14-cve-2015-7696.patch", "patches/15-cve-2015-7697.patch", "patches/16-fix-integer-underflow-csiz-decrypted.patch", "patches/17-restore-unix-timestamps-accurately.patch", "patches/18-cve-2014-9913-unzip-buffer-overflow.patch", "patches/19-cve-2016-9844-zipinfo-buffer-overflow.patch", "patches/20-cve-2018-1000035-unzip-buffer-overflow.patch", "patches/20-unzip60-alt-iconv-utf8.patch", "patches/21-fix-warning-messages-on-big-files.patch", "patches/22-cve-2019-13232-fix-bug-in-undefer-input.patch", "patches/23-cve-2019-13232-zip-bomb-with-overlapped-entries.patch", "patches/24-cve-2019-13232-do-not-raise-alert-for-misplaced-central-directory.patch", "patches/25-cve-2019-13232-fix-bug-in-uzbunzip2.patch", "patches/26-cve-2019-13232-fix-bug-in-uzinflate.patch", "patches/27-zipgrep-avoid-test-errors.patch", "patches/28-cve-2022-0529-and-cve-2022-0530.patch" ] } ] } } ], "database_specific": { "source": "generated" }, "details": "Buffer overflow in the list_files function in list.c in Info-Zip UnZip 6.0 allows remote attackers to cause a denial of service (crash) via vectors related to the compression method.", "severity": [ { "type": "CVSS_V3", "score": "CVSS:3.0/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L" } ], "references": [ { "type": "ADVISORY", "url": "http://www.openwall.com/lists/oss-security/2014/11/03/5" }, { "type": "ADVISORY", "url": "http://www.openwall.com/lists/oss-security/2016/12/05/13" }, { "type": "ADVISORY", "url": "http://www.openwall.com/lists/oss-security/2016/12/05/19" }, { "type": "ADVISORY", "url": "http://www.openwall.com/lists/oss-security/2016/12/05/20" }, { "type": "ADVISORY", "url": "http://www.securityfocus.com/bid/95081" }, { "type": "ADVISORY", "url": "https://bugs.launchpad.net/ubuntu/+source/unzip/+bug/1643750" }, { "type": "ARTICLE", "url": "http://www.openwall.com/lists/oss-security/2014/11/03/5" }, { "type": "ARTICLE", "url": "http://www.openwall.com/lists/oss-security/2016/12/05/13" }, { "type": "ARTICLE", "url": "http://www.openwall.com/lists/oss-security/2016/12/05/19" }, { "type": "ARTICLE", "url": "http://www.openwall.com/lists/oss-security/2016/12/05/20" }, { "type": "REPORT", "url": "https://bugs.launchpad.net/ubuntu/+source/unzip/+bug/1643750" } ] }, { "schema_version": "1.7.3", "id": "BREW-unzip-CVE-2015-7696", "published": "2026-06-28T21:29:54Z", "modified": "2026-07-27T14:59:08Z", "upstream": [ "CVE-2015-7696" ], "affected": [ { "package": { "ecosystem": "Homebrew", "name": "unzip", "purl": "pkg:brew/unzip" }, "ranges": [ { "type": "ECOSYSTEM", "events": [ { "introduced": "0" }, { "fixed": "6.0_1" } ] } ], "ecosystem_specific": { "fix": "patch", "patches": [ { "type": "unofficial", "url": "https://archive.ubuntu.com/ubuntu/pool/main/u/unzip/unzip_6.0-28ubuntu4.1.debian.tar.xz", "apply": [ "patches/01-manpages-in-section-1-not-in-section-1l.patch", "patches/02-this-is-debian-unzip.patch", "patches/03-include-unistd-for-kfreebsd.patch", "patches/04-handle-pkware-verification-bit.patch", "patches/05-fix-uid-gid-handling.patch", "patches/06-initialize-the-symlink-flag.patch", "patches/07-increase-size-of-cfactorstr.patch", "patches/08-allow-greater-hostver-values.patch", "patches/09-cve-2014-8139-crc-overflow.patch", "patches/10-cve-2014-8140-test-compr-eb.patch", "patches/11-cve-2014-8141-getzip64data.patch", "patches/12-cve-2014-9636-test-compr-eb.patch", "patches/13-remove-build-date.patch", "patches/14-cve-2015-7696.patch", "patches/15-cve-2015-7697.patch", "patches/16-fix-integer-underflow-csiz-decrypted.patch", "patches/17-restore-unix-timestamps-accurately.patch", "patches/18-cve-2014-9913-unzip-buffer-overflow.patch", "patches/19-cve-2016-9844-zipinfo-buffer-overflow.patch", "patches/20-cve-2018-1000035-unzip-buffer-overflow.patch", "patches/20-unzip60-alt-iconv-utf8.patch", "patches/21-fix-warning-messages-on-big-files.patch", "patches/22-cve-2019-13232-fix-bug-in-undefer-input.patch", "patches/23-cve-2019-13232-zip-bomb-with-overlapped-entries.patch", "patches/24-cve-2019-13232-do-not-raise-alert-for-misplaced-central-directory.patch", "patches/25-cve-2019-13232-fix-bug-in-uzbunzip2.patch", "patches/26-cve-2019-13232-fix-bug-in-uzinflate.patch", "patches/27-zipgrep-avoid-test-errors.patch", "patches/28-cve-2022-0529-and-cve-2022-0530.patch" ] } ] } } ], "database_specific": { "source": "generated" }, "details": "Info-ZIP UnZip 6.0 allows remote attackers to cause a denial of service (heap-based buffer over-read and application crash) or possibly execute arbitrary code via a crafted password-protected ZIP archive, possibly related to an Extra-Field size value.", "references": [ { "type": "ADVISORY", "url": "http://www.debian.org/security/2015/dsa-3386" }, { "type": "ADVISORY", "url": "http://www.ubuntu.com/usn/USN-2788-1" }, { "type": "ADVISORY", "url": "http://www.ubuntu.com/usn/USN-2788-2" }, { "type": "WEB", "url": "http://www.openwall.com/lists/oss-security/2015/09/07/4" }, { "type": "WEB", "url": "http://www.openwall.com/lists/oss-security/2015/09/15/6" }, { "type": "WEB", "url": "http://www.openwall.com/lists/oss-security/2015/09/21/6" }, { "type": "WEB", "url": "http://www.openwall.com/lists/oss-security/2015/10/11/5" }, { "type": "WEB", "url": "http://www.securityfocus.com/bid/76863" }, { "type": "WEB", "url": "http://www.securitytracker.com/id/1034027" } ] }, { "schema_version": "1.7.3", "id": "BREW-unzip-CVE-2015-7697", "published": "2026-06-28T21:29:54Z", "modified": "2026-07-27T14:59:08Z", "upstream": [ "CVE-2015-7697" ], "affected": [ { "package": { "ecosystem": "Homebrew", "name": "unzip", "purl": "pkg:brew/unzip" }, "ranges": [ { "type": "ECOSYSTEM", "events": [ { "introduced": "0" }, { "fixed": "6.0_1" } ] } ], "ecosystem_specific": { "fix": "patch", "patches": [ { "type": "unofficial", "url": "https://archive.ubuntu.com/ubuntu/pool/main/u/unzip/unzip_6.0-28ubuntu4.1.debian.tar.xz", "apply": [ "patches/01-manpages-in-section-1-not-in-section-1l.patch", "patches/02-this-is-debian-unzip.patch", "patches/03-include-unistd-for-kfreebsd.patch", "patches/04-handle-pkware-verification-bit.patch", "patches/05-fix-uid-gid-handling.patch", "patches/06-initialize-the-symlink-flag.patch", "patches/07-increase-size-of-cfactorstr.patch", "patches/08-allow-greater-hostver-values.patch", "patches/09-cve-2014-8139-crc-overflow.patch", "patches/10-cve-2014-8140-test-compr-eb.patch", "patches/11-cve-2014-8141-getzip64data.patch", "patches/12-cve-2014-9636-test-compr-eb.patch", "patches/13-remove-build-date.patch", "patches/14-cve-2015-7696.patch", "patches/15-cve-2015-7697.patch", "patches/16-fix-integer-underflow-csiz-decrypted.patch", "patches/17-restore-unix-timestamps-accurately.patch", "patches/18-cve-2014-9913-unzip-buffer-overflow.patch", "patches/19-cve-2016-9844-zipinfo-buffer-overflow.patch", "patches/20-cve-2018-1000035-unzip-buffer-overflow.patch", "patches/20-unzip60-alt-iconv-utf8.patch", "patches/21-fix-warning-messages-on-big-files.patch", "patches/22-cve-2019-13232-fix-bug-in-undefer-input.patch", "patches/23-cve-2019-13232-zip-bomb-with-overlapped-entries.patch", "patches/24-cve-2019-13232-do-not-raise-alert-for-misplaced-central-directory.patch", "patches/25-cve-2019-13232-fix-bug-in-uzbunzip2.patch", "patches/26-cve-2019-13232-fix-bug-in-uzinflate.patch", "patches/27-zipgrep-avoid-test-errors.patch", "patches/28-cve-2022-0529-and-cve-2022-0530.patch" ] } ] } } ], "database_specific": { "source": "generated" }, "details": "Info-ZIP UnZip 6.0 allows remote attackers to cause a denial of service (infinite loop) via empty bzip2 data in a ZIP archive.", "references": [ { "type": "ADVISORY", "url": "http://www.debian.org/security/2015/dsa-3386" }, { "type": "ADVISORY", "url": "http://www.ubuntu.com/usn/USN-2788-1" }, { "type": "ADVISORY", "url": "http://www.ubuntu.com/usn/USN-2788-2" }, { "type": "WEB", "url": "http://sourceforge.net/p/infozip/patches/23/" }, { "type": "WEB", "url": "http://www.openwall.com/lists/oss-security/2015/09/07/4" }, { "type": "WEB", "url": "http://www.openwall.com/lists/oss-security/2015/09/15/6" }, { "type": "WEB", "url": "http://www.openwall.com/lists/oss-security/2015/10/11/5" }, { "type": "WEB", "url": "http://www.securityfocus.com/bid/76863" }, { "type": "WEB", "url": "http://www.securitytracker.com/id/1034027" } ] }, { "schema_version": "1.7.3", "id": "BREW-unzip-CVE-2016-9844", "published": "2026-06-28T21:29:54Z", "modified": "2026-07-27T14:59:08Z", "upstream": [ "CVE-2016-9844" ], "affected": [ { "package": { "ecosystem": "Homebrew", "name": "unzip", "purl": "pkg:brew/unzip" }, "ranges": [ { "type": "ECOSYSTEM", "events": [ { "introduced": "0" }, { "fixed": "6.0_3" } ] } ], "ecosystem_specific": { "fix": "patch", "patches": [ { "type": "unofficial", "url": "https://archive.ubuntu.com/ubuntu/pool/main/u/unzip/unzip_6.0-28ubuntu4.1.debian.tar.xz", "apply": [ "patches/01-manpages-in-section-1-not-in-section-1l.patch", "patches/02-this-is-debian-unzip.patch", "patches/03-include-unistd-for-kfreebsd.patch", "patches/04-handle-pkware-verification-bit.patch", "patches/05-fix-uid-gid-handling.patch", "patches/06-initialize-the-symlink-flag.patch", "patches/07-increase-size-of-cfactorstr.patch", "patches/08-allow-greater-hostver-values.patch", "patches/09-cve-2014-8139-crc-overflow.patch", "patches/10-cve-2014-8140-test-compr-eb.patch", "patches/11-cve-2014-8141-getzip64data.patch", "patches/12-cve-2014-9636-test-compr-eb.patch", "patches/13-remove-build-date.patch", "patches/14-cve-2015-7696.patch", "patches/15-cve-2015-7697.patch", "patches/16-fix-integer-underflow-csiz-decrypted.patch", "patches/17-restore-unix-timestamps-accurately.patch", "patches/18-cve-2014-9913-unzip-buffer-overflow.patch", "patches/19-cve-2016-9844-zipinfo-buffer-overflow.patch", "patches/20-cve-2018-1000035-unzip-buffer-overflow.patch", "patches/20-unzip60-alt-iconv-utf8.patch", "patches/21-fix-warning-messages-on-big-files.patch", "patches/22-cve-2019-13232-fix-bug-in-undefer-input.patch", "patches/23-cve-2019-13232-zip-bomb-with-overlapped-entries.patch", "patches/24-cve-2019-13232-do-not-raise-alert-for-misplaced-central-directory.patch", "patches/25-cve-2019-13232-fix-bug-in-uzbunzip2.patch", "patches/26-cve-2019-13232-fix-bug-in-uzinflate.patch", "patches/27-zipgrep-avoid-test-errors.patch", "patches/28-cve-2022-0529-and-cve-2022-0530.patch" ] } ] } } ], "database_specific": { "source": "generated" }, "details": "Buffer overflow in the zi_short function in zipinfo.c in Info-Zip UnZip 6.0 allows remote attackers to cause a denial of service (crash) via a large compression method value in the central directory file header.", "severity": [ { "type": "CVSS_V3", "score": "CVSS:3.0/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L" } ], "references": [ { "type": "ADVISORY", "url": "http://www.securityfocus.com/bid/94728" }, { "type": "ADVISORY", "url": "http://www.openwall.com/lists/oss-security/2016/12/05/13" }, { "type": "ADVISORY", "url": "http://www.openwall.com/lists/oss-security/2016/12/05/19" }, { "type": "ADVISORY", "url": "http://www.openwall.com/lists/oss-security/2016/12/05/20" }, { "type": "REPORT", "url": "https://bugs.launchpad.net/ubuntu/+source/unzip/+bug/1643750" } ] }, { "schema_version": "1.7.3", "id": "BREW-unzip-CVE-2018-1000035", "published": "2026-06-28T21:29:54Z", "modified": "2026-07-27T14:59:08Z", "upstream": [ "CVE-2018-1000035" ], "affected": [ { "package": { "ecosystem": "Homebrew", "name": "unzip", "purl": "pkg:brew/unzip" }, "ranges": [ { "type": "ECOSYSTEM", "events": [ { "introduced": "0" }, { "fixed": "6.0_4" } ] } ], "ecosystem_specific": { "fix": "patch", "patches": [ { "type": "unofficial", "url": "https://archive.ubuntu.com/ubuntu/pool/main/u/unzip/unzip_6.0-28ubuntu4.1.debian.tar.xz", "apply": [ "patches/01-manpages-in-section-1-not-in-section-1l.patch", "patches/02-this-is-debian-unzip.patch", "patches/03-include-unistd-for-kfreebsd.patch", "patches/04-handle-pkware-verification-bit.patch", "patches/05-fix-uid-gid-handling.patch", "patches/06-initialize-the-symlink-flag.patch", "patches/07-increase-size-of-cfactorstr.patch", "patches/08-allow-greater-hostver-values.patch", "patches/09-cve-2014-8139-crc-overflow.patch", "patches/10-cve-2014-8140-test-compr-eb.patch", "patches/11-cve-2014-8141-getzip64data.patch", "patches/12-cve-2014-9636-test-compr-eb.patch", "patches/13-remove-build-date.patch", "patches/14-cve-2015-7696.patch", "patches/15-cve-2015-7697.patch", "patches/16-fix-integer-underflow-csiz-decrypted.patch", "patches/17-restore-unix-timestamps-accurately.patch", "patches/18-cve-2014-9913-unzip-buffer-overflow.patch", "patches/19-cve-2016-9844-zipinfo-buffer-overflow.patch", "patches/20-cve-2018-1000035-unzip-buffer-overflow.patch", "patches/20-unzip60-alt-iconv-utf8.patch", "patches/21-fix-warning-messages-on-big-files.patch", "patches/22-cve-2019-13232-fix-bug-in-undefer-input.patch", "patches/23-cve-2019-13232-zip-bomb-with-overlapped-entries.patch", "patches/24-cve-2019-13232-do-not-raise-alert-for-misplaced-central-directory.patch", "patches/25-cve-2019-13232-fix-bug-in-uzbunzip2.patch", "patches/26-cve-2019-13232-fix-bug-in-uzinflate.patch", "patches/27-zipgrep-avoid-test-errors.patch", "patches/28-cve-2022-0529-and-cve-2022-0530.patch" ] } ] } } ], "database_specific": { "source": "generated" }, "details": "A heap-based buffer overflow exists in Info-Zip UnZip version <= 6.00 in the processing of password-protected archives that allows an attacker to perform a denial of service or to possibly achieve code execution.", "severity": [ { "type": "CVSS_V3", "score": "CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H" } ], "references": [ { "type": "WEB", "url": "https://lists.debian.org/debian-lts-announce/2020/01/msg00026.html" }, { "type": "ADVISORY", "url": "https://sec-consult.com/en/blog/advisories/multiple-vulnerabilities-in-infozip-unzip/index.html" }, { "type": "ADVISORY", "url": "https://security.gentoo.org/glsa/202003-58" } ] }, { "schema_version": "1.7.3", "id": "BREW-unzip-CVE-2019-13232", "published": "2026-06-28T21:29:54Z", "modified": "2026-07-27T14:59:08Z", "upstream": [ "CVE-2019-13232" ], "affected": [ { "package": { "ecosystem": "Homebrew", "name": "unzip", "purl": "pkg:brew/unzip" }, "ranges": [ { "type": "ECOSYSTEM", "events": [ { "introduced": "0" }, { "fixed": "6.0_6" } ] } ], "ecosystem_specific": { "fix": "patch", "patches": [ { "type": "unofficial", "url": "https://archive.ubuntu.com/ubuntu/pool/main/u/unzip/unzip_6.0-28ubuntu4.1.debian.tar.xz", "apply": [ "patches/01-manpages-in-section-1-not-in-section-1l.patch", "patches/02-this-is-debian-unzip.patch", "patches/03-include-unistd-for-kfreebsd.patch", "patches/04-handle-pkware-verification-bit.patch", "patches/05-fix-uid-gid-handling.patch", "patches/06-initialize-the-symlink-flag.patch", "patches/07-increase-size-of-cfactorstr.patch", "patches/08-allow-greater-hostver-values.patch", "patches/09-cve-2014-8139-crc-overflow.patch", "patches/10-cve-2014-8140-test-compr-eb.patch", "patches/11-cve-2014-8141-getzip64data.patch", "patches/12-cve-2014-9636-test-compr-eb.patch", "patches/13-remove-build-date.patch", "patches/14-cve-2015-7696.patch", "patches/15-cve-2015-7697.patch", "patches/16-fix-integer-underflow-csiz-decrypted.patch", "patches/17-restore-unix-timestamps-accurately.patch", "patches/18-cve-2014-9913-unzip-buffer-overflow.patch", "patches/19-cve-2016-9844-zipinfo-buffer-overflow.patch", "patches/20-cve-2018-1000035-unzip-buffer-overflow.patch", "patches/20-unzip60-alt-iconv-utf8.patch", "patches/21-fix-warning-messages-on-big-files.patch", "patches/22-cve-2019-13232-fix-bug-in-undefer-input.patch", "patches/23-cve-2019-13232-zip-bomb-with-overlapped-entries.patch", "patches/24-cve-2019-13232-do-not-raise-alert-for-misplaced-central-directory.patch", "patches/25-cve-2019-13232-fix-bug-in-uzbunzip2.patch", "patches/26-cve-2019-13232-fix-bug-in-uzinflate.patch", "patches/27-zipgrep-avoid-test-errors.patch", "patches/28-cve-2022-0529-and-cve-2022-0530.patch" ] } ] } } ], "database_specific": { "source": "generated" }, "details": "Info-ZIP UnZip 6.0 mishandles the overlapping of files inside a ZIP container, leading to denial of service (resource consumption), aka a \"better zip bomb\" issue.", "severity": [ { "type": "CVSS_V3", "score": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L" } ], "references": [ { "type": "WEB", "url": "https://support.f5.com/csp/article/K80311892?utm_source=f5support&%3Butm_medium=RSS" }, { "type": "ADVISORY", "url": "https://www.bamsoftware.com/hacks/zipbomb/" }, { "type": "ADVISORY", "url": "https://lists.debian.org/debian-lts-announce/2019/07/msg00005.html" }, { "type": "ADVISORY", "url": "https://lists.debian.org/debian-lts-announce/2019/07/msg00027.html" }, { "type": "ADVISORY", "url": "https://security.gentoo.org/glsa/202003-58" }, { "type": "ADVISORY", "url": "https://security.netapp.com/advisory/ntap-20190814-0002/" }, { "type": "PACKAGE", "url": "https://github.com/madler/unzip" } ] }, { "schema_version": "1.7.3", "id": "BREW-unzip-CVE-2022-0529", "published": "2026-06-28T21:29:54Z", "modified": "2026-07-18T04:02:33Z", "upstream": [ "CVE-2022-0529" ], "affected": [ { "package": { "ecosystem": "Homebrew", "name": "unzip", "purl": "pkg:brew/unzip" }, "ranges": [ { "type": "ECOSYSTEM", "events": [ { "introduced": "0" }, { "fixed": "6.0_8" } ] } ], "ecosystem_specific": { "fix": "patch", "patches": [ { "type": "unofficial", "url": "https://archive.ubuntu.com/ubuntu/pool/main/u/unzip/unzip_6.0-28ubuntu4.1.debian.tar.xz", "apply": [ "patches/01-manpages-in-section-1-not-in-section-1l.patch", "patches/02-this-is-debian-unzip.patch", "patches/03-include-unistd-for-kfreebsd.patch", "patches/04-handle-pkware-verification-bit.patch", "patches/05-fix-uid-gid-handling.patch", "patches/06-initialize-the-symlink-flag.patch", "patches/07-increase-size-of-cfactorstr.patch", "patches/08-allow-greater-hostver-values.patch", "patches/09-cve-2014-8139-crc-overflow.patch", "patches/10-cve-2014-8140-test-compr-eb.patch", "patches/11-cve-2014-8141-getzip64data.patch", "patches/12-cve-2014-9636-test-compr-eb.patch", "patches/13-remove-build-date.patch", "patches/14-cve-2015-7696.patch", "patches/15-cve-2015-7697.patch", "patches/16-fix-integer-underflow-csiz-decrypted.patch", "patches/17-restore-unix-timestamps-accurately.patch", "patches/18-cve-2014-9913-unzip-buffer-overflow.patch", "patches/19-cve-2016-9844-zipinfo-buffer-overflow.patch", "patches/20-cve-2018-1000035-unzip-buffer-overflow.patch", "patches/20-unzip60-alt-iconv-utf8.patch", "patches/21-fix-warning-messages-on-big-files.patch", "patches/22-cve-2019-13232-fix-bug-in-undefer-input.patch", "patches/23-cve-2019-13232-zip-bomb-with-overlapped-entries.patch", "patches/24-cve-2019-13232-do-not-raise-alert-for-misplaced-central-directory.patch", "patches/25-cve-2019-13232-fix-bug-in-uzbunzip2.patch", "patches/26-cve-2019-13232-fix-bug-in-uzinflate.patch", "patches/27-zipgrep-avoid-test-errors.patch", "patches/28-cve-2022-0529-and-cve-2022-0530.patch" ] } ] } } ], "database_specific": { "source": "generated" }, "details": "A flaw was found in Unzip. The vulnerability occurs during the conversion of a wide string to a local string that leads to a heap of out-of-bound write. This flaw allows an attacker to input a specially crafted zip file, leading to a crash or code execution.", "severity": [ { "type": "CVSS_V3", "score": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H" } ], "references": [ { "type": "ADVISORY", "url": "https://lists.debian.org/debian-lts-announce/2022/09/msg00028.html" }, { "type": "ADVISORY", "url": "https://security.gentoo.org/glsa/202310-17" }, { "type": "ADVISORY", "url": "https://www.debian.org/security/2022/dsa-5202" }, { "type": "REPORT", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2051395" }, { "type": "EVIDENCE", "url": "https://github.com/ByteHackr/unzip_poc" } ] }, { "schema_version": "1.7.3", "id": "BREW-unzip-CVE-2022-0530", "published": "2026-06-28T21:29:54Z", "modified": "2026-07-18T04:02:33Z", "upstream": [ "CVE-2022-0530" ], "affected": [ { "package": { "ecosystem": "Homebrew", "name": "unzip", "purl": "pkg:brew/unzip" }, "ranges": [ { "type": "ECOSYSTEM", "events": [ { "introduced": "0" }, { "fixed": "6.0_8" } ] } ], "ecosystem_specific": { "fix": "patch", "patches": [ { "type": "unofficial", "url": "https://archive.ubuntu.com/ubuntu/pool/main/u/unzip/unzip_6.0-28ubuntu4.1.debian.tar.xz", "apply": [ "patches/01-manpages-in-section-1-not-in-section-1l.patch", "patches/02-this-is-debian-unzip.patch", "patches/03-include-unistd-for-kfreebsd.patch", "patches/04-handle-pkware-verification-bit.patch", "patches/05-fix-uid-gid-handling.patch", "patches/06-initialize-the-symlink-flag.patch", "patches/07-increase-size-of-cfactorstr.patch", "patches/08-allow-greater-hostver-values.patch", "patches/09-cve-2014-8139-crc-overflow.patch", "patches/10-cve-2014-8140-test-compr-eb.patch", "patches/11-cve-2014-8141-getzip64data.patch", "patches/12-cve-2014-9636-test-compr-eb.patch", "patches/13-remove-build-date.patch", "patches/14-cve-2015-7696.patch", "patches/15-cve-2015-7697.patch", "patches/16-fix-integer-underflow-csiz-decrypted.patch", "patches/17-restore-unix-timestamps-accurately.patch", "patches/18-cve-2014-9913-unzip-buffer-overflow.patch", "patches/19-cve-2016-9844-zipinfo-buffer-overflow.patch", "patches/20-cve-2018-1000035-unzip-buffer-overflow.patch", "patches/20-unzip60-alt-iconv-utf8.patch", "patches/21-fix-warning-messages-on-big-files.patch", "patches/22-cve-2019-13232-fix-bug-in-undefer-input.patch", "patches/23-cve-2019-13232-zip-bomb-with-overlapped-entries.patch", "patches/24-cve-2019-13232-do-not-raise-alert-for-misplaced-central-directory.patch", "patches/25-cve-2019-13232-fix-bug-in-uzbunzip2.patch", "patches/26-cve-2019-13232-fix-bug-in-uzinflate.patch", "patches/27-zipgrep-avoid-test-errors.patch", "patches/28-cve-2022-0529-and-cve-2022-0530.patch" ] } ] } } ], "database_specific": { "source": "generated" }, "details": "A flaw was found in Unzip. The vulnerability occurs during the conversion of a wide string to a local string that leads to a heap of out-of-bound write. This flaw allows an attacker to input a specially crafted zip file, leading to a crash or code execution.", "severity": [ { "type": "CVSS_V3", "score": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H" } ], "references": [ { "type": "ADVISORY", "url": "https://support.apple.com/kb/HT213257" }, { "type": "ADVISORY", "url": "http://seclists.org/fulldisclosure/2022/May/33" }, { "type": "ADVISORY", "url": "https://support.apple.com/kb/HT213255" }, { "type": "ADVISORY", "url": "https://www.debian.org/security/2022/dsa-5202" }, { "type": "ADVISORY", "url": "http://seclists.org/fulldisclosure/2022/May/35" }, { "type": "ADVISORY", "url": "http://seclists.org/fulldisclosure/2022/May/38" }, { "type": "ADVISORY", "url": "https://lists.debian.org/debian-lts-announce/2022/09/msg00028.html" }, { "type": "ADVISORY", "url": "https://security.gentoo.org/glsa/202310-17" }, { "type": "ADVISORY", "url": "https://support.apple.com/kb/HT213256" }, { "type": "REPORT", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2051395" }, { "type": "EVIDENCE", "url": "https://github.com/ByteHackr/unzip_poc" } ] } ], "yajl": [ { "schema_version": "1.7.3", "id": "BREW-yajl-CVE-2017-16516", "published": "2026-07-18T04:02:33Z", "modified": "2026-07-18T04:02:33Z", "upstream": [ "CVE-2017-16516", "GHSA-wwh7-4jw9-33x6" ], "affected": [ { "package": { "ecosystem": "Homebrew", "name": "yajl", "purl": "pkg:brew/yajl" }, "ranges": [ { "type": "ECOSYSTEM", "events": [ { "introduced": "0" }, { "fixed": "2.1.0_1" } ] } ], "ecosystem_specific": { "fix": "patch", "patches": [ { "type": "unofficial", "url": "https://deb.debian.org/debian/pool/main/y/yajl/yajl_2.1.0-6.debian.tar.xz", "apply": [ "patches/dynamically-link-tools.patch", "patches/CVE-2017-16516.patch", "patches/CVE-2022-24795.patch", "patches/CVE-2023-33460.patch", "patches/6fe59ca50dfd65bdb3d1c87a27245b2dd1a072f9.patch" ] } ] } } ], "database_specific": { "source": "generated" }, "details": "In the yajl-ruby gem 1.3.0 for Ruby, when a crafted JSON file is supplied to Yajl::Parser.new.parse, the whole ruby process crashes with a SIGABRT in the yajl_string_decode function in yajl_encode.c. This results in the whole ruby process terminating and potentially a denial of service.", "severity": [ { "type": "CVSS_V3", "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H" } ], "references": [ { "type": "WEB", "url": "https://lists.debian.org/debian-lts-announce/2023/07/msg00013.html" }, { "type": "WEB", "url": "https://lists.debian.org/debian-lts-announce/2023/08/msg00003.html" }, { "type": "ADVISORY", "url": "https://lists.debian.org/debian-lts-announce/2017/11/msg00010.html" }, { "type": "ADVISORY", "url": "https://rubygems.org/gems/yajl-ruby" }, { "type": "EVIDENCE", "url": "https://github.com/brianmario/yajl-ruby/issues/176" } ] }, { "schema_version": "1.7.3", "id": "BREW-yajl-CVE-2022-24795", "published": "2026-07-18T04:02:33Z", "modified": "2026-07-18T04:02:33Z", "upstream": [ "CVE-2022-24795", "GHSA-jj47-x69x-mxrm" ], "affected": [ { "package": { "ecosystem": "Homebrew", "name": "yajl", "purl": "pkg:brew/yajl" }, "ranges": [ { "type": "ECOSYSTEM", "events": [ { "introduced": "0" }, { "fixed": "2.1.0_1" } ] } ], "ecosystem_specific": { "fix": "patch", "patches": [ { "type": "unofficial", "url": "https://deb.debian.org/debian/pool/main/y/yajl/yajl_2.1.0-6.debian.tar.xz", "apply": [ "patches/dynamically-link-tools.patch", "patches/CVE-2017-16516.patch", "patches/CVE-2022-24795.patch", "patches/CVE-2023-33460.patch", "patches/6fe59ca50dfd65bdb3d1c87a27245b2dd1a072f9.patch" ] } ] } } ], "database_specific": { "source": "generated" }, "summary": "Buffer Overflow and Integer Overflow in yajl-ruby", "details": "yajl-ruby is a C binding to the YAJL JSON parsing and generation library. The 1.x branch and the 2.x branch of `yajl` contain an integer overflow which leads to subsequent heap memory corruption when dealing with large (~2GB) inputs. The reallocation logic at `yajl_buf.c#L64` may result in the `need` 32bit integer wrapping to 0 when `need` approaches a value of 0x80000000 (i.e. ~2GB of data), which results in a reallocation of buf->alloc into a small heap chunk. These integers are declared as `size_t` in the 2.x branch of `yajl`, which practically prevents the issue from triggering on 64bit platforms, however this does not preclude this issue triggering on 32bit builds on which `size_t` is a 32bit integer. Subsequent population of this under-allocated heap chunk is based on the original buffer size, leading to heap memory corruption. This vulnerability mostly impacts process availability. Maintainers believe exploitation for arbitrary code execution is unlikely. A patch is available and anticipated to be part of yajl-ruby version 1.4.2. As a workaround, avoid passing large inputs to YAJL.", "severity": [ { "type": "CVSS_V3", "score": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H" } ], "references": [ { "type": "WEB", "url": "https://github.com/brianmario/yajl-ruby/blob/7168bd79b888900aa94523301126f968a93eb3a6/ext/yajl/yajl_buf.c#L64" }, { "type": "ADVISORY", "url": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2022/24xxx/CVE-2022-24795.json" }, { "type": "ADVISORY", "url": "https://github.com/brianmario/yajl-ruby/security/advisories/GHSA-jj47-x69x-mxrm" }, { "type": "ADVISORY", "url": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/KLE3C4CECEJ4EUYI56KXI6OWACWXX7WN/" }, { "type": "ADVISORY", "url": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/YO32YDJ74DADC7CMJNLSLBVWN5EXGF5J/" }, { "type": "ADVISORY", "url": "https://nvd.nist.gov/vuln/detail/CVE-2022-24795" }, { "type": "FIX", "url": "https://github.com/brianmario/yajl-ruby/commit/7168bd79b888900aa94523301126f968a93eb3a6" }, { "type": "ARTICLE", "url": "https://lists.debian.org/debian-lts-announce/2023/07/msg00013.html" }, { "type": "ARTICLE", "url": "https://lists.debian.org/debian-lts-announce/2023/08/msg00003.html" } ] }, { "schema_version": "1.7.3", "id": "BREW-yajl-CVE-2023-33460", "published": "2026-07-18T04:02:33Z", "modified": "2026-07-18T04:02:33Z", "upstream": [ "CVE-2023-33460" ], "affected": [ { "package": { "ecosystem": "Homebrew", "name": "yajl", "purl": "pkg:brew/yajl" }, "ranges": [ { "type": "ECOSYSTEM", "events": [ { "introduced": "0" }, { "fixed": "2.1.0_1" } ] } ], "ecosystem_specific": { "fix": "patch", "patches": [ { "type": "unofficial", "url": "https://deb.debian.org/debian/pool/main/y/yajl/yajl_2.1.0-6.debian.tar.xz", "apply": [ "patches/dynamically-link-tools.patch", "patches/CVE-2017-16516.patch", "patches/CVE-2022-24795.patch", "patches/CVE-2023-33460.patch", "patches/6fe59ca50dfd65bdb3d1c87a27245b2dd1a072f9.patch" ] } ] } } ], "database_specific": { "source": "generated" }, "details": "There's a memory leak in yajl 2.1.0 with use of yajl_tree_parse function. which will cause out-of-memory in server and cause crash.", "severity": [ { "type": "CVSS_V3", "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H" } ], "references": [ { "type": "ADVISORY", "url": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2023/33xxx/CVE-2023-33460.json" }, { "type": "ADVISORY", "url": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/IBUUHG27RM4ROEYKMVRROR27AX6R63MB/" }, { "type": "ADVISORY", "url": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/KLE3C4CECEJ4EUYI56KXI6OWACWXX7WN/" }, { "type": "ADVISORY", "url": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/YO32YDJ74DADC7CMJNLSLBVWN5EXGF5J/" }, { "type": "ADVISORY", "url": "https://nvd.nist.gov/vuln/detail/CVE-2023-33460" }, { "type": "REPORT", "url": "https://github.com/lloyd/yajl/issues/250" }, { "type": "ARTICLE", "url": "https://lists.debian.org/debian-lts-announce/2023/07/msg00000.html" }, { "type": "ARTICLE", "url": "https://lists.debian.org/debian-lts-announce/2023/07/msg00013.html" }, { "type": "ARTICLE", "url": "https://lists.debian.org/debian-lts-announce/2023/08/msg00003.html" } ] } ], "zip": [ { "schema_version": "1.7.3", "id": "BREW-zip-CVE-2018-13410", "published": "2026-06-28T21:29:54Z", "modified": "2026-07-18T04:02:33Z", "upstream": [ "CVE-2018-13410" ], "affected": [ { "package": { "ecosystem": "Homebrew", "name": "zip", "purl": "pkg:brew/zip" }, "ranges": [ { "type": "ECOSYSTEM", "events": [ { "introduced": "0" }, { "fixed": "3.0_1" } ] } ], "ecosystem_specific": { "fix": "patch", "patches": [ { "type": "unofficial", "url": "https://deb.debian.org/debian/pool/main/z/zip/zip_3.0-15.debian.tar.xz", "apply": [ "patches/01-typo-it-is-transferring-not-transfering.patch", "patches/02-typo-it-is-privileges-not-priviliges.patch", "patches/03-manpages-in-section-1-not-in-section-1l.patch", "patches/04-do-not-set-unwanted-cflags.patch", "patches/05-typo-it-is-preceding-not-preceeding.patch", "patches/06-stack-markings-to-avoid-executable-stack.patch", "patches/07-fclose-in-file-not-fclose-x.patch", "patches/08-hardening-build-fix-1.patch", "patches/09-hardening-build-fix-2.patch", "patches/10-remove-build-date.patch", "patches/11-typo-it-is-ambiguities-not-amgibuities.patch", "patches/13-typo-it-is-os-2-not-risc-os-2.patch", "patches/14-buffer-overflow-unicode-filename.patch", "patches/15-buffer-overflow-cve-2018-13410.patch", "patches/16-fix-symlink-update-detection.patch" ] } ] } } ], "database_specific": { "source": "generated" }, "details": "Info-ZIP Zip 3.0, when the -T and -TT command-line options are used, allows attackers to cause a denial of service (invalid free and application crash) or possibly have unspecified other impact because of an off-by-one error. NOTE: it is unclear whether there are realistic scenarios in which an untrusted party controls the -TT value, given that the entire purpose of -TT is execution of arbitrary commands", "severity": [ { "type": "CVSS_V3", "score": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H" } ], "references": [ { "type": "ADVISORY", "url": "http://seclists.org/fulldisclosure/2018/Jul/24" } ] } ] } }